Location: Chicago
DRW
is a diversified trading firm with over 3 decades of experience bringing sophisticated technology and exceptional people together to operate in markets around the world. We value autonomy and the ability to quickly pivot to capture opportunities, so we operate using our own capital and trading at our own risk.
Headquartered in Chicago with offices throughout the U.S., Canada, Europe, and Asia, we trade a variety of asset classes including Fixed Income, ETFs, Equities, FX, Commodities and Energy across all major global markets. We have also leveraged our expertise and technology to expand into three non-traditional strategies: real estate, venture capital and cryptoassets.
We operate with respect, curiosity and open minds. The people who thrive here share our belief that it’s not just what we do that matters–it's how we do it.
DRW
is a place of high expectations, integrity, innovation and a willingness to challenge consensus.
We are seeking a
Cloud Security Engineer
to work with various business units across the firm to empower our technologists to deliver secure cloud infrastructure and cloud integrated solutions. The position will work with the technology teams to ensure the cloud environments we use and configure are done so in a secure manner. You will also be responsible for defining global standards and guidelines to direct secure cloud development. A successful candidate will be able to establish base guidelines, implement security controls, review architecture and validate this is done in a repeatable and automatable fashion. While ensuring that the overall cloud presence of DRW is as secure as it can be.
What you’ll be doing:
Review and audit AWS/GCP/Azure environments spanning across multiple business units and recommend changes to reduce risk and improve security.
Support development and work with technologists across the firm to unify cloud security efforts.
Integrate services and access routes in a data intensive hybrid cloud environment.
Provide architectural recommendations and support to ensure cloud and Kubernetes environments are securely deployed, including controls for role-based access, workload identity, network policies, secrets, container images, admission policies, runtime protection, logging, and monitoring.
Provide recommendations and create working examples of secure hybrid cloud implementations.
Helping business units across the firm to securely migrate on-premise designed software to the appropriate cloud technologies.
Stay abreast of new developments in the areas of cloud technology, security, services, and networking.
Work with vendors and vendor solutions to evaluate products, produce recommendations for the firm, and educate internal clients.
Have a strong grasp of technologies that can be leveraged across both cloud and on-premise deployments (user supported authorization, etc).
Identify and analyze vulnerabilities and work with the various business units on remediation.
Continuously assess and enhance cloud privilege models to ensure least privilege access to data and services.
Respond to any security related incidents.
What we’re looking for:
Bachelor’s degree or relevant work experience required.
Relevant cloud certifications are a plus.
Strong knowledge of cloud encryption technologies including key management such as (KMS, HSM, etc).
5+ years of experience working with Amazon Web Services, with exposure to other cloud vendors such as Google Cloud Platform and Microsoft Azure.
A strong command of infrastructure-as-code tools such as Terraform, CloudFormation, and related technologies.
Proficient with containerization and Kubernetes in Linux environments, including Kubernetes architecture, workloads, networking, managed services, security configuration assessment, vulnerability remediation, and automated guardrails using infrastructure-as-code and policy-as-code.
Proficient with at least one applicable programming language (Python, Go, Javascript, etc).
Experience with automation in the cloud, in addition to services used in loosely coupled serverless architectures, such as Lambda, SQS, API Gateway, and DynamoDB.
Knowledge of cloud security best practices and cloud based controls.
Familiarity with security considerations, capabilities, and regulatory adherence for services across cloud providers.
Working knowledge of networking in hybrid cloud environments.
Must work well in a fast-paced, dynamic work environment and have strong work ethic and initiative.
Proven ability to troubleshoot and resolve production problems while making sensible decisions in times of stress.
Excellent verbal/written communication skills and documentation/knowledge management skills.
The annual base salary range for this position is $150,000 USD to $200,000 USD depending on the candidate’s experience, qualifications, and relevant skill set. The position is also eligible for an annual discretionary bonus. In addition, DRW offers a comprehensive suite of employee benefits including group medical, pharmacy, dental and vision insurance, 401k (with discretionary employer match), short and long-term disability, life and AD&D insurance, health savings accounts, and flexible spending accounts.
For more information about DRW's processing activities and our use of job applicants' data, please view our Privacy Notice at
https://drw.com/privacy-notice
.
California residents, please review the California Privacy Notice for information about certain legal rights at
https://drw.com/california-privacy-notice
.
[#LI-LD1]
Location: London
QRT is a global quantitative and systematic investment manager, operating across all liquid asset classes. We are a data- and technology-driven organization applying scientific methods to investing. Our collaborative culture and focus on innovation enable us to solve complex challenges and deliver high-quality returns for our investors.
Your future role within QRT
We are seeking an experienced Senior Security Engineer to own complex security challenges across QRT’s global environment. This is a senior individual contributor role combining hands-on engineering, technical leadership, mentoring and operational responsibilities.
The role is expected to involve the following activities:
Own security initiatives from discovery and design through delivery and ongoing operation, coordinating dependencies across teams and regions.
Set technical direction and engineering standards, balancing security, reliability, performance and operational cost.
Build and improve controls across identity and privileged access, endpoints, cloud and on-premises infrastructure, data protection and security monitoring.
Identify security weaknesses and attack paths, prioritise them by business impact and deliver practical remediation.
Automate deployment and operations through APIs, scripting and infrastructure as code, with appropriate testing and rollback procedures.
Deliver resilient, supportable services with effective monitoring, runbooks and recovery procedures. Share responsibility for maintenance, support and troubleshooting.
Participate in the security on-call rota, responding outside normal working hours as required. Lead complex incident troubleshooting and follow through on corrective actions.
Partner with Security, Infrastructure, IT and development teams to integrate controls and drive adoption. Evaluate technologies through testing and ensure successful operational handover.
Mentor junior engineers through coaching and design reviews, acting as a senior technical escalation point.
Your present skillset
Substantial security engineering experience in complex enterprise environments, including ownership of major initiatives spanning multiple teams.
Deep practical expertise in several relevant security domains, such as identity, privileged access, endpoint or cloud security, infrastructure hardening, secrets management, PKI, data protection or detection engineering.
Strong understanding of Windows, Linux, Active Directory, modern identity platforms, networking, authentication and hybrid infrastructure.
Ability to work at both architecture and implementation level, with strong automation skills and experience using version control and delivery pipelines.
Experience operating reliable production services, including upgrades, configuration management, monitoring, resilience and recovery.
Sound risk judgement, clear communication and the ability to influence stakeholders, resolve dependencies and deliver under ambiguous requirements.
Experience mentoring engineers and providing senior technical support during incidents and in an on-call environment.
Desirable to have experience or a willingness to learn in the following areas:
Quantitative trading, financial services or other environments with demanding availability and performance requirements.
Security services spanning multiple regions, clouds and data centres, including migration from legacy platforms.
QRT is an equal opportunity employer. We welcome diversity as essential to our success. QRT empowers employees to work openly and respectfully to achieve collective success. In addition to professional achievement, we offer initiatives and programmes to enable employees to achieve a healthy work-life balance.
Location: Hyderabad, India
Our Global Structure
Deliveroo is now part of DoorDash, bringing together teams with even greater reach, scale, and ambition. Depending on your role, you may collaborate with teammates, systems, and leaders across DoorDash and Wolt. Together, we’re unlocking new possibilities as one global team.
Join us in our mission to transform the way people shop and eat, where impact, innovation, and growth drive everything we do. Our Information Security team enables innovation at speed—securely. As digital guardians of DoorDash, Deliveroo, and Wolt, we safeguard our systems and the data of our employees, customers, riders, and partners. We defend against emerging cyber threats and embed security into every facet of the business. From building resilient defenses and responding to incidents to empowering teams with security knowledge, we are trusted partners protecting these global brands from the inside out.
About the Role
The Senior Security Operations Centre Specialist offers a unique opportunity to shape our global Security Operations strategy across a global footprint of DoorDash, Deliveroo, and Wolt. This role provides the platform to optimize our technology and AI investments while pioneering new methods to protect our data, people, and partners. As we expand, your specialist capabilities will be essential to our continued success.
What you’ll be doing
Work in a 24/7 global security operations centre, including scheduled night and weekend shifts.
Lead the triage and investigation of security alerts, including phishing, malware, network attacks, security hygiene and privacy related incidents within specified SLAs.
Mentor a team of SOC Specialists, providing the necessary guidance and feedback to deliver a best-in-class security service to the business.
Lead the development and continuously improve operational documentation, processes and playbooks
Build and manage autonomous AI runbooks to automate and scale our alert triage capabilities.
Lead incident response and escalation, ensuring lessons learned are translated into continuous security improvements.
Support the design, development and review of threat-detection use-cases to identify suspicious activity across our cloud environment.
Feed into the risk framework of emerging and observed threats from intelligence and / or incidents (e.g., post incident activity / repair items).
Support wider security incident investigations involving Threat Intelligence and Incident Response & Digital Forensics stakeholders.
Keep up to date with current security trends, advisories, publications and security research across the threat landscape
Leverage metrics and KPIs to improve security posture and identify opportunities for strategic optimisation
Collaborate with the team to develop and help deliver cybersecurity awareness programs for employees, emphasising incident reporting and best practices.
Requirements
6–8 years of experience in SOC, demonstrating success in managing security incidents and delivering platform optimisations while acting as a technical mentor and lead for shift operations.
Proven experience building threat detection capabilities in a cloud-centric, fast-moving organisation.
Hands-on experience with AWS security config, SOAR, GSO, EDR/XDR, Splunk and SQL queries.
Practical experience ideating, configuring, managing defensive security solutions and technical project management
Committed to continuous improvement, leveraging feedback to elevate both personal and team performance.
Exceptional collaborative team player and a knowledge-sharing mindset.
Working knowledge of security compliance standards, e.g. ISO27001, GDPR, NIS2 and PCI-DSS.
Capable of working well both independently and collaboratively, whilst keeping calm, under the pressure of an incident with potentially high impact to the business.
Able to communicate effectively during or after any incident update to both technical and non-technical stakeholders.
Coordinate with the US, UK and EU central security teams as required.
Preferred, but not required
Understanding of IAM cloud security principles
Experience in a DevOps environment with familiarity of CI/CD pipelines
Hands-on experience with container technologies and orchestration services
Knowledge of cloud security data encryption standards and principles
Why Deliveroo?
At Deliveroo, you’ll do work that matters—solving real-world problems in a three-sided marketplace that’s constantly evolving.
We’re food lovers, problem solvers, community organisers, proud parents, and more, brought together by a shared drive to make things better. Working here you can expect to:
🔧 Solve meaningful problems at real scale
Work on a complex, always-on marketplace that impacts millions every day.
🌱See your impact, fast
Ship, test and improve ideas quickly in a low-hierarchy, high-ownership
environment.
🧠Grow through challenge and ownership
Take on big, ambiguous problems and accelerate your career with strong support.
🌎A culture built for builders
High standards, collaboration, flexible working and continuous learning.
Our Global Structure
Deliveroo is now part of DoorDash, bringing together teams with even greater reach, scale, and ambition. Depending on your role, you may collaborate with teammates, systems, and leaders across DoorDash and Wolt. Together, we’re unlocking new possibilities as one global team.
Diversity, Equity and Inclusion
At Deliveroo, we know that a great workplace reflects the world around us and that true diversity and inclusion make us stronger, more creative, and better at what we do. We’re committed to fostering an environment where everyone can do their best work and feel they belong.
We believe in equality of opportunity and welcome candidates from all backgrounds regardless of age, gender, ethnicity, disability, sexual orientation, gender identity, socio-economic background, religion, or belief.
If you have a disability or long-term health condition and need support to apply for one of our roles, or require any reasonable adjustments during the recruitment process, you’ll have the opportunity to let us know once you’ve submitted your application. We’ll share details on how to request support so we can ensure you have a fair and equitable experience.
If you’re excited about making a real impact in a fast-moving marketplace and growing your career alongside ambitious, supportive teams, we’d love to hear from you!
Beware of recruitment scams: DASH Brands will never ask you to pay money or share sensitive financial information during hiring — learn more about DASH Brands' legitimate recruiting process at
careersatdoordash.com/recruitment-scam-awareness
.
Location: Poland
Workplace: remote
A company Cybersecurity organization is seeking a Security Operations Center (SOC) Analyst to provide front-line monitoring, investigation, and response across the firm's global environment. The role is intended for a technical professional with foundational cybersecurity knowledge and practical experience in security operations, IT operations, infrastructure support, networking, systems administration, or a related discipline. The analyst will use enterprise security platforms and approved AI-assisted capabilities to assess threats, document findings, execute established response procedures, and escalate significant or ambiguous events. The position provides a development path into senior SOC analysis, incident response, threat hunting, detection engineering, and cybersecurity engineering. Measures of Success Independently investigates routine alerts and follows escalation standards. Produces complete, concise, and defensible investigation records. Demonstrates proficiency with the firm's primary security platforms and playbooks. Contributes measurable improvements to runbooks, detections, automation, or analyst workflows. Builds trusted working relationships with Cybersecurity, Infrastructure, and business stakeholders.
Location: US - Headquarters - Maryland - Columbia
Who is Tenable?
Tenable® is the Exposure Management company. Over 40,000 organizations around the globe rely on Tenable to understand and reduce cyber risk. Our global employees support 65 percent of the Fortune 500, 50 percent of the Global 2000, and large government agencies. Come be part of our journey!
What makes Tenable such a great place to work?
Ask a member of our team and they’ll answer, “Our people!” We work together to build and innovate best-in-class cybersecurity solutions for our customers; all while creating a culture of belonging, respect, and excellence where we can be our best selves. When you’re part of our #OneTenable team, you can expect to partner with some of the most talented and passionate people in the industry, and have the support and resources you need to do work that truly matters. We deliver results that exceed expectations and we win together!
Your Role:
Tenable's InfoSec team is looking for a Security Engineer to join our Security Engineering & Architecture group. This role was built deliberately to span disciplines rather than specialize in one: you'll split your time between securing our cloud environments and supporting general security engineering disciplines across the business — covering cloud and non-cloud systems alike. If you're early-career but curious across the breadth of InfoSec rather than narrowly focused on one domain, this role is built for you.
Your Opportunity:
Support day-to-day cloud security operations — monitoring, triage, and remediation of findings across AWS, Azure, and/or GCP environments using CNAPP/CSPM tooling.
Contribute to Security Architecture Reviews for new systems, integrations, and vendor onboarding — regardless of whether the system in question is cloud-hosted, on-prem, or SaaS. You'll work directly with the architects and engineers who own this process today, learning the methodology and eventually taking reviews from intake to sign-off.
Help identify and document misconfigurations, excessive permissions, and insecure IaC patterns (Terraform/CloudFormation), and help track remediation through to closure.
Participate in risk assessments and threat modeling exercises for new projects — applying the same core analysis skills whether the subject is a cloud workload, an internal application, or a third-party integration.
Assist with IAM/RBAC reviews and least-privilege efforts; flag static credentials, over-broad roles, and gaps in audit logging wherever they appear in the environment.
Build foundational familiarity with how AI/agentic systems intersect with our environment — cloud-hosted LLM services (AWS Bedrock, Azure OpenAI, GCP Vertex AI), the Model Context Protocol (MCP), and the basic risk surface of agent/tool-calling architectures and apply that awareness during reviews when these systems show up in scope.
Work cross-functionally with engineering, GRC, and TPRM to keep architecture reviews and cloud findings moving — this role is a connective thread between teams, not a silo.
What You'll Need:
2–3 years of experience in a security engineering, cloud security, IT security, or related technical role (internships and adjacent IT/ops experience count).
Working knowledge of at least one major cloud provider (AWS, Azure, or GCP) — IAM fundamentals, networking basics, and common misconfiguration patterns.
Basic understanding of security architecture review or threat modeling concepts (e.g., STRIDE, data flow diagrams) — or clear aptitude and interest in learning them.
Familiarity with core security engineering practices: least-privilege access, audit logging, secrets management (no static credentials), and secure configuration baselines.
Comfort reading documentation and asking good questions across unfamiliar systems — this role touches a lot of different architectures, so curiosity matters more than deep specialization in any one of them.
Strong written communication — you'll be documenting review findings and cloud remediation guidance for technical and non-technical audiences alike.
And Ideally:
Exposure to IaC security scanning (Terraform/CloudFormation) or CNAPP/CSPM/CIEM platforms.
Some hands-on exposure to a formal architecture/design review process, even informally (e.g., reviewing a peer's system design for security gaps).
Basic familiarity with AI/LLM concepts — prompts, context windows, tool/function calling, RAG — and awareness of frameworks like the OWASP Top 10 for LLM Applications or the NIST AI RMF.
A relevant certification (Security+, AWS/Azure/GCP security certs, or similar) or equivalent self-directed learning.
Prior exposure to compliance frameworks (SOC 2, FedRAMP, ISO 27001) relevant to architecture review sign-off
#LI-Hybrid #LI-MS1
This is the base pay range for this position. Compensation for the role will depend on a number of factors, including the candidate's qualifications, skills, competencies, location and experience, and may fall outside of the range shown. Employees are also eligible for variable compensation in addition to base pay (commission for sales roles, bonus for non-sales roles), depending on company and individual performance. Tenable also offers a variety of comprehensive and competitive benefits which include: medical, dental, vision, disability and life insurance; 401(k) retirement savings with company match; an employee stock purchase plan; an employee referral program; flexible spending accounts; an Employee Assistance Program (EAP); education assistance; parental leave; paid time off (PTO); company-paid holidays; health and wellness events; and community programs.
US Pay Range
$102,500
—
$136,500 USD
We’re committed to promoting Equal Employment Opportunity (EEO) at Tenable - through all equal employment opportunity laws and regulations at the international, federal, state and local levels. If you need a reasonable accommodation due to a disability during the application or recruiting process, please contact
Recruiting@Tenable.com
for further assistance.
Tenable Data Consent Statement
Tenable is committed to protecting the privacy and security of your personal data. Depending on your location, one or more of the following notices may apply to you:
General Applicant Privacy Notice
California Applicant Privacy Notice
EU/EEA/UK Applicant Privacy Notice
Location: Strava SF
Workplace: Hybrid
ABOUT STRAVA
Strava is the app for active people. With over 200 million athletes in more than 185 countries, it’s more than tracking workouts—it’s where people make progress together, from new habits to new personal bests. No matter your sport or how you track it, Strava’s got you covered. Find your crew, crush your goals, and make every effort count. Start your journey https://www.strava.com/subscription with Strava today.
Our mission is simple: to motivate people to live their best active lives. We believe in the power of movement to connect and drive people forward.
This role is on the Strava Security Team, which exists to protect Strava’s people, business, and data through integrated, proactive security practices.
We work across all security domains, including, but not limited to, product security, vulnerability management, incident response, infrastructure, network, and enterprise security.
We follow a flexible hybrid model that generally translates to around half your time on-site in our San Francisco office – three days per week.
WHAT YOU’LL DO:
- Protect a platform that supports millions of athletes by ensuring Strava’s applications and infrastructure are secure, resilient, and compliant across regions.
- Work closely with engineering, infrastructure, and security teams to design and implement secure architectures and development practices.
- Make a high-leverage impact by shaping how Strava manages application and infrastructure risks in the US and EU, ensuring speed, accuracy, and consistency in remediation.
- Build automated workflows that identify vulnerabilities early, enforce secure configurations, and strengthen our CI/CD and cloud security controls.
YOU WILL BE SUCCESSFUL HERE BY:
- Being highly self-motivated and detail-oriented, with a strong sense of ownership for Strava’s application, infrastructure, and network security posture.
- Driving secure-by-design practices across engineering teams, including threat modeling, architecture reviews, and vulnerability management.
- Embracing the usefulness of generative AI tools and applying them to your daily work.
- Partnering with Engineering and Infrastructure teams to embed automated security checks into CI/CD pipelines and infrastructure-as-code deployments.
- Coordinating incident response, vulnerability triage, and remediation validation in partnership with the global security team.
WHAT YOU’LL BRING TO THE TEAM:
- Bring hands-on experience in application and infrastructure security, including code review, threat modeling, and securing cloud-native environments (AWS preferred).
- Have designed or implemented automated security controls in CI/CD pipelines using tools like GHAS, Snyk, Semgrep, Trivy, etc.
- Understand how to secure containerized and distributed environments, including Kubernetes, IAM, and network segmentation.
- Are comfortable managing vulnerability management programs end-to-end, from detection and prioritization through engineering remediation.
- Are collaborative and pragmatic — able to influence engineering teams through partnership, technical credibility, and clear communication.
For information on benefits, please click here https://docs.google.com/document/d/e/2PACX-1vTkFMPz3eCjd0FgQ28VWnK4d2BEnzGyaSFGwATR-dQdBb9HxZgay6kboqnT0-V-qaBDzSvYIzI76vT5/pub.
WHY JOIN US?
Movement brings us together. At Strava, we’re building the world’s largest community of active people, helping them stay motivated and achieve their goals.
Our global team is passionate about making movement fun, meaningful, and accessible to everyone. Whether you’re shaping the technology, growing our community, or driving innovation, your work at Strava makes an impact.
When you join Strava, you’re not just joining a company—you’re joining a movement. If you’re ready to bring your energy, ideas, and drive, let’s build something incredible together.
Strava builds software that makes the best part of our athletes’ days even better. Just as we’re deeply committed to unlocking their potential, we’re dedicated to providing a world-class, inclusive workplace where our employees can grow and thrive, too. We’re backed by Sequoia Capital, TCV, Madrone Partners and Jackson Square Ventures, and we’re expanding in order to exceed the needs of our growing community of global athletes. Our culture reflects our community. We are continuously striving to hire and engage teammates from all backgrounds, experiences and perspectives because we know we are a stronger team together.
Strava is an equal opportunity employer. In keeping with the values of Strava, we make all employment decisions including hiring, evaluation, termination, promotional and training opportunities, without regard to race, religion, color, sex, age, national origin, ancestry, sexual orientation, physical handicap, mental disability, medical condition, disability, gender or identity or expression, pregnancy or pregnancy-related condition, marital status, height and/or weight.
We will ensure that individuals with disabilities are provided reasonable accommodation to participate in the job application or interview process, to perform essential job functions, and to receive other benefits and privileges of employment. Please contact us to request accommodation.
California Consumer Protection Act Applicant Notice https://docs.google.com/document/d/e/2PACX-1vSc8y6On4NlP5s12hf4kmWe_pvenVyQ78TbtVaz_clROhj9ADQ6kY4YScglBIuY2joKFKalOReX7vP_/pub
Location: North America
Workplace: Remote
At Linear, we're building the product development system for teams and agents. AI is fundamentally changing how software gets built, and we’re shaping the tools this new era requires.
Founded in 2019, Linear has become the platform of choice for more than 50,000 companies (including OpenAI, Coinbase, and Ramp) to plan, build, and ship their products. Today, our team is distributed across North America, Europe, and Australia, and we’re continuing to grow internationally. What unites us is relentless focus, fast execution, and a deep care for software craftsmanship.
At Linear, we are committed to quality. Security is an essential part of that quality — not a layer that we add later, but something we build in from the start. We have a foundational security program we're proud of but, as Linear evolves our product and scales into enterprise, there's meaningful work ahead: staying ahead of vulnerabilities as our attack surface grows, responding fast and cleanly when incidents happen, and hardening our product and infrastructure. As Security Engineer at Linear, you'll be operating in a high-autonomy role with real scope, doing hands-on security work across the product and infrastructure we build.
Location & work mode
Linear is a remote-first company. This role is open to candidates based in North America. You can work from anywhere within this region. We value deep focus and async collaboration, with intentional moments to connect in person through team off-sites, optional co-working, and occasional travel.
What you’ll do
Depending on your experience / skillset and our broader priorities, you could:
- Operate, automate, and extend vulnerability management end-to-end: triage, prioritize, and drive remediation across product, infrastructure, and dependencies, and keep the program’s SLAs meaningful rather than theoretical
- Run our bug bounty program: triage incoming reports, validate severity, work with engineering on fixes, and keep researcher relationships professional and responsive
- Lead product security testing: threat model new features (including AI/agent-facing surfaces), review designs and code for security-relevant risk, and do hands-on testing (manual and tool-assisted) rather than relying solely on scanners
- Be a primary responder for security incidents: lead investigation and containment, drive postmortems, and turn lessons into concrete hardening work
- Own meaningful chunks of our cloud/infra security posture on GCP/k8s/Postgres: harden configurations, close gaps surfaced by audits or scanning, and partner with infra engineering on secure defaults
- Build and maintain security tooling and automation, including using AI/LLM tooling to speed up triage, code review, and repetitive investigation work, so the program scales without linear headcount growth
- Partner with the GRC/Trust function: feed real findings into the risk register and control evidence, and help make sure compliance requirements reflect actual engineering practice
What we’re looking for
- A generalist, senior-level security engineer (5+ years across security engineering, with real depth in at least two of: vulnerability management, product/appsec testing, incident response, and cloud security). We need breadth, rather than a narrow specialist in any one of these.
- Hands-on and technical: you can read and reason about code (we use a lot of TypeScript), you’re comfortable in cloud environments (GCP a plus), and you can go deep on a finding rather than just filing a ticket for someone else to fix. You’re comfortable using AI coding/security tools as force multipliers (Linear Agent, Claude, Codex, etc).
- Calm under pressure: you can lead an incident from first alert through postmortem without needing to be told what to do next
- A builder: you’d rather write a script or ship a tool than repeat a manual process a third time
- A pragmatic risk-reducer: you optimize for actually reducing risk, not for checking a box or maximizing findings count
- Autonomy-oriented: comfortable setting your own priorities, working with significant independence, and knowing when to escalate
- A clear communicator: able to explain a technical finding to a non-technical stakeholder and write it up so it’s actually actionable
Our tech
This is a hands-on security engineering role. You'll be running tools, reading/writing code, building detections, working in our cloud environment, and partnering closely with the engineers who build our product. Our stack is fronted by Cloudflare and runs on Google Cloud with k8s, Postgres, and Node.
For day-to-day work, we use:
- Linear, GitHub, Slack, and Google Workspace for collaboration
- Claude and ChatGPT for general & engineering-specific AI tasks
- Vanta for compliance automation and evidence collection
Our security-specific tooling includes:
- GitHub Advanced Security
- RunReveal
- SentinelOne
What we offer
We're a small, focused team that cares deeply about the quality of our work and the people we do it with. Here's what you can expect:
- Competitive salary and equity
- Employee-friendly equity terms including early exercise in the US and extended exercise windows
- Daily meal and coffee stipend on every workday
- Paid co-working space or desk
- Health coverage (based on country requirements)
- 5 weeks paid vacation, plus local statutory holidays
- 4 months paid parental leave
- Paid month off after 4 years & every 2 years thereafter
- Regular team events and off-sites
- Remote-first with no required commute
Compensation
For US-based candidates, the expected cash compensation range for this role is $240,000—$282,000. For sales roles, this range represents on-target earnings (OTE), including base salary and variable compensation; for all other roles, it represents base salary. Final compensation is determined based on job-related knowledge, skills, and experience. For sales roles, actual earnings vary based on sales performance. Equity is a meaningful part of all offers at Linear.
Learn how we think and work
- Read Me https://linear.app/readme a story about our mission
- Our hiring process: How we hire at Linear https://linear.app/now/how-we-hire-at-linear
- How we work: Designing remote work at Linear https://linear.app/now/designing-remote-work-at-linear
- Why and how we do work trials https://linear.app/blog/why-and-how-we-do-work-trials-at-linear Linear blog post
- How we use AI in design https://designerfund.substack.com/p/ai-design-linear feature of Linear's design team
- Scaling our real-time sync engine https://linear.app/blog/scaling-the-linear-sync-engine talk by our cofounder, Tuomas Artman, at Linear's 2023 offsite
- Our recent tender offer: Sharing Linear’s growth with the people building it https://linear.app/now/sharing-growth-with-the-people-building-linear
A note on recruitment fraud: all official Linear hiring communication comes from an @linear.app http://linear.app email address, and all open roles are listed at linear.app/careers http://linear.app/careers. We never ask candidates for payment or financial information. Suspicious messages can be reported to security@linear.app.
Linear is an equal opportunity employer. We do not discriminate based on race, color, religion, gender identity or expression, sexual orientation, national origin, age, disability, veteran status, or any other protected characteristic under applicable law.
Location: Москва
Сильнейшая команда кибербезопасности вместе с производственными командами SberTech (архитекторами, разработчиками, тестировщиками и др.) создаёт и развивает инновационный продукт на российском и зарубежном рынке - Platform V. Наша платформа помогает внутренним и внешним пользователям быстро и просто создавать и использовать нативно-безопасные low-code приложения. Отдел методологии, сертификации и лицензирования - неотъемлемая часть команды кибербезопасности, лидирует процессы подготовки (совместно с производственными командами) и сопровождает проведение независимой оценки безопасности программных компонентов Platform V (СЗИ) и аудитов процессов разработки безопасного программного обеспечения.
Обязанности
* сопровождение производственной команды сертифицированного СЗИ от этапа создания до этапа получения сертификата, а также поддержание СЗИ в сертифицированном состоянии
* взаимодействие с производственными командами, испытательной лабораторией, Регулятором и другими участниками процесса сертификации
* планирование и регулярный контроль выполнения проектов по сертификации
* проверка конструкторской (КД), эксплуатационной (ЭД) и программной (ПД) документации на соответствие требованиям безопасности Регулятора
* проведение сертификационных испытаний СЗИ.
Требования
* опыт сопровождения (и/или проведения) сертификационных испытаний СЗИ по линии ФСТЭК России, ФСБ России, Минобороны России
* опыт взаимодействия с разработчиками в части устранения уязвимостей и подготовки различных материалов (тестовых стендов, документации, отчетов по анализу уязвимостей)
* знания нормативной регуляторики, связанной с сертификацией по ФСТЭК России (117/21/239/55/76 приказы, Методика выявления уязвимостей и недекларированных возможностей (2026) и др.), ФСБ России (117/378/564 приказы, ПКЗ-2005 и др.) и Минобороны России (488 приказ и др.)
* понимание практик разработки безопасного программного обеспечения (РБПО), знание требований ГОСТ серии Разработка безопасного программного обеспечения (ГОСТ Р 56939-2024, ГОСТ Р 71207-2024 и т.д.)
* понимание принципов функционирования OC Linux, контейнеризации приложений и микросервисной архитектуры, а также облачной безопасности
* опыт использования ИИ-инструментов
* владение профессиональной терминологией (способность отличить аутентификацию от авторизации и ключ электронной подписи от сертификата ключа проверки).
### Особые требования, выдвигаемые Отделом специальных производственных задач:
* оформление формы допуска для работы со сведениями, составляющими государственную тайну с проведением в отношении кандидата и его близких родственников проверочных мероприятий ФСБ России. В случае отказа ФСБ России по результатам проверочных мероприятий договор расторгается
* вероятен запрет выезда за границу
* у кандидата и его близких родственников не должно быть судимости, возбужденных в их отношении уголовных дел и иных проблем с законом
* кандидат и его близкие родственники не должен иметь никакого отношения к деятельности запрещенных на территории РФ организаций
* кандидат должен быть полностью дееспособен, не состоять на учете в психоневрологическом, наркологическом диспансерах, не иметь каких-либо иных зависимостей (алкогольной, наркотической, игровой и т.п.).
* кандидат и его близкие родственники не должны проживать на постоянной основе за границей (более 6 месяцев в течение года)
* у кандидата и его близких родственников не должно быть иностранного гражданства, подданства, ВНЖ в иностранном государстве.
### Преимущества:
* сотрудники отдела имеют бронь в период мобилизации и военного положения (для пребывающих в запасе) или отсрочку от прохождения срочной службы (для призывников)
* надбавка к окладу не менее 10%.
Условия
* гибридный формат работы по адресу: Новоданиловская наб.10 (БЦ Даниловский Форт)
* годовой бонус и ежегодный пересмотр зарплаты
* статус аккредитованной ИТ-компании
* расширенный ДМС с первого дня и льготное страхование для семьи
* корпоративный университет Сбера, внутренняя образовательная платформа, участие в IT-конференциях
* льготная ипотека в Сбере, подписка Прайм с возможностью совместного использования на трёх близких.
Мы хотим создать закрытый клуб пентестеров с практикой каждую неделю.
Задачи:
— проведение уроков с лабораторными работами: полный курс по XSS и Bash для пентестера, а также другие именные курсы.
— глубокие разборы обходов фильтров, CSP, IDOR, методологии.
— разборы реальных отчётов bug bounty.
— организация закрытого чата с «Вопросами недели», где автор темы отвечает в комментариях.
— реализация других идей, обсуждаемых с участниками.
Условия:
— курс «JSON с нуля до профи» в подарок при вступлении.
— «Карта пути пентестера» с рекомендациями по обучению и порядку изучения.
— доступ через закрытый чат по ссылке.
Присоединяйтесь к чату и участвуйте в обсуждениях, не выходите из чата до старта, чтобы не пропустить цену early bird.
Location: Gurgaon, India
Workplace: remote
About Welo Data
Welo Data, a Welo Global brand, is the multilingual data and evaluation partner for foundation labs and enterprises deploying GenAI systems globally. They deliver the human judgment, data infrastructure, and evaluation systems that ensure AI models perform reliably across languages, cultures, and real-world contexts, at every stage from training through deployment. Its global network of 500,000+ vetted experts spans 300+ languages and locales, enabling high-quality multilingual data creation and structured model evaluation across the full spectrum of modern AI applications — from large language models and voice and speech systems to agentic workflows and robotics and embodied AI. This breadth of linguistic, cultural, and domain expertise enables Welo Data to address critical AI development challenges, including safety, bias, inclusivity, and cross-lingual reliability. A unified global operating model, led by specialized program and quality experts and grounded in assessment-driven talent selection, localized rubrics, and continuous calibration, ensures consistent performance across languages, domains, and modalities. Underpinning all of this is NIMO™ (Network Identity Management and Operations), Welo Data's proprietary identity and fraud-prevention framework. Built to maintain data integrity and workforce trust across a global contributor base, NIMO combines advanced verification, continuous monitoring, and structured QA to ensure every dataset is accurate, traceable, and culturally grounded. welodata.ai
About the Team
Welo Data's Trust & Safety function protects the integrity of a global, distributed workforce that powers AI data and annotation work. We run a multi-layered fraud detection stack combining identity verification checks, in-house behavioral signals, and platform activity data, and are actively building out a Trust & Safety Committee spanning four core workstreams: identity verification, location verification, account integrity, and multi-accounting detection. This is a hands-on investigative role, not a policy-only seat — you'll be working live cases from day one.
About the Role
We're looking for a Trust & Safety Specialist, based in India, to join our investigations team, working active fraud cases and supporting the broader fraud strategy program. You'll come in with real T&S, fraud/risk, or identity-verification experience from another platform, marketplace, gaming company, fintech, IDV vendor, or crowdsourced-workforce environment, and be ready to run investigations, process removals, and spot fraud patterns from week one.
What You Will Do
Run investigations end-to-end:
triage flagged accounts, review evidence (identity signals, behavioral flags, platform activity data), reach a disposition, and process removals in line with policy and SLA.
Own IDV review:
verify identity and location signals for flagged or high-risk accounts, distinguishing genuine edge cases from fraud.
Conduct manual audits and reviews:
prioritizing cases by risk and signal strength rather than intake order.
Detect multi-accounting and account integrity abuse:
recognize patterns across linked accounts, device/location overlap, and behavioral signals.
Apply a hypothesis-driven investigation method:
form a hypothesis, test it against the evidence, and reach a disposition that can be replicated and audited.
Contribute to detection improvement:
escalate emerging fraud vectors, false-positive/false-negative patterns, and rule gaps to the fraud strategy team.
Handle sensitive data responsibly:
apply GDPR-aligned data handling and deletion practices in every case.
Collaborate cross-functionally:
partner with Research Labs, Quality Strategy Architecture (QSA), and Forward Deployment Engineering on tooling gaps and process fixes surfaced by your casework
What You Bring (Must Have-s)
4+ years in a T&S, fraud/risk, or identity-verification investigations role — from a platform/marketplace T&S team, a fintech/payments risk team, an identity-verification vendor, or a crowdsourced/gig-workforce trust function.
Direct experience with identity/fraud signals — device fingerprinting, IP/geolocation checks, document verification, or behavioral fraud scoring.
Multi-accounting / account integrity pattern recognition — you've dealt with linked-account abuse, farming, or account sharing before, not just single-account review.
Case documentation discipline — you write clean, evidence-backed case notes that would survive an audit or an appeal.
Comfort with ambiguity and volume — you can prioritize a queue by risk, not just clear it by count.
Working knowledge of data privacy obligations (GDPR or equivalent) as they apply to case handling and data retention/deletion.
Nice to Have
Experience specifically in AI/ML data annotation, RLHF, or research operations workforce platforms.
Exposure to rule-based fraud detection engines and an opinion on rule sprawl vs. signal quality.
Familiarity with clustering/anomaly-detection approaches to fraud (even at a conceptual level).
Case management system experience (any ticketing or knowledge-base tooling).
Recommended Education
Bachelor's degree in Criminology, Law, Criminal Justice, Cybersecurity, Information Security, Data/Computer Science, or a related field.
Equivalent practical experience in T&S, fraud investigations, or identity verification will be considered in place of a degree.
Relevant certifications are a plus: CFE (Certified Fraud Examiner), CAMS (Certified Anti-Money Laundering Specialist), or IDV/identity risk vendor certifications.
Location: United Kingdom, London
Why Sony Interactive Entertainment?
Sony Interactive Entertainment isn’t just the Best Place to Play — it’s also the Best Place to Work. Sony Interactive Entertainment (SIE) is the company behind the PlayStation brand. As a subsidiary of Sony Group Corporation, we’re part of a proud legacy of innovation and excellence. SIE is a dynamic technology company, delivering cutting-edge hardware and network services to more than 100 million people and an entertainment leader, home to some of the most beloved and recognizable intellectual properties (IP) in the world. Our role at SIE is to create and nurture the experiences under the PlayStation brand, a name synonymous with entertainment excellence and creativity.
Sony Interactive Entertainment
Security Architecture | Cloud | AI Security | Enterprise Platforms
We are seeking a Staff Security Architect to help shape and secure the next generation of enterprise, cloud, platform, and AI-enabled technology. This role combines deep security architecture expertise with strong engineering judgment and the ability to influence technical direction across complex, global environments. The successful candidate will partner with engineering, infrastructure, product, and security teams to identify systemic risk, develop scalable security patterns, and guide secure adoption of emerging technologies, including generative AI and agentic systems.
Key Responsibilities
Design, review, and approve security architecture for enterprise, cloud, SaaS, platform, and application environments, balancing business objectives, engineering constraints, and risk.
Lead cloud security architecture across AWS, Google Cloud, and hybrid environments, including identity, network security, data protection, logging and monitoring, key management, workload isolation, security posture management, and the effective use of native and third-party cloud security controls.
Define and review security architecture for SaaS and PaaS platforms, including identity federation, privileged access, tenant configuration, data protection, API and integration security, logging, third-party risk, and secure adoption of enterprise SaaS services.
Drive security throughout the software delivery lifecycle, including source control, CI/CD pipelines, build systems, artifact repositories, infrastructure as code, secrets management, code and artifact signing, software provenance, deployment automation, and security controls for developer platforms.
Lead security architecture for AI-enabled systems, including generative AI, large language models, retrieval-augmented generation, AI agents, model-serving platforms, and AI-assisted developer workflows.
Design mitigations for risks such as prompt injection, insecure tool use, excessive agency, sensitive-data disclosure, model or supply-chain compromise, unsafe output handling, and abuse of AI services.
Define security requirements for AI data, models, prompts, embeddings, vector stores, APIs, tools, and agent identities, including least-privilege access, secrets management, encryption, isolation, provenance, logging, monitoring, and lifecycle controls.
Architect and improve identity, authentication, authorization, network security, key management, cryptography, application security, and production security controls across complex environments.
Identify security design gaps in existing and proposed systems; translate findings into practical architecture improvements, reference patterns, hardening standards, preventative controls, and responsible automation that improves repeatability and operational effectiveness.
Provide technical leadership across multi-disciplinary teams, clearly articulating risks, tradeoffs, and recommended solutions to engineering leaders, business stakeholders, and audiences without a security background.
Required Qualifications
15+ years of relevant experience in security architecture, security engineering, product security, cloud security, infrastructure security, or related disciplines, with demonstrated leadership at senior or staff level.
Deep knowledge of security architecture principles across cloud, application, network, identity, platform, infrastructure, and enterprise environments.
Hands-on experience designing or securing cloud-based and containerized environments, including major cloud platforms such as AWS or Google Cloud.
Strong understanding of modern identity and access management, PKI, OAuth/OIDC, SAML, TLS, VPNs, secrets management, key management systems, cloud KMS, and HSMs.
Expertise in network and application security controls such as WAFs, NGFWs, segmentation, DMZ design, DDoS mitigation, load balancing, proxies, intrusion detection/prevention, and host-based controls.
Experience with secure software development, threat modeling, CI/CD and developer platforms, application security, and engineering mitigations across the software lifecycle.
Working knowledge of AI/ML security concepts and the ability to evaluate security risks in generative AI, LLM, and agentic system architectures, including data flows, trust boundaries, model access, and tool integrations.
Strong critical thinking, risk prioritization, communication, and influence skills, with the ability to lead through ambiguity and work effectively across global, cross-functional teams.
Bachelor's degree in Computer Science, Mathematics, Engineering, Information Security, or equivalent practical experience.
Preferred Qualifications
Experience securing AI/ML platforms, generative AI applications, model gateways, RAG architectures, vector databases, or agentic workflows in production environments.
Experience with AI security evaluation, red teaming, adversarial testing, model abuse testing, or control validation for AI-enabled systems.
Experience securing large-scale Linux, distributed, multi-tenant, or high-availability production environments.
Development or automation experience in Python, C++, Java, or similar languages.
Recognized technical leadership through patents, publications, open-source contributions, conference participation, teaching, or security community involvement.
Penetration testing, adversarial security, or attacker-minded design experience.
Master's degree or Ph.D. in Computer Science, Mathematics, Engineering, Information Security, or a related field.
Please note, Sony Interactive Entertainment conducts background checks at the offer stage for all new employees (which may include criminal background checks for some roles) and will need to process personal information to support these checks.
Please refer to our Candidate Privacy Notice (where applicable) for more information about what personal information we collect, how we use it, who we share it with, and your data protection rights.
Equal Opportunity Statement:
Sony is an Equal Opportunity Employer. All persons will receive consideration for employment without regard to gender (including gender identity, gender expression and gender reassignment), race (including colour, nationality, ethnic or national origin), religion or belief, marital or civil partnership status, disability, age, sexual orientation, pregnancy, maternity or parental status, trade union membership or membership in any other legally protected category.
We strive to create an inclusive environment, empower employees and embrace diversity. We encourage everyone to respond.
Sony Interactive Entertainment is a Fair Chance employer and qualified applicants with arrest and conviction records will be considered for employment.
Location: Bulgaria
Company Background
Our client is a travel technology company developing cloud-native, AI-powered software for airlines and hospitality brands. Its products help customers improve commercial performance, reduce costs, and evolve their digital commerce capabilities. The company’s technology is designed to work alongside existing airline systems, allowing customers to introduce new capabilities without replacing their current technology landscape.
Project Description
You will contribute to a large-scale greenfield travel-technology initiative supporting the launch of a new airline operation. The project uses a modern commercial platform to enable flexible retailing, pricing, and digital shopping experiences across travel products and ancillary services.
Technologies
GCP, AWS
Wiz
Cloudflare WAF, Bot Management, DNS, TLS, DDoS Protection and Rate Limiting
Terraform
SonarCloud and Dependabot
Jira, PagerDuty and Slack
Python and Bash
What You'll Do
Own and continuously improve cloud security posture across GCP organizations and AWS accounts, including connector coverage, runtime sensor deployment on production clusters, custom policy development, finding-triage baselines, and integrations with Jira, PagerDuty, and Slack;
Operate and evolve the edge security layer, centralizing internet-facing protection through Cloudflare WAF, bot management, rate limiting, DNS/TLS, and origin routing for customer-facing production zones;
Tune security rules using real production traffic, manage allow-list requests, and enable other teams to use edge-security tooling effectively;
Support and automate vulnerability management and secure configuration, maintaining the intake of Wiz, SAST, penetration-test, and customer-reported findings, defining remediation baselines, and driving owners to closure;
Participate in security incident response for cloud events, including DDoS and bot attacks, supply-chain alerts, credential exposure, and data-handling incidents, while creating and maintaining detection, triage, and mitigation runbooks;
Help secure the software supply chain by owning SAST reporting in SonarCloud, dependency scanning with Dependabot, container base-image hardening, and the selection of SBOM and SCA tooling, and publish release-level security reports for engineering teams;
Produce technical evidence for SOC 2, PCI DSS, ISO 27001, and NIS2, including evidence of log-sink configuration and retention, access reviews, authenticated scanning, and IAM remediation, and map Wiz controls to relevant frameworks to make evidence collection repeatable;
Enable security self-service by training Platform, CloudOps, and Product Engineering teams on the tools they use, including Wiz and Cloudflare administration, mapping service catalogues to owners, and automating recurring customer-security and issue-triage reporting through scripting and AI-assisted workflows;
Advise and partner with engineering teams on the security of new platform integrations and AI/RAG services, contributing to the annual cloud-security roadmap and target-state architecture;
Job Requirements
5+ years of experience in cloud security or platform engineering with a security focus, including hands-on experience with GCP or AWS across IAM, audit logging, log routing, network security, and workload protection;
Production experience with a CNAPP/CSPM platform, such as Wiz (preferably) / Prisma Cloud / Orca / Google Security Command Center, including policy authoring, integrations, and runtime protection;
Hands-on administration of a WAF, CDN, and bot-management stack at scale;
Strong Terraform experience, including building modules for security tooling and WAF configuration, reviewing changes, and managing configuration drift and legacy infrastructure;
Experience with vulnerability management across cloud infrastructure, containers, and code, including SAST, SCA/dependency scanning, container image hardening, and penetration-test remediation tracking;
Experience routing cloud security signals to a SIEM or security-monitoring platform, such as Wazuh, Microsoft Sentinel, Google Security Operations, or Datadog Security Monitoring, and integrating actionable alerts with PagerDuty and Slack;
Scripting skills in Python or Bash for automation and security reporting;
Security incident-response experience in a production environment, including developing runbooks and managing vendor escalations;
Clear written and verbal communication skills, with the ability to train engineering teams and document security decisions;
Nice To Have
Experience automating security workflows, such as report generation and issue triage, with AI-assisted or LLM-based tooling;
Experience working across both GCP and AWS, experience with Azure;
Familiarity with Rego, OPA, or other policy-as-code languages;
Experience with identity and access-management tooling, including Okta SSO/SCIM, PAM solutions, and least-privilege reviews for cloud IAM;
Experience facilitating OWASP SAMM assessments, threat-modelling sessions, or security-champions programs;
Airline or travel-industry experience, including PCI-scoped payment flows, partner integrations, and customer-facing security reporting;
Experience supporting compliance with PCI DSS, SOC 2, ISO 27001, or NIS2;
Certifications such as Google Professional Cloud Security Engineer, CCSP, or AWS Certified Security – Specialty;
What Do We Offer
The global benefits package includes:
Technical and non-technical training for professional and personal growth;
Internal conferences and meetups to learn from industry experts;
Support and mentorship from an experienced employee to help you professional grow and development;
Health insurance;
Sports activities to promote a healthy lifestyle;
Flexible work options, including remote and hybrid opportunities;
Referral program for bringing in new talent;
Work anniversary program and additional vacation days.
Задачи:
— Выполнять задачи, ставящиеся перед командой, включая исследование ядра iOS, реверс-инжиниринг компонентов с закрытым исходным кодом, отладку смартфонов, проверку имеющихся уязвимостей и proof-of-concepts на эксплуатируемость, написание рабочих эксплоитов, объединение эксплоитов в цепочки.
— Участвовать в процессе тестирования готовых эксплоитов, модифицировать и обновлять их при выходе новых версий ПО.
— Предлагать команде свои идеи и участвовать в обсуждениях по вопросам новых разработок и исследований.
Требования:
— Способность быстро обучаться, анализировать большие объемы разрозненной информации и синтезировать их в конкретное знание, владение системным мышлением.
— Умение работать и принимать решения в условиях ограниченной информации, отсутствие страха постановки гипотез, их проверки, отказа от нерабочих идей.
— Способность фокусироваться на задачах, требующих большого количества времени для их решения вплоть до нескольких месяцев.
— Способность сохранять продуктивность и не опускать руки, когда задача кажется невыполнимой.
— Подтвержденный опыт написания эксплоитов или поиска критических уязвимостей (удалённое исполнение кода, повышение привилегий, выход из песочницы, обход защитных механизмов — RCE, LPE, SBX, mitigation bypasses) в iOS за последний год.
— Понимание архитектуры и внутреннего устройства XNU: Mach, BSD, IOKit, threading, scheduling, memory management, IPC, kernel extensions (kext), kernel modules, DriverKit.
— Владение языками программирования и инструментами: ассемблер ARM и AArch64, C, C++, Objective-C, IDA Pro, Ghidra, Hopper, LLDB, lldbinit, Frida, Clang/LLVM, Xcode.
— Опыт отладки устройств iPhone и MacBook: JTAG, ktrace, sysdiagnose; умение разбирать crash dumps и kernel panics и выявлять причину ошибки.
— Опыт изучения и использования на практике джейлбрейков и цепочек Coruna и DarkSword.
— Знание современных механизмов защиты iOS: KPP, KTRR, PAC, PPL, SPTM, SEP, code signing, AMFI, keychain и т.п.
— Умение настраивать и использовать LLM для автоматизации исследовательских задач.
— Будет вашим преимуществом: опыт написания драйверов режима ядра для macOS, опыт поиска уязвимостей, знание языка Swift.
— Английский язык на уровне чтения технической документации.
Location: Global Remote
Workplace: remote
Metabase is the easiest way for people to get insights from their data, from tiny startups who get up and running quickly to major corporations with tens of thousands of users. That's why people love us.
We bring data tools with the elegance and simplicity of consumer products to the crufty world of enterprise business intelligence. We provide an opinionated open source starting point for how companies should measure, analyze and share their data, which is used by tens of thousands of companies.
About the Role
We’re looking for a Security Engineer with deep expertise in source code analysis and offensive product security research. You’ll dig into complex software architectures, trace how code behaves at runtime, uncover subtle vulnerabilities, and address the systemic flaws behind them.
Embedded in our core engineering team, you’ll help shape security decisions from early design through release and adoption. This is a hands-on engineering and research role: you’ll combine your security expertise with frontier AI tools to find vulnerabilities, develop fixes, and make Metabase secure by default across its product, dependencies, and runtime.
Things you’ll do
Partner with engineers throughout feature development, bringing security expertise to design, implementation, release, and adoption.
Build security-focused features, lead security improvements across the codebase, and implement fixes that address root causes.
Use and evaluate advanced AI tools to scale code analysis, vulnerability research, and secure engineering practices.
Conduct offensive research into Metabase, develop proofs of concept, and validate vulnerabilities.
Assess findings based on exploitability and real-world impact, define clear remediation criteria, and verify that fixes are effective.
Turn individual findings into broader improvements that prevent entire classes of vulnerabilities.
What you bring
A demonstrated track record of finding and exploiting application vulnerabilities through source code analysis and hands-on research.
The ability to independently navigate unfamiliar codebases, understand complex architectures, and reason about runtime behavior and trust boundaries.
Experience with application security challenges, including authentication, authorization, injection, and unsafe handling of untrusted data.
Sound judgment about exploitability and real-world impact, and the ability to communicate findings and remediation options clearly.
Strong software engineering skills, including the ability to implement durable security fixes. Experience in Clojure, or a strong desire to learn.
A thoughtful approach to AI-assisted security work, using these tools to extend your expertise while independently validating their output.
Ownership and curiosity: you pursue difficult questions, collaborate closely with engineers, and follow findings through to resolution.
Compensation
The US base salary range for this role is $160K–$225K annually, plus equity and benefits.
Compensation is determined by role, level, location, and individual qualifications, including skills, experience, and scope of responsibility. Pay may vary by geographic location and other job-related factors.
Benefits
We offer meaningful equity and a comprehensive US benefits package, including fully employer-covered medical, dental, and vision insurance (with 75% coverage for dependents), a 401(k) with employer match available to enroll after the first 30 days, flexible and unlimited paid time off including sick time, and an asynchronous, remote-first environment.
We're a global team (50% outside the US), fully distributed (from Thailand to California), who get things done asynchronously, with plenty of uninterrupted time, supporting each other to do the best work of our careers. We offer flexibility (define your own schedule and work from wherever you want), autonomy, and an environment that fosters growth, learning, and development. We're relentlessly user-focused and believe in building long-term value, not short-term hacks. And we raised a $30M Series B to take our approach to the next level for years to come.
For U.S. applicants: Metabase participates in the federal E-Verify program, which confirms employment authorization of newly hired U.S. based employees. E-Verify is not used as a tool to pre-screen candidates and is only initiated upon hire.
E-Verify Participation Notice (English/Spanish)
Right to Work Notice (English/Spanish)
Задачи:
— Наставничество и обучение в области кибербезопасности, специализация Pentester.
Требования:
— Желание обучаться с реальным практическим опытом.
— Цель — успешно завершить курс и подготовиться к реальной работе.
— Работа с опытным наставником, который достиг успеха в данной области.
Условия:
— Возраст 16 лет.
— Место: Qashqadaryo.
— Время для связи: 09:00 - 18:00.
— Оплата: от 200 до 400 долларов США.
Контакты для связи: +998 88 639 30 83, Telegram: https://t.me/mmz_L7.
Задачи:
— Встраивать и сопровождать процессы SSDLC / DevSecOps в CI/CD
— Настраивать и развивать инструменты SAST, DAST, SCA, Secret Detection, снижать количество ложных срабатываний
— Проводить триаж уязвимостей: оценивать риски, приоритизировать задачи, рекомендовать способы исправления и проверять фиксы
— Участвовать в ревью кода и архитектуры с точки зрения безопасности, проводить threat modeling
— Консультировать разработчиков по вопросам безопасной разработки
— Проводить аудит процессов и практик безопасной разработки
Требования:
— Самостоятельный, убедительный, амбициозный, с лидерскими качествами (или умением сделать так, чтобы управлять не приходилось:), стремящийся к построению защищенной инфраструктуры
— Опыт от 1 года опыта в AppSec / ИБ разработке
— Понимание OWASP Top 10, основных классов уязвимостей, способов их эксплуатации и защиты
— Практический опыт работы с инструментами SAST / DAST / SCA, например Semgrep, Burp Suite, ZAP, Trivy, Dependency-Check
— Навыки автоматизации на Python или Bash
— Уверенная работа с Git / GitLab
— Умение понятно оформлять результаты работы и находить общий язык с разработчиками
— Умение читать и писать код хотя бы на одном из языков: Python, Go, PHP, C#
Будет плюсом:
— Опыт коммерческой разработки
— Работа с Docker / Kubernetes в контексте безопасности
— Опыт с SonarQube, Jenkins, Ansible, Nexus
— Знание Cloud Security и IaC-сканирования
— Опыт работы с Terraform, Checkov, tfsec, OPA/Kyverno
Location: Vienna, Austria
About Us
Established in 2018, Bybit is one of the world’s leading cryptocurrency exchanges and digital financial platforms, serving over 80 million users across more than 200 countries and regions. Powered by world-class technology and a user-first mindset, Bybit delivers a seamless ecosystem across trading, payments, wealth management, custody, institutional services, and Web3 — connecting users to the future of digital finance.
Our core values define how we build. We listen, care and improve to create products and experiences that put users first. Backed by a global team of ambitious builders, problem-solvers, and innovators, we foster a high-performance and fast-moving environment where talent is empowered to drive real impact at the global scale. Supported by 24/7 multilingual customer service and a strong commitment to innovation, we are shaping the future of finance through technology, collaboration, and bold execution.
Today, Bybit is recognized as one of the most trusted and transparent platforms in the digital asset industry, continuing to expand its global presence while building the infrastructure for the next generation of financial services.
We are looking for a hands-on Senior Security Specialist to lead and oversee key security initiatives across the organization. You will play a central role in strengthening our security posture, driving compliance certifications, and ensuring robust access governance — working closely with the CISO to protect our infrastructure and data assets.
Key Responsibilities
Identity & Access Management (IAM)
Design, implement, and maintain IAM frameworks, policies, and processes across the organization
Oversee access rights management, including provisioning, de-provisioning, and periodic access reviews
Lead the rollout and enforcement of Multi-Factor Authentication (MFA) across all systems and user groups
Ensure least-privilege principles are consistently applied and audited
Network Security
Oversee the implementation and continuous improvement of network security controls
Monitor, detect, and respond to security threats and vulnerabilities across the network infrastructure
Security Reporting & Audit
Generate regular security reports and dashboards for the CISO and senior management
Support internal and external audit processes, ensuring timely and accurate documentation
Coordinate and oversee penetration testing engagements, track findings, and drive remediation
Compliance & Certification
Lead and coordinate security certification processes (e.g. PCI DSS, ISO 27001) in close collaboration with the CISO
Conduct gap analyses, maintain compliance documentation, and liaise with auditors and certification bodies
Requirements
Bachelor's degree or above in Computer Science, Information Technology, Cybersecurity, or a related field
3–5 years of hands-on experience in information security
Proven track record in security project implementation and management
Demonstrated experience in IAM, network security, or compliance programs
Certifications would be a strong plus
CISSP, CISM, CISA, or equivalent
ISO 27001 Lead Implementer / Lead Auditor
PCI DSS QSA or ISA certification
IAM-related certifications (e.g. Microsoft Identity, SailPoint, Okta)
Skills
Solid understanding of IAM principles, network security, and regulatory frameworks
Strong analytical and independent problem-solving abilities
Excellent communication and stakeholder management skills
Ability to manage multiple priorities in a fast-paced environment
Can use German and English as working language
Why Join Us
At Bybit, we are committed to fostering a supportive and enriching work environment.
Our benefits include:
- Study Growth Fund: We support your professional development and continuous learning.
- Internal Events: Participate in regular team-building activities, workshops, and events designed to promote collaboration and innovation.
- Global Collaboration: Be part of a diverse, international team, working alongside colleagues from around the world.
- Career Advancement: Access opportunities for growth and advancement within a rapidly expanding global company.
- Internal Mobility: Grow with us- Your long-term development is important to us. We offer internal job opportunities to help build your career path.
Location: Hybrid
About Us
At Cloudflare, we are on a mission to help build a better Internet. Today the company runs one of the world’s largest networks that powers millions of websites and other Internet properties for customers ranging from individual bloggers to SMBs to Fortune 500 companies. Cloudflare protects and accelerates any Internet application online without adding hardware, installing software, or changing a line of code. Internet properties powered by Cloudflare all have web traffic routed through its intelligent global network, which gets smarter with every request. As a result, they see significant improvement in performance and a decrease in spam and other attacks. Cloudflare was named to Entrepreneur Magazine’s Top Company Cultures list and ranked among the World’s Most Innovative Companies by Fast Company.
At Cloudflare, we’re not looking for people who wait for a polished roadmap; we’re looking for the builders who see the cracks in the Internet that everyone else has simply learned to live with. We value candidates who have the instinct to spot a "normalized" problem and the AI-native curiosity to create a solution using the latest tools. Our culture is built on iteration, leveraging AI to ship faster today to make it better tomorrow, while ensuring that every improvement, no matter how small, is shared across the team to lift everyone up. If you’re the type of person who values curiosity over bureaucracy, and that AI is a partner in solving tough problems to keep the Internet moving forward, you’ll fit right in.
Available Locations:
Austin, TX
What You'll Do
Cloudflare is seeking a Security Engineer to design and build agentic security tooling for Cloudflare Security, and to release that work as open-source reference implementations, interactive labs, and technical workshops for customers and partners.
This role sits in the Applied Research & Labs function within the Office of the CSO. You will work embedded with Cloudflare's security teams, build on Cloudflare's Developer Platform, and represent the team's security & engineering work externally.
Security Tooling & Reference Implementations
Design and build agentic security workflows and tooling for Cloudflare Security, including multi-agent orchestration, tool integration, and evaluation harnesses
Release internal harnesses, skill definitions, and orchestration workflows as documented open-source reference implementations
Implement on Cloudflare Workers, Durable Objects, Workflows, Workers AI, AI Gateway, and the Agents SDK
Labs & Workshops
Define the technical scope and sequencing of each lab, including the failure modes participants will hit and the scaffolding they need
Build and operate the lab infrastructure: per-participant isolation, automated provisioning, state reset, and teardown
Run hands-on workshops where customers and partners build and deploy the tooling themselves
Document and package workshop formats so other Cloudflare engineers can deliver them
External Engagement
Present Cloudflare's agentic security architecture through customer briefings and conference talks
Author technical deep dives and architecture write-ups that establish Cloudflare Security as a recognized voice in the security community
Partner with Product and Engineering to align external technical content with the roadmap
Required Qualifications
4+ years in software engineering, shipping and operating production systems
Demonstrated experience building interactive labs, hands-on learning platforms, or developer training environments, including the infrastructure behind them
Strong design judgment for technical learning experiences, including scope, sequencing, and knowing what to leave out
Proficiency in TypeScript, Python, or a comparable language, with production experience in distributed or event-driven systems
Hands-on experience building LLM-based systems, including agent orchestration, tool use, context engineering, and evaluation
Experience with Cloudflare Workers, Durable Objects, Workflows, Workers AI, AI Gateway, and Vectorize, or an equivalent serverless stack
Working knowledge of application and infrastructure security, including common vulnerability classes and secure development practices
Published technical writing, conference talks, or open-source contributions
Bonus Points
Hands-on security background in any domain
Experience with the Cloudflare Agents SDK
Experience with developer education, technical certification programs, or developer relations
Maintainer or significant contributor to an open-source security or developer tooling project
Experience speaking at security or developer conferences
Location & Travel
Based in Austin, TX
15-25% travel for customer workshops, conferences, and other Cloudflare offices
Occasional work outside standard hours to support sessions across EMEA and APAC time zones
What Makes Cloudflare Special?
We’re not just a highly ambitious, large-scale technology company. We’re a highly ambitious, large-scale technology company with a soul. Fundamental to our mission to help build a better Internet is protecting the free and open Internet.
Project Galileo
: Since 2014, we've equipped more than 2,400 journalism and civil society organizations in 111 countries with powerful tools to defend themselves against attacks that would otherwise censor their work, technology already used by Cloudflare’s enterprise customers--at no cost.
Athenian Project
: In 2017, we created the Athenian Project to ensure that state and local governments have the highest level of protection and reliability for free, so that their constituents have access to election information and voter registration. Since the project, we've provided services to more than 425 local government election websites in 33 states.
1.1.1.1
: We released
1.1.1.1
to help fix the foundation of the Internet by building a faster, more secure and privacy-centric public DNS resolver. This is available publicly for everyone to use - it is the first consumer-focused service Cloudflare has ever released. Here’s the deal - we don’t store client IP addresses never, ever. We will continue to abide by our
privacy commitment
and ensure that no user data is sold to advertisers or used to target consumers.
Sound like something you’d like to be a part of? We’d love to hear from you!
Please note that applicants who progress to the offer stage of the interview process may be asked to attend an in-person interview within one of the Cloudflare Offices or Cloudflare Hubs. More details about this will be available at that stage of the interview process.
This position may require access to information protected under U.S. export control laws, including the U.S. Export Administration Regulations. Please note that any offer of employment may be conditioned on your authorization to receive software or technology controlled under these U.S. export laws without sponsorship for an export license.
Cloudflare is proud to be an equal opportunity employer. We are committed to providing equal employment opportunity for all people and place great value in both diversity and inclusiveness. All qualified applicants will be considered for employment without regard to their, or any other person's, perceived or actual
race, color, religion, sex, gender, gender identity, gender expression, sexual orientation, national origin, ancestry, citizenship, age, physical or mental disability, medical condition, family care status, or any other basis protected by law.
We are an AA/Veterans/Disabled Employer.
Cloudflare provides reasonable accommodations to qualified individuals with disabilities. Please tell us if you require a reasonable accommodation to apply for a job. Examples of reasonable accommodations include, but are not limited to, changing the application process, providing documents in an alternate format, using a sign language interpreter, or using specialized equipment. If you require a reasonable accommodation to apply for a job, please contact us via e-mail at
hr@cloudflare.com
or via mail at 101 Townsend St. San Francisco, CA 94107.
seniorLondon
seniorHyderabad, India; We believe in equality of opportunity and welcome candidates from all backgrounds regardless of age, gender, ethnicity, disability, sexual orientation, gender identity, socio-economic background, religion, or belief
Не хотите искать каждый день?
Настройте подбор один раз, и подходящие вакансии будут сами приходить в Telegram.
Настройте подбор, и подходящие вакансии будут приходить в Telegram.
Автоотклики