Вакансии

Location: San Francisco, CA | New York City, NY About Anthropic Anthropic’s mission is to create reliable, interpretable, and steerable AI systems. We want AI to be safe and beneficial for our users and for society as a whole. Our team is a quickly growing group of committed researchers, engineers, policy experts, and business leaders working together to build beneficial AI systems. About the team Anthropic's Security Governance, Risk, and Compliance (GRC) team is the connective tissue that holds the company accountable to its security commitments. We translate regulatory, customer, and voluntary obligations into controls that teams act on, and give leadership a bird's-eye view of how well we're meeting them. We're building toward a fundamentally different kind of GRC: one that directs Claude, with the right humans in the loop, to challenge and evidence the performance of controls continuously rather than through periodic audits. Within Security GRC, Compliance and Audit Programs (CAP) runs the integrated audit across our frameworks and maintains the Common Control Framework the program hangs off. This role sits in Compliance & Audit Programs and works one regime family, US public sector, from requirements through authorization and ongoing compliance, working alongside the public sector engineering pods rather than downstream of them. About the role You'll help drive the compliance programs that keep Anthropic's US government authorizations current: federal civilian (FedRAMP, including FedRAMP 20x for Claude Enterprise), Department of War (DoD impact levels, CMMC, NIST SP 800-171), and state and local (StateRAMP, TX-RAMP and agency requirements). You'll own the recurring cycles those authorizations run on (continuous monitoring, POA&M, annual assessments, significant changes), help build new authorizations as we add them, and keep every frontier model's authorizations current. You'll turn government requirements into specific, testable requirements that engineering teams build against, review the evidence that comes back, and say so when a launch is not ready for a government boundary. You'll map US government requirements onto our Common Control Framework so the public sector view and the integrated audit view of the same control stay one framework. Building with Claude is a normal part of the job: mapping, evidence collection and reporting, with you deciding where human judgment stays in the loop. This is an individual contributor role, working closely with a peer on US public sector compliance, for someone who works well independently, writes clearly, and gets satisfaction from a government authorization that holds up as the product changes underneath it. Key responsibilities Run the recurring compliance cycles for our US government authorizations (continuous monitoring, POA&M, annual assessments, SSP updates, significant changes and incident notifications), starting with C4G on Palantir FedStart and the NIST SP 800-171 assessment with Schellman Co-own FedRAMP 20x work for Claude Enterprise, and help build new authorizations (first-party FedRAMP High, DoW impact levels, StateRAMP and TX-RAMP) with requirements and evidence work Support model authorizations in GovCloud and Vertex for every model launch, as the GRC member of the Inference and model delivery pod Translate government obligations into partner team requirements, for example vulnerability SLAs in our internal vulnerability reporting platform, and review the evidence Answer public sector customer and deal questions (what a boundary allows, CUI, IRS Publication 1075, CJIS, ITAR), and handle questionnaires and RFIs until they move to Customer Trust Map US government requirements onto the Common Control Framework with the Controls Assurance Lead and keep one source of truth for status Build with Claude: automate mapping, evidence collection and reporting, and verify machine-drafted language before it becomes the record Minimum qualifications Several years in security compliance or IT audit with hands-on US government compliance for a cloud service (FedRAMP, DoD impact levels, CMMC or NIST SP 800-171, or StateRAMP), including the ongoing compliance cycle after authorization Working command of the NIST SP 800-53 Moderate baseline and the mechanics of authorization: boundary definition, control implementation statements, assessment, continuous monitoring, POA&M and significant change Experience writing requirements for engineering teams from a control baseline and reviewing the evidence that came back Working knowledge of how a GovCloud or Vertex style government region differs from commercial, and what changes when a model, feature or region is added to an authorized boundary Enough technical fluency to read a runbook, configuration or pipeline definition and judge whether it enforces the written control Clear writing, because implementation statements and status reports are what assessors, engineers and leadership work from Ability to get partner teams to prioritize and close compliance work without authority over them Preferred qualifications Have taken a service through FedRAMP High or DoD IL4 or IL5, or supported a service on classified networks Have worked on a FedRAMP 20x pilot or built machine-readable evidence or reporting for an assessor Have applied LLMs to compliance work such as control mapping, evidence testing or continuous evidence collection Hold or are eligible for a US security clearance Experience with state and local requirements such as StateRAMP, TX-RAMP, IRS Publication 1075 or CJIS You don't need to Have done everything on this list or worked every regime. The scarce combination is running a government authorization on its recurring cycle plus the judgment to tell whether a control actually works Write production code. The bar is fluency sufficient to read, query and challenge Hold every certification. CISSP, CISA, CGRC or similar are welcome and not required Have prior AI industry experience Deadline to apply: None. Applications will be received on a rolling basis. The annual compensation range for this role is listed below. For sales roles, the range provided is the role’s On Target Earnings ("OTE") range, meaning that the range includes both the sales commissions/sales bonuses target and annual base salary for the role. Annual Salary: $255,000 — $270,000 USD Logistics Minimum education: Bachelor’s degree or an equivalent combination of education, training, and/or experience Required field of study: A field relevant to the role as demonstrated through coursework, training, or professional experience Minimum years of experience: Years of experience required will correlate with the internal job level requirements for the position Location-based hybrid policy: Currently, we expect all staff to be in one of our offices at least 25% of the time. However, some roles may require more time in our offices. Visa sponsorship: We do sponsor visas! However, we aren't able to successfully sponsor visas for every role and every candidate. But if we make you an offer, we will make every reasonable effort to get you a visa, and we retain an immigration lawyer to help with this. For roles performing work in California: We will consider for employment all qualified applicants, including those with arrest or conviction records or criminal histories, in a manner consistent with the requirements of applicable state and local laws, including the San Francisco Fair Chance Ordinance, the City of Los Angeles’ Fair Chance Initiative for Hiring Ordinance, the Los Angeles County Fair Chance Ordinance for Employers, and the California Fair Chance Act. We encourage you to apply even if you do not believe you meet every single qualification. Not all strong candidates will meet every single qualification as listed.  Research shows that people who identify as being from underrepresented groups are more prone to experiencing imposter syndrome and doubting the strength of their candidacy, so we urge you not to exclude yourself prematurely and to submit an application if you're interested in this work. We think AI systems like the ones we're building have enormous social and ethical implications. We think this makes representation even more important, and we strive to include a range of diverse perspectives on our team. Your safety matters to us. To protect yourself from potential scams, remember that Anthropic recruiters only contact you from @anthropic.com email addresses. In some cases, we may partner with vetted recruiting agencies who will identify themselves as working on behalf of Anthropic. Be cautious of emails from other domains. Legitimate Anthropic recruiters will never ask for money, fees, or banking information before your first day. If you're ever unsure about a communication, don't click any links—visit anthropic.com/careers directly for confirmed position openings. How we're different We believe that the highest-impact AI research will be big science. At Anthropic we work as a single cohesive team on just a few large-scale research efforts. And we value impact — advancing our long-term goals of steerable, trustworthy AI — rather than work on smaller and more specific puzzles. We view AI research as an empirical science, which has as much in common with physics and biology as with traditional efforts in computer science. We're an extremely collaborative group, and we host frequent research discussions to ensure that we are pursuing the highest-impact work at any given time. As such, we greatly value communication skills. The easiest way to understand our research directions is to read our recent research. This research continues many of the directions our team worked on prior to Anthropic, including: GPT-3, Circuit-Based Interpretability, Multimodal Neurons, Scaling Laws, AI & Compute, Concrete Problems in AI Safety, and Learning from Human Preferences. Come work with us! Anthropic is a public benefit corporation headquartered in San Francisco. We offer competitive compensation and benefits, optional equity donation matching, generous vacation and parental leave, flexible working hours, and a lovely office space in which to collaborate with colleagues. Guidance on Candidates' AI Usage: Learn about our policy for using AI in our application process.

Location: San Francisco, CA | New York City, NY | Seattle, WA About Anthropic Anthropic’s mission is to create reliable, interpretable, and steerable AI systems. We want AI to be safe and beneficial for our users and for society as a whole. Our team is a quickly growing group of committed researchers, engineers, policy experts, and business leaders working together to build beneficial AI systems. About the team Anthropic's Security Governance, Risk, and Compliance (GRC) team is the connective tissue that holds the company accountable to its security commitments. We translate regulatory, customer, and voluntary obligations into controls that teams act on, and give leadership a bird's-eye view of how well we're meeting them. We're building toward a fundamentally different kind of GRC: one that directs Claude, with the right humans in the loop, to challenge and evidence the performance of controls continuously rather than through periodic audits. Within Security GRC, Compliance & Audit Programs runs the integrated audit across our frameworks and maintains the Common Control Framework, the single set of controls that the whole program is built on. This role sits in Audit & Assurance and owns the framework and the assurance view across every control domain. About the role As part of the Security Audit & Controls team,  you will own the CCF across every control domain, from access and change management to logging, encryption, and people controls: which controls we have, what each one says, how each maps to the frameworks and commitments we hold, and whether each one is actually working. You'll work with control owners and GRC Partners to draft and validate control descriptions and activities that describe reality rather than policy intent, build the monitoring that shows operating effectiveness continuously instead of once a year, and drive what monitoring finds to closure with control owners. Building with Claude is a normal part of the job: drafting and mapping controls, testing evidence, and monitoring control health, with you deciding where human judgment stays in the loop. This is an individual contributor role for someone who works well independently, writes clearly, and gets satisfaction from a control set that is accurate, tested, and trusted by auditors and engineers alike. Key responsibilities Own the Common Control Framework: the canonical control set, its mappings to SOC 2, ISO 27001/42001, HIPAA, FedRAMP, and customer commitments, and the change process for adding, retiring, or rewording controls Draft and validate control descriptions and control activities with control owners, so each control states who does what, how often, in which system, and what evidence proves it Design and run continuous monitoring of control efficacy: define the metrics and automated tests that show operating effectiveness, tune out false positives, surface failures to owners before an auditor does, and build the controls maturity model that shows where each control domain stands and what it takes to move up a level Verify remediation and carry it into steady state: GRC Partners lead remediation in their domains and control owners implement the fixes. This role advises on control design and implementation, confirms fixes against what the auditor actually asked for, and keeps one source of truth for control and finding status. Once a fix holds, it works with the partner to standardize the evidence pull and, where appropriate, automate it or build continuous Map new frameworks and commitments onto the CCF as we commit to them, and support gap assessments when a new framework, certification, product, or entity comes into scope, using the CCF as the baseline and writing the requirements for each delta Support the integrated audit and customer audits: readiness checks, walkthrough preparation, evidence request lists, and the readout of external findings back to GRC Evaluate evidence reliability, including the completeness and accuracy of system-generated reports and AI-generated evidence, and set the standard for what audit-ready evidence looks like here Build with Claude: automate control mapping, evidence testing, and monitoring, and verify machine-drafted control language before it becomes the record Minimum qualifications Several years in IT audit, security compliance, or controls assurance, including hands-on ownership of a control framework or control library across more than one framework (for example SOC 2, ISO 27001, FedRAMP, HIPAA) Working command of audit mechanics: scoping, walkthroughs, sampling, design versus operating effectiveness, deficiency evaluation, and evidence reliability Experience writing control descriptions, control activities, and test procedures that other teams and external auditors relied on Experience with continuous controls monitoring or automated evidence collection, whether you built it, ran it, or audited it Enough technical fluency to read a runbook, a configuration, or a pipeline definition and judge whether it enforces what the written control claims Clear writing, because your control language and status reports are what auditors, engineers, and leadership work from Ability to get control owners and partner teams to prioritize and close work without having authority over them Preferred qualifications Have designed or rebuilt a common controls framework and led the remapping of existing frameworks onto it Have stood up continuous controls monitoring or automated evidence programs and can speak to coverage, false-positive rates, and what changed as a result Have applied LLMs to assurance work, such as control drafting, framework mapping, evidence testing, or monitoring Have defined or assessed controls for AI systems or agents operating in production, or for home-built internal systems Have provided requirements for a homegrown GRC platform and worked with the engineers who build it You don't need to Have done everything on this list. The scarce combination this role exists for is framework ownership plus the judgment to tell whether a control actually works Write production code. The bar is fluency sufficient to read, query, and challenge Hold every certification. CISA, CISSP, or similar are welcome and not required Have prior AI-industry experience Logistics Education requirements: We require at least a Bachelor's degree in a related field or equivalent experience. Location-based hybrid policy: Currently, we expect all staff to be in one of our offices at least 25% of the time. However, some roles may require more time in our offices. Visa sponsorship: We do sponsor visas. However, we aren't able to successfully sponsor visas for every role and every candidate. But if we make you an offer, we will make every reasonable effort to get you a visa, and we retain an immigration lawyer to help with this. We encourage you to apply even if you do not believe you meet every single qualification. Not all strong candidates will meet every single qualification as listed. Research shows that people who identify as being from underrepresented groups are more prone to experiencing imposter syndrome and doubting the strength of their candidacy, so we urge you not to exclude yourself prematurely and to submit an application if you're interested in this work. We think AI systems like the ones we're building have enormous social and ethical implications. We think this makes representation even more important, and we strive to include a range of diverse perspectives on our team. Deadline to apply: None. Applications will be received on a rolling basis. The annual compensation range for this role is listed below. For sales roles, the range provided is the role’s On Target Earnings ("OTE") range, meaning that the range includes both the sales commissions/sales bonuses target and annual base salary for the role. Annual Salary: $270,000 — $345,000 USD Logistics Minimum education: Bachelor’s degree or an equivalent combination of education, training, and/or experience Required field of study: A field relevant to the role as demonstrated through coursework, training, or professional experience Minimum years of experience: Years of experience required will correlate with the internal job level requirements for the position Location-based hybrid policy: Currently, we expect all staff to be in one of our offices at least 25% of the time. However, some roles may require more time in our offices. Visa sponsorship: We do sponsor visas! However, we aren't able to successfully sponsor visas for every role and every candidate. But if we make you an offer, we will make every reasonable effort to get you a visa, and we retain an immigration lawyer to help with this. For roles performing work in California: We will consider for employment all qualified applicants, including those with arrest or conviction records or criminal histories, in a manner consistent with the requirements of applicable state and local laws, including the San Francisco Fair Chance Ordinance, the City of Los Angeles’ Fair Chance Initiative for Hiring Ordinance, the Los Angeles County Fair Chance Ordinance for Employers, and the California Fair Chance Act. We encourage you to apply even if you do not believe you meet every single qualification. Not all strong candidates will meet every single qualification as listed.  Research shows that people who identify as being from underrepresented groups are more prone to experiencing imposter syndrome and doubting the strength of their candidacy, so we urge you not to exclude yourself prematurely and to submit an application if you're interested in this work. We think AI systems like the ones we're building have enormous social and ethical implications. We think this makes representation even more important, and we strive to include a range of diverse perspectives on our team. Your safety matters to us. To protect yourself from potential scams, remember that Anthropic recruiters only contact you from @anthropic.com email addresses. In some cases, we may partner with vetted recruiting agencies who will identify themselves as working on behalf of Anthropic. Be cautious of emails from other domains. Legitimate Anthropic recruiters will never ask for money, fees, or banking information before your first day. If you're ever unsure about a communication, don't click any links—visit anthropic.com/careers directly for confirmed position openings. How we're different We believe that the highest-impact AI research will be big science. At Anthropic we work as a single cohesive team on just a few large-scale research efforts. And we value impact — advancing our long-term goals of steerable, trustworthy AI — rather than work on smaller and more specific puzzles. We view AI research as an empirical science, which has as much in common with physics and biology as with traditional efforts in computer science. We're an extremely collaborative group, and we host frequent research discussions to ensure that we are pursuing the highest-impact work at any given time. As such, we greatly value communication skills. The easiest way to understand our research directions is to read our recent research. This research continues many of the directions our team worked on prior to Anthropic, including: GPT-3, Circuit-Based Interpretability, Multimodal Neurons, Scaling Laws, AI & Compute, Concrete Problems in AI Safety, and Learning from Human Preferences. Come work with us! Anthropic is a public benefit corporation headquartered in San Francisco. We offer competitive compensation and benefits, optional equity donation matching, generous vacation and parental leave, flexible working hours, and a lovely office space in which to collaborate with colleagues. Guidance on Candidates' AI Usage: Learn about our policy for using AI in our application process.

Location: London, United Kingdom - Deliveroo Our Global Structure Deliveroo is now part of DoorDash, bringing together teams with even greater reach, scale, and ambition. Depending on your role, you may collaborate with teammates, systems, and leaders across DoorDash and Wolt. Together, we’re unlocking new possibilities as one global team. About the Team At Deliveroo we’re striving to build London’s best and most admired Security Engineering organisation as part of our global team based across North America and Europe. Our London based Security Engineering team is looking for a Senior GRC Engineer. You will be a part of our inclusive, collaborative global team responsible. This is a London based position reporting directly to the Security Compliance Manager based in London. About the Role We're hiring a Senior GRC Engineer to help take DoorDash's compliance program from something people run to something the platform runs on its own. You'll take primary ownership of how regulatory and framework change gets tracked, interpreted, and turned into real controls - one part of a broader GRC function that spans audit, policy, and risk. Day to day, that means less time updating spreadsheets and more time writing the automation, integrations, and control logic that let audit evidence collect itself. You'll also lead major external audits from start to finish and help shape the policies and control standards the rest of the program is built on. This is a hands-on role for someone who already has deep audit and assurance experience, wants to spend more time building than briefing and can move a program forward, and change how people work, without needing the title to make it happen. You’re excited about this opportunity because you will… Build the regulatory and framework change-management process that keeps DoorDash ahead of new obligations, instead of reacting to them. Move manual, point-in-time compliance work onto Compliance-as-Code foundations: policy-as-code, automated control testing, and continuous evidence collection wired into CI/CD, so audit readiness holds up between audits, not just during them. Design and run agentic workflows for evidence analysis, control testing, and audit response preparation, with a human in the loop where assurance demands it. Partner directly with engineering and architecture teams to design controls into new systems at build time and translate that technical work into the narratives auditors actually need. Partner with the Security Compliance Manager to shape and mature the global compliance program. Design, implement and validate security controls relevant to DoorDash’s regulatory environment, not just document them. Support development and refinement of security policies, standards, and guidance. Mentor other members of the compliance team and help set the technical bar the rest of the function grows into. Ensure policies are actionable, testable, and aligned to real-world controls. We’re excited about you because you have… 6+ years of experience in security compliance, GRC or technology risk, with a strong track record in high-growth, technology-driven and regulated environments. Hands-on experience building large language models and agent workflows with daily use of AI in your own work, grounded judgment on what to delegate to agents versus what needs a human, and the ability to evidence both to an auditor. DoorDash is an AI-forward organization and the ability to optimize efficiency using AI is crucial in this role. The ideal candidate brings hands-on experience with frameworks such as DORA, the EU AI Act, NIS2 and CRA. Real, hands-on experience implementing and assessing controls against frameworks like PCI DSS, SOC 2, ISO 27001 - not just reading them. Demonstrated ability to identify control gaps, assess risk and drive remediation in partnership with cross-functional stakeholders. Experience developing, implementing and improving security policies, standards, and procedures, ensuring they are operational and effective. Strong understanding of compliance metrics and reporting, with the ability to track control effectiveness, audit outcomes, and risk exposure. Ability to influence and drive accountability across technical and non-technical stakeholders. Excellent verbal and written communication skills, with the ability to translate complex audit and compliance requirements into clear, actionable guidance. Comfort owning compliance metrics and reporting - you can show, not just assert, that a program is working. Bachelor’s degree in Information Security, Computer Science, or related field, or equivalent practical experience. About DoorDash DoorDash is a technology company that connects customers with their favorite local and national businesses in over 4,000 cities and all 50 states across the United States and Canada. Founded in 2013, DoorDash empowers merchants to grow their businesses by offering on-demand delivery, data-driven insights, and better in-store efficiency, providing delightful experiences from door to door. By building the last-mile delivery infrastructure for local cities, DoorDash is bringing communities closer, one doorstep at a time. Read more on the DoorDash blog or at www.doordash.com . Our Commitment to Diversity and Inclusion We’re committed to growing and empowering a more inclusive community within our company, industry, and cities. That’s why we hire and cultivate diverse teams of the best and brightest from all backgrounds, experiences, and perspectives. We believe that true innovation happens when everyone has room at the table and the tools, resources, and opportunity to excel. Diversity, Equity and Inclusion At Deliveroo, we know that a great workplace reflects the world around us and that true diversity and inclusion make us stronger, more creative, and better at what we do. We’re committed to fostering an environment where everyone can do their best work and feel they belong. We believe in equality of opportunity and welcome candidates from all backgrounds regardless of age, gender, ethnicity, disability, sexual orientation, gender identity, socio-economic background, religion, or belief. If you have a disability or long-term health condition and need support to apply for one of our roles, or require any reasonable adjustments during the recruitment process, you’ll have the opportunity to let us know once you’ve submitted your application. We’ll share details on how to request support so we can ensure you have a fair and equitable experience. If you’re excited about making a real impact in a fast-moving marketplace and growing your career alongside ambitious, supportive teams, we’d love to hear from you! Beware of recruitment scams: DASH Brands will never ask you to pay money or share sensitive financial information during hiring — learn more about DASH Brands' legitimate recruiting process at careersatdoordash.com/recruitment-scam-awareness .

Location: Serbia; Poland; Kazakhstan; Georgia; European Union Workplace: Remote 🌍 Remote Salmon is a technology-driven financial company building a banking and lending platform across Southeast Asia, starting in the Philippines. We combine global fintech expertise with deep local market knowledge to make financial services simple, accessible, and useful for millions of people across the region. 7M+ app downloads. 2M+ monthly active users. 7,000+ partner stores. US$310M+ raised from leading global investors. Manila-based, globally distributed, and hybrid-first — our team spans 45+ countries. If you want to solve complex problems at scale and impact how millions of people access and manage money, come build with us. Southeast Asia’s fintech moment starts here. About the role: You’ll build one ISMS framework for the whole Salmon Group, so every new regulation, licence, entity or market extends it instead of starting a new compliance project. What you’ll do: - Run the core GRC processes yourself while leading a GRC Engineer and growing the function. You report to the Group CISO. - Work with the Bank CISO, the Bank IS governance team, SOC, AppSec, IT, Risk, Compliance and Legal to apply one set of controls across every Group entity. BSP rules are one input to the framework, not its boundary. - Keep ISO/IEC 27001:2022 certification and PCI DSS v4.0.1 compliance as outputs of the common framework, and act as the main contact for the certification body and the QSA. What you’ll own: - Own the common controls framework: a single control catalogue with named owners, mapped to ISO/IEC 27001, PCI DSS, BSP regulations and the Data Privacy Act. It includes entity and jurisdiction overlays and standard risk and control matrices (RCMs). - Track changes in regulations and standards, and map each new obligation to an existing control or to a gap with an owner and a date. - Define how a new entity, licence, product or market joins the framework, and review new initiatives early for security and compliance impact. - Run information security risk management: methodology, risk register, annual assessment, treatment plans and risk acceptance. Own the policy lifecycle, an exception process with expiry dates, and the third-party security risk methodology. - Define how controls are tested and what counts as evidence. Automate control checks towards continuous monitoring, and select and implement a GRC platform. - Lead internal audits, external audits and regulatory examinations, and track findings to closure. Own responses to partner and client security due diligence. - Run the security and risk committees, report on risks and compliance status to the Group CISO and management, and brief and train managers and risk owners. Formalise the security services the Group provides to each entity. What makes you a strong fit: - 6+ years in information security GRC, including 2+ years leading a GRC function or programme - A track record of building or scaling a GRC programme, ideally around a common controls framework and RCMs mapped to several standards - Hands-on experience taking an ISO/IEC 27001 ISMS through certification and surveillance audits - Practical PCI DSS experience, ideally v4.0.1 in a payments or service provider environment - Experience in regulated financial services (banking, payments or lending), including designing control testing and working with auditors and regulators on findings - Working knowledge of ISO/IEC 27005 or NIST SP 800-30, clear writing for senior management, and daily use of AI tools to build your own automations with AI-assisted coding What we offer: Ownership and flexibility - Fully remote work - Company-provided tools and equipment Health and time off - Medical insurance support for you and your family through co-funding or reimbursement, depending on your location and subject to policy limits - Access to an internal mental health support specialist - 22 vacation days, Philippine public holidays, and 15 sick days Growth and team experience - Opportunities to learn and share your expertise through internal expert meetups, external conferences, speaking opportunities, and industry publications - Company-sponsored trips to Manila to meet and work with your team in person - High-performing teams can earn a dedicated beach house week in Southeast Asia We believe strong teams are built by people with different backgrounds, experiences, and points of view. Salmon is an equal opportunity employer, and we make hiring decisions based on skills, experience, and potential.

Location: San Francisco, CA | Seattle, WA | New York City, NY | Washington, DC About Anthropic Anthropic’s mission is to create reliable, interpretable, and steerable AI systems. We want AI to be safe and beneficial for our users and for society as a whole. Our team is a quickly growing group of committed researchers, engineers, policy experts, and business leaders working together to build beneficial AI systems. About the role Anthropic's Supplier Security & Assurance (SSA) team sits within Security GRC and is responsible for assessing the security of our suppliers: evaluating whether vendors meet our security requirements, capturing the deviations, and giving the business a clear approval decision it can act on. We assess the vendor population a frontier AI lab actually depends on: SaaS and software, human data operations, compute and data center providers, hardware suppliers, and services firms. The program is designed agent-first so that people spend their time on judgment, remediation, and the vendors that matter most. As a member of the Supplier Security & Assurance team you will run supplier security assessments end to end: reviewing evidence, verifying agent-drafted evaluations, determining inherent and residual risk, and driving findings to closure with vendors and business owners. You will also carry the work that extends assurance past the approval, from contractual security terms and secure configuration baselines to continuous monitoring and reassessment, and you will help shape the tooling and requirements the program runs on. Key responsibilities Run supplier security assessments: review agent-prefilled outputs, evaluate vendor controls and evidence, determine residual risk, route to domain reviewers where deeper assessment is warranted Operate supplier issue management and risk treatment: document each finding with a severity, an owner, and a due date, drive remediation with the vendor and the business owner, record risk acceptances, and roll open issues up to the risk register Run continuous monitoring after approval: reopen an assessment on defined triggers (data classification change, new SOC 2 report, new subprocessor, vendor incident), investigate SaaS configuration, data, and use case drift signals, and queue a reassessment where the vendor's scope has moved Improve the program as you run it: identify gaps in coverage, questionnaires, requirements, and tooling that surface during assessments, propose the fix, and carry roadmap items that mature supplier security overall Tune and maintain our Claude-powered assessment platform alongside the team: prompt development, questionnaire and assessment type design, calibration against assessor decisions, and output QA Contribute to KPI and KRI reporting on coverage, cycle time, residual risk, open issues, and reassessments due Minimum qualifications Experience running supplier security assessments end to end at a technology company: scoping the engagement, determining inherent risk, reviewing controls and evidence, documenting residual risk, and driving findings to closure Working knowledge of risk fundamentals (inherent and residual risk, control effectiveness, compensating controls, risk acceptance) and the judgment to apply them when the evidence is incomplete or the answer isn't in a framework Ability to assess a vendor across security domains, and to recognize which findings you can close yourself and which need a security domain specialist Track record of driving risk treatment to closure through influence across teams with competing priorities Experience building or tuning an LLM-backed workflow, agent, or automation in a risk, compliance, or operations context, including tuning prompts and reviewing model output for accuracy Experience building or operating issue management workflows: logging issues with a clear owner and due date, tracking remediation, and escalating when treatment stalls Working technical knowledge of SaaS security configuration (SSO and SCIM, admin scoping, sharing defaults, audit log export) and of standard vendor security contract terms (DPA, incident notification, subprocessors, audit and testing rights) Ability to read a SOC 2 report or penetration test and turn it into findings: identify control exceptions and carve-outs, map complementary user entity controls, and judge what the evidence does and does not prove Preferred qualifications Experience assessing cloud infrastructure, data center, or data-pipeline vendors Experience supporting SOX, SOC 2, or ISO 27001 third party or vendor management controls Experience assessing additional, more specialized vendor cohorts from a security risk perspective: human data operations or data labeling vendors, hardware suppliers, compute providers and neoclouds, and others Experience with post-approval supplier continuous monitoring: configuration, data, and use case drift detection, shadow IT & SaaS detection, vendor incident management, or evidence-based vendor audits/site visits The annual compensation range for this role is listed below. For sales roles, the range provided is the role’s On Target Earnings ("OTE") range, meaning that the range includes both the sales commissions/sales bonuses target and annual base salary for the role. Annual Salary: $255,000 — $270,000 USD Logistics Minimum education: Bachelor’s degree or an equivalent combination of education, training, and/or experience Required field of study: A field relevant to the role as demonstrated through coursework, training, or professional experience Minimum years of experience: Years of experience required will correlate with the internal job level requirements for the position Location-based hybrid policy: Currently, we expect all staff to be in one of our offices at least 25% of the time. However, some roles may require more time in our offices. Visa sponsorship: We do sponsor visas! However, we aren't able to successfully sponsor visas for every role and every candidate. But if we make you an offer, we will make every reasonable effort to get you a visa, and we retain an immigration lawyer to help with this. For roles performing work in California: We will consider for employment all qualified applicants, including those with arrest or conviction records or criminal histories, in a manner consistent with the requirements of applicable state and local laws, including the San Francisco Fair Chance Ordinance, the City of Los Angeles’ Fair Chance Initiative for Hiring Ordinance, the Los Angeles County Fair Chance Ordinance for Employers, and the California Fair Chance Act. We encourage you to apply even if you do not believe you meet every single qualification. Not all strong candidates will meet every single qualification as listed.  Research shows that people who identify as being from underrepresented groups are more prone to experiencing imposter syndrome and doubting the strength of their candidacy, so we urge you not to exclude yourself prematurely and to submit an application if you're interested in this work. We think AI systems like the ones we're building have enormous social and ethical implications. We think this makes representation even more important, and we strive to include a range of diverse perspectives on our team. Your safety matters to us. To protect yourself from potential scams, remember that Anthropic recruiters only contact you from @anthropic.com email addresses. In some cases, we may partner with vetted recruiting agencies who will identify themselves as working on behalf of Anthropic. Be cautious of emails from other domains. Legitimate Anthropic recruiters will never ask for money, fees, or banking information before your first day. If you're ever unsure about a communication, don't click any links—visit anthropic.com/careers directly for confirmed position openings. How we're different We believe that the highest-impact AI research will be big science. At Anthropic we work as a single cohesive team on just a few large-scale research efforts. And we value impact — advancing our long-term goals of steerable, trustworthy AI — rather than work on smaller and more specific puzzles. We view AI research as an empirical science, which has as much in common with physics and biology as with traditional efforts in computer science. We're an extremely collaborative group, and we host frequent research discussions to ensure that we are pursuing the highest-impact work at any given time. As such, we greatly value communication skills. The easiest way to understand our research directions is to read our recent research. This research continues many of the directions our team worked on prior to Anthropic, including: GPT-3, Circuit-Based Interpretability, Multimodal Neurons, Scaling Laws, AI & Compute, Concrete Problems in AI Safety, and Learning from Human Preferences. Come work with us! Anthropic is a public benefit corporation headquartered in San Francisco. We offer competitive compensation and benefits, optional equity donation matching, generous vacation and parental leave, flexible working hours, and a lovely office space in which to collaborate with colleagues. Guidance on Candidates' AI Usage: Learn about our policy for using AI in our application process.

We are seeking an elite, hands-on Senior Security Compliance Consultant (SOC 2 & GRC Specialist) to lead a critical, company-wide SOC 2 Type II audit readiness initiative. In this strategic engagement, you will perform comprehensive gap analyses, assess existing security controls, design robust compliance workflows, and drive cross-functional teams toward audit completion. The ideal candidate brings a proven track record in GRC frameworks, control mapping, evidence automation, and policy development. Utilizing automated compliance platforms such as Sprinto, you will build repeatable compliance processes, validate technical controls, and ensure a seamless audit experience across the entire organization. General Information (About the Client): Our client is a fast-scaling, cloud-native technology platform committed to maintaining enterprise-grade trust, security, and data privacy. To support their rapid commercial growth and enterprise sales pipeline, they are establishing a formal, highly disciplined security governance model. They operate a modern, cloud-first environment where compliance is treated not as a passive checklist, but as an active, automated operational advantage. By leveraging modern GRC platforms and fostering a security-conscious culture, they provide an empowering environment for compliance experts to drive real architectural and procedural improvements. Tasks and Deliverables: SOC 2 Readiness & Gap Analysis: Conduct a thorough assessment of existing technical and operational security controls, pinpointing compliance gaps and building an actionable remediation roadmap. Control Design & Implementation: Author, refine, and operationalize security controls, policies, and procedures aligned with SOC 2 Trust Services Criteria (TSC) and PCI DSS standards. Automated Evidence Collection: Lead evidence-gathering workflows using automated GRC tooling (Sprinto), ensuring all technical artifacts, access logs, and policy attestations are validated and audit-ready. PCI DSS Guidance: Provide expert advisory on maintaining PCI DSS alignment alongside SOC 2, ensuring overlapping control requirements are mapped efficiently to reduce operational drag. Cross-Functional Coordination: Collaborate with engineering, DevOps, HR, and IT teams to embed compliance workflows into daily operations without slowing down feature execution. Auditor Interface & Readiness: Serve as the primary liaison during the audit preparation phase, coordinating directly with external auditors to present evidence, resolve findings, and ensure a successful audit cycle. Required Experience: SOC 2 Mastery: Proven track record of leading end-to-end SOC 2 readiness, gap remediation, and audit preparation initiatives for cloud-native or B2B SaaS companies. GRC & PCI DSS Acumen: Deep familiarity with Governance, Risk, and Compliance (GRC) frameworks, risk assessment methodologies, and PCI DSS compliance requirements. Tooling Proficiency (Sprinto): Direct, practical experience leveraging automated compliance and evidence-collection platforms, specifically Sprinto (or equivalent modern platforms like Vanta/Drata). Policy & Control Mapping: Exceptional capability to author clear, enforceable security policies and translate abstract regulatory requirements into concrete engineering controls. Cross-Functional Facilitation: Strong stakeholder management skills with a history of driving accountability across distributed engineering, product, and operations teams.

Location: Boston, MA Workplace: OnSite At WHOOP, we're on a mission to unlock and inspire performance for life. WHOOP empowers members to perform at a higher level through a deeper understanding of their bodies and daily lives. As a Senior Manager GRC you will play a critical role in shaping, driving, and leading our GRC team towards supporting ongoing operation and enhancement of the overall information security governance program, assessing the risk landscape in a fast-paced, high-growth environment. This role will strategically craft the roadmap in collaboration with stakeholders across the business and fulfill growing security needs assessing risk landscape across WHOOP. In addition to core GRC responsibilities, you will partner closely with functions across Product, Engineering, Data Analytics, and Legal to meaningfully move the security posture of the company. We are seeking a leader and strategic partner with prior experience driving GRC programs for technology teams. RESPONSIBILITIES - Lead the development, implementation, and continuous evolution of the GRC program, driving both strategy and hands-on execution. - Lead the development, implementation, and ongoing management of scalable security control frameworks, policies, standards, and security awareness programs, contributing directly while guiding the team’s work to strengthen organizational compliance. - Support incident response activities and translated into actionable improvements across the risk and compliance program. - Actively manage the enterprise risk register, driving risk prioritization, and delivering executive-level reporting. - Manage, mentor, and develop GRC analysts while balancing hands-on execution with effective delegation and team enablement as the program scales. - Evaluate, implement, and continuously improve GRC program, tools, processes, and metrics. QUALIFICATIONS - 10+ years of experience in GRC, or information security / cybersecurity, with 5+ years in managing GRC, information security, or cybersecurity professionals. - Demonstrated success scaling GRC programs whilst crafting clear and efficient team objectives and programs. - Deep understanding of regulations and standards including, but not limited to ISO 27001, SOC 2, GDPR, PCI, NIST CSF, and privacy/security obligations - Experience building or integrating GRC programs in enterprise security to improve overall security posture of the organization - Excellent communication, interpersonal, and leadership skills with the ability to influence across teams and levels - A minimum bachelor’s degree in any discipline. Computer science, cyber security and risk or technology degrees preferred. BONUS QUALIFICATIONS - Certifications such as CISA, CISSP, CIPP/E, CRISC, or ISO Lead Auditor. - Background in leading Enterprise Risk, Cybersecurity Risk, Information Security programs. - Background in establishing DevSecOps, AI Governance, and SSDLC guardrails. ABOUT YOU - You are a strategic and people-focused leader who thrives on balancing hands-on oversight with long-term organizational growth. - You are a risk aware leader with ability to translate security risks in business terms to influence both technical and non-technical teams. - You are passionate about building bridges across different departments and can operate confidently in both strategic and security control tactical domains. - You believe that security enables innovation, and you lead with integrity fostering a culture that embodies a risk mind-set. This role is based in the WHOOP office located in Boston, MA. The successful candidate must be prepared to relocate if necessary to work out of the Boston, MA office. Interested in the role, but don’t meet every qualification? We encourage you to still apply! At WHOOP, we believe there is much more to a candidate than what is written on paper, and we value character as much as experience. As we continue to build a diverse and inclusive environment, we encourage anyone who is interested in this role to apply. WHOOP is an Equal Opportunity Employer and participates in E-verify https://www.e-verify.gov/to determine employment eligibility The WHOOP compensation philosophy is designed to attract, motivate, and retain exceptional talent by offering competitive base salaries, meaningful equity, and consistent pay practices that reflect our mission and core values. At WHOOP, we view total compensation as the combination of base salary, equity, and benefits, with equity serving as a key differentiator that aligns our employees with the long-term success of the company and allows every member of our corporate team to own part of WHOOP and share in the company’s long-term growth and success. The U.S. base salary range for these full-time positions is $185,000-$205,000. Salary ranges are determined by role, level, and location. Within each range, individual pay is based on factors such as job-related skills, experience, performance, and relevant education or training.  In addition to the base salary, the successful candidate will also receive benefits and a generous equity package. These ranges may be modified in the future to reflect evolving market conditions and organizational needs. While most offers will typically fall toward the starting point of the range, total compensation will depend on the candidate’s specific qualifications, expertise, and alignment with the role’s requirements.

Location: San Francisco Bay Area, USA Workplace: Hybrid Why work at Higgsfield AI? Higgsfield AI is the fastest-scaling generative AI company in history, hitting $1B in annual revenue run rate, 30M+ users worldwide, 6M+ generations per day, and powering 390 of Fortune 500 brands. We're building at the absolute frontier of AI-powered video creation and next-generation creative tools. Joining Higgsfield means becoming part of a high-impact team shaping the future of AI-native experiences, at a company that isn't just moving fast, but rewriting what fast looks like. About the role: Higgsfield AI is looking for a hands-on Member of Technical Staff, GRC Engineering to build and scale the technical infrastructure supporting our security, risk, and compliance programs. As we scale globally, you'll translate compliance requirements into automated technical controls, continuous monitoring systems, and preventative security measures that evolve alongside our business. Working closely with Security, Engineering, IT, and cross-functional teams, you'll design and implement controls that proactively prevent compliance gaps rather than simply identifying them during audits. This is a technical engineering role focused on building scalable GRC infrastructure, not traditional policy management or audit coordination. We're looking for someone who combines strong knowledge of compliance frameworks with technical problem-solving skills, sound judgment, and the ability to build systems that support a rapidly growing organization. WHAT YOU'LL DO COMPLIANCE ENGINEERING & CONTROL AUTOMATION - Translate regulatory and compliance requirements into actionable technical controls across corporate and product infrastructure. - Design and implement automated controls for access management, system configurations, security monitoring, and compliance validation. - Build preventative controls and release gates that identify and block noncompliant changes before deployment. - Evaluate which controls should be automated and where human review remains necessary. GRC INFRASTRUCTURE & CONTINUOUS MONITORING - Build and maintain scalable GRC infrastructure that supports continuous compliance monitoring and evidence collection. - Develop automated workflows to validate control effectiveness and identify compliance gaps in real time. - Design controls that remain effective as employees, systems, vendors, locations, and products evolve. - Integrate compliance checks into existing engineering workflows, infrastructure, and security tooling. RISK MANAGEMENT & SECURITY CONTROLS - Translate frameworks such as SOC 2, ISO 27001, and other applicable standards into practical engineering requirements. - Partner with Security and Engineering to identify control gaps, prioritize risks, and implement sustainable remediation. - Establish technical standards and preventative guardrails that reduce reliance on manual compliance processes. - Evaluate emerging security and compliance requirements and incorporate them into scalable control designs. TECHNICAL OWNERSHIP & COLLABORATION - Own GRC engineering initiatives from control design through implementation, validation, and ongoing operations. - Build automation through scripts, APIs, integrations, and engineering workflows. - Partner with technical teams to embed compliance requirements into system architecture and development processes. - Help define the long-term GRC infrastructure roadmap to support the company's growth over the next several years. Requirements: - 6+ years spanning security, GRC, software engineering, automation engineering, or related technical roles. - Demonstrated experience translating framework, regulatory, or policy requirements into technical implementations. - Hands-on experience personally building or automating security and compliance controls. - Production-grade scripting or programming experience, such as Python, including working with APIs and integrations. - Strong understanding of frameworks such as SOC 2 and ISO 27001 and what constitutes credible control evidence. - Ability to distinguish between a control that technically exists and one that is actually effective, enforced, and continuously monitored. - Experience building in rapidly changing or 0→1 environments without relying on mature infrastructure or large teams. - Strong judgment around automation, risk, exceptions, enforcement, and engineering velocity. - Ability to communicate technical controls and evidence clearly to auditors, customer security teams, engineers, and nontechnical stakeholders. Compensation & Benefits - We offer a competitive and thoughtfully structured compensation package designed to align with impact, experience, and long-term growth. - Base Salary: The anticipated salary range for this role is $200,000 - $300,000, depending on experience, skills, scope, and location. - Bonus: This role is Bonus eligible and may participate in the Company's discretionary annual bonus program. - Equity: In addition to cash compensation, employees are eligible to participate in the company’s stock option program and share in Higgsfield’s long-term growth. - Benefits: We offer a comprehensive benefits package designed to support employees professionally and personally, including medical, dental, and vision insurance, a competitive 401(k) retirement plan with company matching, and additional benefits and perks. - The opportunity to work on ambitious AI products alongside a highly experienced, fast-moving, and international team. - Significant ownership, direct impact, and opportunities for professional growth as the company scales. This is a hybrid role based in the San Francisco Bay Area. Team members are expected to work from our San Francisco office three full days per week, with the remaining days worked remotely and are expected to be available during agreed working hours and to maintain sufficient overlap with the relevant team’s time zone. We value in-person collaboration, active communication, responsiveness, and close partnership across teams. Higgsfield AI is an equal opportunity employer. We are committed to building a diverse and inclusive team and do not discriminate on the basis of race, color, religion, sex, gender identity or expression, sexual orientation, national origin, age, disability, veteran status, or any other protected characteristic.

Location: Espoo Workplace: Hybrid ROLE HIGHLIGHTS: - Senior GRC Engineer (Security) - Location: Espoo, Finland - Department: Product Security - Reports to: VP Product Security - Employment type: Permanent - Workplace model: Hybrid - Employment is subject to applicable security screening (incl. SUPO, where required) WHY THIS ROLE MATTERS:   As Senior GRC Engineer (Security), you'll mature ICEYE's Security Governance, Risk and Compliance program across a multi-country, multi-regulator footprint, including Finland, Germany, Spain, Poland, the UK and Greece amongst others. ICEYE operates at the intersection of commercial space technology and sovereign defence, so our compliance posture (ISO 27001, NIS2, NIST, and national frameworks) has to be credible to customers who include governments and defence agencies. You'll be the person who keeps that posture accurate, current and audit-ready, maps client and national requirements to internal ICEYE requirements, as a senior individual contributor. This role will be working closely with all the ICEYE Security team domains, ICEYE IT, ICEYE product management and the Program Management Office, Engineering and Sales.   WHO WE ARE ICEYE is the world leader in sovereign intelligence from space. We deliver persistent monitoring capabilities to detect and respond to changes in any location on Earth.   ICEYE owns the world's largest and most advanced SAR (synthetic aperture radar) satellite constellation. To our customers we provide intelligence with unmatched quality, latency and revisit times, in any weather, day or night. To governments who choose to operate their own constellation we provide this proven capability as a sovereign system.   ICEYE-built constellations serve customers in defence and intelligence, environmental monitoring, insurance and emergency management. We enable fast decisions that contribute to a safer future.   Founded and headquartered in Finland, ICEYE operates globally with over 1000 employees across Europe, North America, the Middle East, and Asia-Pacific. YOUR DAY-TO-DAY RESPONSIBILITIES The position will evolve according to the needs of the company and the growing team. Initially, the position has two main aspects, which are adjacent and many initiatives will cross both, especially in terms of overlapping requirements and compliance evidence: - Product requirements and compliance: - Ensure clients’ and their national security requirements are at all times clearly translated accurately to ICEYE internal requirements across product, IT, and other ICEYE functions, and we can clearly communicate those towards existing and new clients. - Ensure ICEYE has evidence of fulfilling and complying with the requirements, preferably as compliance-as-code whenever possible. - Support ICEYE’s Product, the Missions business line, PMO and Sales on client requirements. Produce material to support accreditation and acceptance requirements. - Wider Iceye and regulatory compliance: - Continuously improve ICEYE's ISO 27001 ISMS, including risk assessments, the risk register, Statement of Applicability, internal audits and certification/surveillance audit cycles. - Track and operationalise NIS2, CRA and other EU product security obligations across ICEYE's in-scope entities, translating regulatory requirements into concrete policies, controls and evidence. - Prepare clear, concise compliance and risk reporting for senior leadership, including status against certifications, audits and remediation plans. - Maintain information security policies, standards and supporting documentation, ensuring they stay practical and enforceable rather than shelfware. - Act as a day-to-day point of contact for external auditors, certification bodies and regulators on GRC matters.   WHAT WE’RE LOOKING FOR Must haves: - Eligible for being cleared for a Personal Security Clearance as necessary as well as a citizenship or a permanent residency in the European Union. - Technical skills that allow you to interpret compliance requirements towards the product function; this includes being able to fluently discuss modern software architecture and development, deployment and release concepts. - Proven hands-on experience running ISO 27001 (implementation, internal audit, or certification maintenance) in a real organisation, not just theoretical knowledge or external auditing experience. - Working knowledge of NIS2, CRA, and how their obligations translate into practical controls and reporting. - Strong stakeholder management skills, with the ability to influence product management, engineering, IT, legal and leadership without formal authority. - Experience building or maintaining a risk register and running quantified risk assessments. - Comfortable operating independently across multiple countries and regulatory regimes. - Awareness of emerging AI governance frameworks (ISO 42001, NIST AI Risk Management Framework, EU AI Act) as well as NIST frameworks   Nice to haves: - Relevant certifications such as CISSP, CISM, CISA, CRISC, ISO 27001 Lead Implementer or Lead Auditor. - Experience in defence, space, aerospace or another regulated/sovereign-sensitive industry. - Exposure to classified information handling frameworks (EUCI, NATO equivalents, or national security clearance regimes). - A well-rounded skillset of using language models for automation.   APPLICATION PROCESS - Initial screening call with Talent Acquisition - Technical/competency interview with the VP Product Security - Scenario-based exercise on requirements discovery, mapping and prioritisation - Final interview with senior stakeholders including a behavioural interview WORKING AT ICEYE At ICEYE, you’ll join a diverse and highly engaged team united by the ambition to make the impossible possible. As a global scale-up, we combine speed and ambition with the opportunity to take real ownership from day one. Your growth, wellbeing, and success are a priority, with continuous professional development, training opportunities, and a culture where collaboration is how we win. HOW WE WORK (OUR VALUES) Make the impossible possible: We set ambitious goals and stay calm under pressure. We bring grit, optimism, and ownership when things get hard, and we keep moving until we find a way. - Be curious: Go deep, ask questions, listen carefully, and think critically. Understand the “why” behind decisions. - See the big picture: Stay close to what’s happening across the company so you can make better decisions. Consider how your work affects others. - Drive effective teamwork: Create psychological safety, invite different perspectives, and build inclusive teams. There are no bad questions. - Act as one team: We win together. We match tasks to the right owner and stay agile as priorities shift. - Have fun: What we do matters—and it should be enjoyable. Celebrate progress, take pride in results, and share the wins. BENEFITS Our benefits are designed to support your health and wellbeing, at work and beyond. We keep improving them based on employee feedback, and offerings vary by location. Talent Acquisition will confirm what applies for this role and location during the process.   OUR COMMITMENT TO DIVERSITY, EQUITY, AND INCLUSION We want ICEYE to be a place where people can be themselves and do great work. Different backgrounds and perspectives make us stronger, which is why we work to create an environment where people feel included, respected, and able to speak up. Whatever your background, we want you to bring your authentic self to the table. We’re committed to fair, inclusive hiring and equal opportunity. Everyone is welcome to apply. If you need any adjustments or support during the recruitment process, tell us—we’ll do our best to help. Apply now to start your ICEYE journey, and help us continue to make the impossible possible together. Read more about ICEYE and working with us at iceye.com http://iceye.com.

Location: Kuala Lumpur, Malaysia About Us Established in 2018, Bybit is one of the world’s leading cryptocurrency exchanges and digital financial platforms, serving over 80 million users across more than 200 countries and regions. Powered by world-class technology and a user-first mindset, Bybit delivers a seamless ecosystem across trading, payments, wealth management, custody, institutional services, and Web3 — connecting users to the future of digital finance. Our core values define how we build. We listen, care and improve to create products and experiences that put users first. Backed by a global team of ambitious builders, problem-solvers, and innovators, we foster a high-performance and fast-moving environment where talent is empowered to drive real impact at the global scale. Supported by 24/7 multilingual customer service and a strong commitment to innovation, we are shaping the future of finance through technology, collaboration, and bold execution. Today, Bybit is recognized as one of the most trusted and transparent platforms in the digital asset industry, continuing to expand its global presence while building the infrastructure for the next generation of financial services. Job Responsibilities Responsible for building risk control capabilities for deposit/withdrawal and on-chain fund operation scenarios, covering core processes such as wallet transactions, signing pipelines, staking/redemption, and cross-chain bridge transfers. Design and implement blockchain transaction risk control strategies, including risk identification, rule validation, anomaly interception, and pipeline consistency assurance. Build a risk control decision engine, supporting the implementation of rule engines, decision trees, and strategy orchestration in fund security scenarios, forming a unified risk control capability covering on-chain fund operations. Collaborate closely with wallet, asset, and security teams to continuously improve the security, traceability, and system stability of fund pipelines. Job Requirements 5+ years of backend development experience; proficient in at least one of Go / Node.js; familiar with high-concurrency architecture (microservices, message queues, caching, rate limiting) and MySQL, Redis. Proficient in at least one public blockchain (Ethereum / Bitcoin / BSC); familiar with on-chain querying (Web3.js / Ethers.js / The Graph); able to read Solidity contract code; knowledgeable about HD wallets, multi-sig, MPC, and other wallet technologies. 5+ years of risk control development experience in internet/finance/blockchain/payments; practical experience with rule engines or decision trees; has led or deeply participated in building deposit/withdrawal risk control systems. Deep understanding of fund security; familiar with signing mechanisms, transaction validation, and security risk control solutions. Nice to Have Hands-on risk control experience at platforms with tens of millions of DAU or millions of daily transactions. Experience in emergency response to major security incidents (hacking attacks, coin theft, fund anomalies). Experience building a risk control system from scratch (0 to 1). Why Join Us At Bybit, we are committed to fostering a supportive and enriching work environment. Our benefits include: - Study Growth Fund: We support your professional development and continuous learning. - Internal Events: Participate in regular team-building activities, workshops, and events designed to promote collaboration and innovation. - Global Collaboration: Be part of a diverse, international team, working alongside colleagues from around the world. - Career Advancement: Access opportunities for growth and advancement within a rapidly expanding global company. - Internal Mobility: Grow with us- Your long-term development is important to us. We offer internal job opportunities to help build your career path.

Location: Boston, MA Workplace: OnSite At WHOOP, we're on a mission to unlock and inspire performance for life. WHOOP is seeking an execution-oriented Senior Governance, Risk, and Compliance Analyst to lead the day-to-day execution and support the ongoing operation of the GRC program in a fast-paced, high-growth environment. This role is responsible for operations of GRC initiatives - including but not limited to structured cybersecurity and AI risk assessments, exceptions management, SDLC reviews and security compliance process ownership. The role will partner closely with Legal, Security, Product, and other teams to advance compliance objectives, reduce enterprise risk, and strengthen operational resilience. The ideal candidate combines strong analytical thinking, critical risk mind-set with the ability to communicate complex risk scenarios clearly to both technical and non-technical stakeholders. RESPONSIBILITIES: - Lead cyber, AI, and technology risk assessments across systems, cloud environments, business processes, and major initiatives, evaluating threats, vulnerabilities, control effectiveness, and residual risk - Maintain and operate the enterprise cyber risk register, including drafting risk statements, tracking mitigation plans, and supporting governance and reporting processes - Translate technical findings, architectural concerns, and control gaps into clear business risk scenarios that support prioritization and decision-making - Support and help mature quantitative cyber risk analysis approaches such as FAIR to improve how risk is measured and communicated - Prepare materials and analysis to support the Cyber Risk Committee and executive risk reporting - Partner with Security Architecture to assess risk in system designs, cloud architecture, identity models, data flows, and platform changes - Collaborate with Security Engineering, Product Security, Legal, IT, and business teams to evaluate new initiatives, technology changes, artificial intelligence use cases, and third-party integrations through a risk lens - Conduct risk assessments for emerging technologies including artificial intelligence and machine learning systems, evaluating data usage, model behavior, external dependencies, and security implications - Develop dashboards and reporting that provide leadership with visibility into key cybersecurity risks and trends. - Contribute to the continued development of cyber risk management processes QUALIFICATIONS: - 6+ years of experience in cybersecurity or enterprise risk management, information security, or a related field - Demonstrated experience conducting structured cybersecurity or IT risk assessment - Experience maintaining risk registers and tracking risk mitigation or treatment activities - Deep understanding of security frameworks such as NIST CSF, ISO 27001, or PCI DSS, and familiarity with regulatory environments such as GDPR, HIPAA or other privacy and data protection requirements - Ability to translate technical findings into clear business risk for non-technical stakeholders - Strong written and verbal communication skills with experience presenting findings to cross-functional teams - Experience assessing risks related to artificial intelligence, machine learning systems, or emerging technologies, including familiarity with emerging AI governance frameworks such as NIST AI RMF, ISO/IEC 42001, or similar standards - Professional certifications such as CRISC, CISSP, CISA, or CGRC are a plus This role is based in the WHOOP office located in Boston, MA. The successful candidate must be prepared to relocate if necessary to work out of the Boston, MA office. Interested in the role, but don’t meet every qualification? We encourage you to still apply! At WHOOP, we believe there is much more to a candidate than what is written on paper, and we value character as much as experience. As we continue to build a diverse and inclusive environment, we encourage anyone who is interested in this role to apply. WHOOP is an Equal Opportunity Employer and participates in E-verify https://www.e-verify.gov/to determine employment eligibility The WHOOP compensation philosophy is designed to attract, motivate, and retain exceptional talent by offering competitive base salaries, meaningful equity, and consistent pay practices that reflect our mission and core values. At WHOOP, we view total compensation as the combination of base salary, equity, and benefits, with equity serving as a key differentiator that aligns our employees with the long-term success of the company and allows every member of our corporate team to own part of WHOOP and share in the company’s long-term growth and success. The U.S. base salary range for this full-time position is $130,000 - $170,000. Salary ranges are determined by role, level, and location. Within each range, individual pay is based on factors such as job-related skills, experience, performance, and relevant education or training.  In addition to the base salary, the successful candidate will also receive benefits and a generous equity package. These ranges may be modified in the future to reflect evolving market conditions and organizational needs. While most offers will typically fall toward the starting point of the range, total compensation will depend on the candidate’s specific qualifications, expertise, and alignment with the role’s requirements.

Location: Hybrid - San Francisco, New York City, London About Vercel: Vercel is the agentic infrastructure company, freeing people and agents to ship what's next. For more than a decade we've helped builders move from idea to production with speed, security, and exceptional developer experience. Now we're scaling our products for both agents and people to ship and run software, built in the open and trusted by OpenAI, PayPal, Ramp, Supreme, and millions of developers worldwide. About the role We are looking for a Governance, Risk and Compliance (GRC) Analyst who wants to build GRC with AI, and you do not need to be an engineer to do it. We encourage and equip you to use AI tooling to build automations for audit evidence and customer security questionnaires, alongside assessing AI tools and vendors and managing audits. This is a hybrid role based in San Francisco, New York City, or London, with three days a week in the office. What you’ll do Assess AI tools and vendors against security, privacy, and compliance requirements, and run company compliance and ethics training Maintain the internal controls behind ISO 27001, System and Organization Controls 2 (SOC 2), Health Insurance Portability and Accountability Act (HIPAA), and Payment Card Industry Data Security Standard (PCI DSS) compliance, and drive remediation to completion with documented progress Use AI tooling to build automations that collect audit evidence, monitor controls, and draft security questionnaire responses, and report on controls maturity scores Manage annual audit deliverables, write treatment plans, and track completion across teams Answer customer compliance inquiries and maintain customer-facing security and compliance documentation What you need 3+ years supporting the audit lifecycle for SOC 2, ISO 27001, PCI DSS, or HIPAA in a cloud-based environment Applied security or privacy controls to AI systems or AI vendors, such as model access, data handling, or third-party risk review Built security policies and technical controls into the software development lifecycle (SDLC) with engineering partners Led compliance projects across multiple business units and seniority levels Bonus if you Built an automation or internal tool, with code or AI coding tools, even outside an engineering role Worked with AI governance frameworks such as ISO/IEC 42001 or the National Institute of Standards and Technology (NIST) AI Risk Management Framework Hold a Certified Information Security Manager (CISM), Certified Information Systems Security Professional (CISSP), or Certified Compliance & Ethics Professional (CCEP) certification Compensation & Benefits: Competitive compensation package, including equity. Inclusive Healthcare Package. Learn and Grow - we provide mentorship and send you to events that help you build your network and skills. Flexible Time Off. We will provide you the gear you need to do your role, and a WFH budget for you to outfit your space as needed. The San Francisco, CA base pay range for this role is $134,000-$202,000. Actual salary will be based on job-related skills, experience, and location. Compensation outside of San Francisco may be adjusted based on employee location. The total compensation package may include benefits, equity-based compensation, and eligibility for a company bonus or variable pay program depending on the role. Your recruiter can share more details during the hiring process. Disclosures: Privacy: Please review our Job Applicant Privacy Policy for more information on how we handle your data. Equal Opportunity: Vercel is committed to fostering and empowering an inclusive community within our organization. We do not discriminate on the basis of race, religion, color, gender expression or identity, sexual orientation, national origin, citizenship, age, marital status, veteran status, disability status, or any other characteristic protected by law. Vercel encourages everyone to apply for our available positions, even if they don't necessarily check every box on the job description.

Location: United States Mattermost is the leading collaborative workflow platform for defense, intelligence, security, and critical infrastructure. Trusted by the U.S. Department of War and Fortune 500s, our platform runs on-premises and in private clouds, delivering secure messaging, file sharing, workflow automation, audio/screenshare, and project management—all with full data and operational control. Mattermost powers high-stakes workflows across mission planning, real-time, real-world operations, DevSecOps, incident response, and cyber defense—enabling secure collaboration from tactical edge and DDIL environments to enterprise HQ. Teams operate across web, desktop, and mobile, with embedded interoperability for Microsoft Teams, Outlook, and Microsoft 365. To learn more, visit www.mattermost.com Mattermost is hiring a GRC Manager to own and modernize our governance, risk, and compliance program across both federal and commercial markets. This is a program-ownership role for someone who brings a modern, engineering-led approach to compliance — harnessing GRC engineering and AI to reduce manual effort and scale our programs. You will own Mattermost's compliance posture end to end, accountable for our federal readiness and commercial certifications, and you will modernize how we run them: automated, continuously monitored, and AI-native. You will do the hands-on compliance work while coordinating across internal stakeholders in engineering, infrastructure, and IT who implement controls, the external auditors who assess them, and the customers whose trust rests on the outcome. As the program scales, you will grow and lead the team behind it. What You'll Do Own and modernize Mattermost's compliance programs across federal and commercial markets Lead readiness, certification, and surveillance cycles across both programs Operate the risk management program end to end — from identification and assessment through treatment and acceptance Own the third-party and vendor risk management program, including security assessments and supply chain risk Apply GRC engineering and automation to replace manual evidence collection with continuous controls monitoring Build AI-native workflows to accelerate and improve the quality of recurring compliance work Maintain the control library, system security plans, POA&Ms, and policies Coordinate external audits from scoping through remediation Accelerate deal cycles by owning customer security questionnaires, trust center content, and reusable compliance artifacts Grow and lead the GRC team as the program scales What We're Looking For Bachelor's degree in computer science, information security, or related field — or significant professional GRC and compliance experience Proven senior-level experience in governance, risk, and compliance, security compliance, or IT audit, including direct ownership of a certification or authorization program Experience with U.S. Federal standards including CMMC and NIST series (800-171 / 800-53) Experience with ISO 27001 and SOC 2 Type II Experience operating a formal risk management program Experience running a third-party and vendor risk management program Experience owning customer-facing security assurance, including security questionnaires and trust center content Working knowledge of security controls for cloud environments (AWS, GCP, and/or Azure) Excellent written and verbal communication skills Nice to Have Professional GRC certifications such as CISA, CRISC, CISM, CISSP, or CIPP Experience working with AI platforms such as Claude, OpenAI, or Gemini Experience with compliance automation tooling such as Vanta or Drata, and continuous controls monitoring Direct experience applying AI or LLM-based workflows to GRC tasks Proficiency in no-code automation or scripting languages Past success in critical infrastructure industries including defense, cybersecurity, communications, or manufacturing How Success Is Measured CMMC Level 2 gap assessment and readiness roadmap delivered within first 90 days SOC 2 Type II and ISO 27001 audit cycles completed on time without slippage Manual evidence collection replaced with automated, continuously monitored controls Customer security questionnaires and trust center content maintained to unblock deal cycles GRC team grown and operating as a scalable, program-driven function Why Mattermost Mission-driven work: Your contributions directly support the organizations and missions that depend on secure, reliable collaboration Remote-first culture: Work from anywhere with a globally distributed, high-trust team built for autonomy and ownership Open source at the core: Be part of a vibrant developer community shaping the future of secure collaboration AI-forward environment: We actively adopt and build AI-enabled workflows — you'll work with and on cutting-edge tooling Unique scope: Own the compliance program end to end across both federal and commercial markets at a high-growth Series B company Target Salary Range: $139,254-$168,318 Mattermost takes a market-based approach to pay and pay may vary depending on your location. The successful candidate’s starting pay will be determined based on job-related skills, experience, qualifications, work location, and market conditions. These ranges may be modified in the future. Mattermost offers a remote-first work environment with medical, dental, and vision coverage. You’ll also receive unlimited PTO plus company holidays, a work from home stipend, an annual learning and development budget for conferences, certifications, and courses, paid parental leave for all parents, and a 401(k) plan. U.S. Eligibility & Compliance This role may require obtaining and maintaining a U.S. government security clearance. Candidates must meet federal eligibility requirements to be considered. For more information visit Security Clearances — United States Department of State Applicants must meet eligibility requirements for access to export-controlled information as defined by U.S. export control laws, including EAR and ITAR. For more information visit the Bureau of Industry and Security and the Directorate of Defense Trade Controls . Mattermost is an EEO Employer, we are a remote-first, open-source company. We are continually working to expand our hiring in more countries and regions, ensuring compliance with local laws and regulations, which takes time. Mattermost values your unique perspective—we welcome all applicants. We encourage individuals from all backgrounds to apply and are committed to assessing candidates based on their skills and qualifications. We do not tolerate discrimination against staff or applicants based on race, religion, national origin, age, disability, pregnancy status, veteran status, or other personal characteristics. If you require accommodations during the interview process, please let us know—we’re happy to assist.

Location: Riyadh, Saudi Arabia Müller's Solutions is seeking an experienced GRC Specialist to support a SAMA-aligned IT Risk and IT Compliance Assessment programme. The candidate will be responsible for delivering a structured set of project outputs across governance, risk, compliance, and IT process improvement workstreams. Key Responsibilities: Develop and deliver the Project Charter & Project Plan Conduct current state and maturity assessments and produce formal reports Design and implement an IT Governance Framework aligned to SAMA requirements Develop a full set of IT policies and procedures Define the IT Operating Model and RACI Matrix Build and maintain a Control Catalog mapped to SAMA Establish Governance Committee Charters and Dashboards Conduct Gap Assessments and produce a remediation roadmap Perform SAMA Readiness Assessments Complete a Risk Assessment for Information Assets Develop and maintain Risk Registers and Treatment Plans Support IT teams in closing SAMA and Internal Audit observations Produce Cybersecurity Compliance Reports and IT Process Performance Reports Deliver Knowledge Transfer Sessions to internal stakeholders (up to 10 sessions) Requirements Requirements: Minimum 7–10 years in IT GRC, IT Risk, or IT Compliance roles Strong working knowledge of SAMA Cybersecurity Framework Experience delivering IT governance frameworks and policy suites Proven track record in risk assessment and risk register management Familiarity with Internal Audit closure processes and compliance reporting Experience in maturity assessments aligned to recognised frameworks (NIST, ISO 27001, SAMA) Excellent documentation and stakeholder communication skills Prior experience in the Saudi Arabian financial or regulated sector is highly preferred Benefits Why Join Us: Opportunity to work with a talented and passionate team. Competitive salary and benefits package. Exciting projects and innovative work environment.

Location: Lagos, Nigeria Governance & Policy Develop, review, and maintain information security policies, standards, procedures, and guidelines. Ensure alignment with recognized frameworks and standards (e.g. ISO/IEC 27001, PCIDSS, CBN Cybersecurity Framework). Define security governance structures, roles, and decision‑making processes. Risk Management Support enterprise information security risk assessments and risk treatment plans. Maintain the security risk register and track remediation activities. Advise business units on risk acceptance, mitigation, transfer, or avoidance. Compliance & Regulatory Assurance Ensure compliance with applicable laws, regulations, and contractual requirements (e.g. NDPR, CBN Cybersecurity Framework, PCI DSS, ISO 27001). Coordinate internal and external audits, assessments, and certifications. Track and remediate audit findings and compliance gaps. Metrics, Reporting & Assurance Define and maintain security governance KPIs, KRIs, and dashboards. Prepare security posture reports for management, risk committees, and auditors. Support board‑level and executive reporting on information security matters. Third‑Party & Vendor Security Governance Support third‑party security risk assessments and due diligence processes. Review supplier security controls and contractual security clauses. Monitor ongoing compliance of critical vendors. Awareness & Continuous Improvement Support security awareness and policy training initiatives. Monitor regulatory changes and emerging governance trends. Drive continuous improvement of governance and control maturity. Requirements Bachelor’s degree in Information Security, Computer Science, Information Technology, or a related field. Minimum of 5–9 years’ experience in information security governance, risk, and compliance (GRC). Hands-on experience implementing or managing security frameworks (e.g., ISO 27001, CBN Cybersecurity Framework, NDPR, PCI DSS). Strong understanding of risk management methodologies and control frameworks. Experience working with audits, compliance reviews, and regulatory requirements. Familiarity with security tools and platforms supporting governance and compliance activities. Experience in financial services, fintech, or telecommunications is an added advantage.

Location: Dhahran, Saudi Arabia Eram Talent is looking for a detail-oriented and knowledgeable GRC (Governance, Risk, and Compliance) Analyst with COBIT certification to join our team. As a trusted Talent Acquisition partner, we serve various industries by providing top-notch recruitment solutions. The GRC Analyst will play a crucial role in ensuring that our clients' IT governance, risk management, and compliance frameworks are effectively designed, implemented, and maintained. The successful candidate will work closely with stakeholders to identify and assess risks, develop control frameworks based on COBIT standards, and ensure compliance with relevant regulations and policies. This role involves continuous monitoring, reporting, and improvement of governance processes to ensure operational excellence and risk mitigation. Key Responsibilities: Develop, implement, and maintain GRC frameworks using COBIT principles and best practices. Conduct risk assessments and internal control evaluations to identify gaps and recommend improvements. Monitor compliance with IT policies, procedures, and regulatory requirements. Collaborate with IT and business teams to ensure proper governance and risk mitigation strategies are in place. Prepare and present reports to senior management on governance, risk, and compliance statuses. Support audit activities and facilitate responses to audit findings related to IT governance. Stay updated on new regulations and frameworks affecting IT governance and compliance. Promote awareness and understanding of GRC practices across the organization. Requirements Bachelor’s degree in Information Technology, Computer Science, Business Administration, or a related field. Experience in developing and implementing governance frameworks. Familiarity with compliance standards (e.g., ISO 38500, COBIT, NIST). Experience managing governance-related projects, including the ability to define objectives, allocate resources, and monitor progress. Good understanding of IT governance principles and best practices COBIT certification is mandatory. ISO/IEC 35800 (Corporate Governance Of IT) is preferred Proven experience as a GRC analyst or similar role, preferably in IT governance and risk management. Strong understanding of IT governance frameworks, especially COBIT. Knowledge of compliance requirements, risk management methodologies, and regulatory frameworks. Excellent analytical, problem-solving, and communication skills. Ability to work collaboratively with cross-functional teams and senior management. Detail-oriented with strong organizational skills. Experience supporting IT audits and addressing audit findings. Knowledge of other governance frameworks (e.g., ISO 27001, ITIL) is a plus.

Location: Riyadh, Saudi Arabia; Dubai, United Arab Emirates; Cairo, Egypt Müller's Solutions is seeking a talented SAP GRC Consultant to join our team, focusing on implementation projects. In this role, you will be responsible for delivering comprehensive Governance, Risk, and Compliance (GRC) solutions to our clients, helping them efficiently manage their compliance requirements and mitigate risks within their SAP environments. Key Responsibilities: Collaborate with clients to gather and analyze business requirements related to GRC processes and tools. Design, configure, and implement SAP GRC solutions, including Access Control and Process Control modules. Conduct workshops with stakeholders to ensure understanding of GRC functionalities and best practices. Prepare documentation, including functional specifications, process flows, and user guides. Actively participate in testing phases, ensuring GRC solutions meet business needs and compliance standards. Provide end-user training and support during and after the implementation process. Monitor and support the live operation of GRC solutions, troubleshooting issues as they arise. Stay updated on the latest trends, updates, and regulatory changes in the GRC landscape. Requirements Requirements: Bachelor's degree in Computer Science, Business Administration, or a related field. A minimum of 5 years of experience in SAP GRC implementation and configuration. Strong knowledge of GRC Access Control, Process Control, and Risk Management modules. Experience in designing and implementing role-based access controls and compliance processes. Excellent analytical and problem-solving skills to address compliance challenges. Effective communication and interpersonal skills, with the ability to work collaboratively with clients and team members. Experience with SAP S/4HANA and related technologies is advantageous. SAP GRC certification(s) are highly desirable. Demonstrated ability to manage multiple projects and meet deadlines in a fast-paced environment. Benefits Why Join Us: Opportunity to work with a talented and passionate team. Competitive salary and benefits package. Exciting projects and innovative work environment.

Location: Riyadh, Saudi Arabia As a GRC (Governance, Risk, and Compliance) Consultant at Müller's Solutions, you will play a pivotal role in helping organizations strengthen their governance frameworks, manage risks effectively, and ensure compliance with industry regulations. You will work closely with clients to assess their GRC practices, identify areas of improvement, and implement tailored solutions that drive operational efficiency and reduce risk exposure. Key Responsibilities: Evaluate and assess existing governance, risk management, and compliance frameworks within client organizations. Develop and implement GRC strategies, policies, and procedures aligned with best practices and regulatory requirements. Conduct risk assessments, internal audits, and compliance reviews to identify deficiencies and recommend corrective actions. Collaborate with cross-functional teams to promote a risk-aware culture and ensure compliance with relevant laws and regulations. Design and deliver GRC training programs to enhance knowledge and awareness among stakeholders. Assist in the selection and implementation of GRC software solutions to automate processes and improve reporting capabilities. Stay informed about industry trends, regulatory changes, and emerging risks to provide proactive advice to clients. Requirements Qualifications: Bachelor's degree in Business Administration, Risk Management, Finance, or a related field. 5+ years of experience in governance, risk, and compliance consulting or related fields. Strong understanding of GRC frameworks, methodologies, and best practices. Knowledge of relevant regulations and standards, such as ISO 31000, COSO, GDPR, and others. Excellent analytical skills with the ability to evaluate complex information and provide actionable insights. Strong interpersonal and communication skills, capable of engaging stakeholders at all levels of the organization. Proven ability to manage multiple projects and priorities effectively. Relevant certifications, such as CRISC, CISA, CISM, or similar, are a plus.