Вакансии

О компании и команде Страховая Группа «СОГАЗ», один из крупнейших в России страховщиков федерального уровня, предлагает присоединиться к высокопрофессиональной команде специалистов, обладающей уникальным для рынка опытом, знаниями и технологиями. Блок ИБ в СОГАЗ активно развивается. Мы создаем новые решения, которые делают нашу работу более технологичной и эффективной. В настоящее время мы находимся в поиске опытного специалиста по безопасности кода. Задачи: — развивать цикл и процессы безопасной разработки (S-SDLC) в части статического анализа Web приложений (процессы, автоматизация); — обеспечивать защиту разрабатываемых и используемых приложений компании; — проводить аудиты безопасности разрабатываемых сервисов (ручной анализ, статический анализ кода, поиск секретов); — принимать участие в проектировании безопасной архитектуры разрабатываемых продуктов; — формировать и формализовывать требования безопасности для продуктов; — консультировать разработчиков и контролировать устранение выявленных уязвимостей; — разрабатывать, внедрять и сопровождать системы и процессы информационной безопасности в части статического анализа кода и поиска уязвимостей; — проводить обучение сотрудников требованиям информационной безопасности в части разработки Требования: — умение самостоятельно выявлять уязвимости в Web приложениях; — понимание циклов CI/CD (Gitlab-CI) и DevOps; — понимание принципа работы и настройки правил и инструментов статического анализа Web приложений; — экспертное знание Client-Side и Server-Side уязвимостей (OWASP TOP-10 и немного больше); — понимание хотя бы одного языка программирования (в приоритете Java и Python); — понимание принципов работы систем аутентификации и авторизации (PKI, LDAP, OAuth, SAML, 2FA); — знание Bash, Docker, Python или Go; — умение читать код и выявлять ошибки; — опыт работы со сканерами уязвимостей (Burp Suite, OWASP ZAP). Будет плюсом: — наличие репортов о найденных уязвимостях в программах Bug Bounty; — наличие профильных сертификатов (OSCP, OSWE, CDP и т.д.); — наличие зарегистрированных CVE; — опыт выступления на профильных конференциях и написания профильных статей Условия: — оформление полностью в соответствии с ТК РФ; — ДМС со стоматологией в лучших клиниках страны; — премиальные условия на все виды страхования в «СОГАЗе» для вас и близких родственников; — собственный фитнес-центр в офисе в центре Москвы (оборудование Milon для «умных» тренировок); — возможность проходить внешнее обучение после успешного прохождения испытательного срока, а также обучаться на курсах корпоративного портала; — скидки в детские лагеря и подарки на Новый год для детей сотрудников; — реальные возможности профессионального и карьерного роста; — настрой на долгосрочное сотрудничество; — возможность работать гибридно (офис в пешей доступности от м. Чистые пруды).

Location: Lisbon, Portugal Joom Group is an international tech-centric group of e-commerce companies founded in 2016 in Latvia. We are here to transform the largest industry in the world, global trade, making it more transparent, efficient, and technology-driven. Today, Joom Group brings together the following businesses: Joom, a platform for shopping from all over the world; JoomPro, the first end-to-end cross-border B2B marketplace, with successful operations in Brazil and plans to expand to other markets; JoomPulse, data platform that provides analytics and recommendations for marketplace sellers; and Onfy, a pharmaceutical marketplace in Germany. Joom Group’s offices are located in China, Brazil, Portugal, Latvia, and Germany, with headquarters in Lisbon, Portugal. We work as one international team, sharing knowledge and collaborating across countries, businesses, and products. As we continue to grow and introduce new products and services, we become increasingly susceptible to security threats. We are currently seeking an Application Security Engineer for our infrastructure team to stay informed about current threats and ensure the security of our development and applications. This role offers the opportunity to develop the application security direction from the ground up and achieve international certification. We prioritize innovation over bureaucracy and legacy code and are always open to fresh ideas. Responsibilities Implement SSDLC with the development team Analyze the security of the company's products Assist teams in addressing vulnerabilities Stay informed about current threats and develop code protections Requirements 3+ years of experience in web/mobile application security Experience in securing mobile and web applications Experience in building secure development processes (SSDLC) Experience with white box testing Knowledge of *NIX systems and basic network protocols Preferred Experience in bug bounty programs Relevant information security certifications (e.g., OSCP, CompTIA Security+) CVE authorship Proficiency in Go, Python, or Java We offer Compensation package: base salary and performance-based bonuses Office-first: flexible hours with a possibility to work remotely 52 days per year, and 22 days of paid annual leave Care & Wellbeing: health insurance (including dental care) for employees and their children, daily meal allowance, and 100% paid sick leave AI-first approach: licenses and access to a wide range of AI tools Team & Growth: collaboration with colleagues across Portugal, Brazil, Latvia and China, with opportunities for promotions, professional trainings, and English courses Community & Engagement: annual team building activities, knowledge-sharing workshops, and a strong sense of team work B efore applying for the above position please review our Candidate Privacy Notice here . By responding to the vacancy, you acknowledge that you have read our Privacy notice.

Location: Москва Workplace: гибкий В роли аналитика информационной безопасности в объединённой команде безопасности социальных сетей у тебя будет возможность внести значительный вклад в защиту пользователей и инфраструктуры одних из самых популярных сайтов в России — ВКонтакте и Одноклассники, а также их различных сервисов-сателлитов. Масштаб и сложность нашей инфраструктуры требуют нестандартных подходов к обеспечению безопасности. Команда решает широкий спектр задач: от мониторинга событий и выявления подозрительной активности до расследования инцидентов и развития механизмов защиты инфраструктуры. Мы за постоянное развитие — поэтому активно делимся опытом и знаниями, разбираем реальные кейсы, участвуем в CTF, посещаем профильные конференции и проходим различные курсы. Кроме профессионального роста, мы стремимся создать среду, где каждый член команды чувствует себя ценным и вовлечённым. У нас развита культура взаимопомощи и поддержки, где успехи отмечаются и становятся общими. Задачи Экспертный разбор и триаж сработок сканеров инфраструктуры и SOC, в том числе сложных/неоднозначных случаев, которые не смогли закрыть младшие специалисты Методологическое лидерство в построении детектов и корреляционных правил SOC под актуальные TTPs (MITRE ATT&CK), включая оценку покрытия (coverage mapping) и выявление слепых зон мониторинга Самостоятельная постановка и приоритизация технических требований к эксплуатации/разработке по устранению уязвимостей и архитектурных рисков, включая сложные случаи (legacy, компенсирующие меры) Ведение и (или) участие в комплексных расследованиях инцидентов (incident response), включая root cause analysis и post-mortem Проведение и (или) сопровождение AppSec- и инфраструктурных аудитов, ревью архитектуры новых продуктов/сервисов с точки зрения ИБ Разработка регламентов, стандартов и DoD по процессам сканирования, мониторинга и реагирования; внедрение их в масштабе нескольких команд/продуктов Менторство и ревью работы младших/средних специалистов (триаж, качество детектов, оформление задач) Автоматизация рутинных процессов анализа и отчётности (скрипты, интеграции между VM/SIEM/CMDB/Jira через API) Взаимодействие с руководством продуктов и смежных команд на уровне защиты решений и обоснования приоритетов по рискам Требования Опыт в ИБ от пяти-шести лет, из них не менее двух-трёх лет в инфраструктурной безопасности / SOC Глубокое понимание сетевых технологий, ОС (Linux/Windows), виртуализации/контейнеризации Опыт построения или существенного развития SOC-мониторинга: выбор источников логирования, написание/ревью корреляционных правил, оценка покрытия по MITRE ATT&CK Опыт самостоятельного ведения инцидентов ИБ от обнаружения до post-mortem, включая взаимодействие с разными командами в стрессовых условиях Уверенное понимание CVSS, моделей угроз, risk-based подхода к приоритизации Опыт архитектурных security-ревью Опыт выстраивания процессов и регламентов ИБ, умение аргументированно отстаивать приоритеты перед другими командами и руководством Опыт менторства/ревью младших коллег Будет плюсом Профильные сертификации (OSCP, OSCE, GCIH, CISSP и аналоги) Опыт выступлений/публикаций Участие в Bug Bounty или CTF

Location: Москва Мы создаем фундамент для технологического суверенитета, объединяя экспертизу в классическом банковском деле, платежных системах, B2B-логистике и AML/KYC-комплаенсе. Наши команды разработки создают продукты для миллионов пользователей. Сейчас мы переживаем масштабную технологическую трансформацию: переходим от традиционной микросервисной архитектуры к внедрению автономных ИИ-агентов и генеративного искусственного интеллекта во внутренние процессы. Обязанности **Обязанности** * Техническая настройка и администрирование инструментов безопасной разработки (SCA, систем связанных с контролем AI, систем связанных с практикой Container Security) * Взаимодействие с командами разработки, участие в митапах и контроль выполнения требований безопасности в конечных продуктах. * Триаж уязвимостей/дефектов кода, заведение задач на исправление на команды * Экспертиза по безопасности при создании систем с функциями ML/LLM; * Проработка требований и проведение контрольных мероприятий связанных с механизмами Guardrails (система защиты ИИ), которые обеспечивают безопасность и предсказуемость поведения ИИ агентов; * Проведение исследований по КБ в разрезе всех продуктовых команд; * Коммуникации с командами и их консультирование с целью реализации требования КБ; * Участие в разработка требований КБ с учетом нормативных актов и международных практик; * Изучение существующих продуктов и участие в интеграционных проектах. * Участие в проработке возможности автоматизаций процессов ИБ при помощи ИИ (Аудиты, выявление аномалий в логах, выявление ПДн в тестовых БД и т.д) Требования **Требования** * Опыт работы в области информационной безопасности приложений от 3-х лет; * Опыт администрирования систем участвующих в цикле безопасной разработки CI\\CD; * Опыт программирования (написание скриптов автоматизации, уверенный Python, знание основных ML-фреймворков PyTorch/TensorFlow); * Понимание процессов и этапов цикла безопасной разработки ПО (SSDLC); * Понимание, как работают угрозы из OWASP Top 10, OWASP Top 10 LLM, OWASP Mobile Top 10, CWE Top 25; * Понимание принципов работы микросервисной архитектуры и подходов к безопасности микросервисов (k8s); * Понимание различий видов тестирования (SAST,SCA,DAST,IAST); * Понимание основ сетевой безопасности; * Понимание принципов AI PDLC; * Инструментальное владение AI для анализа, генерации и автоматизации. **Будет плюсом:** * Опыт взаимодействия с продуктовыми командами в сфере КБ; * CISM,CISA,CEH или аналогичные сертификаты; * Опыт работы в направлении DevSecOps,AppSec; * Знание английского языка на уровне Intermediate. Условия **Условия** * Гибридный формат работы (современный офис в Москве, м. Выставочная Башня Федерация); * Льготные ипотечные условия кредитования; * Выгодная подписка на продукты и услуги компаний партнеров; * ДМС и страхование от несчастных случаев и болезней после 3-х месяцев работы; * Корпоративная пенсионная программа; * Детский отдых и подарки за счет Компании; * Обучение за счет Компании: онлайн курсы, неограниченный доступ к библиотеке и обучение на базе Корпоративного университета, тренинги, митапы и возможность получить новую квалификацию.

Location: Москва В Центре Робототехники Сбера мы занимаемся созданием универсального воплощенного ИИ для роботов, который способен управлять разнообразными физическими воплощениями. Кроме этого, одним из ключевых направлений нашей работы является разработка антропоморфного робота общего назначения, не безызвестного Грина. Обязанности * проведение Red Teaming и пентеста ИИ-агентов: поиск промпт-инъекций, отравлений данных, jailbreaks и обходов системных инструкций. * проектирование и внедрение защиты агентов: системы модерации, детекторы, изоляция, контроль цепочек инструментов. * консультирование инженерных команд по безопасной интеграции агентов с корпоративными системами и интернетом, помощь в проектировании архитектуры * создание практических гайдлайнов по работе с агентами (выдаче API-ключей, ограничению доступа к файловой системе и проверке действий агента). * проведение код-ревью пайплайнов агентов с фокусом на безопасность LLM-вызовов и обработку внешних данных. * аудит и поиск уязвимостей в моделях управления роботом: защита от состязательных (adversarial) атак, визуальных обманок и злонамеренного переобучения. * проектирование безопасных ML-контуров * внедрение практик MLSecOps: сканирование весов моделей, контроль целостности датасетов, аудит-логирование решений. * настройка безопасного деплоя: изоляция инференса в песочницах, управление секретами, мониторинг аномалий в поведении агентов. * участие во внутренних митапах и воркшопах для работников по безопасности ИИ. Требования * опыт в AppSec, MLSec или Red Team от 4 лет, из них 1.5–2 года — с LLM и автономными агентами * глубокое понимание механики LLM (контексты, tool calling, RAG), профиля нарушителя и угроз * практический опыт Red Teaming ИИ-агентов: поиск промпт-инъекций, отравлений данных, jailbreaks * опыт проектирования защиты агентов: системы модерации, детекторы, изоляция, контроль цепочек инструментов * навыки консультирования инженеров и проектирования безопасной архитектуры интеграции агентов * опыт проведения код-ревью пайплайнов агентов (Python/TypeScript) с фокусом на безопасность LLM-вызовов * опыт аудита моделей компьютерного зрения и управления роботами (adversarial attacks, визуальные обманки) * практическое внедрение MLSecOps: сканирование весов, контроль датасетов, аудит-логирование решений * навыки безопасного деплоя: изоляция инференса, управление секретами, мониторинг аномалий * Владение Python для написания PoC и инструментов, уверенная работа с Linux. Условия * офисный/гибридный формат в Москве (Автозаводская 23а к2) * ежегодный пересмотр зарплаты и годовая премия * расширенный ДМС и льготное страхование для семьи * уникальная система обучения Сбера для профессионального и карьерного развития * выгодная ипотека для сотрудников * подписка Прайм с возможностью совместного использования на трёх близких * вознаграждение за рекомендацию друзей в команду Сбера * корпоративная пенсионная программа.

Location: Limassol, Cyprus Workplace: hybrid We are looking for an Application Security Engineer in the AppSec team. As a Senior Application Security Engineer at inDrive, you will own whole areas of our AppSec program, from security requirements and design reviews to controls that work in production. You will work with product, platform and infrastructure teams on new architecture, AI systems and the security of our apps and services. The role fits a hands-on engineer who reviews code and architecture, leads work across several teams and makes security decisions based on data. Key Responsibilities Own one or more areas of the AppSec program end to end, including the plan, the risks and the metrics. Run security design reviews and threat modeling of new features, services and AI systems, and defend security requirements at the architecture committee. Assess the security of web, mobile and API applications and find variants of confirmed vulnerabilities across other services. Coordinate external security assessments and bug bounty findings, from triage and prioritisation with teams to fix verification. Design secure authentication and authorization between users, services and internal tools together with platform teams. Choose, pilot and tune security tools, and keep only those that pay off in real findings. Turn incidents and assessment results into lasting controls, policies and secure defaults for developers. Consult development teams on complex security issues and take shifts in AppSec duty for Critical and High incidents. Skills, Knowledge and Expertise Higher education in IT, preferably in information security. Knowledge of mobile application security on Android and iOS, client-server trust, app integrity and protection against bots and account takeover. Deep knowledge of web and API security, including authentication and authorization flaws, SSRF, injections and business logic issues, and the ability to find variants of a vulnerability class across many services. Strong understanding of identity and access, OAuth 2.0, OIDC, JWT, signing key rotation, mTLS, service-to-service authentication and SSO. Understanding of security risks of AI systems and LLM agents, such as prompt injection, excessive tool permissions and agent access to sensitive data, and practical use of AI in your own security work. Practical understanding of cloud-native infrastructure, Kubernetes, containers, API gateways and AWS. Experience in threat modeling and security design review of new features and architecture. Understanding of vulnerability management and risk, including severity, SLA, compensating controls and risk acceptance. Ability to read and review code in at least one language, preferably Golang. Track record of leading projects with two or more teams from a requirement to a verified fix, and clear written English. Experience with secrets and key management, rotation and response to credential leaks. Nice to have Knowledge of software supply chain security, dependencies, CI/CD pipelines and source control platform hardening. Experience tuning SAST, DAST and SCA tools for precision and judging a tool by noise and cost per real finding. Why join us Help us challenge injustice by creating fair choices for millions of people across 47 countries. Develop your professional skills with access to mentoring, career consulting, and learning programs. Collaborate with teams around the world and gain international experience through our Global Talent Exchange Program. Engage in company-wide challenges, awards, sports activities, employee-led social impact and volunteering projects. Work alongside people who take initiative, speak openly, and challenge themselves to grow. Improve your language skills through co-financed courses and internal speaking clubs. Annual salary from 70 700 EUR gross. Final benefits may vary depending on the location.

Проводить архитектурные ревью и моделирование угроз как для текущих, так и для новых сервисов и функциональностей. Проводить анализ защищенности приложений, API и бизнес-логики.

• Формирование и развитие программы проактивного выявления угроз и Threat Hunting в Компании, включая методологию, приоритизацию исследований, hunting backlog и критерии оценки результатов;

Location: United States - Remote Chainguard is the trusted source for open source. By delivering hardened, secure, and production-ready builds of all the open source software engineers and AI agents rely on, Chainguard helps organizations build faster, stay compliant, and eliminate risk. Our customers include Fortune 500 enterprises and global industry leaders, including Anduril, Canva, Fortinet, Hewlett Packard Enterprise, OpenAI, Snap Inc., and Snowflake. Chainguard is venture-backed by leading investors, including Amplify, IVP, Kleiner Perkins, Lightspeed Venture Partners, Mantis VC, Redpoint Ventures, Sequoia Capital, and Spark Capital. The role, in a nutshell: As a Customer Success Manager at Chainguard, you will be the post-sales primary point of contact for our Enterprise customers. You will be responsible for taking lead on customer engagements across onboarding, implementation, and adoption. In this role, you will work closely with Solutions Architects, Technical Support, Product Management, Engineering and Sales to ensure the successful onboarding and support of your customers. You are their day-to-day contact, building relationships with customers and driving outcomes, adoption, and delivering time-to-value. What you’ll do: Customer Onboarding: Lead the technical onboarding process for new customers. Partner with customers, pre-sales, and post-sales teams to understand requirements, goals, and challenges to formulate an onboarding plan. Customer Advocacy: Act as the voice of the customer within the organization, advocating for customer needs and requirements to internal teams.  This means being a team player and having strong collaboration skills - this role must align with many different internal teams, influence them to act toward customer needs. Issue Management: Collaborate with Technical Support and Customer Engineering teams to ensure timely resolution to customer issues. Product Expertise: Develop hands-on technical knowledge of Chainguard and stay up-to-date with industry trends, new features, and best practices so you can help customers optimize their use of Chainguard. Training & Education: Collaborate with customers and our Edu team to ensure customers are educated on product features, best practices, and security principles. Account Management: Develop relationships with multiple levels of customer stakeholders from technicians to CISOs. Work closely with sales teams to identify the best path to renew and expand customers while minimizing churn risks. What we're looking for: 3+ years experience in SMB and mid-market customer facing roles collaborating with both technical and business teams - Customer Success, Professional Services, Technical Account Management or a combination of those plus Sales, Solutions Engineering, or Technical Support. Relevant domain knowledge of one or more of the following; Supply Chain Security, DevSecOps, AppSec, security infrastructure, containers, regulatory compliance requirements, vulnerability management, software development lifecycle. This is a strategic and proactive role, our expectation is that this person will take full ownership of their customer portfolio and act with a high level of autonomy.  This includes making key decisions to drive effective customer outcomes; deciding when to include our executive team or c-suite in customer escalations, how to de-risk or de-escalate customer issues and conflict, and advocating to internal teams including sales, product, engineering, etc. An entrepreneurial mindset - this is a new team at Chainguard where you will be required to both deviate from established procedure and often build entirely new process or practices to ensure we best serve customers. Demonstrates a strong commitment to continuous personal and professional development, actively seeking opportunities to enhance skills, expand knowledge, and advance within their career and field. Driven, high emotional intelligence, and strong priority management skills Strongly Preferred: Previous early-stage startup experience Passion for technology & cybersecurity Relevant hands-on technical experience, in one or more of the following domains: cloud computing environments (AWS, GCP, Azure), containers, Linux, Supply Chain Security, DevSecOps, AppSec, security, security infrastructure, regulatory compliance requirements, vulnerability management, software development lifecycle Compensation: $125,000 base salary + bonus About Us We live and breathe our company values: We are customer obsessed — We focus on delivering solutions to our customers that create value and make their lives better. We have a bias for intentional action — We prioritize, plan, try things, and fail fast. We don't take ourselves too seriously (but we do serious work) — We are solving an important problem which takes focus, but we also like to enjoy the journey. We trust each other and assume good intentions — We're transparent with decisions to empower team members to make well informed decisions. A few of the benefits we offer: Flexible & Remote-First Culture: Work remotely with team meetup opportunities, bi-annual destination summits, and a monthly stipend for coworking spaces, phone and internet costs. Our Approach to Equity: Receive stock options upon hire and promotion. Plus, you can participate in secondary offerings and have 10 years to exercise your options (yes, you read that correctly: 10 years!). 100% Covered Health Insurance: We cover 100% of your health, vision and dental insurance premiums for you and your dependents. Nothing comes out of your paycheck. ∞ Flexible Time Off: Take the time you need – to do our best work, we need to recharge and reset. 18 Weeks Paid Parental Leave: We offer 18 weeks for birthing parents and 12 weeks for non-birthing parents, with the option to use it all at once or throughout your child's first year. If your experience is close but doesn't fulfill all requirements, please apply. We're building the best team in technology and are focused on hiring "Chainguardians" with unique backgrounds, perspectives, and experiences. Chainguard is an equal opportunity employer. We do not discriminate based upon race, religion, color, national origin, sex (including pregnancy, childbirth, reproductive health decisions, or related medical conditions), sexual orientation, gender identity, gender expression, age, status as a protected veteran, status as an individual with a disability, genetic information, political views or activity, or other applicable legally protected characteristics. We also consider qualified applicants with criminal histories, consistent with applicable federal, state and local law. By submitting your application, you acknowledge that Chainguard will process your personal data in accordance with Chainguard's Global Candidate Privacy Notice . ©2026 Chainguard. All Rights Reserved.

Location: Australia - Remote Chainguard is the trusted source for open source. By delivering hardened, secure, and production-ready builds of all the open source software engineers and AI agents rely on, Chainguard helps organizations build faster, stay compliant, and eliminate risk. Our customers include Fortune 500 enterprises and global industry leaders, including Anduril, Canva, Fortinet, Hewlett Packard Enterprise, OpenAI, Snap Inc., and Snowflake. Chainguard is venture-backed by leading investors, including Amplify, IVP, Kleiner Perkins, Lightspeed Venture Partners, Mantis VC, Redpoint Ventures, Sequoia Capital, and Spark Capital. The role, in a nutshell: As a Senior Customer Success Manager at Chainguard, you will be the post-sales primary point of contact for our enterprise customers. You will be responsible for taking lead on customer engagements across onboarding, implementation, and adoption. In this role, you will work closely with Solutions Architects, Technical Support, Product Management, Engineering and Sales to ensure the successful onboarding and support of your customers. You are their day-to-day contact, building relationships with customers and driving outcomes, adoption, and delivering time-to-value. What you’ll do: Customer Onboarding: Lead the technical onboarding process for new customers. Partner with customers, pre-sales, and post-sales teams to understand requirements, goals, and challenges to formulate an onboarding plan. Account Management: Develop relationships with multiple levels of customer stakeholders from technicians to CISOs. Work closely with sales teams to identify the best path to renew and expand customers while minimizing churn risks. Training & Education: Collaborate with customers and our Edu team to ensure customers are educated on product features, best practices, and security principles. Product Expertise: Develop hands-on technical knowledge of Chainguard and stay up-to-date with industry trends, new features, and best practices so you can help customers optimize their use of Chainguard. Customer Advocacy: Act as the voice of the customer within the organization, advocating for customer needs and requirements to internal teams.  This means being a team player and having strong collaboration skills - this role must align with many different internal teams, influence them to act toward customer needs. Issue Management: Collaborate with Technical Support and Customer Engineering teams to ensure timely resolution to customer issues. What we're looking for: 5+ years experience in enterprise, customer facing roles collaborating with both technical and business teams - Customer Success, Professional Services, Technical Account Management or a combination of those plus Sales, Solutions Engineering, or Technical Support. Must hold an active NV1 with the ability to obtain NV2 to support our federal book of business. Relevant domain knowledge of one or more of the following: Supply Chain Security, DevSecOps, AppSec, security infrastructure, containers, regulatory compliance requirements, vulnerability management, software development lifecycle. This is a strategic and proactive role, our expectation is that this person will take full ownership of their customer portfolio and act with a high level of autonomy.  This includes making key decisions to drive effective customer outcomes; deciding when to include our executive team or c-suite in customer escalations, how to de-risk or de-escalate customer issues and conflict, and advocating to internal teams including sales, product, engineering, etc. An entrepreneurial mindset - you will be often build entirely new process or practices to ensure we best serve customers. Demonstrates a strong commitment to continuous personal and professional development, actively seeking opportunities to enhance skills, expand knowledge, and advance within their career and field. Driven, high emotional intelligence, and strong priority management skills Strongly Preferred: Sydney location is preferred, but not required Previous early-stage startup experience Passion for technology & cybersecurity Relevant hands-on technical experience, in one or more of the following domains: cloud computing environments (AWS, GCP, Azure), containers, Linux, Supply Chain Security, DevSecOps, AppSec, security, security infrastructure, regulatory compliance requirements, vulnerability management, software development lifecycle About Us We live and breathe our company values: We are customer obsessed — We focus on delivering solutions to our customers that create value and make their lives better. We have a bias for intentional action — We prioritize, plan, try things, and fail fast. We don't take ourselves too seriously (but we do serious work) — We are solving an important problem which takes focus, but we also like to enjoy the journey. We trust each other and assume good intentions — We're transparent with decisions to empower team members to make well informed decisions. A few of the benefits we offer: Flexible & Remote-First Culture: Work remotely with team meetup opportunities, bi-annual destination summits, and a monthly stipend for coworking spaces, phone and internet costs. Our Approach to Equity: Receive stock options upon hire and promotion. Plus, you can participate in secondary offerings and have 10 years to exercise your options (yes, you read that correctly: 10 years!). 100% Covered Health Insurance: We cover 100% of your health, vision and dental insurance premiums for you and your dependents. Nothing comes out of your paycheck. ∞ Flexible Time Off: Take the time you need – to do our best work, we need to recharge and reset. 18 Weeks Paid Parental Leave: We offer 18 weeks for birthing parents and 12 weeks for non-birthing parents, with the option to use it all at once or throughout your child's first year. If your experience is close but doesn't fulfill all requirements, please apply. We're building the best team in technology and are focused on hiring "Chainguardians" with unique backgrounds, perspectives, and experiences. Chainguard is an equal opportunity employer. We do not discriminate based upon race, religion, color, national origin, sex (including pregnancy, childbirth, reproductive health decisions, or related medical conditions), sexual orientation, gender identity, gender expression, age, status as a protected veteran, status as an individual with a disability, genetic information, political views or activity, or other applicable legally protected characteristics. We also consider qualified applicants with criminal histories, consistent with applicable federal, state and local law. By submitting your application, you acknowledge that Chainguard will process your personal data in accordance with Chainguard's Global Candidate Privacy Notice . ©2026 Chainguard. All Rights Reserved.

- Участие в Agile-командах и проектных группах в качестве эксперта по защите информации. - Формирование и обоснование требований информационной безопасности к ИТ-системам.

Организовывать и контролировать проведение аудитов и архитектурных ревью; Планировать задачи и управлять приоритетами;

Команда безопасности ИИ ищет специалиста для whitebox-анализа LLM-приложений, AI-агентов, RAG и векторных БД. Нужно выявлять prompt injection и другие AI-угрозы, проверять защитные фильтры и контроль вызовов инструментов.

Location: United States - Remote Chainguard is the trusted source for open source. By delivering hardened, secure, and production-ready builds of all the open source software engineers and AI agents rely on, Chainguard helps organizations build faster, stay compliant, and eliminate risk. Our customers include Fortune 500 enterprises and global industry leaders, including Anduril, Canva, Fortinet, Hewlett Packard Enterprise, OpenAI, Snap Inc., and Snowflake. Chainguard is venture-backed by leading investors, including Amplify, IVP, Kleiner Perkins, Lightspeed Venture Partners, Mantis VC, Redpoint Ventures, Sequoia Capital, and Spark Capital. At Chainguard, we are on a mission to secure the software supply chain by default. We are choosing to do this the right way, which is the hard way. Some have even called us “the Justice League of security.” Our team is founded by the industry's leading experts on open source software, security and cloud native development and is backed by Spark Capital, Sequoia, Amplify Partners, the Chainsmokers and more. Chainguard’s product portfolio includes Chainguard Images and Professional Services. Customers range from Fortune 500 companies in banking, fintech, government and infrastructure to startups and SMBs. Join us as we help organizations secure their software supply chain from source to production. The role, in a nutshell: As a Customer Success Manager at Chainguard, you will be the post-sales primary point of contact for our Commercial customers. You will be responsible for taking lead on customer engagements across onboarding, implementation, and adoption. In this role, you will work closely with Solutions Architects, Technical Support, Product Management, Engineering and Sales to ensure the successful onboarding and support of your customers. You are their day-to-day contact, building relationships with customers and driving outcomes, adoption, and delivering time-to-value. What you’ll do: Customer Onboarding: Lead the technical onboarding process for new customers. Partner with customers, pre-sales, and post-sales teams to understand requirements, goals, and challenges to formulate an onboarding plan. Account Management: Develop relationships with multiple levels of customer stakeholders from technicians to CISOs. Work closely with sales teams to identify the best path to renew and expand customers while minimizing churn risks. Training & Education: Collaborate with customers and our Edu team to ensure customers are educated on product features, best practices, and security principles. Product Expertise: Develop hands-on technical knowledge of Chainguard and stay up-to-date with industry trends, new features, and best practices so you can help customers optimize their use of Chainguard. Customer Advocacy: Act as the voice of the customer within the organization, advocating for customer needs and requirements to internal teams.  This means being a team player and having strong collaboration skills - this role must align with many different internal teams, influencing them to act toward customer needs. Issue Management: Collaborate with Technical Support and Customer Engineering teams to ensure timely resolution to customer issues. What we're looking for: 2+ years experience in customer facing roles collaborating with both technical and business teams - Customer Success, Professional Services, Technical Account Management or a combination of those plus Sales, Solutions Engineering, or Technical Support. Relevant domain knowledge of one or more of the following: Supply Chain Security, DevSecOps, AppSec, security infrastructure, containers, regulatory compliance requirements, vulnerability management, software development lifecycle. This is a strategic and proactive role, our expectation is that this person will take full ownership of their customer portfolio and act with a high level of autonomy. This includes making key decisions to drive effective customer outcomes; deciding when to include our executive team or C-suite in customer escalations, how to de-risk or de-escalate customer issues and conflict, and advocating to internal teams including sales, product, engineering, etc. An entrepreneurial mindset - you will be required to both deviate from established procedure and often build entirely new processes or practices to ensure we best serve customers. Demonstrates a strong commitment to continuous personal and professional development, actively seeking opportunities to enhance skills, expand knowledge, and advance within their career and field. Driven, high emotional intelligence, and strong priority management skills Strongly Preferred: Previous early-stage startup experience Passion for technology & cybersecurity Relevant hands-on technical experience, in one or more of the following domains: cloud computing environments (AWS, GCP, Azure), containers, Linux, Supply Chain Security, DevSecOps, AppSec, security, security infrastructure, regulatory compliance requirements, vulnerability management, software development lifecycle Compensation: Up to $125,000 base salary + bonus About Us We live and breathe our company values: We are customer obsessed — We focus on delivering solutions to our customers that create value and make their lives better. We have a bias for intentional action — We prioritize, plan, try things, and fail fast. We don't take ourselves too seriously (but we do serious work) — We are solving an important problem which takes focus, but we also like to enjoy the journey. We trust each other and assume good intentions — We're transparent with decisions to empower team members to make well informed decisions. A few of the benefits we offer: Flexible & Remote-First Culture: Work remotely with team meetup opportunities, bi-annual destination summits, and a monthly stipend for coworking spaces, phone and internet costs. Our Approach to Equity: Receive stock options upon hire and promotion. Plus, you can participate in secondary offerings and have 10 years to exercise your options (yes, you read that correctly: 10 years!). 100% Covered Health Insurance: We cover 100% of your health, vision and dental insurance premiums for you and your dependents. Nothing comes out of your paycheck. ∞ Flexible Time Off: Take the time you need – to do our best work, we need to recharge and reset. 18 Weeks Paid Parental Leave: We offer 18 weeks for birthing parents and 12 weeks for non-birthing parents, with the option to use it all at once or throughout your child's first year. If your experience is close but doesn't fulfill all requirements, please apply. We're building the best team in technology and are focused on hiring "Chainguardians" with unique backgrounds, perspectives, and experiences. Chainguard is an equal opportunity employer. We do not discriminate based upon race, religion, color, national origin, sex (including pregnancy, childbirth, reproductive health decisions, or related medical conditions), sexual orientation, gender identity, gender expression, age, status as a protected veteran, status as an individual with a disability, genetic information, political views or activity, or other applicable legally protected characteristics. We also consider qualified applicants with criminal histories, consistent with applicable federal, state and local law. By submitting your application, you acknowledge that Chainguard will process your personal data in accordance with Chainguard's Global Candidate Privacy Notice . ©2026 Chainguard. All Rights Reserved.

Location: Serbia; Armenia; Bulgaria On behalf of SafetyTech Client #1 , SD Solutions is looking for a talented Adversarial Task Writer for AI Security RL Gyms. SD Solutions is a staffing company operating globally. Contact us to get more details about the benefits we offer. Responsibilities: You design prompt injection scenarios in YAML, run them against frontier models, validate success rates, and submit passing tasks. 5 high-quality tasks per week (full-time equivalent). Per-task compensation, paid on acceptance. Requirements: Adversarial mindset: you think like an attacker and understand how to exploit an AI agent’s helpfulness, authority assumptions, or trust in its environment Prompt injection expertise: direct (role-play, encoding, context flooding) and indirect/environment-embedded (poisoned tool responses, malicious content in documents, cross-context leakage) Technical writing in YAML Comfortable with Docker, CLI tools, and running systematic tests against multiple models Domain realism in at least one vertical: e-commerce, finance, HR, enterprise SaaS, healthcare, travel Background in pentesting, appsec, LLM security research, or red teaming strongly preferred The Task You build adversarial prompt injection tasks for Alice’s RL Gym platform. Each task is a self-contained YAML scenario simulating a realistic AI agent deployment, testing whether the agent can be manipulated into violating its safety policies. About the company: A company building specialized evaluation infrastructure for AI safety and robustness testing. Their platform simulates adversarial conditions used by AI development teams to validate agent behavior before deployment. Currently expanding a freelance contributor pool for scenario and environment development. By applying for this position, you agree to the terms outlined in our Privacy Policy. Please take a moment to review our Privacy Policy https://sd-solutions.breezy.hr/privacy-notice , and make sure you understand its contents. If you have any questions or concerns regarding our Privacy Policy, please feel free to contact us.

Location: EMEA - Remote Please note that we are unable to consider applications from candidates based in France, Italy, or Germany for this role. Money is moving onto the internet, and the shift has a name: Open Money. This is money that is open, portable, agentic, and owned by you. MetaMask spent the last ten years building it; with 100M+ downloads, users in ~190 countries, and trillions in cumulative transaction volume, it's the most trusted self-custodial financial platform on the internet. Now we're building the operating system for your money: one place to hold, move, grow, and use anything you own.  Join a remote-first, global team rebuilding how money works: a problem that touches everyone, every day. About the role MetaMask is a self-custody wallet that does not hold users’ private keys. Blockchain transactions are generally irreversible, meaning a vulnerability in the product or its software delivery chain can lead directly to financial losses for users. As a result, MetaMask attracts sustained attention from financially motivated attackers and sophisticated supply chain actors. We are looking for a Senior Manager, Application Security to lead application security across the MetaMask extension, mobile app, Snaps, backend services, DeFi primitives, stablecoins, and supporting smart contracts. The role covers architecture, code, dependencies, build and release controls, security testing, and vulnerability disclosure. This is a hands-on leadership role. You will set the strategy and operating model, lead a small senior team, and remain directly involved in code review and threat modelling. You will report to the Head of Security and work closely with MetaMask Engineering leadership to ensure security risks are understood, owned, and addressed. Responsibilities Leadership and planning Lead and develop the Application Security team, including hiring, performance management and career development, while remaining directly involved in technical work. Set the Application Security strategy, annual goals and quarterly OKRs in line with company objectives and the approved Target Operating Model. Define and track KPIs to measure performance and progress. Report AppSec progress, coverage, remediation performance and material gaps to Security leadership and contribute to Risk Committee reporting. Secure design and delivery Define security review requirements across development and release, assess whether they are met and escalate unresolved risks. Lead threat modelling and security design reviews across clients, APIs and backend services, including authentication, key management, signing and delegated actions. Assess trust boundaries across the full system and participate in architecture and RFC reviews. Define software supply chain security requirements and work with engineering teams to implement and validate controls for dependencies, builds, artefacts and publishing. Lead security code reviews across MetaMask applications and smart contracts, working with engineers and relevant specialists to address findings. Define and evolve the secure development lifecycle to incorporate AI agents, including their access, actions and human review requirements. Set security standards for AI development tools, generated code and AI components in products. Integrate security testing into development and delivery workflows, including static and dynamic analysis, dependency scanning, secrets detection and AI scanning. Evaluate tools and validate their findings. Help engineers prevent recurring vulnerabilities through secure coding guidance, reusable libraries, training and the security champions programme. Vulnerability management and external testing Own application vulnerability assessment, triage, prioritisation and remediation tracking within the organisation’s vulnerability management framework. Correlate findings across clients, services and supporting infrastructure with the relevant owners to assess combined impact. Ensure findings have clear owners and deadlines, verify fixes and escalate overdue risks. Set the scope and proposed investment for bug bounty, penetration testing and AI security scanning based on risk and results. Manage external providers, researcher relationships, rewards and payouts, and coordinate vulnerability disclosure. Assurance and incident support Provide evidence of application security controls for audits and assurance reviews, and support customer and partner due diligence. Provide application security expertise during incidents, including vulnerability analysis and remediation support. Qualifications Required : At least eight years in application security or software engineering with a security focus, including two years leading people. Strong practical code review skills in TypeScript/JavaScript, Go or Solidity across browser extensions, mobile applications and backend services, with the ability to identify vulnerabilities and work with engineers to fix them. Proven experience securing applications across clients and backend services, including distributed authentication, authorisation and key management. Experience building or substantially improving an AppSec programme, including security reviews, automated testing, AI scanning, vulnerability management and developer support, with sound judgement on where AI adds value and how to validate its findings. Practical experience securing software supply chains, including dependency policies, software composition analysis, npm, artefact integrity and CI/CD. Experience running bug bounty and penetration testing programmes, including selecting and managing external providers. Working knowledge of EVM smart contract security, including common vulnerabilities, review methods, upgrade and admin controls, and assessing external audits. A record of delivering security improvements through engineering teams outside your reporting line. Clear written communication, from actionable threat models to concise summaries of risk for executives. Preferred : Offensive security qualifications such as OSCP, OSWE or OSWA, or a proven record in bug bounty programmes or CTF competitions. Experience securing browser extensions or mobile applications. Experience securing development workflows that use AI, or AI components in production applications. Experience in crypto, Web3 or another sector facing sustained attacks, such as fintech, payments or infrastructure. Knowledge of or a strong interest in applied cryptography. Familiarity with attacks by state actors against software companies, particularly DPRK supply chain and social engineering campaigns. Experience providing evidence of secure development controls for SOC 2 or ISO 27001 assessments. Don't meet all the requirements? Don't sweat it. We’re passionate about building a diverse team of humans and as such, if you think you've got what it takes for our chaotic-but-fun, remote-friendly, start-up environment—apply anyway, detailing your relevant transferable skills in your cover letter. While we have a pretty good idea of what we need, we're ready for you to challenge our thinking on who needs to be in this role. In the rapidly evolving Web3 space, we believe that everyone is a builder. This expansive paradigm requires a range of backgrounds, talents, skills, and experiences to influence and shape the future. At MetaMask, this diversity fuels our ability to shift control and redefine the realm of possibility. We are committed to ensuring that our technology empowers people and communities through decentralized technologies. We welcome the range of perspectives and differences and celebrate them. We're excited to see how your unique skills as a builder can contribute to our vision, drive innovation, and help us shape a more inclusive Web3. MetaMask is an equal opportunity employer. All employment decisions are made without regard to race, color, national origin, ancestry, sex, gender, gender identity or expression, sexual orientation, age, genetic information, religion, disability, medical condition, pregnancy, marital status, family status, veteran status, or any other characteristic protected by law. MetaMask is aware of fraudulent recruitment practices and we encourage all applicants to review our best practices to protect yourself, which can be found on our page. MetaMask may use artificial intelligence (AI) tools to support parts of our recruitment process, such as reviewing applications, screening resumes, or conducting initial candidate assessments. These tools are designed to assist our recruiting team and improve efficiency — they do not replace human judgment. A human recruiter or hiring manager reviews every candidate, and all final hiring decisions are made by people, not AI. It is a requirement of employment in this position that applicants may be required to submit to background and identity verification checks, including but not limited to employment, education, criminal record checks, and other such checks as determined necessary by the company.

Location: San Francisco, CA | New York City, NY About Anthropic Anthropic’s mission is to create reliable, interpretable, and steerable AI systems. We want AI to be safe and beneficial for our users and for society as a whole. Our team is a quickly growing group of committed researchers, engineers, policy experts, and business leaders working together to build beneficial AI systems. About Anthropic Anthropic’s mission is to create reliable, interpretable, and steerable AI systems. We want AI to be safe and beneficial for our users and for society as a whole. Our team is a quickly growing group of committed researchers, engineers, policy experts, and business leaders working together to build beneficial AI systems. About the role Anthropic’s Applied AI team helps the world’s largest organizations put Claude to work. As a Cybersecurity Specialist on Applied AI, you’ll be part of an overlay team of domain experts who sit alongside our enterprise account teams and bring deep security expertise to the accounts where it matters most. You won’t own an account. You’ll be the security expert the account team pulls in to win and grow the most important security conversations: helping CISOs and security leaders see where Claude can take on real security work, then guiding them from early pilots to durable, production workloads. You’ll cover a portfolio of enterprise accounts across regulated industries like financial services, insurance, and healthcare, strategic accounts like semiconductors (IP protection, industrial control systems, export controls), and digital natives and public sector agencies, each with its own threat model. How this team works You partner with account executives, account architects, and generalist Applied AI engineers, who own the customer relationship and the broader technical engagement. You bring the security depth they don’t have time to build. You work across many accounts at once, so the playbooks, reference implementations, and evaluation approaches you build are reused across the field, not just for one customer. You are the connection point between the field and Anthropic’s Product, Research, and Engineering teams, turning what you see in customer security programs into product feedback. You work alongside ISVs, systems integrators, and managed security providers who already serve these customers, enabling them where they own the engagement rather than competing with them. Responsibilities Join account teams to understand a customer’s security program, identify where Claude can do meaningful security work, and turn that into a technical plan and business case Serve as the security-domain technical advisor on strategic enterprise accounts, from discovery through deployment Move customers from one-time code scanning to sustained security workloads: application security in the SDLC, continuous automated penetration testing, alert triage and investigation, and threat intelligence that answers “does this new vulnerability affect us, and where” Build and maintain reference implementations, harnesses, and evaluation approaches, and help customers adapt them to their own environments and controls Run workshops and hands-on sessions where customer security teams use Claude on their own code and workflows Equip partners to deliver Claude-powered security outcomes, with a clear line between what Anthropic delivers and what partners deliver Speak credibly to every audience, from appsec engineers to CISOs and executives, including how to explain the value and risk of security work in business terms Define and track adoption depth for each security workload across your accounts, and work with Product and Engineering on the telemetry to measure it Write the playbooks and best practices the rest of the field can reuse, including how Claude complements the security tooling customers already own Develop reference customers who can speak to the value they’re realizing Stay current on frontier LLM capabilities and the new classes of vulnerabilities and attacks they surface Travel occasionally to customer sites for workshops and technical deep dives You may be a good fit if you have 5+ years in security roles, with hands-on depth in at least two of: application security and secure SDLC, offensive security and penetration testing, detection and response, or threat intelligence and vulnerability management Experience in a technical customer-facing role (Solutions Architect, Sales Engineer, security consultant, TAM), or on a security team where you had to win investment from leadership Experience with large enterprise customers and complex, multi-stakeholder buying cycles, including working alongside the vendors and partners already in the account The ability to translate between security teams, engineering teams, and executives Comfort with Python, CI/CD, and cloud environments, plus hands-on experience using LLMs for security work such as code review, vulnerability discovery, triage, or investigation A love of teaching and a collaborative approach to working across teams and balancing competing priorities The annual compensation range for this role is listed below. For sales roles, the range provided is the role’s On Target Earnings ("OTE") range, meaning that the range includes both the sales commissions/sales bonuses target and annual base salary for the role. Annual Salary: $300,000 — $400,000 USD Logistics Minimum education: Bachelor’s degree or an equivalent combination of education, training, and/or experience Required field of study: A field relevant to the role as demonstrated through coursework, training, or professional experience Minimum years of experience: Years of experience required will correlate with the internal job level requirements for the position Location-based hybrid policy: Currently, we expect all staff to be in one of our offices at least 25% of the time. However, some roles may require more time in our offices. Visa sponsorship: We do sponsor visas! However, we aren't able to successfully sponsor visas for every role and every candidate. But if we make you an offer, we will make every reasonable effort to get you a visa, and we retain an immigration lawyer to help with this. We encourage you to apply even if you do not believe you meet every single qualification. Not all strong candidates will meet every single qualification as listed.  Research shows that people who identify as being from underrepresented groups are more prone to experiencing imposter syndrome and doubting the strength of their candidacy, so we urge you not to exclude yourself prematurely and to submit an application if you're interested in this work. We think AI systems like the ones we're building have enormous social and ethical implications. We think this makes representation even more important, and we strive to include a range of diverse perspectives on our team. Your safety matters to us. To protect yourself from potential scams, remember that Anthropic recruiters only contact you from @anthropic.com email addresses. In some cases, we may partner with vetted recruiting agencies who will identify themselves as working on behalf of Anthropic. Be cautious of emails from other domains. Legitimate Anthropic recruiters will never ask for money, fees, or banking information before your first day. If you're ever unsure about a communication, don't click any links—visit anthropic.com/careers directly for confirmed position openings. How we're different We believe that the highest-impact AI research will be big science. At Anthropic we work as a single cohesive team on just a few large-scale research efforts. And we value impact — advancing our long-term goals of steerable, trustworthy AI — rather than work on smaller and more specific puzzles. We view AI research as an empirical science, which has as much in common with physics and biology as with traditional efforts in computer science. We're an extremely collaborative group, and we host frequent research discussions to ensure that we are pursuing the highest-impact work at any given time. As such, we greatly value communication skills. The easiest way to understand our research directions is to read our recent research. This research continues many of the directions our team worked on prior to Anthropic, including: GPT-3, Circuit-Based Interpretability, Multimodal Neurons, Scaling Laws, AI & Compute, Concrete Problems in AI Safety, and Learning from Human Preferences. Come work with us! Anthropic is a public benefit corporation headquartered in San Francisco. We offer competitive compensation and benefits, optional equity donation matching, generous vacation and parental leave, flexible working hours, and a lovely office space in which to collaborate with colleagues. Guidance on Candidates' AI Usage: Learn about our policy for using AI in our application process.

Задачи: — Работа над платформой безопасной разработки TRAIO, сканирующей код, библиотеки и приложения. — Работа с банками и госсектором Центральной Азии. Требования: — Опыт работы в стартапе или небольшой команде. — Умение выявлять и предлагать улучшения. — Уверенное владение Linux и Docker. — Опыт работы с Claude Code или Cursor, понимание их ограничений и умение проверять результат ИИ. — Стек: React + TypeScript, Python (FastAPI), PostgreSQL, Docker, GitLab CI. Условия: — Ноутбук и Claude Max за счет компании. — Работа в области AppSec. — График: 5/2, 10:00–18:00.