Вакансии

Location: Самара Workplace: В офисе О компании RED Security – открытая экосистема ИБ-решений и экспертизы для комплексной защиты бизнеса. RED Security SOC – центр мониторинга и реагирования на кибератаки. Обязанности расследовать нетиповые инциденты ИБ с различных источников; взаимодействовать с заказчиками по техническим вопросам; анализировать полноту и качество анализа инцидентов; проводить обучение и делиться опытом с другими аналитиками. Требования понимание векторов атак на корпоративные сети и способы противодействия; знание современных методов классификации тактик и техник атакующих (Mitre Attack, Kill Chain); опыт в расследовании инцидентов ИБ; умение анализировать журналы регистрации событий в различных системах (ОС, СЗИ, сетевое оборудование, прикладное ПО, access логи и др). Условия сменный режим работы в офисе г. Самара; собственную платформу MTS Ocean для получения ИТ-ресурсов, а это значит, что деплой, мониторинг, observability — не будут для тебя проблемой, ты сможешь сосредоточиться на фичах; профессиональные гильдии инженеров, где мы поддерживаем друг друга и помогаем стать лучше; внутреннюю площадку TechTalks для обмена опытом, дискуссий, развития навыков самопрезентации; участие во внешних IT конференциях. Наши эксперты выступают на ведущих профильных конференциях, таких как HighLoad++, DevOps Conf, Joker, AHA!, Матемаркетинг и другие. А еще мы организуем собственную масштабную конференцию True Tech Day и регулярно проводим митапы для разработчиков и инженеров. полезные курсы и вебинары в корпоративном университете и электронную библиотеку; ДМС с первого месяца работы, включая стоматологию; страхование от несчастных случаев с 1 месяца работы. Материальную помощь в сложных жизненных ситуациях; отпуск 28 календарных дней (+3 дополнительных дня за ненормированный рабочий день); прием врачей общей практики и массаж в офисе; мобильная связь за счет компании и льготные тарифы для близких; подписка на онлайн-кинотеатр KION, сервис МТС Музыка, книжный сервис Строки от МТС, безлимитные мессенджеры и соцсети.

Location: Warsaw, PL We bring startups and disruptive tech companies to the local market, offering engineers the opportunity to work on innovative, high-impact products. Join us and become a member of their R&D team while we take care of employment, HR support, a benefits package, and an enjoyable work environment. We are building a local Polish team for a customer who is a US-based B2B technology company. ‍ They develop an AI-powered skills assessment and workforce development platform. It helps enterprises assess employees’ and candidates’ capabilities, identify skill gaps, and guide development across areas such as AI, data, and technology. Companies use these insights to support hiring, upskilling, and workforce planning. We are looking for a Security Operations Specialist to take ownership of information security operations and collaborate closely with the engineering team to ensure robust security practices are in place. ‍ Please note: ‍ 📌 This is a 6-month project role, with a potential possibility of extention. 📌 The role requires working closely with the US team, with working hours overlapping until 10:00 PM Warsaw time. ‍ Own vulnerability management across cloud infrastructure, applications, APIs, dependencies, containers, secrets, and infrastructure-as-code where applicable; Coordinate penetration testing engagements and drive the remediation of identified findings; Maintain security documentation, metrics, remediation records, and technical response playbooks; Review and improve security processes and controls across the entire engineering organization; Support cross-functional security initiatives, technical readiness efforts, and transitions involving systems, tooling, and controls; Maintain cloud security standards and align processes with security frameworks such as SOC 2 and NIST; Partner with technical teams on security monitoring, logging, identity and access, secure configuration, incident response, and technical risk reduction. Proven experience in security monitoring and vulnerability management; Experience coordinating penetration testing and following up on findings; Practical experience with Cloud Security and industry frameworks such as SOC 2 and NIST; Proactive approach with the ability to work independently, prioritize tasks, and deliver results in a lean team environment. Hands-on experience using AI tools to enhance security operations and streamline workflows. ‍ ‍ ‍ 📌 This is a 6-month project role, with a potential possibility of extention. 📌 The role requires working closely with the US team, with working hours overlapping until 10:00 PM Warsaw time. At On The Spot, we’re creating a workplace people would want to stay in: supportive, well-organized, and fair in terms of conditions and benefits. ‍ We’ll share more about our benefit package during the interviews. In the meantime, you can always check our Glassdoor reviews .

Location: Remote (Ukraine) Workplace: remote ELEKS Information Security Office is looking for a Security Operations Supervisor in Lviv, Ternopil, Kyiv, or Ivano-Frankivsk. Security Operations Supervisor is responsible for designing, implementing and maintenance of ELEKS Security Operations Center (SOC) and related ISMS processes. Specifically, Security Operations Supervisor objective is to ensure efficient execution of Incident Management, Threat Intelligence, Vulnerability Management and Patch Management activities. REQUIREMENTS Working experience in architecture, design and implementation of security systems and countermeasures (e.g. SIEM, EDR, DLP, UEBA, IDS/IPS, vulnerability scanners, anti-virus and anti-malware, firewalls, encryption) Knowledge of Security Operation Center processes, ability to perform supervision of SOC and perform continuous improvement of its operations Working experience in planning and conducting of technical security audits. Knowledge of Information Security (IS) standards/frameworks (ISO 27001/2, SOC2, Cyber Essentials, PCI DSS, HiTrust), ability to establish IS processes in line with these standards Network architecture, security principles, technologies, and tools Detailed technical knowledge of Windows and UNIX operating systems Virtualization technologies and security Identity and access management principles and technologies Subnetting, DNS,DHCP, VPNs, VLANs, VoIP and other network routing methods Network and web related protocols (e.g., TCP/IP, UDP, IPSEC, HTTP, HTTPS, etc.) Solid knowledge of secure coding practices, application security and cryptography technologies, ethical hacking, threat modeling, secure SDLC process Solid knowledge of disaster recovery and business continuity planning Strong analytical and conceptual skills balanced by broad perspective on how security efforts to support realization of business goals and customer satisfaction Proven leadership capabilities and strong communication and interpersonal skills English – upper-intermediate or higher RESPONSIBILITIES Develop and maintain short- and long-term goals and objectives for ELEKS Security Operations Center aligned with Information Security goals Define activities and projects supporting continuous improvement of ELEKS Security Operations Center, addressing the IS gaps identified and enhancing ELEKS security overall Evaluate new technologies and processes that enhance security capabilities. Design, architect, test, analyze, evaluate and implement new security systems and processes Perform program and project management activities to ensure successful execution of ISMS projects assigned. Coordinate the development and review of ISMS policies relevant to SOC activities and other supporting documents, such as Hardening Baselines, IS standards/procedures Effectively inform stakeholders about the status of the ELEKS information security posture. Perform periodic security reporting (both: executive and technical) Coordinate handling of the information security incidents, coordinate investigation activities, communicate with clients and, if needed, escalate to ELEKS senior management, and contact authorities (Police, CERT-UA, etc.) Plan, control, and perform installation, configuration, technical support and administration of security systems and countermeasures (e.g. SIEM, EDR, DLP, UEBA, IDS/IPS, vulnerability scanners, anti-virus and anti-malware, firewalls, encryption) Supervise and perform system hardening, security testing, and vulnerability management Prevent, detect, investigate and respond to cyber threats for the organization’s assets Build and establish plans and controls to protect digital files and information systems against unauthorized access, modification and/or destruction Coordinate configuration, management and running the phishing simulation campaigns Plan, manage and optimize the capacity of ELEKS SOC Provide leadership, training and technical advice to SOC team. Identify/address training and career development needs, provide feedback and conduct performance assessment of subordinates Management of access rights for SOC by participation in approval, review, and removal of access rights (in case of specialist termination, role change and on a regular basis as per Access Control Policy) Resolve security incidents within the SOC team and, if necessary, perform disciplinary actions in conjunction with HR team

Workplace: Москва и Краснодар (гибрид/офис), другие города - удаленно MAGNIT TECH — технологичный драйвер одного из крупнейших ритейлеров страны. Мы создаём будущее: от решений в области автономной логистики с полностью автоматизированными распределительными центрами до исследований потенциала квантовых вычислений. Сейчас мы в поиске Аналитика SOC L3. О продукте Команда создаёт и развивает контент для систем SIEM и SOAR: пишем нормализацию событий, правила корреляции, сценарии реагирования и плейбуки. Фокус — на автоматизации: строим рабочие процессы, кастомные модули и интеграции внутри SOAR-платформы, чтобы обработка инцидентов и рутинные операции закрывались алгоритмами, а не руками. Задачи Разрабатывать и поддерживать плейбуки и сценарии автоматизации в SOAR; Проектировать и реализовывать кастомные модули и интеграции внутри платформы; Настраивать и развивать механизмы нормализации событий и корреляций; Выстраивать и оптимизировать рабочие процессы для обработки инцидентов; Участвовать в проектировании архитектуры сценариев и выборе технических решений; Документировать реализованные сценарии и автоматизации; Предлагать улучшения и новые механизмы автоматизации в существующей базе. Требования Понимание процессов мониторинга и реагирования; Уверенный опыт администрирования и разработки под SOAR-системы; Навыки программирования на скриптовых языках; Опыт практической интеграции SIEM и различных СЗИ с системой оркестрации Условия Оформление в аккредитованную ИТ-компанию Конкурентоспособную заработную плату (обсуждается индивидуально) ДМС со стоматологией и льготными условиями для членов семьи Технику для работы График работы 5/2 с гибким началом Работу в максимально уютном офисе в Москве на ст. м. Савёловская, в Краснодаре или удаленно из других городов РФ, так же есть ИТ офисы в Санкт-Петербурге (ст. м. Балтийская) и Иннополисе Возможность проведения и участия в митапах, хакатонах, где есть возможность познакомиться с работой других подразделений Возможность реализовать свой опыт и потенциал в интересных и многоплановых проектах, получить новый интересный опыт в решении сложных задач Наличие корпоративных скидок и программ лояльности Наличие корпоративной библиотеки курсов Формат работы Москва и Краснодар (гибрид/офис), другие города - удаленно

Workplace: Москва и Краснодар (гибрид/офис), другие города - удаленно MAGNIT TECH — технологичный драйвер одного из крупнейших ритейлеров страны. Мы создаём будущее: от решений в области автономной логистики с полностью автоматизированными распределительными центрами до исследований потенциала квантовых вычислений. Сейчас мы в поиске Инженера SOC L2 . О продукте Команда защищает современную облачную инфраструктуру компании: Linux, Kubernetes, контейнеры и облачные сервисы. Расследуем инциденты, проактивно ищем угрозы и наводим порядок в конфигурациях безопасности, чтобы инфраструктура работала без сбоев. Работаем с реальной продуктовой средой: собственная облачная платформа, Yandex Cloud, Cloud.ru, Kafka, PostgreSQL, Redis, Object Storage. Каждый инцидент — возможность разобраться, как система устроена изнутри, на уровне процессов, сетей и ядра. Формального опыта в SOC не требуется — нам интересны и инженеры DevOps, DevSecOps, SRE с сильной технической базой, которые хотят развиваться в Cloud Security, Threat Hunting и Incident Response. Для нас важнее практические инженерные навыки и системное мышление. Задачи Расследовать сложные и нетиповые инциденты в Linux, Kubernetes, контейнерной и облачной инфраструктуре; Проводить технический анализ и DFIR: процессы, сетевые соединения, системные журналы, артефакты компрометации; Проводить проактивный поиск угроз (Threat Hunting) на основе гипотез, IoC и техник MITRE ATT&CK; Выявлять векторы атак, находить первопричины инцидентов и давать технические рекомендации по устранению угроз; Расследовать инциденты в Kubernetes: Audit Logs, события, контейнеры, активность внутри кластера; Анализировать техники атак на Kubernetes и контейнеры по MITRE ATT&CK for Containers; Выявлять небезопасные конфигурации: RBAC, NetworkPolicy, Pod Security Standards, Secrets, SecurityContext, Admission Controllers; Анализировать защищённость облачных сервисов: Kafka, S3/Object Storage, PostgreSQL, Redis; Находить ошибки в конфигурациях IAM, сетевого доступа, аутентификации, авторизации, шифрования и управления секретами; Писать скрипты и инструменты для автоматизации расследований, сбора артефактов и проверки конфигураций; Разрабатывать сценарии обнаружения атак и методы проактивного поиска угроз; Исследовать новые техники атак на Linux, Kubernetes и облачные сервисы; Готовить техническую документацию, инструкции и сценарии расследований; Делиться экспертизой с командой и развивать процессы реагирования на инциденты. Требования Уверенное знание Linux: процессы, файловая система, права доступа, systemd, сетевой стек, системные журналы, механизмы аудита; Практический опыт работы с Kubernetes: kubectl, архитектура кластера, Pod, Deployment, DaemonSet, ServiceAccount, RBAC, NetworkPolicy, Secrets; Понимание Docker/containerd, механизмов изоляции контейнеров и возможных векторов атак; Знание основных техник MITRE ATT&CK применительно к Linux, контейнерам и Kubernetes; Понимание принципов безопасной настройки облачных сервисов: IAM, S3/Object Storage, Kafka, СУБД, сетевой доступ, управление секретами; Знание сетевых протоколов TCP/IP, DNS, HTTP(S), TLS; Уверенное владение Bash — самостоятельно пишешь скрипты для автоматизации задач; Понимание Git, CI/CD, Infrastructure as Code и DevOps-практик; Умение технически анализировать проблемы и самостоятельно искать их первопричину. Будет плюсом Опыт в SOC L2/L3, Incident Response, DFIR, DevSecOps или SRE; Практический опыт с российскими облаками или частными облачными платформами; Python / Go и опыт разработки инструментов автоматизации; Опыт с Terraform, Helm, Argo CD / FluxCD, GitLab CI/CD; Знакомство с инструментами безопасности Kubernetes: Falco, Tetragon, Trivy, Kyverno; Опыт работы с Wireshark, osquery и другими DFIR-инструментами; Понимание eBPF, Kubernetes Runtime Security и обнаружения атак на уровне ОС и контейнеров; Опыт технических исследований безопасности и Threat Hunting. Условия Оформление в аккредитованную ИТ-компанию Конкурентоспособную заработную плату (обсуждается индивидуально) ДМС со стоматологией и льготными условиями для членов семьи Технику для работы График работы 5/2 с гибким началом Работу в максимально уютном офисе в Москве на ст. м. Савёловская, в Краснодаре или удаленно из других городов РФ, так же есть ИТ офисы в Санкт-Петербурге (ст. м. Балтийская) и Иннополисе Возможность проведения и участия в митапах, хакатонах, где есть возможность познакомиться с работой других подразделений Возможность реализовать свой опыт и потенциал в интересных и многоплановых проектах, получить новый интересный опыт в решении сложных задач Наличие корпоративных скидок и программ лояльности Наличие корпоративной библиотеки курсов Формат работы Москва и Краснодар (гибрид/офис), другие города - удаленно

Workplace: Удаленно Объединённая компания Wildberries и Russ — это международная технологическая компания, образованная в результате слияния двух лидеров рынка — IT-компании Wildberries и оператора наружной рекламы Russ. По мере масштабирования IT-направления, Wildberries активно усиливает команду ИБ, создавая надежную и адаптивную инфраструктуру защиты. Мы сталкиваемся с уникальными вызовами, от повышения безопасности каждого отдельного сервиса до обеспечения целостной защиты всей нашей обширной инфраструктуры. Мы ищем аналитика SOC, который будет проектировать и развивать распределенные системы централизованного сбора, обработки и анализа событий. Аналитику предстоит обеспечить масштабируемое и воспроизводимое обнаружение и реагирование на инциденты в инфраструктурах бизнес-юнитов объединенной группы компаний. Обязанности Реагирование на инциденты информационной безопасности; Проведение полного цикла мероприятий по форензике; Формирование списка корректирующих действий, их контроль и реализация на основе уроков, извлеченных из инцидентов; Разработка и поддержка в актуальном состоянии плейбуков по реагированию на инциденты; Участие в процессе подключения источников: оценка полноты информации для реагирования на инциденты. Требования Навыки идентификации и анализа вредоносного ПО, cкриптов, документов; Опыт работы с SIEM: умение выстраивать оптимальные поисковые запросы, интерпретировать полученные результаты, строить визуализации для удобного отображения и анализа данных; Умение пользоваться инструментарием по сбору триажа и форензике; Владение Python/PowerShell/Bash на уровне, позволяющем автоматизировать повседневные задачи; Знание одной из систем Linux/Windows/MacOS на уровне системного администратора; Навыки анализа и обработки большого объема данных (логи с хостов, триажи, дампы памяти/жестких дисков) с ручной и/или автоматической корреляцией между собой и выделением значащих данных. Будет плюсом: Опыт работы с ELK stack; Знание устройства Kubernetes, Docker, особенностей их мониторинга; Умение писать простые SQL-запросы; Опыт работы с NTA; Наличие профильных сертификатов по информационной безопасности Выступления на крупных конференциях и митапах, например PHDays, OffZone, Standoff и других. Условия Обучение и развитие: языковые клубы, собственный корпоративный университет, программы развития управленческих навыков и многое другое; Благополучие сотрудников: корпоративный пакет ДМС со стоматологией, корпоративный спорт, консультации психолога и дополнительные возможности аккредитованной IT-компании; Множество сообществ: клуб спикеров, футбола, йоги, шахмат и т.д.; Забота о семьях: создаем условия, в которых легко сочетать карьеру и заботу о близких – от гибкого подхода до масштабных проектов для детей сотрудников; Скидки и партнерские программы: на обучение, страхование, покупки и многое другое; Комфортная рабочая среда: бесплатное питание в офисе, современные офисы рядом с метро, корпоративная техника и портал для сотрудников.

Location: Australia; Hong Kong The Global Security Operations Engineer is a senior technical role responsible for strengthening the firm's ability to detect, investigate, respond to, and recover from cybersecurity threats across its global environment. Working as part of the Global Security operations team, the successful candidate will lead complex security investigations, develop and optimize threat detection capabilities, and implement automation to improve the effectiveness and efficiency of security operations. The role combines hands-on incident response with proactive security engineering, helping the firm move from reactive alert management toward an increasingly automated, intelligence-led security operating model. Operating within a geographically distributed organization, the successful candidate will work closely with global and regional technology and security teams, provide technical leadership during significant incidents, and contribute to the continuous improvement of security capabilities. Based in APAC, the role will provide critical regional coverage as part of a coordinated global security operations function. Responsibilities Advanced Investigation and Incident Response Serve as a senior escalation point for security incidents, assuming ownership of complex, ambiguous, and high-severity events that exceed first-line triage capability. Conduct detailed investigations to establish initial access vectors, attacker activities and objectives, scope of compromise, and dwell time, documenting findings to an appropriate evidentiary standard. Perform root cause analysis on confirmed incidents and near misses, identifying underlying security control or process failures rather than simply addressing immediate symptoms. Act as technical lead during significant incidents across containment, eradication, and recovery, coordinating activities across global and regional teams. Conduct host and network forensics and malware triage, engaging specialist forensic providers where investigations exceed internal capabilities. Translate technical findings into clear statements of business risk for leadership and drive post-incident corrective actions through to closure. Investigate identity-based attacks, account compromise, unauthorized access, and suspicious activity across cloud platforms and enterprise applications, including Microsoft 365 and Entra ID. Participate in an on-call rotation and provide out-of-hours escalation support during serious incidents, and undertake additional projects and activities as required. Security Automation & Detection Engineering Design, build, tune, and maintain detection content mapped to the MITRE ATT&CK framework, identifying and reporting coverage gaps against threat actor tactics, techniques, and procedures relevant to the firm. Reduce false-positive volume and analyst alert fatigue through systematic tuning, suppression logic, and automated alert enrichment. Operationalize threat intelligence by translating reporting and indicators of compromise into actionable detections, threat-hunting hypotheses, and preventive controls. Design, develop, and maintain automated response playbooks, including Logic Apps, automation rules, and SOAR workflows, to reduce mean time to detect and respond. Write and maintain queries, scripts, and code (KQL, PowerShell, Python, or equivalent) supporting detection, enrichment, automated triage, and reporting. Integrate security tooling and data sources through APIs and connectors, including onboarding new log sources with appropriate parsing, normalization, and validation. Continuously assess and improve security monitoring, detection, and response capabilities, identifying opportunities to strengthen coverage, reduce operational complexity, and improve effectiveness through automation and technology optimization. Identify opportunities to apply AI-assisted investigation, alert triage, and security automation capabilities to improve detection effectiveness, reduce manual effort, and accelerate incident response. Conduct proactive threat hunting to identify suspicious activity, validate detection effectiveness, and uncover threats that may evade existing security controls. Requirements This is a hands-on technical role requiring demonstrated depth in security operations, sound technical judgment, and the ability to work with limited supervision. We value analytical rigor, curiosity, initiative, and a willingness to share knowledge and develop others as highly as any individual technology or certification. Compulsory Requirements: 5+ years of experience in security operations, incident response, or detection engineering, including demonstrable experience working in a Security Operations Center (SOC). Proven experience leading complex technical investigations end to end, from escalation through root cause analysis to documented remediation. Deep, hands-on expertise with modern SIEM and endpoint detection and response (EDR) platforms, including authoring and optimizing detection logic, conducting investigations, and managing data onboarding. Strong practical automation and scripting abilities, including KQL and at least one of PowerShell or Python, with demonstrated experience developing and operating automation in production. Experience designing and maintaining automated response playbooks using Logic Apps, automation rules, or comparable SOAR capabilities. Advanced knowledge of the MITRE ATT&CK framework, Cyber Kill Chain analysis, and established incident response methodologies, such as PICERL. Strong working knowledge of TCP/IP and networking, Windows and Linux operating systems, Active Directory, Entra cloud identity and authentication, and security operations across cloud and hybrid environments. Experience with host and network forensics, malware triage, and the analysis of malicious email headers, links, and attachments. Strong written and verbal communication skills, including the ability to communicate technical findings and security risks to both technical and nontechnical audiences. Ability to work independently and collaborate effectively with geographically dispersed teams, with flexibility to provide out-of-hours support during significant security incidents. Occasional travel to support global cybersecurity operations and incident response may be required Preferred Requirements: Bachelor's degree in Information Security, Information Technology, Computer Science, or a related discipline, or equivalent professional experience. Industry certifications such as GCIH, GCIA, GCFA, GREM, OSCP, CySA+, SC-200, AZ-500, or CISSP. Hands-on experience with Microsoft security technologies, including Microsoft Sentinel, Microsoft Defender XDR, Microsoft Entra ID, and Microsoft Azure. Experience operating within a global, federated, or shared-services model, ideally in professional services or another highly regulated sector. Familiarity with ISO 27001, the NIST Cybersecurity Framework, or comparable control frameworks Benefits Benefits are aligned with the respective location. The above is intended to describe the general content of and requirements for the performance of this job.  It is not to be construed as an exhaustive statement of essential functions, responsibilities or requirements.

Location: Lisbon, Portugal About the Role iCapital is looking to hire a Cyber Security Operations Associate to join the Information Security team. This role is a first responder for reviewing and responding to cyber security alerts.  The Associate will work alongside the security engineering team to provide situational awareness through detecting, containing and resolving cyber security threats using a comprehensive set of cyber security technologies including IDS, IPS, DLP, SIEM, AWS and firewall technologies. Responsibilities Monitor and respond to security events and alerts from a variety of signals. Triage incidents quickly and effectively, escalating priorities to the appropriate business units. Perform routine tasks to measure and report on the state of cyber security defenses at the company. Develop and curate security detections through the security technology stack. Take charge of responding to and remediating cyber security intrusions. Compile and maintain detailed incident response reports. Assist in developing and updating security procedures, playbooks, and knowledge bases. Conduct open-source threat intelligence research to seek out and investigate new indicators of compromise for application. Qualifications 3-4 years security related experience or in a similar field Bachelor’s degree in information security, information technology or computer science preferred Experience in Splunk or other SIEM; Search and analysis, log aggregation etc. Basic understanding of Agile Frameworks Knowledge of common cyber threats, attack vectors, and security frameworks (NIST, MITRE ATT&CK) Good understanding of TCP/IP protocols Knowledge of Linux, Windows and macOS operating systems Experience with cloud infrastructure systems like AWS is preferred Fast learner with desire to always learn combined with the ability to multi-task Attentive, organized, and detail-oriented Solid problem-solving and analytical skills Excellent communication skills We believe the best ideas and innovation happen when we are together. Employees in this role will work in the office four days, with the flexibility to work remotely one day (Friday). Benefits iCapital offers a comprehensive benefits package that includes a total compensation program consisting of competitive salary, annual performance bonus, and equity for all full-time employees; healthcare with 100% employer-paid health and dental insurance; and generous paid time off (PTO). For additional information on iCapital Network, please visit https://www.icapitalnetwork.com/about-us Twitter: @icapitalnetwork | LinkedIn: https://www.linkedin.com/company/icapital-network-inc

Location: Australia What We Do: Cybercrime is growing, and more businesses are getting hit by threats that used to target only the biggest organizations. That pushes defenders like us to operate at the highest level, and it deepens our need for good people who want to make a meaningful impact. Founded in 2015 by former NSA cyber operators, Huntress is a remote-first team working to make enterprise-grade cybersecurity accessible to businesses of all sizes. We work closely with security teams and service providers protecting complex environments, often without the time or headcount to handle it all. That’s why we build our technology in-house and back it with a 24/7 human-led Security Operations Center (SOC). As a result, our platform is never disconnected from the experts who manage it, ensuring our customers' protection. Huntress now secures more than 6M endpoints and 17M identities worldwide. Those numbers keep growing because more businesses rely on us to help carry the load and operate with more confidence. Every day, you can see that commitment in how we stand with our customers and how we show up for each other. Reports to: Senior Manager, Security Operations Center Location: Remote Australia Compensation Range: $110,000 to $140,000 AUD base plus bonus and equity What You’ll Do: You’re a hands-on SOC Analyst who thrives on detecting and responding to cybercrime. You’ll triage Active Hands-On Keyboard intrusions, track attackers through networks, and help remove them before they achieve their objectives. You’ll contextualise endpoint telemetry, analyse logs, leverage forensic artifacts, and understand malware to uncover the full scope of an intrusion. You give a $ht about protecting customers and improving how the team operates, taking ownership of investigations and acting on the information available. You bring Warrior Spirit to complex incidents, staying resilient and composed under pressure. You are Outcome-Obsessed, measuring your work by the threats contained, customers protected, and actionable remediation delivered. Alongside alert triage and intrusion response, you’ll support sales, collaborate with Product to shape Huntress’ MDR service and platform, and have opportunities to contribute across Incident Response, Security Operations, Threat Hunting, and Detection Engineering. We’ll also support you in sharing your work through blogs, conference talks, webinars, and research publications that build your personal brand and the broader security community. This role follows Perth time (AWST), Monday to Friday, 8:00 am to 4:00 pm. Applicants based elsewhere in Australia are welcome, provided you are able to work these hours converted to your local time. Responsibilities: Triage, investigate, respond to, and remediate alerts generated by the Huntress platform. Review EDR/SIEM telemetry, log sources, and forensic artifacts to determine the root cause of attacks where possible and provide the remediation needed to remove the threat. Perform dynamic analysis of malware when required to extract indicators of compromise or determine a file’s malicious intent. Contribute to and refine detection capabilities and queue hygiene through crafting and tuning signals to address emerging threats. Investigate activity in Microsoft 365 and Google Workspace and deliver actionable remediation advice for compromised tenants. Continue to grow your skills and knowledge through real-world intrusion data, paid training opportunities, and responsible use of AI tools to support research, summarise findings, and accelerate routine analysis while validating outputs. Support customer success by assisting our SOC Support team with customer/partner escalations related to threat-related and SOC-relevant questions. Help through partnering with Product and Engineering Teams to continue to evolve Human Led Agentic workflows What You Bring To The Team: You have 2+ years of experience in SOC, Incident Response, Managed Detection and Response, or Digital Forensics roles. You have demonstrated experience with at least one of Windows, Linux, or macOS, including attack surfaces, malware analysis, and basic threat actor tools and techniques. You understand common system administration skills and how threat actors abuse them to achieve their goals, including Active Directory, PowerShell, Group Policy, and local account creation. You are familiar with the techniques and tactics in MITRE ATT&CK, including credential dumping, lateral movement, persistence mechanisms, and exfiltration techniques. You have a working knowledge of core networking concepts, including common ports and protocols, NAT, public and private IP addresses, and VLANs. You have a passion for forensics and enjoy digging into logs, processes, and artifacts to understand intrusions and outmaneuver attackers. You communicate clearly in writing and verbally, simplify complex technical findings for diverse audiences, and demonstrate self-guided learning that keeps your skills current. You use AI to work faster and smarter in day-to-day security analysis, applying sound judgment and validating its output before acting on it. You enjoy working with a fun, supportive team, bring a genuine team-player mindset, and help deliver great outcomes with a smile, a laugh, and a dash of witty (but accurate) memes. A desire to hold your manager accountable for delivering ice cream at the Australian Security Offsite. What We Offer: Fully remote work At least one annual trip to the US for Summer Summit, with additional local events in Australia! New starter home office set up reimbursement ($800 AUD) 12 weeks paid parental leave for both primary and secondary carers Monthly digital allowance for personal phone and internet costs ($185 AUD) Monthly home office tech stipend to upgrade or replace equipment ($40 AUD) Subsidised private health insurance through our preferred provider Stock options for all full-time employees Access to the BetterUp platform for coaching, personal, and professional growth Huntress is committed to creating a culture of inclusivity where every single member of our team is valued, has a voice, and is empowered to come to work every day just as they are. We do not discriminate based on race, ethnicity, color, ancestry, national origin, religion, sex, sexual orientation, gender identity, disability, veteran status, genetic information, marital status, or any other legally protected status. We do discriminate against hackers who try to exploit businesses of all sizes. Accommodations: If you require reasonable accommodation to complete this application, interview, or pre-employment testing or participate in the employee selection process, please direct your inquiries to accommodations@huntresslabs.com . Please note that non-accommodation requests to this inbox will not receive a response. Huntress uses artificial intelligence tools to assist in reviewing and evaluating job applications, including resume screening, skills assessment, and candidate matching and comparisons. These AI tools support our human recruiters in the initial review process, but do not make final hiring decisions without human involvement. By submitting your application, you acknowledge this use of AI in our recruitment process. Please review our Candidate Privacy Notice for more details on our practices and your data privacy rights. #BI-Remote

Location: Москва; Санкт-Петербург Workplace: Офис, Гибридный Yandex Cloud Security — это подразделение в публичной облачной платформе Yandex Cloud, которое отвечает за обеспечение безопасности всей экосистемы. Ищем инженера, который возьмёт на себя создание и развитие детектирующего контента для собственных продуктов безопасности Yandex Cloud. Yandex Cloud — это облачная платформа, которая объединяет вычислительные ресурсы, сети, хранилища, базы данных, контейнерные и другие управляемые сервисы. В её основе — множество распределённых высоконагруженных систем и API собственной разработки, которыми пользуются компании и разработчики для создания и эксплуатации своей инфраструктуры и приложений. Команда Yandex Cloud Detection and Response развивает технологии обнаружения и реагирования на угрозы в облачных и гибридных инфраструктурах. Мы исследуем способы улучшения разработки и сопровождения детектирующего контента. Одно из направлений — создание AI-агентов, которые помогают исследовать данные, разрабатывать и тестировать правила, анализировать результаты их работы и автоматизировать повторяемые задачи detection engineering. Мы ищем инженера, который будет отвечать за создание и развитие детектирующего контента для собственных продуктов безопасности Yandex Cloud. В вашей зоне ответственности будет полный жизненный цикл детекта: исследование техники атаки, определение требований к телеметрии, разработка и тестирование правила и последующий контроль качества. Обязанности Разработка детектирующего контента Вы будете создавать и развивать правила обнаружения угроз для продуктов безопасности Yandex Cloud и команды SOC, работать с нормализацией и таксономией событий, тестировать детекты и контролировать их качество после выпуска. Исследование угроз и работа с инцидентами Вам предстоит исследовать техники атакующих, проводить Threat Hunting, участвовать в расследовании сложных инцидентов, превращать полученные результаты в новые способы обнаружения угроз. Отдельное направление работы — endpoint detection для Linux и контейнерных сред, включая телеметрию на основе eBPF. R&D и автоматизация Вы будете автоматизировать разработку, тестирование и выпуск детектирующего контента, а также развивать AI-агентов для анализа данных и проверки детектов. Больше о том, что под капотом платформы Yandex Cloud, — в канале Inside Yandex Cloud Требования * Работали в detection engineering, threat hunting, incident response либо на второй или третьей линии SOC * Разрабатывали и отлаживали правила в SIEM или EDR, работали с Git и CI/CD * Понимаете полный жизненный цикл детекта: гипотеза, требования к данным, реализация, тестирование, внедрение, мониторинг качества * Знаете сетевые протоколы, устройства современных операционных систем и основные техники атак на Active Directory * Понимаете модели безопасности облачных платформ: IAM, ресурсную иерархию и облачные API * Знаете принципы виртуализации, контейнеризации * Разбираетесь в Linux: процессы, системные вызовы, файловая и сетевая подсистемы * Понимаете принципы eBPF и его применения для наблюдаемости и безопасности Linux-систем * Умеете писать код или скрипты для автоматизации — прежде всего на Python или Go * Способны самостоятельно доводить исследование до работающего результата и сопровождать его Будет плюсом * Работали с Yandex Cloud, AWS, Azure или GCP и их событиями безопасности * Разрабатывали детектирующий контент для EDR * Работали с purple teaming, adversary emulation или проверяли детекты воспроизведением техник атак * Использовали eBPF, Falco, Tetragon, Tracee или другие средства runtime security и сбора endpoint-телеметрии * Знаете Sigma, YARA, Suricata или другие форматы детектирующего контента * Разбираетесь в ClickHouse, YDB или других SQL-подобных аналитических системах

Location: Москва Workplace: Гибридный О компании RED Security – открытая экосистема ИБ-решений и экспертизы для комплексной защиты бизнеса. RED Security SOC – центр мониторинга и реагирования на кибератаки. Обязанности расследовать нетиповые инциденты ИБ с различных источников; взаимодействовать с заказчиками по техническим вопросам; участвовать в выездном реагировании в инфраструктуре Заказчика; анализировать полноту и качество анализа инцидентов; принимать участие в разработке методик и инструкций (playbooks) по работе с инцидентами; обеспечивать развитие платформы по реагированию и инструментария для расследования инцидентов; проводить обучение и делиться опытом с другими аналитиками. Требования понимание векторов атак на корпоративные сети и способы противодействия; знание современных методов классификации тактик и техник атакующих (Mitre Attack, Kill Chain); опыт в расследовании инцидентов ИБ; умение анализировать журналы регистрации событий в различных системах (ОС, СЗИ, сетевое оборудование, прикладное ПО, access логи и др); экспертные знания в одном из доменов ИТ инфраструктуры (ОС, сеть, веб, виртуализация, БД). Условия собственную платформу MTS Ocean для получения ИТ-ресурсов, а это значит, что деплой, мониторинг, observability — не будут для тебя проблемой, ты сможешь сосредоточиться на фичах; профессиональные гильдии инженеров, где мы поддерживаем друг друга и помогаем стать лучше; внутреннюю площадку TechTalks для обмена опытом, дискуссий, развития навыков самопрезентации; участие во внешних IT конференциях. Наши эксперты выступают на ведущих профильных конференциях, таких как HighLoad++, DevOps Conf, Joker, AHA!, Матемаркетинг и другие. А еще мы организуем собственную масштабную конференцию True Tech Day и регулярно проводим митапы для разработчиков и инженеров; полезные курсы и вебинары в корпоративном университете и электронную библиотеку; ДМС с первого месяца работы, включая стоматологию; страхование от несчастных случаев с 1 месяца работы. Материальную помощь в сложных жизненных ситуациях; отпуск 28 календарных дней; прием врачей общей практики и массаж в офисе; мобильная связь за счет компании и льготные тарифы для близких; подписка на онлайн-кинотеатр KION, сервис МТС Музыка, книжный сервис Строки от МТС, безлимитные мессенджеры и соцсети; гибридный формат работы при наличии офиса, удаленный формат при отсутствии офиса.

Location: Самара Workplace: Гибридный О компании RED Security – открытая экосистема ИБ-решений и экспертизы для комплексной защиты бизнеса. RED Security SOC – центр мониторинга и реагирования на кибератаки. Обязанности обеспечивать управление полным циклом разработки правил корреляции; анализировать ложноположительные инциденты и добавлять исключения в SIEM; выполнять роль клиентского аналитика; продвигать развитие технологической платформы в части работы с SIEM системами и увеличивать эффективность процесса управления библиотекой корреляционных правил; взаимодействовать с заказчиками по техническим вопросам; проводить обучение и делиться опытом с другими аналитиками. Требования знание основных векторов атак на корпоративные сети и способы противодействия; знание современных методов классификации тактик и техник атакующих (Mitre Attack, Kill Chain); опыт работы как минимум с MaxPatrol SIEM, KUMA SIEM; умение анализировать журналы регистрации событий в различных системах (ОС, СЗИ, сетевое оборудование, прикладное ПО, access логи и др); умение разрабатывать логику детектирующих правил по обнаружению атак и аномалий; будет плюсом, опыт работы с doker; будет плюсом, опыт написания контента для NTA. Условия собственную платформу MTS Ocean для получения ИТ-ресурсов, а это значит, что деплой, мониторинг, observability — не будут для тебя проблемой, ты сможешь сосредоточиться на фичах; профессиональные гильдии инженеров, где мы поддерживаем друг друга и помогаем стать лучше; внутреннюю площадку TechTalks для обмена опытом, дискуссий, развития навыков самопрезентации; участие во внешних IT конференциях. Наши эксперты выступают на ведущих профильных конференциях, таких как HighLoad++, DevOps Conf, Joker, AHA!, Матемаркетинг и другие. А еще мы организуем собственную масштабную конференцию True Tech Day и регулярно проводим митапы для разработчиков и инженеров. полезные курсы и вебинары в корпоративном университете и электронную библиотеку; ДМС с первого месяца работы, включая стоматологию; страхование от несчастных случаев с 1 месяца работы. Материальную помощь в сложных жизненных ситуациях; отпуск 28 календарных дней (+3 дополнительных дня за ненормированный рабочий день); прием врачей общей практики и массаж в офисе; мобильная связь за счет компании и льготные тарифы для близких; подписка на онлайн-кинотеатр KION, сервис МТС Музыка, книжный сервис Строки от МТС, безлимитные мессенджеры и соцсети.

Location: Москва Workplace: В офисе О компании МТС Банк – команда, которая развивает цифровые финансовые сервисы и делает их доступными для всех. Мы работаем с современным технологическим стеком, высоконагруженными системами и облачной инфраструктурой, внедряем лучшие инженерные практики. Такой подход позволяет создавать надёжные решения для бизнеса и клиентов Обязанности Проводить мероприятия по реагированию на инциденты информационной безопасности Сопровождать и развивать процессы реагирования на компьютерные инциденты Проводить анализ угроз и развивать применяемые сценарии детектирования Участвовать в расследованиях компьютерных инцидентов Участвовать в развитии практик Purple Team Участвовать в развитии систем автоматизации анализа и реагирования Требования Знание и понимание современного ландшафта угроз информационной безопасности, моделей (e.g. MITRE ATT&CK, Cyber Killchain), знание актуальных инструментов и методов реализации атак Практический опыт проведения мероприятий по реагированию на инциденты информационной безопасности Опыт расследования компьютерных инцидентов и исследования криминалистических артефактов Опыт разработки сценариев реагирования и инструкций по реагированию на компьютерные инциденты Навыки разработки скриптов для автоматизации рутинных задач, написания SQL-подобных запросов Опыт участия в мероприятиях Red/Purple Team будет плюсом

Location: Israel About Nebius: Nebius is leading a new era in cloud infrastructure for the global AI economy. We are building a full-stack AI cloud platform that supports developers and enterprises from data and model training through to production deployment, without the cost and complexity of building large in-house AI/ML infrastructure. Built by engineers, for engineers. From large-scale GPU orchestration to inference optimization, we own the hard problems across compute, storage, networking and applied AI. Listed on Nasdaq (NBIS) and headquartered in Amsterdam, we have a global footprint with R&D hubs across Europe, the UK, North America and Israel. Our team of 1,500+ includes hundreds of engineers with deep expertise across hardware, software and AI R&D. The role Nebius is seeking an experienced Deputy SOC Manager for its Security Operations Center (SOC). This role is a technical-leaning leadership position that owns the SOC's capability: the strategy and standards the regions run to, the technology the SOC runs on, and how the SOC gets better over time. This role reports to the SOC Manager, under the Detection and Response function within the CISO Office. You are welcome to work in our offices in Tel Aviv, Israel. Your responsibilities will include: Help define the SOC's strategy and roadmap with the SOC Manager, and turn it into priorities the regions can execute. Use operational metrics across regions to find where the SOC is weak and drive the improvements that fix it. Work with the Regional SOC Managers on resource allocation and consistency across regions, so each region runs to the same standard. Own SOC processes and runbook governance, keeping procedures current, consistent, and followed. Apply AI and automation to cyber defense, making the SOC faster and its analysts more effective, with judgment about where it belongs. Mentor the Regional SOC Managers and senior analysts as a peer and sounding board, developing the SOC's next layer of leadership. Own how the SOC handles high-severity incidents: the escalation criteria, the coordination process, and the post-incident review, without running individual incidents. Support hiring and onboarding, participating in interviews and shaping the analyst ramp-up. Share the SOC Manager's accountability for the SOC's performance, stepping in across all of its responsibilities when needed. We expect you to have: 8-10 years in security operations, including at least 2 years managing people. Technical Expertise Solid understanding of SOC tooling and workflows (EDR, SIEM, SOAR) at the depth needed to lead analysts and challenge investigations. Working knowledge of investigation methodology and the incident lifecycle. Understanding of attacker TTPs (MITRE ATT&CK) sufficient to assess investigation quality. Familiarity with cloud and cloud-native environments as they relate to SOC coverage. Certifications such as GCIH, GSOM, or CISM are an advantage. Leadership & Communication Builds trust across teams, leading the SOC from transparency and consistency rather than authority. Calm during high-severity incidents, with the judgment to keep the team on the right priorities. Genuine investment in people, developing managers and analysts while holding a fair, high bar. Fluent in English, written and verbal, comfortable working with international teams and stakeholders Benefits & Perks: Competitive compensation Career growth and learning opportunities Flexibility and ownership Collaborative and innovative culture Opportunity to work on impactful AI projects International environment and talented teams What's it like to work at Nebius: Fast moving - Bold thinking - Constant growth - Meaningful impact - Trust and real ownership - Opportunity to shape the future of AI Equal Opportunity Statement: Nebius is an equal opportunity employer. We are committed to fostering an inclusive and diverse workplace and to providing equal employment opportunities in all aspects of employment. We do not discriminate on the basis of race, color, religion, sex (including pregnancy), national origin, ancestry, age, disability, genetic information, marital status, veteran status, sexual orientation, gender identity or expression, or any other characteristic protected by applicable law. Applicants must be authorized to work in the country in which they apply and will be required to provide proof of employment eligibility as a condition of hire. If you need accommodations during the application process, please let us know.

Location: Hyderabad, India Our Global Structure Deliveroo is now part of DoorDash, bringing together teams with even greater reach, scale, and ambition. Depending on your role, you may collaborate with teammates, systems, and leaders across DoorDash and Wolt. Together, we’re unlocking new possibilities as one global team. Join us in our mission to transform the way people shop and eat, where impact, innovation, and growth drive everything we do. Our Information Security team enables innovation at speed—securely. As digital guardians of DoorDash, Deliveroo, and Wolt, we safeguard our systems and the data of our employees, customers, riders, and partners. We defend against emerging cyber threats and embed security into every facet of the business. From building resilient defenses and responding to incidents to empowering teams with security knowledge, we are trusted partners protecting these global brands from the inside out. About the Role The Senior Security Operations Centre Specialist offers a unique opportunity to shape our global Security Operations strategy across a global footprint of DoorDash, Deliveroo, and Wolt. This role provides the platform to optimize our technology and AI investments while pioneering new methods to protect our data, people, and partners. As we expand, your specialist capabilities will be essential to our continued success. What you’ll be doing Work in a 24/7 global security operations centre, including scheduled night and weekend shifts. Lead the triage and investigation of security alerts, including phishing, malware, network attacks, security hygiene and privacy related incidents within specified SLAs. Mentor a team of SOC Specialists, providing the necessary guidance and feedback to deliver a best-in-class security service to the business. Lead the development and continuously improve operational documentation, processes and playbooks Build and manage autonomous AI runbooks to automate and scale our alert triage capabilities. Lead incident response and escalation, ensuring lessons learned are translated into continuous security improvements. Support the design, development and review of threat-detection use-cases to identify suspicious activity across our cloud environment. Feed into the risk framework of emerging and observed threats from intelligence and / or incidents (e.g., post incident activity / repair items). Support wider security incident investigations involving Threat Intelligence and Incident Response & Digital Forensics stakeholders. Keep up to date with current security trends, advisories, publications and security research across the threat landscape Leverage metrics and KPIs to improve security posture and identify opportunities for strategic optimisation Collaborate with the team to develop and help deliver cybersecurity awareness programs for employees, emphasising incident reporting and best practices. Requirements 6–8 years of experience in SOC, demonstrating success in managing security incidents and delivering platform optimisations while acting as a technical mentor and lead for shift operations. Proven experience building threat detection capabilities in a cloud-centric, fast-moving organisation. Hands-on experience with AWS security config, SOAR, GSO, EDR/XDR, Splunk and SQL queries. Practical experience ideating, configuring, managing defensive security solutions and technical project management Committed to continuous improvement, leveraging feedback to elevate both personal and team performance. Exceptional collaborative team player and a knowledge-sharing mindset. Working knowledge of security compliance standards, e.g. ISO27001, GDPR, NIS2 and PCI-DSS. Capable of working well both independently and collaboratively, whilst keeping calm, under the pressure of an incident with potentially high impact to the business. Able to communicate effectively during or after any incident update to both technical and non-technical stakeholders. Coordinate with the US, UK and EU central security teams as required. Preferred, but not required Understanding of IAM cloud security principles Experience in a DevOps environment with familiarity of CI/CD pipelines Hands-on experience with container technologies and orchestration services Knowledge of cloud security data encryption standards and principles Why Deliveroo? At Deliveroo, you’ll do work that matters—solving real-world problems in a three-sided marketplace that’s constantly evolving. We’re food lovers, problem solvers, community organisers, proud parents, and more, brought together by a shared drive to make things better. Working here you can expect to: 🔧 Solve meaningful problems at real scale Work on a complex, always-on marketplace that impacts millions every day. 🌱See your impact, fast Ship, test and improve ideas quickly in a low-hierarchy, high-ownership environment. 🧠Grow through challenge and ownership Take on big, ambiguous problems and accelerate your career with strong support. 🌎A culture built for builders High standards, collaboration, flexible working and continuous learning. Our Global Structure Deliveroo is now part of DoorDash, bringing together teams with even greater reach, scale, and ambition. Depending on your role, you may collaborate with teammates, systems, and leaders across DoorDash and Wolt. Together, we’re unlocking new possibilities as one global team. Diversity, Equity and Inclusion At Deliveroo, we know that a great workplace reflects the world around us and that true diversity and inclusion make us stronger, more creative, and better at what we do. We’re committed to fostering an environment where everyone can do their best work and feel they belong. We believe in equality of opportunity and welcome candidates from all backgrounds regardless of age, gender, ethnicity, disability, sexual orientation, gender identity, socio-economic background, religion, or belief. If you have a disability or long-term health condition and need support to apply for one of our roles, or require any reasonable adjustments during the recruitment process, you’ll have the opportunity to let us know once you’ve submitted your application. We’ll share details on how to request support so we can ensure you have a fair and equitable experience. If you’re excited about making a real impact in a fast-moving marketplace and growing your career alongside ambitious, supportive teams, we’d love to hear from you! Beware of recruitment scams: DASH Brands will never ask you to pay money or share sensitive financial information during hiring — learn more about DASH Brands' legitimate recruiting process at careersatdoordash.com/recruitment-scam-awareness .

Location: Poland Workplace: remote A company Cybersecurity organization is seeking a Security Operations Center (SOC) Analyst to provide front-line monitoring, investigation, and response across the firm's global environment. The role is intended for a technical professional with foundational cybersecurity knowledge and practical experience in security operations, IT operations, infrastructure support, networking, systems administration, or a related discipline. The analyst will use enterprise security platforms and approved AI-assisted capabilities to assess threats, document findings, execute established response procedures, and escalate significant or ambiguous events. The position provides a development path into senior SOC analysis, incident response, threat hunting, detection engineering, and cybersecurity engineering. Measures of Success Independently investigates routine alerts and follows escalation standards. Produces complete, concise, and defensible investigation records. Demonstrates proficiency with the firm's primary security platforms and playbooks. Contributes measurable improvements to runbooks, detections, automation, or analyst workflows. Builds trusted working relationships with Cybersecurity, Infrastructure, and business stakeholders.

Location: San Francisco Workplace: Hybrid WHY HARVEY At Harvey, we’re transforming how legal and professional services operate. By combining frontier agentic AI, an enterprise-grade platform, and deep domain expertise, we’re reshaping how critical knowledge work gets done for decades to come. This is a rare chance to help build a generational company at a true inflection point. We have strong product-market fit and world-class investor support. We’re scaling fast and defining a new category in real time. The work is ambitious, the bar is high, and the opportunity for growth — personal, professional, and financial — is unmatched. Our team moves fast, takes ownership, and is deeply committed to the mission — operating with intensity, staying close to our customers, and pushing each other for excellence. We live by three values: Decisiveness, Simplicity, and Job's Not Finished. We act quickly on clear judgment over perfect information, we believe simplicity is what scales, and we're never satisfied with where we are. If you want to do the best work of your career alongside people who share that drive, we'd love to build with you. At Harvey, the future of professional services is being written today — and we’re just getting started. ROLE OVERVIEW Harvey is building AI-native software for professional services. Our customers trust us with highly sensitive information and critical business workflows, making security fundamental to everything we build. We’re looking for a Director of Detection and Response to build and lead the team that identifies threats, responds decisively to incidents, and turns what we learn into stronger defenses. You will own Harvey’s Detection and Response strategy, technical direction, and operational readiness across our production platform and corporate environment. Working with the CISO and leaders across Engineering, Infrastructure, IT, Legal, and Customer Trust, you’ll translate business risk into a focused program that protects customer data and enables Harvey to move quickly with confidence. This is a technical leadership role for someone who can build an exceptional team, earn the trust of senior engineers, and bring clarity to high-stakes situations. You’ll develop a function that scales through software, automation, and strong partnerships, while staying close enough to the work to challenge detection designs and guide complex investigations. WHAT YOU'LL DO - Build and lead the organization. Hire and develop detection engineers, incident responders, and technical leaders; establish clear ownership and a culture of curiosity, sound judgment, and continuous learning. Own the roadmap, staffing plan, and investment decisions. - Own incident response and crisis readiness. Lead Harvey’s response to major security incidents, coordinating investigation, containment, recovery, and executive communication. Build clear severity criteria, escalation paths, playbooks, and sustainable 24/7 coverage for critical threats; develop incident commanders and cross-functional responders through exercises. - Build detection as an engineering capability. Set the technical direction for telemetry, detection pipelines, forensic tooling, and response automation across cloud, endpoint, identity, SaaS, and application environments. Apply software engineering practices to test detections, improve signal quality, and reduce manual work; evaluate AI-assisted investigation with measurable quality and appropriate human oversight. - Focus defenses on meaningful threats. Use threat intelligence, hunting, and an attacker’s perspective to prioritize scenarios that matter to Harvey, including account compromise, data theft, insider risk, privileged-access abuse, and abuse of AI-enabled workflows. Partner with offensive security and platform owners to validate coverage and close blind spots. - Make response a company capability. Partner with Engineering, IT, Legal, Privacy, Communications, and Customer Trust on sensitive investigations and crisis decisions. Establish clear escalation and decision authority, preserve evidence, and provide accurate findings to support Legal-led notification and disclosure decisions. Prepare cross-functional responders to contribute when incidents require broader support. - Turn incidents into lasting improvements. Drive blameless reviews and ensure corrective actions have owners, deadlines, and verified outcomes. Measure detection coverage, time to detect and contain, recurring failure modes, and responder workload, and use those results to guide investments and reduce customer impact. WHAT YOU HAVE - Experience building and leading Detection and Response, incident response, or security engineering teams in a technology company with complex production systems. A record of hiring strong engineers, developing technical leaders, and scaling both the team and its operating model. - Deep incident response experience and demonstrated judgment during serious security events. You can lead investigations with incomplete information, make timely containment decisions, and communicate clearly with executives, engineers, and business partners. You bring composure, integrity, and discretion to sensitive investigations and decisions under scrutiny. - Strong technical foundations in cloud infrastructure, operating systems, networking, identity, and attacker tradecraft, with depth in detection engineering, threat hunting, or digital forensics. You understand how to investigate across corporate and production environments. - An engineering approach to security operations, backed by experience building detection platforms, investigation tools, or response automation. You can evaluate architecture and code, guide senior engineers, and make practical decisions about what to build, buy, or retire. - The ability to turn business risk into a focused strategy and deliver it through influence and partnership. You balance urgent response with long-term engineering work and build a demanding, supportive environment where people can do their best work. Experience protecting enterprise SaaS, sensitive customer data, or AI/ML environments is especially valuable, as is experience investigating insider threats, partnering on privileged-access governance, or leading response under regulatory and public scrutiny. At Harvey, you’ll shape how an AI company detects and responds to threats as its products and customers evolve. Your team’s work will directly protect customer trust and help make security a durable foundation for the business. COMPENSATION $280,000 - $385,000 USD DEPENDING ON YOUR LOCATION, AN APPLICANT PRIVACY NOTICE MAY APPLY TO YOU. YOU CAN FIND ALL OF OUR APPLICANT PRIVACY NOTICES HERE https://harveyai.notion.site/Harvey-Candidate-Privacy-Notices-319ac3fcdd7a803bb807d5094f249922?pvs=74. #LI-DZ1 Harvey is an equal opportunity employer and does not discriminate on the basis of race, gender, sexual orientation, gender identity/expression, national origin, disability, age, genetic information, veteran status, marital status, pregnancy or related condition, or any other basis protected by law. We are committed to providing reasonable accommodations to applicants with disabilities, and requests can be made by emailing accommodations@harvey.ai

Location: New York Workplace: Hybrid WHY HARVEY At Harvey, we’re transforming how legal and professional services operate. By combining frontier agentic AI, an enterprise-grade platform, and deep domain expertise, we’re reshaping how critical knowledge work gets done for decades to come. This is a rare chance to help build a generational company at a true inflection point. We have strong product-market fit and world-class investor support. We’re scaling fast and defining a new category in real time. The work is ambitious, the bar is high, and the opportunity for growth — personal, professional, and financial — is unmatched. Our team moves fast, takes ownership, and is deeply committed to the mission — operating with intensity, staying close to our customers, and pushing each other for excellence. We live by three values: Decisiveness, Simplicity, and Job's Not Finished. We act quickly on clear judgment over perfect information, we believe simplicity is what scales, and we're never satisfied with where we are. If you want to do the best work of your career alongside people who share that drive, we'd love to build with you. At Harvey, the future of professional services is being written today — and we’re just getting started. ROLE OVERVIEW Harvey is building AI-native software for professional services. Our customers trust us with highly sensitive information and critical business workflows, making security fundamental to everything we build. We’re looking for a Director of Detection and Response to build and lead the team that identifies threats, responds decisively to incidents, and turns what we learn into stronger defenses. You will own Harvey’s Detection and Response strategy, technical direction, and operational readiness across our production platform and corporate environment. Working with the CISO and leaders across Engineering, Infrastructure, IT, Legal, and Customer Trust, you’ll translate business risk into a focused program that protects customer data and enables Harvey to move quickly with confidence. This is a technical leadership role for someone who can build an exceptional team, earn the trust of senior engineers, and bring clarity to high-stakes situations. You’ll develop a function that scales through software, automation, and strong partnerships, while staying close enough to the work to challenge detection designs and guide complex investigations. WHAT YOU'LL DO - Build and lead the organization. Hire and develop detection engineers, incident responders, and technical leaders; establish clear ownership and a culture of curiosity, sound judgment, and continuous learning. Own the roadmap, staffing plan, and investment decisions. - Own incident response and crisis readiness. Lead Harvey’s response to major security incidents, coordinating investigation, containment, recovery, and executive communication. Build clear severity criteria, escalation paths, playbooks, and sustainable 24/7 coverage for critical threats; develop incident commanders and cross-functional responders through exercises. - Build detection as an engineering capability. Set the technical direction for telemetry, detection pipelines, forensic tooling, and response automation across cloud, endpoint, identity, SaaS, and application environments. Apply software engineering practices to test detections, improve signal quality, and reduce manual work; evaluate AI-assisted investigation with measurable quality and appropriate human oversight. - Focus defenses on meaningful threats. Use threat intelligence, hunting, and an attacker’s perspective to prioritize scenarios that matter to Harvey, including account compromise, data theft, insider risk, privileged-access abuse, and abuse of AI-enabled workflows. Partner with offensive security and platform owners to validate coverage and close blind spots. - Make response a company capability. Partner with Engineering, IT, Legal, Privacy, Communications, and Customer Trust on sensitive investigations and crisis decisions. Establish clear escalation and decision authority, preserve evidence, and provide accurate findings to support Legal-led notification and disclosure decisions. Prepare cross-functional responders to contribute when incidents require broader support. - Turn incidents into lasting improvements. Drive blameless reviews and ensure corrective actions have owners, deadlines, and verified outcomes. Measure detection coverage, time to detect and contain, recurring failure modes, and responder workload, and use those results to guide investments and reduce customer impact. WHAT YOU HAVE - Experience building and leading Detection and Response, incident response, or security engineering teams in a technology company with complex production systems. A record of hiring strong engineers, developing technical leaders, and scaling both the team and its operating model. - Deep incident response experience and demonstrated judgment during serious security events. You can lead investigations with incomplete information, make timely containment decisions, and communicate clearly with executives, engineers, and business partners. You bring composure, integrity, and discretion to sensitive investigations and decisions under scrutiny. - Strong technical foundations in cloud infrastructure, operating systems, networking, identity, and attacker tradecraft, with depth in detection engineering, threat hunting, or digital forensics. You understand how to investigate across corporate and production environments. - An engineering approach to security operations, backed by experience building detection platforms, investigation tools, or response automation. You can evaluate architecture and code, guide senior engineers, and make practical decisions about what to build, buy, or retire. - The ability to turn business risk into a focused strategy and deliver it through influence and partnership. You balance urgent response with long-term engineering work and build a demanding, supportive environment where people can do their best work. Experience protecting enterprise SaaS, sensitive customer data, or AI/ML environments is especially valuable, as is experience investigating insider threats, partnering on privileged-access governance, or leading response under regulatory and public scrutiny. At Harvey, you’ll shape how an AI company detects and responds to threats as its products and customers evolve. Your team’s work will directly protect customer trust and help make security a durable foundation for the business. COMPENSATION $280,000 - $385,000 USD DEPENDING ON YOUR LOCATION, AN APPLICANT PRIVACY NOTICE MAY APPLY TO YOU. YOU CAN FIND ALL OF OUR APPLICANT PRIVACY NOTICES HERE https://harveyai.notion.site/Harvey-Candidate-Privacy-Notices-319ac3fcdd7a803bb807d5094f249922?pvs=74. #LI-DZ1 Harvey is an equal opportunity employer and does not discriminate on the basis of race, gender, sexual orientation, gender identity/expression, national origin, disability, age, genetic information, veteran status, marital status, pregnancy or related condition, or any other basis protected by law. We are committed to providing reasonable accommodations to applicants with disabilities, and requests can be made by emailing accommodations@harvey.ai