Вакансии

Location: London 500M+ downloads. 80M+ monthly users. A decade of building – and we’re still accelerating. Flo is the world’s #1 health & fitness app worldwide on a mission to build a better future for female health. Backed by a $200M investment led by General Atlantic, we became the first product of our kind to reach a $1B valuation in 2024 – and we’re not slowing down. With 7M paid subscribers and the highest-rated experience in the App Store’s health category, we’ve spent 10 years earning trust at scale. Now, we’re building the next generation of digital health – AI-powered, privacy-first, clinically backed – to help our users know their body better. The job This role unites Security and Infrastructure under a single organizational mandate to ensure security practices align directly with rapid engineering execution and platform scalability. Flo Health protects the data of over 80 million monthly active users, holding ISO 27001 and ISO 27701 certifications alongside privacy-first features such as Anonymous Mode. The VP of Security & Infrastructure is accountable for maintaining and elevating these security, privacy, and architectural standards across the organization. We are building organisation where secure is the default path and the fast path. Core Ownership & Responsibilities 1. Security Strategy & Governance Security Stategy and Roadmap: Develop, evolve and communicate Flo’s security strategy and roadmap, promoting strong shared security ownership culture. Security Programme: Oversee all aspects of Flo’s security programme, risk management, security architecture, product security, and security operations, including embedded security engineering functions. Data Protection & Governance: Define and enforce standards for storing, protecting, and deleting personal and health data across production systems, analytics warehouses, AI model training sets, backups, and search indexes. Regulatory & Compliance Engineering: Deliver and oversee the performance of technical controls, automated evidence extraction, and ongoing compliance for ISO 27001, ISO 27701, SOC 2 Type 2, HIPAA, EU AI Act, and Cyber Resilience Act. Third-Party & Supply-Chain Risk: Establish evaluation criteria and ongoing governance controls for vendors, SDKs, and external partners accessing internal environments or data. Vulnerability Management: Oversee the management life cycle of code, third party and platform vulnerabilities, ensuring remediation paths are transparent, risk-based, and tracked to closure. Security Operations & Incident Response: Oversee detection engineering, continuous threat monitoring, and serve as the accountable executive for major incident escalations. 2. Platform & Infrastructure Engineering Cloud & Developer Infrastructure: Own GCP and AWS multi-account architecture, Kubernetes, Terraform, and developer platform delivery to drive down lead times and change failure rates. Secure SDLC: embed technical security requirements across the development lifecycle, optimising automated security controls within CI/CD pipelines, and ensuring well informed platform and product security architecture decisions drive strong protection, resilience and scalability. Corporate IT & Access Controls: Manage IT service provision, including identity, hardware devices, collaboration tools and joiner-mover-leaver lifecycle workflows through automated, self-service access controls. 3. User Identity & AI Security Product Identity & Access Management: Direct cross-functional roadmaps for user facing security services and account safety, including authentication, sessions management, and cryptography,while balancing conversion metrics with security controls. AI & Machine Actor Security: Establish governance, scoping, permissioning, appropriate security guardrails and auditing for AI-assisted engineering agents and consumer-facing AI features. 4. External Trust and Transparency Advocate for Security In FemTech: Set and continually raisethe bar as market leader, executing transparent and proactive external communications and raising Flo's security profile through external events and industry engagement. Key Qualifications & Technical Requirements Leadership Experience: Proven track record of managing combined or parallel Security and Production Infrastructure functions at consumer scale (tens of millions of active users). Product Integration: Demonstrated experience partnering with Product, Design, and Mobile/Backend Engineering teams to ship user-facing features to roadmap. Audit Track Record: Successful execution and ongoing maintenance of ISO 27001, SOC 2, HIPAA, or equivalent certification frameworks through external audits. Data Privacy Systems: Deep technical experience implementing GDPR, automated data deletion, retention policies, DPIAs, and cross-border transfer controls programmatically. AI Governance & Security: Practical implementation experience securing AI models, autonomous code/development agents, and automated permission/audit systems. Preferred Qualifications: Experience with consumer sign-in optimization, health/biometric data protection, in-house offensive security engineering, and mobile platform security. Annual Salary Range (ranges may vary based on skills and experience) £200,000 — £220,000 GBP How we work We’re a mission-led, product-driven team. We move fast, stay focused and take ownership – from brief to build to impact. Debate is encouraged. Decisions are shared. We care about craft, ship with purpose, and always raise the bar. You’ll be working with people who take their work seriously, not themselves. It takes commitment, resilience, and the drive to keep going when things get tough. Because better health outcomes are worth it. What you'll get We support impact with meaningful reward. Here’s what that looks like: Competitive salary and annual reviews Opportunity to participate in Flo’s performance incentive scheme Paid holiday, sick leave, and female health leave Enhanced parental leave and pay for maternity, paternity, same-sex and adoptive parents Accelerated professional growth through world-changing work and learning support In-person collaboration and work in a hybrid model, with 3 days per week spent in the office 5-week fully paid sabbatical at 5-year Floversary Flo Premium for friends & family, plus more health, pension and wellbeing perks Diversity, equity and inclusion Our strength is in our differences. At Flo, hiring is based on merit, skill and what you bring to the role – nothing else. We’re proud to be an equal opportunity employer, and we welcome applicants from all backgrounds, communities and identities. Read our privacy notice for job applicants .

Location: Remote-Friendly, United States; San Francisco, CA | Seattle, WA | New York City, NY | Washington, DC About Anthropic Anthropic’s mission is to create reliable, interpretable, and steerable AI systems. We want AI to be safe and beneficial for our users and for society as a whole. Our team is a quickly growing group of committed researchers, engineers, policy experts, and business leaders working together to build beneficial AI systems. About the Team The Security Engineering team's mission is to safeguard our AI systems and maintain the trust of our users and society at large. Whether we're developing critical security infrastructure, building secure development practices, or partnering with our research and product teams, we are committed to operating as a world-class security organization and keeping the safety and trust of our users at the forefront of everything we do. What You’ll Do: Conduct red and purple team engagements simulating advanced threat actors across our cloud infrastructure, endpoints and bare metal deployments. Penetration test specific, high value deployments. Contribute to AI-assisted security testing tooling and workflows. Work cross functionally with other security and engineering teams, particularly on AI-specific attack scenarios. Document and present findings to technical and executive audiences, translating attack narratives into actionable risk insights that inform security roadmaps. Who You Are: 5+ years of hands-on experience in red teaming and offensive security operations Deep expertise in at least two of: macOS security, Linux Security, Cloud security (GCP/AWS/Azure), Kubernetes, CI/CD pipelines Track record of discovering novel attack vectors and chaining vulnerabilities creatively Experience conducting adversarial simulations against well-defended environments Strong engineering skills (Python, Go, or similar) Ability to write clear findings that drive action, helping teams understand risk and prioritize fixes Collaborative approach, working in close collaboration with the blue team Strong candidates may also have experience with: Prior work at organizations with state actor threat models Interest in AI safety and how security engineering contributes to responsible AI developments Background testing AI/ML systems or agentic workflows Familiarity with detection engineering and SIEM/EDR platforms from the defensive side Experience with data center security or hardware-based attacks Deadline to apply: None. Applications will be received on a rolling basis. The annual compensation range for this role is listed below. For sales roles, the range provided is the role’s On Target Earnings ("OTE") range, meaning that the range includes both the sales commissions/sales bonuses target and annual base salary for the role. Annual Salary: $300,000 — $320,000 USD Logistics Minimum education: Bachelor’s degree or an equivalent combination of education, training, and/or experience Required field of study: A field relevant to the role as demonstrated through coursework, training, or professional experience Minimum years of experience: Years of experience required will correlate with the internal job level requirements for the position Location-based hybrid policy: Currently, we expect all staff to be in one of our offices at least 25% of the time. However, some roles may require more time in our offices. Visa sponsorship: We do sponsor visas! However, we aren't able to successfully sponsor visas for every role and every candidate. But if we make you an offer, we will make every reasonable effort to get you a visa, and we retain an immigration lawyer to help with this. For roles performing work in California: We will consider for employment all qualified applicants, including those with arrest or conviction records or criminal histories, in a manner consistent with the requirements of applicable state and local laws, including the San Francisco Fair Chance Ordinance, the City of Los Angeles’ Fair Chance Initiative for Hiring Ordinance, the Los Angeles County Fair Chance Ordinance for Employers, and the California Fair Chance Act. We encourage you to apply even if you do not believe you meet every single qualification. Not all strong candidates will meet every single qualification as listed.  Research shows that people who identify as being from underrepresented groups are more prone to experiencing imposter syndrome and doubting the strength of their candidacy, so we urge you not to exclude yourself prematurely and to submit an application if you're interested in this work. We think AI systems like the ones we're building have enormous social and ethical implications. We think this makes representation even more important, and we strive to include a range of diverse perspectives on our team. Your safety matters to us. To protect yourself from potential scams, remember that Anthropic recruiters only contact you from @anthropic.com email addresses. In some cases, we may partner with vetted recruiting agencies who will identify themselves as working on behalf of Anthropic. Be cautious of emails from other domains. Legitimate Anthropic recruiters will never ask for money, fees, or banking information before your first day. If you're ever unsure about a communication, don't click any links—visit anthropic.com/careers directly for confirmed position openings. How we're different We believe that the highest-impact AI research will be big science. At Anthropic we work as a single cohesive team on just a few large-scale research efforts. And we value impact — advancing our long-term goals of steerable, trustworthy AI — rather than work on smaller and more specific puzzles. We view AI research as an empirical science, which has as much in common with physics and biology as with traditional efforts in computer science. We're an extremely collaborative group, and we host frequent research discussions to ensure that we are pursuing the highest-impact work at any given time. As such, we greatly value communication skills. The easiest way to understand our research directions is to read our recent research. This research continues many of the directions our team worked on prior to Anthropic, including: GPT-3, Circuit-Based Interpretability, Multimodal Neurons, Scaling Laws, AI & Compute, Concrete Problems in AI Safety, and Learning from Human Preferences. Come work with us! Anthropic is a public benefit corporation headquartered in San Francisco. We offer competitive compensation and benefits, optional equity donation matching, generous vacation and parental leave, flexible working hours, and a lovely office space in which to collaborate with colleagues. Guidance on Candidates' AI Usage: Learn about our policy for using AI in our application process.

Location: San Francisco, CA | Seattle, WA | New York City, NY | Washington, DC About Anthropic Anthropic’s mission is to create reliable, interpretable, and steerable AI systems. We want AI to be safe and beneficial for our users and for society as a whole. Our team is a quickly growing group of committed researchers, engineers, policy experts, and business leaders working together to build beneficial AI systems. About the role Anthropic's Security Governance, Risk, and Compliance (GRC) team is the connective tissue that holds the company accountable to its security and control commitments. We translate regulatory, customer, and voluntary obligations into controls that teams act on, and give leadership a bird's-eye view of how well we're meeting them. We're building toward continuous assurance, to challenge and evidence the performance of controls continuously rather than through periodic audits. As Anthropic scales to meet public-company standards, the Sarbanes-Oxley (SOX) control environment over our technology stack is one of the most consequential things this team owns. As part of Security GRC's technical controls assurance function, you will be the voice on what the IT general controls must achieve to support SOX 404 compliance. In partnership with Internal Audit, you will define control requirements and acceptance criteria for the in-scope engineering systems and infrastructure that underpin financial reporting. You will pair with engineering as they design and implement against those requirements, and validate that what ships actually meets the bar before Internal Audit and our external auditors test it. You are the product owner for control design methodology and continuous control monitoring, initially around ITGCs, but extending into other areas of security and compliance to drive visibility where and when we need it. Key responsibilities Define control requirements and acceptance criteria across the core ITGC domains of logical access, change management, computer operations, and program development for SOX in-scope systems, including home-built platforms where the control has to be designed into the system rather than bolted on. Set the bar for in-scope systems from day one. As financially significant systems are built, migrated, or replaced, define what the system must provide (auditability, segregation of duties, change control, immutable logging, evidence retention) before go-live, so controls are not retrofitted after the fact. Pressure-test changes for SOX impact during design. Review major infrastructure, system, and agent framework changes for control impact while decisions are still cheap, and maintain a clear view of which changes alter the SOX scope, key control population, or evidence requirements. Own second-line control monitoring and evidence readiness. Stand up continuous controls monitoring and automated evidence collection for ITGCs (control testing, walkthrough preparation, population and completeness validation, and mapping to the common controls framework). Materially raise automated evidence coverage and cut audit prep time. Drive control deficiency remediation with cross functional partners. Track and root-cause ITGC deficiencies surfaced by monitoring, Internal Audit, or external audit; partner with engineering owners on remediation design; and assess whether remediation actually closes the gap before re-testing. Assess scope changes through a SOX lens. When new products, entities, systems, or integrations come into scope, provide technical and compliance assessment of their impact on control design, evidence requirements, and engineering effort before commitments are made. Maintain alignment with the broader compliance portfolio. Where SOX ITGCs overlap with SOC 2, ISO 27001/42001, or other frameworks, ensure controls are designed once and evidenced once, and that changes made for one framework do not silently break another. Minimum qualifications Thrive at the pace of a hypergrowth company. You're comfortable making calls with incomplete information and reprioritizing as scope shifts. Have led or been a senior contributor to an ITGC program through SOX 404 readiness and/or at a public company, with a working command of PCAOB AS 2201, COSO 2013, and how external auditors scope, test, and evaluate technology controls and deficiencies. Have genuine engineering fluency, possibly from an earlier engineering career: you can read code and Terraform, follow a CI/CD pipeline end to end, and challenge a design on its technical merits. Have programming skills in Python or at least one systems language such as Go, Rust, or C/C++. Have deep familiarity with developer platform, release engineering, cloud infrastructure, or ERP/financial systems control domains. Understand the role of the second line: you can advise and challenge engineering without taking ownership of their controls, and you know where the line sits between your monitoring and Internal Audit's independent testing. Are a strong collaborator and communicator across Finance, Engineering, Internal Audit, and external auditors. Use Claude and other LLMs as daily working tools, and have grounded, specific views on which SOX assurance workflows AI can run today and which it can't yet. Translate SOX and framework language into acceptance criteria engineers can build against, and translate engineering reality back into assurance language auditors and leadership can rely on. Default to getting the requirement designed into the system rather than papering over the gap with procedure. Preferred qualifications A combination of audit or advisory experience (Big 4 or equivalent, ideally IT audit) with in-house experience at an AI-forward tech company, in either order. Taken a company through a first-year SOX 404(a) and 404(b) assessment, including a first external ITGC audit. Defined or assessed controls over home-built financially significant systems, usage-based billing, or revenue metering pipelines. Defined or assessed controls for AI/ML systems or agents acting in production environments. Stood up continuous controls monitoring or automated evidence programs. Experience with SOC 1 reliance, service organization control mapping, and complementary user entity controls. CISSP, CISA, CPA, or equivalent certification. The annual compensation range for this role is listed below. For sales roles, the range provided is the role’s On Target Earnings ("OTE") range, meaning that the range includes both the sales commissions/sales bonuses target and annual base salary for the role. Annual Salary: $410,000 — $510,000 USD Logistics Minimum education: Bachelor’s degree or an equivalent combination of education, training, and/or experience Required field of study: A field relevant to the role as demonstrated through coursework, training, or professional experience Minimum years of experience: Years of experience required will correlate with the internal job level requirements for the position Location-based hybrid policy: Currently, we expect all staff to be in one of our offices at least 25% of the time. However, some roles may require more time in our offices. Visa sponsorship: We do sponsor visas! However, we aren't able to successfully sponsor visas for every role and every candidate. But if we make you an offer, we will make every reasonable effort to get you a visa, and we retain an immigration lawyer to help with this. For roles performing work in California: We will consider for employment all qualified applicants, including those with arrest or conviction records or criminal histories, in a manner consistent with the requirements of applicable state and local laws, including the San Francisco Fair Chance Ordinance, the City of Los Angeles’ Fair Chance Initiative for Hiring Ordinance, the Los Angeles County Fair Chance Ordinance for Employers, and the California Fair Chance Act. We encourage you to apply even if you do not believe you meet every single qualification. Not all strong candidates will meet every single qualification as listed.  Research shows that people who identify as being from underrepresented groups are more prone to experiencing imposter syndrome and doubting the strength of their candidacy, so we urge you not to exclude yourself prematurely and to submit an application if you're interested in this work. We think AI systems like the ones we're building have enormous social and ethical implications. We think this makes representation even more important, and we strive to include a range of diverse perspectives on our team. Your safety matters to us. To protect yourself from potential scams, remember that Anthropic recruiters only contact you from @anthropic.com email addresses. In some cases, we may partner with vetted recruiting agencies who will identify themselves as working on behalf of Anthropic. Be cautious of emails from other domains. Legitimate Anthropic recruiters will never ask for money, fees, or banking information before your first day. If you're ever unsure about a communication, don't click any links—visit anthropic.com/careers directly for confirmed position openings. How we're different We believe that the highest-impact AI research will be big science. At Anthropic we work as a single cohesive team on just a few large-scale research efforts. And we value impact — advancing our long-term goals of steerable, trustworthy AI — rather than work on smaller and more specific puzzles. We view AI research as an empirical science, which has as much in common with physics and biology as with traditional efforts in computer science. We're an extremely collaborative group, and we host frequent research discussions to ensure that we are pursuing the highest-impact work at any given time. As such, we greatly value communication skills. The easiest way to understand our research directions is to read our recent research. This research continues many of the directions our team worked on prior to Anthropic, including: GPT-3, Circuit-Based Interpretability, Multimodal Neurons, Scaling Laws, AI & Compute, Concrete Problems in AI Safety, and Learning from Human Preferences. Come work with us! Anthropic is a public benefit corporation headquartered in San Francisco. We offer competitive compensation and benefits, optional equity donation matching, generous vacation and parental leave, flexible working hours, and a lovely office space in which to collaborate with colleagues. Guidance on Candidates' AI Usage: Learn about our policy for using AI in our application process.

Location: Mexico The primary responsibility is to ensure that the company understands its obligations, submits accurate information on time, and remains continuously prepared for regulatory reviews. This is a regulatory leadership role. Technical controls are implemented by the Global Information Security and Technology teams, and the Information Security Manager drives that work from the regulatory side: translating Mexican regulatory requirements into clear actions, coordinating delivery across those teams, validating evidence, and owning the final regulatory outcome. The successful candidate combines senior regulatory judgment with disciplined execution. The role suits someone who works from verified facts, sees every issue through to closure, and plans ahead so that deliverables arrive ready on time. Challenges That Await You: Regulatory Compliance Monitor Mexican Information Security, cybersecurity, technology risk, business continuity, and related regulatory requirements applicable to The Company. Maintain a complete register of regulatory obligations, reporting deadlines, responsible owners, required evidence, dependencies, and current status. Interpret regulatory requirements and translate them into clear, actionable tasks for Information Security, Technology, Internal IT, Operations, Fraud Prevention, Business Continuity, and other responsible teams. Assess the impact of regulatory changes and coordinate required updates to controls, processes, policies, procedures, and reporting. Escalate regulatory risks, missing evidence, and potential delays before obligations become overdue. Regulatory Reporting Own the preparation and coordination of Information Security reports, formal responses, indicators, evidence packages, and information requests submitted to Mexican regulators. Coordinate reporting related to CNBV, Banco de México, SPEI, and other applicable local supervisory activities within the scope of Information Security. Verify all submitted information against source systems and supporting evidence. Ensure that reports accurately identify the work performed, responsible owners, control status, findings, incidents, and remediation progress. Maintain a clear audit trail of data sources, reviews, approvals, submissions, and regulator correspondence. Act as the quality gate for everything submitted to management, auditors, and regulators, so it is complete, consistent, and backed by evidence. Regulatory Engagement and Examinations Act as the primary Information Security contact in Mexico for regulatory examinations, formal information requests, interviews, and follow-up activities. Coordinate responses with the Global CISO, Legal, Compliance, Risk, Internal Audit, Technology, and other relevant stakeholders. Prepare Company representatives for regulatory meetings and ensure that answers are consistent, accurate, and supported by evidence. Track all commitments made to regulators until formally completed. Keep the company exam-ready all year round, so each review or request starts from a solid, up-to-date position. Audit and Assurance Lead Information Security preparation for internal audits, regulatory reviews, SPEI assessments, PCI DSS activities, and other assurance exercises applicable to Mexico. Maintain an evidence repository that is complete, current, and easy to validate. Review evidence before submission and make sure every statement and control description is complete and supported. Convert findings into remediation plans with clear owners, actions, deadlines, dependencies, and acceptance criteria. Monitor remediation and escalate overdue or blocked actions. Own the coordination of all Information Security audit and regulatory activities in Mexico from start to finish. Information Security Governance Represent Information Security before local management and control functions. Provide clear reporting on regulatory exposure, control gaps, audit findings, incidents, remediation, and material risks. Coordinate local implementation of the global Information Security Program. Ensure that local regulatory requirements are reflected in The Company’s Information Security documentation. Review local-language policies, procedures, standards, and regulatory responses to ensure that they preserve the original requirements and control meaning. Support regulatory aspects of information security incidents, including assessment of reporting obligations, evidence collection, and coordination of formal notifications. Team and Stakeholder Management Manage the local Information Security regulatory function with clear responsibilities, measurable objectives, and regular performance reviews. Build effective working relationships with Compliance, Legal, Internal Audit, Risk, Technology, Operations, Fraud Prevention, Business Continuity, and global Information Security teams. Distribute work fairly and transparently, based on clear roles and real capacity. Give timely, direct feedback and support each team member’s development, with documented follow-up. Build business cases for resources based on scope, workload, capability gaps, and expected outcomes. How Success Will Be Measured Regulatory reports are complete, accurate, approved, and supported by source-system evidence. All regulatory obligations and findings have documented owners, actions, deadlines, status, and evidence. Risks and blockers are escalated before they affect delivery. The Company is ready for regulatory and audit reviews at any time. Engineering and operational teams receive clear, actionable requirements they can execute directly. Remediation moves forward on schedule under local leadership. Local Information Security responsibilities are managed independently and transparently. What Makes You a Great Fit At least 5 years of experience in Information Security, governance, technology risk, regulatory compliance, or IT audit. At least 3 years of experience within a regulated financial institution in Mexico. Direct experience working with CNBV requirements and regulatory examinations. Practical experience with Banco de México and SPEI-related security, audit, reporting, or compliance activities. Proven ownership of regulatory submissions, formal responses, evidence collection, and remediation tracking. Experience translating regulatory requirements into operational and technical controls. Experience coordinating senior stakeholders across Information Security, cybersecurity, Technology, Legal, Compliance, Risk, Internal Audit, and Operations. Experience managing employees or specialist regulatory and security teams. Strong understanding of Information Security governance, risk management, incident response, access management, business continuity, third-party risk, logging, vulnerability management, and data protection. Fluent Spanish and professional working proficiency in English. Excellent written communication skills in both languages. Preferred Qualifications Experience with PCI DSS, ISO 27001, regulatory incident reporting, business continuity, and disaster recovery. Professional certifications such as CISSP, CISM, CRISC, CISA, or ISO 27001 Lead Auditor.

Location: Dublin, Ireland Workplace: Hybrid WHO WE ARE Notion is the collaborative AI workspace where teams and agents think together https://www.youtube.com/watch?v=vkpYpWfEK5s. We're building one place where your knowledge, projects, meetings, and AI tools live side by side, so work is faster, clearer, and less fragmented. Millions of individuals, small teams, and large companies run their work on Notion. Notinos (our employees) are customer zero in bringing this future of work to life. We care about craft, building things that last, and the belief that great work is still fundamentally human. Our goal isn’t to ship the next feature. Each and every team of Notinos is working to set the standard for how humans work together in the AI era. From building a business’s system of record to making and managing AI agents to automating away the busy work, we care deeply about giving our customers more time for their life’s work. ABOUT US: Notion helps you build beautiful tools for your life’s work. In today's world of endless apps and tabs, Notion provides one place for teams to get everything done, seamlessly connecting docs, notes, projects, calendar, and email—with AI built in to find answers and automate work. Millions of users, from individuals to large organizations like Toyota, Figma, and OpenAI, love Notion for its flexibility and choose it because it helps them save time and money.   In-person collaboration is essential to Notion's culture. We require all team members to work from our offices on Mondays, Tuesdays, and Thursdays, our designated Anchor Days. Certain teams or positions may require additional in-office workdays.   ABOUT THE ROLE: Millions of people rely on Notion to do their most important work. Protecting that trust starts with protecting the people who build Notion: our employees, their laptops, their identities, and the SaaS apps they rely on every day. We are looking for a hands-on Corporate Security Engineer to own and improve the technical controls that keep our workforce and corporate environment safe. This is a security engineering role focused on building scalable controls and automation across identity, endpoints, SaaS, and workforce infrastructure, not a traditional IT support or corporate engineering role. You'll own and evolve core security controls, design systems and automation that scale with the company, and help make security both stronger and easier to use. You'll partner closely with IT, Infrastructure, GRC, and Detection & Response to improve the security foundations that employees rely on every day.   WHAT YOU'LL ACHIEVE: - Harden our identity and access management stack, including Okta and Google Workspace, with phishing-resistant MFA, strong SSO and SCIM lifecycles, and least-privilege access across SaaS. - Run our endpoint security program across a macOS-first fleet, including MDM, EDR, and configuration baselines, with working coverage for Windows and ChromeOS. - Secure AI tool usage at the endpoint, including governance of large language models, AI agents, and model context protocol (MCP) integrations; detect and prevent unauthorized or risky AI service access and data exfiltration through AI-enabled tools. - Reduce SaaS risk at scale through SSPM tooling and custom automation, including detection of risky OAuth grants, excessive permissions, shadow IT, and configuration drift. - Write code (Python, Terraform) to automate access reviews, onboarding and offboarding, configuration drift detection, and audit evidence collection. - Partner with Detection & Response to ensure corporate systems produce the telemetry needed to detect identity, endpoint, and SaaS abuse. - Support SOC 2, ISO 27001, and customer audits as a byproduct of good engineering, not a separate workstream. - Partner with Detection & Response on investigation and response for corporate security incidents, including phishing, account compromise, lost devices, and BEC.   SKILLS YOU NEED TO BRING: - Have 5+ years of hands-on experience in corporate security, enterprise security, or IT security engineering at a cloud-native company. - Have working knowledge of a major identity provider (Okta, Entra, or Google Workspace) and the underlying protocols (SAML, OIDC, OAuth 2.0, SCIM). - Have hands-on experience operating endpoint management and detection tooling across macOS and enterprise environments. - Write production-quality scripts and automation in Python or Bash, and have shipped Terraform or other infrastructure-as-code for security configuration. - Are familiar with SaaS security risks (OAuth governance, audit logging, SSPM) and the realities of integrating a long tail of vendors. - Have working knowledge of at least one major cloud platform (AWS, GCP, or Azure) at the security configuration level. - Communicate clearly in writing and work effectively across IT, Engineering, Legal, People, and GRC. NICE TO HAVES: - Experience at a fast-growing tech or AI company where the security program had to outpace headcount. - A background in IT engineering, SRE, or production engineering that transitioned into security engineering. - Experience building internal security tooling or workflows that improved employee or developer experience. - Contributions to the security community through open-source tools, blog posts, or conference talks.   We hire talented and passionate people from a variety of backgrounds because we want our global employee base to represent the wide diversity of our customers. If you’re excited about a role but your past experience doesn’t align perfectly with every bullet point listed in the job description, we still encourage you to apply. If you’re a builder at heart, share our company values, and enthusiastic about making software toolmaking ubiquitous, we want to hear from you.   Notion is proud to be an equal opportunity employer. We do not discriminate in hiring or any employment decision based on race, color, religion, national origin, age, sex (including pregnancy, childbirth, or related medical conditions), marital status, ancestry, physical or mental disability, genetic information, veteran status, gender identity or expression, sexual orientation, or other applicable legally protected characteristic. Notion considers qualified applicants with criminal histories, consistent with applicable federal, state and local law. Notion is also committed to providing reasonable accommodations for qualified individuals with disabilities and disabled veterans in our job application procedures. If you need assistance or an accommodation due to a disability, please let your recruiter know.   By clicking “Submit Application”, I understand and agree that Notion and its affiliates and subsidiaries will collect and process my information in accordance with Notion’s Global Recruiting Privacy Policy https://notion.notion.site/Notion-Global-Recruiting-Privacy-Policy-fc3eb4e829354a26a2bb6fd5e289b550. https://dev.notion.so/a3ce416456924276a59de91bca740028?pvs=21   #LI-Onsite A NOTE ON AI You don’t need deep AI expertise for every role, but we do expect every Notino to be intellectually curious, drawn to tinkering and discovery, and excited to use AI as a real collaborator in their work. For some roles, AI fluency is a core requirement — when that’s the case, we'll say so explicitly in the qualifications. People who thrive here don’t treat AI as a novelty. They use it to think better, and make their work easier for others to build on. EQUAL OPPORTUNITY & ACCOMMODATIONS We hire talented people from a wide range of backgrounds. If you’re excited about this role but don’t meet every bullet, we still encourage you to apply. Notion is an equal opportunity employer and does not discriminate on the basis of any legally protected characteristic. Consistent with applicable law, we will consider for employment qualified applicants with arrest and conviction records. Notion provides reasonable accommodations during the application process; if you need one, please let your recruiter know. Notion is proud to be an equal opportunity employer. We do not discriminate in hiring or any employment decision based on race, color, religion, national origin, age, sex (including pregnancy, childbirth, or related medical conditions), marital status, ancestry, physical or mental disability, genetic information, veteran status, gender identity or expression, sexual orientation, or other applicable legally protected characteristic. Notion considers qualified applicants with criminal histories, consistent with applicable federal, state and local law. Notion is also committed to providing reasonable accommodations for qualified individuals with disabilities and disabled veterans in our job application procedures. If you need assistance or an accommodation due to a disability, please let your recruiter know.

Samsara is the pioneer of the Connected Operations™ Cloud, a platform that enables organizations that depend on physical operations to harness IoT data to improve safety, efficiency, and sustainability. Key requirements: — proficiency in Go, Python, and JavaScript — bonus: experience with C/C++ (firmware/embedded systems)

Требования: — владение Go, Python и JavaScript — опыт с C/C++ (прошивка/встроенные системы) будет плюсом

Требования: — владение Go, Python и JavaScript — опыт с C/C++ (прошивка/встроенные системы) будет плюсом

Samsara is the pioneer of the Connected Operations™ Cloud, a platform that enables organizations that depend on physical operations to harness IoT data to improve safety, efficiency, and sustainability. Key requirements: — proficiency in Go, Python, and JavaScript — bonus: experience with C/C++ (firmware/embedded systems)

Требования: — владение Go, Python и JavaScript — опыт с C/C++ (прошивка/встроенные системы) будет плюсом

Location: Remote / Germany Orcrist is building a next generation data intelligence platform using cutting-edge technologies. We're handling petabyte-scale data with sub-second queries. Our product is a Kubernetes‑based platform delivered as B2B SaaS or as a self‑hosted on‑prem solution, including air‑gapped deployments. We enable customers across defense, law enforcement, and enterprise to turn mission-critical data into actionable intelligence. Role As Group ISB, you own the information security strategy, programme, and posture of the Vektor Group, from strategy to hands-on execution. You work in close operational partnership with the Director of Internal IT on technical controls and implementation. Your core mandate is ISO 27001 certification on the basis of BSI IT-Grundschutz, together with NIS-2 compliance: from gap analysis and controls implementation through audit readiness, ongoing maintenance, and the regulatory obligations arising under both frameworks. We build AI platforms for customers in the defence and government sector. Information security is a precondition for our business, not an afterthought. We are building the security organisation while the group grows. During this phase, everyone including leadership works hands-on: day-to-day operational security, direct support for the IT team, and tasks outside the boundaries of a traditional governance role. External consultants support the ramp-up. As the ISMS and the team mature, the balance shifts toward strategy and governance. What you'll do Build and operate the group-wide ISMS following BSI standards 200-1/200-2/200-3: structure analysis, protection needs assessment, modelling, risk analysis Create and maintain the security policy framework and processes at group level; coordinate company-specific additions Prepare and accompany ISO 27001 certification, run internal audits, work with external auditors Implement NIS-2 obligations: reporting processes, evidence management, corrective action tracking Manage risk across technical and organizational domains, including reporting to executive management Steer external consultants and service providers within the running programme Build and run the security awareness programme: training and sensitization Own incident response planning and coordinate during incidents, together with IT, Legal, and leadership Assess third-party and vendor risk, run security assessments for new tools and partners Work closely with the Director of Internal IT (technical controls: access governance, endpoint security, identity) and with platform engineering (interface to product security) Support sales and customer trust processes: security questionnaires, due diligence, customer audits Track further regulatory requirements (EU AI Act, Cyber Resilience Act, among others) and derive required action About you Several years of experience as an ISB or in comparable responsibility for information security Proven practice with BSI IT-Grundschutz: BSI standards 200-x and the Grundschutz-Kompendium, ideally including a completed certification procedure Experience building or leading ISO 27001 programmes, from gap analysis to audit readiness Solid risk management: you assess, prioritize, and communicate risk clearly to technical and non-technical audiences Willingness to work hands-on during the build-up phase Confident interaction with executive management, auditors, and customers German at C1 or above, English at B2 or above Nice-to-haves Certifications: IT-Grundschutz-Praktiker/-Berater, ISO 27001 Lead Implementer or Lead Auditor, CISSP, CISM Experience with security governance across multiple legal entities or jurisdictions Experience in regulated environments: defence, government, critical infrastructure; familiarity with VS-NfD, Geheimschutz, or AQAP Practical NIS-2 implementation experience Experience with sales-adjacent security processes (pre-sales, customer audits) What we offer Remote-first, Germany-wide: Work from wherever you do your best work, with regular team gatherings in Berlin and other off-site locations. Flexibility by default: Flexible working hours help you make work fit your life. Your setup, your way: Get a personal home-office equipment budget to create a workspace that works for you. 30 days of vacation: Take the time you need to recharge and come back with fresh energy. Keep growing: We invest in your personal and professional development. Get rewarded for impact: Performance bonuses are tied to agreed objectives and key results. A warm welcome: Every new team member gets a welcome goodie bag. Good people, good times: From summer and Christmas parties to regular team gatherings, we make time to celebrate together. A mission that matters: Work on challenges with tangible impact on public safety and national security.

Location: Tel Aviv, Israel About Nebius: Nebius is leading a new era in cloud infrastructure for the global AI economy. We are building a full-stack AI cloud platform that supports developers and enterprises from data and model training through to production deployment, without the cost and complexity of building large in-house AI/ML infrastructure. Built by engineers, for engineers. From large-scale GPU orchestration to inference optimization, we own the hard problems across compute, storage, networking and applied AI. Listed on Nasdaq (NBIS) and headquartered in Amsterdam, we have a global footprint with R&D hubs across Europe, the UK, North America and Israel. Our team of 1,500+ includes hundreds of engineers with deep expertise across hardware, software and AI R&D. The role Nebius is looking for a Security Risk Lead to strengthen security risk management across our global AI cloud infrastructure, products, business operations, and strategic programs. This is a senior, hands-on individual-contributor role with end-to-end ownership of security risk assessments, the security risk register, remediation tracking, risk acceptance, and risk reporting. The successful candidate will work closely with engineering, cloud infrastructure, product, security, compliance, legal, and business teams to ensure that material risks are identified early, assessed consistently, and driven toward clear treatment decisions. The role requires strong judgment, technical understanding, and the ability to influence stakeholders without relying on formal authority. Your responsibilities will include Risk Assessment Lead security risk assessments for infrastructure, cloud environments, products, applications, business processes, and major technology changes. Conduct risk assessments for new initiatives, systems, and significant changes, including supporting M&A-related risk assessment work alongside the due diligence team. Evaluate the design and effectiveness of controls and identify residual risk following mitigation. Identify emerging and systemic risks that may affect multiple services, regions, or business functions. Risk Register & Tracking Maintain the security risk register: log new risks, update status, track owners, and follow items through to remediation or formal risk acceptance. Support the ongoing refinement of Nebius's risk assessment and risk register processes, contributing improvements as the practice matures. Coordinate with other GRC functions on findings and gap assessments that carry risk implications, and independently determine whether a given finding warrants a risk register entry. Metrics & Reporting Maintain and improve security risk assessment, scoring, prioritization, and acceptance processes. Define and monitor meaningful Key Risk Indicators and risk trends. Translate complex technical risks into clear business impact for senior leadership and governance forums. Prepare risk reporting that supports security posture reviews, strategic decision-making, and Board-level reporting. Support auditors, customers, and internal stakeholders on security risk management matters. Cross-Functional Coordination Work closely with other GRC functions to ensure risk assessments reflect current operating reality. Partner with engineering and business stakeholders to embed risk thinking into day-to-day decisions, building trust through clear, practical communication rather than formal authority. Build trusted relationships with risk and remediation owners while maintaining independent and objective judgment. We expect you to have 5-8 years of experience in security risk management, IT risk, GRC, or a closely related discipline. Hands-on experience running risk assessments and maintaining a risk register, including driving items through to remediation or formal risk acceptance. Solid understanding of risk scoring and prioritization approaches, and the judgment to apply them consistently and defensibly. Ability to define and track meaningful risk metrics/KRIs for leadership reporting. Strong organizational and analytical skills, with the ability to manage multiple concurrent risk items without losing accuracy or follow-through. Strong communication and stakeholder management skills; comfortable working across security, compliance, engineering, and business teams. Familiarity with cloud infrastructure and technology environments is an advantage. Relevant certifications (e.g., CRISC, CISSP) are an advantage, not a requirement. Bachelor's degree in information security, computer science, engineering, or a related field preferred; equivalent practical experience will be considered. Excellent written and verbal communication skills in English. Benefits & Perks: Competitive compensation Career growth and learning opportunities Flexibility and ownership Collaborative and innovative culture Opportunity to work on impactful AI projects International environment and talented teams What's it like to work at Nebius: Fast moving - Bold thinking - Constant growth - Meaningful impact - Trust and real ownership - Opportunity to shape the future of AI Equal Opportunity Statement: Nebius is an equal opportunity employer. We are committed to fostering an inclusive and diverse workplace and to providing equal employment opportunities in all aspects of employment. We do not discriminate on the basis of race, color, religion, sex (including pregnancy), national origin, ancestry, age, disability, genetic information, marital status, veteran status, sexual orientation, gender identity or expression, or any other characteristic protected by applicable law. Applicants must be authorized to work in the country in which they apply and will be required to provide proof of employment eligibility as a condition of hire. If you need accommodations during the application process, please let us know.

Location: Kyiv; Lviv; Vinnytsia Workplace: onsite Ajax Systems is an international technology company and the largest security systems manufacturer in Europe. Ajax products are trusted by more than 4.5 million end users and 330,000 PRO users across over 180 countries. The company offers comprehensive solutions for protecting residential and commercial properties of various sizes. Today, the Ajax portfolio includes 280 devices for intrusion protection, video surveillance, fire safety, and comfort and automation. Every year, we demonstrate exponential growth both in the size of our team and in the number of users worldwide.   Ajax Systems operates a full-cycle production model, from idea generation and prototyping to mass production and global sales. Each department fully covers a specific operational need of the business. The company’s specialists are involved at every stage — from the production line in Ukraine to the logistics center in Poland, from where products are shipped to distributors worldwide. Now we are looking for a hands-on Cyber Security Specialist to strengthen our security posture and operational resilience. You will be at the forefront of our cybersecurity defense, responsible for incident monitoring and investigation, the deployment and improvement of security solutions, and ensuring our corporate processes and infrastructure meets compliance standards. If you are passionate about building secure systems, incidents investigation and translating technical findings into efficient mitigation actions, this role is for you. Key Responsibilities: Security systems support and improvements: Participate in security architecture improvement, provide support for the full lifecycle of security systems — from design and deployment to enhancement and technical support. Security Monitoring & Incident Response: Improve security monitoring processes and practices, participate in security events monitoring and triaging detected events. Develop and refine SIEM detection rules, investigate anomalies and identify root-cause of incidents, develop and execute mitigation plans to neutralize threats. Conduction Security Assessments: Conduct technical security assessments of corporate IT systems to identify compliance deviations and vulnerabilities. Participate in risks assessments, mitigation measures design and implementation. Compliance & Governance: Participate in improvement of security procedures, policies, and operational instructions. Collaborate with stakeholders on security processes implementation and improvement to ensure readiness for external security audits (e.g., ISO 27001, SOC2). Consultancy & Support: Partner with internal teams to define security requirements for new systems and solutions, provide expert guidance on implementing security controls. Participate in security requests processing, security awareness trainings preparation and conduction. Reporting & Strategy: Participate in preparation of reports for management, definition and description of security strategy. Required Technical Skills & Qualifications: Experience: 5+ years in CyberSecurity with a strong focus on SOC operations and security systems implementation. Core Proficiency: Hands-on experience with SIEM systems (Splunk/QRadar/Logsign/Wazuh), MDM solutions (Jamf/Crowdstrike/JumpCloud/Zoho), EDR/XDR solutions (SentinelOne/ESET/Defender), Cloud security monitoring (M365, GWS, AWS), and Firewall/WAF technologies (Cisco/PaloAlto/Fortinet/Ubiquiti). Domain Knowledge: Strong understanding of On-Premise and Cloud architectures, network security protocols, endpoint and application security. Practical experience in industry security best practices implementation (CIS, OWASP, NIST). Security assessment: Practical experience performing IT systems and application security assessments and reports preparation. Security governance: Experience in preparation of security reports, procedures and instructions for reporting. Practical knowledge of ISO 27001 technological controls implementation. Language Proficiency: Intermediate (B1-B2) English level required for working with technical documentation, cross-regional communication with colleagues and partners. Preferred Skills & Certifications: Certifications: Vendor-specific security certifications (e.g., Google, MIcrosoft, Cisco, Palo Alto PCNSE, Fortinet NSE) are highly valued. Frameworks: Practical knowledge of ISO 27001 organizational controls implementation. Why Join Us: Impact: Take ownership of security projects from concept to deployment. Culture: Work in a "zero bullshit" environment that values technical excellence and autonomy. Growth: Access to corporate English training and professional development/certification support. Health care: medical insurance. Beta Access: Get hands-on experience with new Ajax security systems before they reach the market. Innovation: Help shape the future of "Made in Ukraine" reliability.

Location: Remote, Canada; Remote, Israel; Remote, United Kingdom; Remote, United States GitLab is the intelligent orchestration platform for DevSecOps. GitLab enables organizations to increase developer productivity, improve operational efficiency, reduce security and compliance risk, and accelerate digital transformation. More than 50 million registered users and more than 50% of the Fortune 100* trust GitLab to ship better, more secure software faster. The same principles built into our products are reflected in how our team works: we embrace AI as a core productivity multiplier, with all team members expected to incorporate AI into their daily workflows to drive efficiency, innovation, and impact. GitLab is where careers accelerate, innovation flourishes, and every voice is valued. Our high-performance culture is driven by our values and continuous knowledge exchange, enabling our team members to reach their full potential while collaborating with industry leaders to solve complex problems. Co-create the future with us as we build technology that transforms how the world develops software. * Fortune 500® is a registered trademark of Fortune Media IP Limited, used under license. Claim based on GitLab data. Fortune 100 refers to the top 20% ranked companies in the 2025 Fortune 500 list, published in June 2025. Fortune and Fortune Media IP Limited are not affiliated with, and do not endorse products or services of GitLab. An overview of the role We are seeking a Principal Security Researcher to join our Application Security Team to conduct cutting-edge security research on GitLab's AI-powered DevSecOps capabilities. As GitLab transforms software development through intelligent collaboration between developers and specialized AI agents, we need security researchers who can proactively identify and validate vulnerabilities before they impact our platform or customers. In this role, you'll be at the forefront of security research, working with our GitLab DevSecOps platform, Duo Agent Platform, GitLab Duo Chat, and AI workflows that represent the future of human/AI collaborative development. You'll develop novel testing methodologies (including for AI agent security), conduct hands-on penetration testing, and translate emerging threats into actionable security improvements. Your research will directly influence how we build and secure the next generation of AI-powered DevSecOps tools, ensuring GitLab remains the most secure software factory platform on the market. This position offers the unique opportunity to shape security and AI security practices in one of the world's largest DevSecOps platforms, working with engineering teams who are pushing the boundaries of what's possible with AI-assisted software development. You'll have access to cutting-edge AI systems and the freedom to explore creative attack scenarios while contributing to the security of millions of developers worldwide. This role reports to the Senior Manager of Application Security. What you'll do Conduct and lead security research projects across multiple functional areas. Identify novel, systemic, and chained vulnerabilities in GitLab, where individual weaknesses combine for outsized impact. Validate security vulnerabilities through hands-on testing, developing proof-of-concept exploits that demonstrate real-world attack scenarios. Assess emerging industry vulnerability classes against the GitLab codebase, and drive remediation of the class rather than the instance. Lead security research into GitLab's AI and agentic surfaces, and define the security requirements that engineering teams build against. Build and direct the tooling and automation that scales security research, including agent-assisted vulnerability discovery across our codebase. Research the security posture of open source tools and dependencies integrated with GitLab, report findings to their maintainers, and track mitigation following our responsible disclosure guidelines . Solve technical problems of the highest scope, complexity, and ambiguity. Help shape the team and sub-department roadmap. Lead the integration of security research results into the engineering and business functions that need to act on them. Teach, mentor, and advise other domain experts and individual contributors across several teams. Share knowledge and novel vulnerability types with the security community. What you'll bring 10+ years of experience in security research, penetration testing, or offensive security roles Strong ability in discovering and exploiting vulnerabilities in large codebase and complex systems Proficiency in two or more of Ruby, Go, Python, TypeScript, or Rust. Ability to read and analyze code across multiple languages and codebases Strong knowledge of AI frameworks Strong understanding of AI attack vectors including prompt injection, agent manipulation, and workflow exploitation At ease in establishing and driving complex remediation initiatives involving cross-functional teams Excellent written communication skills with an ability to articulate complex topics in a clear and concise manner. Ability to translate complex technical findings into clear risk assessments and remediation recommendations Strong analytical and problem-solving skills with creative thinking about attack scenarios Nice to Have: Published security research or conference presentations; background in software engineering with distributed systems expertise; experience with GitLab or similar DevSecOps platforms About the team Security Researchers are a part of our Application Security team, who address complex security challenges facing GitLab and its customers to enable GitLab to be the most secure software factory platform on the market. We focus on systemic product security risks and work cross-functionally to mitigate them while maintaining Engineering's development velocity. The base salary range for this role’s listed level is currently for residents of the United States only. This range is intended to reflect the role's base salary rate in locations throughout the US. Grade level and salary ranges are determined through interviews and a review of education, experience, knowledge, skills, abilities of the applicant, equity with other team members, alignment with market data, and geographic location. The base salary range does not include any bonuses, equity, or benefits. See more information on our benefits and equity . Sales roles are also eligible for incentive pay targeted at up to 100% of the offered base salary. United States Salary Range $203,200 — $275,000 USD How GitLab Supports Full-Time Employees Benefits to support your health, finances, and well-being Flexible Paid Time Off Team Member Resource Groups Equity Compensation & Employee Stock Purchase Plan Growth and Development Fund Parental Leave Please note that we welcome interest from candidates with varying levels of experience; many successful candidates do not meet every single requirement. Additionally, studies have shown that people from underrepresented groups are less likely to apply to a job unless they meet every single qualification. If you're excited about this role, please apply and allow our recruiters to assess your application. Country Hiring Guidelines: GitLab hires new team members in countries around the world. All of our roles are remote, however some roles may carry specific location-based eligibility requirements. Our Talent Acquisition team can help answer any questions about location after starting the recruiting process. Privacy Policy: Please review our Recruitment Privacy Policy. Your privacy is important to us. GitLab is proud to be an equal opportunity workplace and is an affirmative action employer. GitLab’s policies and practices relating to recruitment, employment, career development and advancement, promotion, and retirement are based solely on merit, regardless of race, color, religion, ancestry, sex (including pregnancy, lactation, sexual orientation, gender identity, or gender expression), national origin, age, citizenship, marital status, mental or physical disability, genetic information (including family medical history), discharge status from the military, protected veteran status (which includes disabled veterans, recently separated veterans, active duty wartime or campaign badge veterans, and Armed Forces service medal veterans), or any other basis protected by law. GitLab will not tolerate discrimination or harassment based on any of these characteristics. See also GitLab’s EEO Policy and EEO is the Law . If you have a disability or special need that requires accommodation , please let us know during the recruiting process .

Location: Toronto; San Francisco; London; New York; Montreal Workplace: Remote WHO ARE WE? Cohere is the leading security-first enterprise AI company. We build cutting-edge foundation AI models and end-to-end products that are designed to solve real-world business problems. We’re training and deploying frontier models for enterprises who are building AI systems. We believe that our work is instrumental to the widespread adoption of AI and we are looking for folks that want to be part of that. We obsess over what we build. Each one of us is responsible for contributing to increasing the capabilities of our models and the value they drive for our customers. Cohere is a team of researchers, engineers, designers, and more, who are all passionate about their craft. We are a global technology company headquartered in Toronto with key offices in London, New York City, San Francisco, Montreal, Paris, Berlin and Seoul. Join us! As a Senior Security Engineer you will: - Serve as trusted advisor to team’s leadership and partner teams by clearly articulating business risks associated with security issues - Lead security operation functions – including vulnerability management, SAST, DAST, detection engineering, and incident response – in CI/CD and cloud-native production environments - Integrate security into our applications throughout the software development lifecycle - Collaborate with product and development teams, driving the success of larger projects to ensure that software is built and deployed securely without compromising agility and speed - Driving and supporting bug bounty program, application security reviews and threat modeling, including code review and dynamic testing - Assess and integrate security tools to automate and scale security processes, i.e: evaluate open-source vs vendor solutions - Gather and analyze security metrics to address security issues with cross-team dependencies - Be a problem solver who is empathetic to developer concerns and will employ constructive and flexible approach to building innovative solutions You may be a good fit if: - 5+ years previous experience in Application/Product Security or Security Operations with a strong focus on security tool onboarding and optimization - You have an understanding of vulnerability management, network security, cloud security concepts, and industry best practices across many fields of security - You are comfortable with ambiguity and are able to make informed decisions with little data - You employ a flexible and constructive approach when solving problems - You are able to make trade-offs between build vs. buy decisions - help build solutions and able to review what tools are available - You understand secure engineering best practices, can articulate problem statements and propose solutions to both technically savvy and non-technical audiences - You have a deep technical understanding of common security vulnerabilities and risks, as well as countermeasures and compensating controls - You’re a hands-on security engineer interested in automating controls FULL-TIME EMPLOYEES AT COHERE ENJOY THESE PERKS: - A weekly lunch stipend of $75/£75 or equivalent in your local currency for lunch. - Full health and dental benefits, including a separate budget for mental health. - RRSP matching, 401K, Pension Scheme. - 100% Parental Leave top-up for up to 6 months, for either parent. - Annual enrichment benefits: Arts & culture, fitness/wellness, quality time, and a workspace improvement credit. Education & learning stipend for conferences, courses, and coaching. - 6 weeks of paid vacation (30 working days!) - Budget for traveling to other offices if you are remote, plus an annual company offsite. HOW AND WHERE WE WORK: - Cohere is remote-friendly, but we also have offices in Toronto, London, New York City, San Francisco, Montreal, Paris, Berlin and Seoul with more opening soon. - For those in the office: a daily lunch program, plenty of snacks, and regular community and social events. - For those not near an office: a co-working benefit so you can work alongside others in your city. - Everyone receives a $500 home office stipend to set up your workspace properly. If any of the above doesn’t line up exactly with your experience, we still encourage you to apply. We strive to create an inclusive work environment for all; we welcome applicants from all backgrounds and are committed to providing equal opportunities. Should you require any accommodations during the recruitment process, please submit an Accommodations Request Form https://docs.google.com/forms/d/12a6IrLdF3kI2nonKSr4tiFuz18rLQbaeYV-JM9L4o9Q/edit, and we will work together to meet your needs. We may use AI-enabled tools to screen and assess applicants against the criteria for this position. This helps our recruiters identify potentially qualified candidates, but it doesn't limit the applications our recruiters may review or consider. Beware of Scams: Cohere will never ask for payment or third-party services (e.g., CV writing) as part of our hiring process. All legitimate roles are listed on the Cohere careers page and LinkedIn only, with all communications from Cohere employees coming from an @cohere.com or @cw.cohere email alias. If jobs are viewed on other sites then please verify these through our official careers https://cohere.com/careers page.

Location: Salt Lake City, Utah, United States About the Role ICapital is looking for a hands-on Application Security practitioner to join a small, high-impact team building a modern AppSec program. This individual will work directly with the Head of AppSec and senior team members, executing secure design, API security, and developer enablement. Responsibilities Support threat modeling and design reviews across a broad and growing service portfolio. Support shift-left security initiatives, security in CI/CD, developer guidance, and SAST and SCA remediation workflows. Contribute to API security across the organization, assessing API exposure, validating authentication and authorization patterns. Write Python automation that scales AppSec capacity: triage tooling, finding pipelines, security context enrichment. Work directly with developers to remediate SAST and SCA findings, reduce false positive noise, and build security habits across engineering. Qualifications Hands-on experience across some secure design and threat modeling, API security, offensive security, or SAST/SCA program work Real understanding of attack patterns and exploitation techniques Familiar with OWASP Top 10 in practice API security experience with REST and GraphQL assessment Able to build and maintain security automation in Python, tooling that scales AppSec capacity Understanding of web application and API security Able to operate with autonomy in an environment still building its processes Relevant certifications, cloud-native environment experience and exposure to AI/LLM security are a plus Experience as a developer or engineer and fluency in Ruby, Python, and Scala are a plus Benefits The base salary range for this role is $100,000 to $130,000.  iCapital offers a compensation package which includes salary, equity for all full-time employees, and an annual performance bonus. Employees also receive a comprehensive benefits package that includes an employer matched retirement plan, generously subsidized healthcare with 100% employer paid dental, vision, telemedicine, and virtual mental health counseling, parental leave, and unlimited paid time off (PTO). We believe the best ideas and innovation happen when we are together. Employees in this role will work in the office Monday-Thursday, with the flexibility to work remotely on Friday. For additional information on iCapital, please visit https://www.icapitalnetwork.com/about-us Twitter: @icapitalnetwork | LinkedIn: https://www.linkedin.com/company/icapital-network-inc | Awards Disclaimer: https://www.icapitalnetwork.com/about-us/recognition/ iCapital is proud to be an Equal Employment Opportunity and Affirmative Action employer. We do not discriminate based upon race, religion, color, national origin, gender, sexual orientation, gender identity, age, status as a protected veteran, status as an individual with a disability, or other applicable legally protected characteristics.

Location: Poland; United Arab Emirates; Brazil; Argentina; Spain; Serbia Imunify360 is a leading developer of Linux infrastructure and security solutions. Our flagship product, Imunify360, is a comprehensive security suite that protects thousands of shared hosting environments, VPS, and dedicated servers worldwide. Our clients include industry giants such as Dell, GoDaddy, IBM, and Zoom, with over 4,500 customers globally. The company has more than 250 employees. We are looking for an engineer-architect to build a new product from scratch . This is not a position within an existing team—you will single-handedly create a runtime protection layer for Node.js applications. The hosting market is rapidly adopting Node.js, and modern applications are increasingly generated by users with AI tools and little technical security expertise. Your mission is to make protection automatic, transparent to client code, and effective in real time. This is a role with the highest level of ownership (Senior / Staff / Architect level), where you will make key architectural decisions and take full responsibility for the outcome. Responsibilities Define the technical approach for building runtime protection inside the Node.js process. Design the detection logic to identify and block attacks during application execution. Build and launch the first version of the product in real production environments. Ensure the protection works without requiring changes to client code and without breaking legitimate applications. Continuously improve the product based on telemetry, production feedback, and real-world incidents. Achieve target values across four key metrics: Runtime overhead False positives False negatives Customer escalation volume Requirements The top priority is Security, not just Node.js. Security experience outweighs general backend tenure. Must-have: Experience in Security Engineering or Security Research (deep understanding of attack vectors and defense methods). Have independently built and shipped a product/solution from scratch (end-to-end ownership: from idea to production). Ability to take an ambiguous problem, define a solution, and deliver a working result without constant supervision. Experience designing architecture and making key technical decisions (Staff/Architect level is a strong plus). English language: Intermediate or higher (written and spoken — all interviews are conducted in English). Nice-to-have: Security experience specifically in the context of Node.js (vulnerability analysis, securing, researching Node.js applications). Experience with Linux in production and development environments. Knowledge of Runtime Protection, WAF, instrumentation, malware analysis, and Incident Response. Experience in managed hosting / VPS domains. Experience with AI coding agents (Copilot, Cursor, etc.). Important: If you are a Security Engineer / Researcher who doesn't code on a daily basis, you must be comfortable using AI-assisted development tools and be capable of building an MVP with their help. Who you are (mindset): Builder: You genuinely enjoy creating something new and seeing it run in production. High ownership: You don't wait for tasks to be assigned — you define the approach and own the results. Practioner: You write code (yourself or with AI), not just review and coordinate. You understand Detection Engineering — how detection rules behave at scale across thousands of servers and the true cost of false positives. We do NOT consider candidates who: Have only theoretical or research experience without shipping real products. Have general Node.js development experience but lack a security component. Reside in countries with complex B2B tax reporting requirements (USA, UK, Canada, Germany, France, and others — to be clarified during screening). Have frequent job changes (every 1–2 years) without valid reasons. Benefits Format: 100% remote work anywhere in the world. Legal setup: B2B only (contract with your sole proprietorship or company). Budget: Up to $12,000 gross/month (before taxes, under a B2B agreement). Company: A stable, established international product company with 15+ years in the market. Role: A key position in building a new product line from the ground up.

Location: Palo Alto Workplace: remote PIP Labs is an R&D company contributing to the development of the DATA Network, open infrastructure that enables real human data to be sourced, proven and processed for AI training. The network is stewarded by the DATA Foundation, which supports its long-term development, integrity and permissionless nature. The Foundation also maintains Trace, the network’s public audit layer, where the provenance, consent, licensing and payment history associated with data records can be verified. We are looking for a hands-on Security Engineer to own and strengthen security across PIP Labs’ cloud environment, endpoints and internal systems, while also supporting related companies, including Poseidon, across the broader ecosystem. You will balance day-to-day security operations with the automation required to manage a growing, globally distributed environment effectively. This is a practical ownership role for someone who communicates clearly, moves quickly and is comfortable getting into the details. You will investigate alerts, improve controls, support employees and engineers, and implement fixes directly. As the ecosystem works with increasingly valuable real-world data, you will also help strengthen how that data, and the systems surrounding it, are accessed and protected. What you’ll do Own day-to-day security operations across PIP Labs and related companies, including monitoring, alert triage, incident response and remediation. Secure and administer our AWS environment, with some exposure to Google Cloud, and continuously improve our cloud security posture. Manage endpoint security and device controls using tools such as CrowdStrike and Jamf. Automate recurring security and IT workflows so that controls can scale across multiple companies without unnecessary manual work. Partner with infrastructure and engineering teams to identify risks, improve configurations and ship practical fixes, including contributing code or pull requests where appropriate. Own dependency hygiene and software supply chain security, ensuring third-party code is appropriately vetted, pinned and continuously monitored for compromise. Support identity, access, device and other internal IT security needs for a globally distributed team. Develop and maintain clear security procedures, playbooks and documentation. Help assess and strengthen how sensitive and valuable real-world datasets are ingested, stored, accessed and protected across the DATA Network ecosystem. Contribute to security readiness in a high-threat environment, including protection against targeted account compromise, credential theft and sophisticated social-engineering attempts. What we’re looking for Professional experience in cloud security, IT security, security engineering or a closely related role. Strong practical knowledge of AWS security, including identity and access management, logging, monitoring and secure configuration. Experience operating endpoint detection and response and device-management tooling. Experience with CrowdStrike and Jamf is strongly preferred. A track record of automating operational workflows through scripting, APIs, infrastructure tooling, agents or security orchestration. Comfort handling both security engineering and hands-on internal IT responsibilities. A proactive, low-ego approach. You identify gaps, propose solutions and follow work through to completion. Excellent written and spoken English, with the ability to communicate clearly across technical and non-technical teams. Sound judgment under pressure and a practical approach to balancing security, speed and usability. Nice to have Experience securing data platforms, ingestion pipelines or environments that hold high-value datasets. Familiarity with Google Cloud or Google Workspace administration and security. Experience working in Web3, blockchain or another environment exposed to persistent, sophisticated threat actors. Experience supporting multiple business entities, business units or portfolio companies through a shared security function. What success looks like Security coverage remains reliable and responsive across cloud environments, endpoints and employee systems. High-priority risks and alerts are investigated quickly, communicated clearly and driven through remediation. Manual work decreases as repeatable security and IT workflows become automated. Infrastructure and engineering teams have a trusted, hands-on security partner who helps them ship safely.