Вакансии

Location: San Francisco, CA, USA About the role We are looking for a Sr. Full Stack Application Security Engineer with deep expertise in mobile application security to join our Product Security team. This role is hands-on and impact driven. You will work directly with mobile, backend, and platform engineering teams to identify, prevent, and remediate security issues across our iOS, Android, API, and backend systems. You will operate close to the code and close to the product. That means reviewing architectures across the stack, influencing secure design decisions early, and helping teams ship features safely without slowing delivery. This role is for someone who understands how modern distributed systems and mobile apps are built, deployed, and attacked in real-world environments. While mobile application security is a core focus, you will be part of a team that owns security posture across the full application stack including APIs, backend services, identity and authentication flows, and CI/CD pipelines. In this role, you can expect to Build and improve security capabilities, automation, and guardrails for mobile applications and backend/API services Perform application or API/backend penetration testing Identify, triage, and help remediate vulnerabilities across Chime products Partner closely with engineering and product teams to embed security into the development lifecycle across mobile apps, APIs, and backend services Perform architecture and code reviews across the stack (iOS/Android, APIs, backend) with a focus on secure data storage, authentication, authorization, secure communication, and session/token handling Leverage AI to accelerate security workflows (e.g., code review support, triage, threat modeling), and partner with teams building AI-enabled features to define and implement production-grade AI security controls To thrive in this role, you have 5+ years of experience in application security, with strong hands-on experience across both mobile and backend systems Hands on experience securing iOS and Android applications in production environments Strong understanding of mobile threat models and common attack techniques Experience with mobile security testing techniques, including static and dynamic analysis Familiarity with iOS and Android platform security features and limitations Practical coding experience, preferably in Ruby, Go, Python  languages Ability to clearly communicate security risks, tradeoffs, and remediation guidance to engineering partners #LI-Hybrid #LI-WW1 Below is the base salary offered for this role and level of experience. Full-time employees may also be eligible for bonus(es), competitive equity, and benefits. For commissioned roles, the base salary listed in this job description does not include incentive/variable pay. The actual base salary offered may be higher, depending on your location, skills, qualifications, and experience. Wage Notice $213,000 — $295,000 USD A little about us At Chime, we believe that everyone can achieve financial progress. We created Chime—a financial technology company, not a bank*—on the premise that core banking services should be helpful, easy, and free. Through our user-friendly tools and intuitive platforms, we empower our members to take control of their finances and work towards their goals. Whether it's starting a savings account, purchasing a first car or home, launching a business, or pursuing higher education, we're proud to have helped millions unlock their financial potential. We're a team of problem solvers, dreamers, and builders with one shared obsession: our members. From day one, Chimers have worked tirelessly to out-hustle and out-execute competitors to bring our mission to life. Their grit and determination inspire us to work harder every day to deliver the very best experience possible. We each bring an owner's mindset to our work, refusing to be outdone and holding ourselves accountable to meet and exceed the highest bars for our teams, our company, and our members. We believe in being bold, dreaming big, and taking risks, while also working together, embracing our diverse perspectives, and giving each other honest feedback. Our culture remains deeply entrepreneurial, encouraging every Chimer to see themselves as stewards of our mission to help everyday Americans unlock their financial progress. We know that to achieve our mission, we must earn and keep people's trust—so we hold ourselves to the highest standards of integrity in everything we do. These aren't just words on a wall—our values are embedded in every aspect of our business, serving as a north star that guides us as we work to help millions achieve their financial potential. Because if we don't—who will? *Chime is a financial technology company, not a bank. Banking services provided by The Bancorp Bank, N.A. or Stride Bank, N.A., Members FDIC. What we offer for our full-time, regular employees 🏢 Our in-office work policy is designed to keep you connected - with four days a week in the office and Fridays from home for those near one of our offices, plus team and company-wide events depending on location. 💻 Benefits that support your work and life, including backup child, elder, and pet care and subsidized commuter benefits for eligible employees. ✨ Comprehensive health, financial, and wellbeing benefits designed to support you at every stage of life. 🏝 Generous vacation policy and company-wide paid days off 🫂 1% of your time off to support local community organizations of your choice 👟 Annual wellness stipend to use towards eligible wellness related expenses 👶 Up to 22 weeks of paid parental leave for birthing parents and 12 weeks of paid parental leave for non-birthing parents 👪 Access to family planning reimbursement 💚 A challenging and fulfilling opportunity to join one of the most experienced teams in FinTech and help millions unlock financial progress We know that great work can’t be done without a diverse team and inclusive environment. That’s why we specifically look for individuals of varying strengths, skills, backgrounds, and ideas to join our team. We believe this gives us a competitive advantage to better serve our members and helps us all grow as Chimers and individuals. Chime is proud to be an Equal Opportunity Employer. We consider qualified applicants without regard to race, color, ancestry, religion, sex, national origin, sexual orientation, gender identity, age, marital or family status, disability, genetic information, veteran status, or any other legally protected basis under provincial, federal, state, and local laws, regulations, or ordinances. We will also consider qualified applicants with criminal histories in a manner consistent with the requirements of state and local laws, including the San Francisco Fair Chance Ordinance, Cook County Ordinance, NYC Fair Chance Act, and the LA City Fair Chance Ordinance, and consistent with Canadian provincial and federal laws. If you have a disability or special need that requires accommodation during any stage of the application process, please contact: accommodations@chime.com . To learn more about how Chime collects and uses your personal information during the application process, please see the Chime Applicant Privacy Notice .

Location: US - Florida Vectra® is the leader in AI-driven threat detection and response for hybrid and multi-cloud enterprises. The Vectra AI Platform delivers integrated signal across public cloud, SaaS, identity, and data center networks in a single platform. Powered by patented Attack Signal Intelligence, it empowers security teams to rapidly prioritize, investigate and respond to the most advanced cyber-attacks. With 35 patents in AI-driven threat detection and the most vendor references in MITRE D3FEND, organizations worldwide rely on the Vectra AI to move at the speed and scale of hybrid attackers. For more information, visit www.vectra.ai. Position Overview As a Security Engineer (Pre-Sales) here at Vectra.ai you'll utilize both your technical aptitude and sales acumen to establish trust during frequent engagement with prospective customers. You’re a key member of the Vectra sales team, assisting fellow Regional Sales Managers by working to understand key customer pain points and positioning and demonstrating the value of Vectra solutions and services that resolve them, while helping them understand the power of Vectra’s Cognito platform, explaining technical features, and problem-solving any potential roadblocks in real-time. Responsibilities Pre-Sales support and Technical Account Management associated to your Regional Sales Managers Walk customers and partners through demos and problem solving in clear, concise matter by being the subject matter expert on all things Vectra. Communicate cross functionally constantly to ensure all key stakeholders are in the loop in order to insure best-of-breed products, tools and documentations. Develop and maintain an in-depth technical knowledge of the Vectra product line. Identify new opportunities by creating and developing strong technical relationships with customers and channel partners. Maintain knowledge at a high technical level of the current security landscape. Collaborate with Customers on Technology reviews, product findings, and integration with other technologies they may have. Collaborate with other Vectra Engineers on high-level projects to deliver Vectra technologies to our customers. Explore and maintain knowledge of Vectra's key competitors. Participate in deployment review and forecast calls. Participate in design review and release meetings. Travel as needed within region. Experience and soft skills Startup DNA is a must: willing and able to do "whatever it takes" with motivation to find solutions rather than admire the challenge. Customer-first behaviour is a must. Ability to work hands-in-hands with your Sales counterpart (RSM) . 5+ years experience in a Technical Account Management or Security Engineering role. Large account management experience is required. Technical qualifications Deep understanding of security-focused product lines (CASB, EDR, SIEM or forensics-type platforms) with the ability to translate into value and security best practices. Strong knowledge in networking and ability to understand L3 to L7 OSI layers. String written (RFP) and verbal communications (Pre-sales presentations and conferences) are a must. Good understanding of an attacker progression (Red Team or Pentest). Certifications such as CEH, OSCP, OSCE is a plus. Good understanding of Incident Response (Blue Team) methodologies. Certifications such as GNFA is a plus. Good understanding of Cloud Security and Network Architectures. Certifications such as AWS Certified Security Specialty (SCS-C01) is a plus. Good understanding of Security Processes and methodologies. Certifications such as CISSP is a plus Vectra provides a comprehensive total rewards package that supports the financial, physical, mental and overall health of our employees and their families. Compensation includes competitive base pay, incentive pla n eligibility, and participation in the employee equity plan (stock options). Specific benefits offered var ies by location, but commonly in clude health care insurance , income protection / life insurance , access to retirement savings plans, behavioral & emotional wellness services , generous time away from work, and a comprehensive employee recognition program. Vectra is committed to creating a diverse environment and is proud to be an equal opportunity employer. We are committed to equal employment opportunity regardless of race, color, ancestry, religion, sex, national origin, sexual orientation, age, citizenship, marital status, disability, gender identity or Veteran status.

Location: US - Georgia Vectra® is the leader in AI-driven threat detection and response for hybrid and multi-cloud enterprises. The Vectra AI Platform delivers integrated signal across public cloud, SaaS, identity, and data center networks in a single platform. Powered by patented Attack Signal Intelligence, it empowers security teams to rapidly prioritize, investigate and respond to the most advanced cyber-attacks. With 35 patents in AI-driven threat detection and the most vendor references in MITRE D3FEND, organizations worldwide rely on the Vectra AI to move at the speed and scale of hybrid attackers. For more information, visit www.vectra.ai. Position Overview As a Security Engineer (Pre-Sales) here at Vectra.ai you'll utilize both your technical aptitude and sales acumen to establish trust during frequent engagement with prospective customers. You’re a key member of the Vectra sales team, assisting fellow Regional Sales Managers by working to understand key customer pain points and positioning and demonstrating the value of Vectra solutions and services that resolve them, while helping them understand the power of Vectra’s Cognito platform, explaining technical features, and problem-solving any potential roadblocks in real-time. Responsibilities Pre-Sales support and Technical Account Management associated to your Regional Sales Managers Walk customers and partners through demos and problem solving in clear, concise matter by being the subject matter expert on all things Vectra. Communicate cross functionally constantly to ensure all key stakeholders are in the loop in order to insure best-of-breed products, tools and documentations. Develop and maintain an in-depth technical knowledge of the Vectra product line. Identify new opportunities by creating and developing strong technical relationships with customers and channel partners. Maintain knowledge at a high technical level of the current security landscape. Collaborate with Customers on Technology reviews, product findings, and integration with other technologies they may have. Collaborate with other Vectra Engineers on high-level projects to deliver Vectra technologies to our customers. Explore and maintain knowledge of Vectra's key competitors. Participate in deployment review and forecast calls. Participate in design review and release meetings. Travel as needed within region. Experience and soft skills Startup DNA is a must: willing and able to do "whatever it takes" with motivation to find solutions rather than admire the challenge. Customer-first behaviour is a must. Ability to work hands-in-hands with your Sales counterpart (RSM) . 5+ years experience in a Technical Account Management or Security Engineering role. Large account management experience is required. Technical qualifications Deep understanding of security-focused product lines (CASB, EDR, SIEM or forensics-type platforms) with the ability to translate into value and security best practices. Strong knowledge in networking and ability to understand L3 to L7 OSI layers. String written (RFP) and verbal communications (Pre-sales presentations and conferences) are a must. Good understanding of an attacker progression (Red Team or Pentest). Certifications such as CEH, OSCP, OSCE is a plus. Good understanding of Incident Response (Blue Team) methodologies. Certifications such as GNFA is a plus. Good understanding of Cloud Security and Network Architectures. Certifications such as AWS Certified Security Specialty (SCS-C01) is a plus. Good understanding of Security Processes and methodologies. Certifications such as CISSP is a plus Vectra provides a comprehensive total rewards package that supports the financial, physical, mental and overall health of our employees and their families. Compensation includes competitive base pay, incentive pla n eligibility, and participation in the employee equity plan (stock options). Specific benefits offered var ies by location, but commonly in clude health care insurance , income protection / life insurance , access to retirement savings plans, behavioral & emotional wellness services , generous time away from work, and a comprehensive employee recognition program. Vectra is committed to creating a diverse environment and is proud to be an equal opportunity employer. We are committed to equal employment opportunity regardless of race, color, ancestry, religion, sex, national origin, sexual orientation, age, citizenship, marital status, disability, gender identity or Veteran status.

Задачи: — искать уязвимости в ИТ-системах клиентов; — проводить penetration testing в команде; — работать с разнообразными технологиями и инфраструктурами. Требования: — немецкий C2 и хороший английский; — готовность работать в офисе в Ахене; — интерес к offensive security; — опыт CTF — приветствуется. Условия: — офис (on-site), возможна неполная ставка от 19 ч/нед для студентов.

В роли инженера по безопасности приложений в AIFC предстоит заниматься обеспечением защиты программных продуктов, выявлением и устранением уязвимостей, а также внедрением современных методов безопасности. Кандидат должен обладать глубокими знаниями в области информационной безопасности, владеть инструментами анализа кода и тестирования на проникновение, а также иметь опыт работы с технологиями, применяемыми в разработке и эксплуатации приложений. Важны навыки работы с системами контроля версий, понимание принципов безопасного программирования и способность сотрудничать с командами разработчиков для повышения уровня безопасности продуктов.

Location: United States; Canada Workplace: Remote ABOUT DOCKER Docker has been one of the most loved brands in developer tooling, trusted by more than 20 million monthly users and over 20 billion container image pulls. From solo founders to the world's largest companies, developers rely on Docker to build, share, and run their applications across our suite of products including Docker Desktop, Docker Hub, and Docker Scout. We are a globally distributed, remote-first team building the tools that define how software gets built and delivered. As AI agents redefine software development, Docker is at the center of that shift, providing the sandboxed environments, verified images, and secure infrastructure that make autonomous workflows trustworthy by default. _______________________________________________________________________ THE ROLE As a Senior Security Engineer, Offensive Security, you'll help drive offensive security at Docker, putting our products, platforms, and cloud infrastructure under realistic adversarial testing to surface and drive out attack paths before real adversaries find them. You'll partner with engineering, product, and leadership to turn findings into durable fixes and to shape how security is designed into every Docker product. You'll apply your expertise in penetration testing, threat modeling, and exploit development to find and eliminate risks across Docker products and infrastructure. Working across cloud infrastructure (AWS, GCP, Azure), containerized environments, and AI/ML products, you'll implement proactive security solutions that scale with Docker's growth. This role offers the opportunity to help improve security programs at a company whose products are trusted by millions of developers worldwide. You'll work in a fast-paced, technically challenging environment where your security expertise directly impacts both Docker's platform and the broader container ecosystem. _______________________________________________________________________ RESPONSIBILITIES - Contribute to security initiatives that align with business goals, helping ensure security is a core component of our products and infrastructure - Support and help implement key security programs such as automated security design reviews, and vulnerability management - Build deep knowledge of software security and architecture, and act as a go-to resource for engineering teams - Partner with engineering to design and implement security architecture and controls across Docker products and platforms - Plan, scope, and execute penetration tests and red-team / adversary-emulation engagements against Docker's products and services - Develop proof-of-concept exploits and produce clear, risk-rated findings with actionable remediation guidance, then retest fixes to confirm closure - Build and maintain offensive security tooling and automation to expand testing coverage and repeatability - Perform security reviews and threat modeling (design, architecture, and code) across Docker products and services, including emerging AI products, and write automated security tests and exploits - Serve on rotating on-call schedule to respond to security events, investigate threats, and coordinate remediation efforts - Educate and collaborate with cross-functional teams (e.g., engineering, product) to promote security practices - Participate in Security Incident response _______________________________________________________________________ QUALIFICATIONS - Have 3+ years in security engineering, including hands-on offensive security and penetration testing across applications and infrastructure - Possess 2+ years of hands-on development experience in Python or Golang - Demonstrate deep expertise in authentication, authorization, including technologies like OAuth, cryptography applications and Zero Trust principles. - Have strong hands-on experience with securing cloud ecosystems (e.g. AWS, GCP, Azure) - Have hands-on penetration testing experience across SaaS web applications and APIs., including manual exploitation beyond automated scanners - Are proficient with offensive tooling and techniques such as. Burp Suite, and OWASP frameworks - Can write security tests and develop exploits and proof-of-concepts that find real vulnerabilities in a product - Understand AI/ML security risks and mitigations, including prompt injection, data poisoning, model extraction, and adversarial attacks - Have practical experience using LLMs and agentic tooling to automate vulnerability discovery, reconnaissance, and pentesting workflows - Have a track record of building security programs and automations from scratch, applying risk-based prioritization - Have experience performing security reviews and building or improving security review automation - Have excellent communication skills, allowing you to explain complex security concepts clearly to technical and non-technical stakeholders - Understand industry standards, and actively keep up with emerging security technologies and models - Are a team player who drives security change via collaboration and cross-functional partnerships - Hold offensive security certifications such as OSCP, OSWE, OSEP, GXPN, GPEN, or CRTO - Have published CVEs, original security research, or conference talks Bonus if you: - Have experience with container escape, Kubernetes attack paths, or cloud red teaming - Have experience testing AI/ML systems for issues like prompt injection, model extraction, and data poisoning _______________________________________________________________________ WHAT TO EXPECT FIRST 30 DAYS: - Meet with security team and key partners across engineering - Gain access to team owned systems, and internal documentation - Complete security awareness training and compliance onboarding - Review application architecture, tech stack and data flow - Review risk registry and annual roadmap - Familiarize oneself with team workflows and processes - Shadow a fellow security engineer during their on-call/secops rotations FIRST 90 DAYS: - Conduct security review on emerging Docker products - Scope and execute your first penetration test against a Docker product or service - Actively participate in architecture design reviews with the team - Contribute to a Security-owned project or initiative - Collaborate with Docker developers to validate and resolve discovered vulnerabilities - Enhance incident response capabilities by participating in on-call rotation and post-incident activities - Create and maintain security documentation and runbooks FIRST YEAR OUTLOOK - Contribute to the security roadmap for improving security controls - Strengthen Zero Trust architecture and least privilege access controls - Enhance security monitoring and anomaly detection - Perform security reviews for major product releases - Own and run recurring penetration tests and adversary-emulation exercises across Docker products, and engage with external researchers - Support audits and ensure compliance with SOC 2, ISO 27xxx - Advocate for “security by design” in all product features - Become well versed in Docker products and emerging AI technologies Visa sponsorship: Not available for this role. _______________________________________________________________________   COMPENSATION & EQUITY All full-time roles include equity. Final compensation is determined on factors including but not limited to experience, skills, qualifications, and location. Canada: CA$271,150 – CA$434,000 base United States: $194,150 – $312,950 base ______________________________________________________________________ POSTING INFORMATION - Open vacancy: This posting is for an existing open role. - AI in hiring: Docker may use AI-assisted tools during our recruiting process. - Interview recordings: Candidates will be invited to opt in to interview recordings to support interviewer calibration and consistent evaluations. Recordings are optional and require explicit consent. ______________________________________________________________________ PERKS & BENEFITS - Remote-first by design – Work from your home, with offices in Seattle and Paris for connection and collaboration. - Flexibility that fits your life – We trust you to manage your schedule while delivering great work. - Time to recharge – Generous PTO, designated quarterly Whaleness Days, and a designated end-of-year Whaleness break. - Home office support – Set up your workspace for comfort and success. - Technology stipend – Equivalent to US$100 net per month to help support your work. - Learning & development – Annual stipend for conferences, courses, certifications, and continued learning. - Parental leave – 16 weeks of paid parental leave after six months of employment. - Equity for all full-time employees – Share in Docker's long-term success as we continue to grow. - Comprehensive benefits – Medical, retirement, and paid holidays vary by country. - Docker swag – Because representing the whale never gets old. Docker is proud to be an equal opportunity employer. We are committed to building a team that reflects a broad range of backgrounds, experiences, and perspectives. We believe diverse teams build better products, make better decisions, and better serve our global community. #LI-REMOTE

Location: Amsterdam, Netherlands At Catawiki, every day brings the extraordinary! Whether it’s Daniel Ricciardo’s Formula 1 Car , a Woolly Mammoth’s Skeleton , Lady Gaga's Jumpsuit or Usain Bolt’s running shoe , we encounter exceptional objects every day. We’re a one-of-a-kind marketplace for buying and selling special objects. Each week, more than 100,000 unique items are auctioned, all carefully curated by our passionate in-house experts. Having sold over 25 million unique objects, our mission is to become the world’s most popular destination for special objects. As a growing, diverse and sustainable scale-up, we proudly live by three core values. If these values resonate with you, we’d love to explore how you can join us. Taking ownership and driving impact Being open to change and feedback Being passionate about our mission and our customers. About the role and team As our Lead Security Engineer, you’ll provide hands-on technical leadership in our small Security team within Platform Engineering. You’ll shape the security engineering roadmap and own the delivery of complex security initiatives, working with Product and Platform Engineering to protect our marketplace, our customers and their data. Our platform runs on Google Cloud and Kubernetes. You’ll focus on application and cloud security, secure software delivery and risks in internal and AI-enabled systems. You’ll combine deep technical work with influence across engineering, turning security risks into controls and practices that teams can use in their everyday workflows. This is an individual contributor role. As the team evolves, there may be an opportunity to move into people management, based on demonstrated readiness and business needs. What you will do Shape the security engineering roadmap and lead complex initiatives from assessment and design through implementation, rollout and ongoing operation. Design and build security controls and automation across applications, cloud infrastructure, identity and access, CI/CD and infrastructure as code. Lead threat modelling and secure code and design reviews. Work with engineering teams early to identify risks and agree practical changes before systems reach production. Investigate vulnerabilities and recurring security weaknesses. Prioritise findings based on exposure and business impact, work with system owners on remediation and build reusable controls that prevent recurrence. Improve security checks in engineering workflows, including dependency and secret scanning. Reduce false positives and make findings easier for developers to understand and resolve. Contribute to security incident investigations and response. Improve detection and response tooling and use lessons from incidents to strengthen preventive controls. Mentor security engineers and help product engineers build security skills through technical guidance, documentation and practical training. Work with Legal, IT and Trust & Safety on technical security controls, policies and audit evidence where responsibilities overlap. Measure the effectiveness and adoption of the controls you deliver. Communicate progress, technical decisions and remaining risks clearly to engineering and business stakeholders. Who you are You have substantial hands-on security engineering experience in a software or cloud environment and a track record of delivering security improvements across multiple teams. You have strong knowledge of application and cloud security, including identity and access management, secrets management and secure software development. You have led threat modelling, secure code and design reviews and complex remediation work, turning findings into solutions that engineers adopt. You can develop or automate in Ruby, Python, Go or a similar language and are comfortable reviewing backend code. You have built and operated security tooling or controls in production. You have integrated security into CI/CD, cloud infrastructure or infrastructure as code and can make sound trade-offs between risk reduction and engineering effort. You have contributed to security incident investigations or responses and can work effectively with others under pressure. You have led technical initiatives and mentored engineers. You’re interested in developing your leadership skills, including potentially taking on people management in the future. You influence through technical credibility and collaboration, explain risks clearly to different audiences and take responsibility for seeing complex work through to completion. Helpful experience Experience with Google Cloud, Kubernetes and Terraform or similar infrastructure tooling. Experience in a marketplace, e-commerce or another software product business, including account and API security. Experience securing AI-enabled applications, agents or data pipelines, or using AI to improve security engineering workflows. Why You'll Love Working with Us Create a visible impact by working at scale in a global organisation serving millions of customers across 80+ categories. In our flat structure, every role has a broad scope and directly impacts both our customers and the business. Learn and grow through our Learning & Development initiatives, including clear development plans and mentorship programmes to support your career progression. A culture of connection defines us . We’re a passionate, diverse team of 800+ Catawikians representing 60+ nationalities. We foster an inclusive and queer-friendly environment where everyone is encouraged to bring their full self to work. Celebrate life’s moments with us. You’ll receive a €100 Catavoucher when you join, a €50 Catavoucher on your birthday, and an extra day off each year to “Pursue Your Passion ” . We also offer additional leave for key work anniversaries and important life events. Benefits may vary by location. Our Offices and Way of Working Our vibrant offices in Amsterdam and Lisbon are designed to inspire collaboration. Most Catawikians operate in a hybrid setup, combining office-based and remote work, with a minimum of two days per week in the office, unless a role is explicitly stated as fully remote or fully office-based. Interested? Apply with an English CV and Cover Letter. By applying, you agree to Catawiki’s Applicant Privacy Policy. If you’re excited about this role but don’t meet every requirement, we still encourage you to apply anyway. You may be just the right candidate for this or other roles. We may use artificial intelligence (AI) tools to support the review of your application. AI may help us assess how your experience matches the requirements of the role, but hiring decisions are always made by our recruitment team

Location: Remote - Costa Rica Founded in 2012, Bugcrowd is the preemptive security platform that unifies exposure discovery and assessment, offensive testing, and intelligence shaped by AI and human insight to help organizations avoid, discover, and validate real-world risk. Bugcrowd helps security teams move faster by identifying the exposures that matter most so they can act first and stay ahead of attackers. By combining the power of humans and AI, teams can preempt attack paths and prevent breaches. Based in San Francisco and New Hampshire, Bugcrowd is supported by General Catalyst, Rally Ventures, Costanoa Ventures, and others. Visit www.bugcrowd.com . Job Summary If you like owning problems end to end, making security a default property of everything we build, and working closely with engineering, we want to meet you. Bugcrowd is looking for security engineers who move beyond standard tooling and drive measurable security outcomes our customers can rely on. You will help us shape a culture where security helps others succeed, not just points out problems. Essential Duties and Responsibilities Partner Closely with Engineering : Refine architecture, validate new features, and drive security investment while prioritizing engineering velocity Build Security Paved Roads : Contribute to the secure defaults, libraries, and "paved roads" that systematically eradicate entire classes of vulnerabilities rather than fixing bugs one by one Create Feedback Loops : Tune security tooling such as SAST, DAST, SCA, and secret scanning to reduce noise and focus on what matters Be our Best Customer : Ensure our bug bounty program can be a model for other customers. Experiment with new ways to leverage the creativity of the crowd. Provide feedback on new platform features to engineering and product Own Projects End to End : Lead cross-functional product security projects from scoping through delivery, influencing product and engineering roadmaps and clearly communicating risk to both technical and non-technical stakeholders Amplify our Impact : Use code and automation as a lever to scale coverage and eliminate repetitive work. Build systems based on incentives and accountability rather than just bureaucratic process Education, Experience, Knowledge, Skills, and Abilities 3+ years of experience in product security, application security, or secure software development Can review code, automate tasks, and build security tooling in at least one modern programming language (e.g., Python, Go, Ruby, Java) Hands-on experience with core application security practices — threat modeling, secure code review, and automated testing (SAST, DAST, SCA) — and a solid grasp of common vulnerability classes (e.g., OWASP Top 10) Demonstrated ability to manage projects and influence cross-functional partners across engineering, DevOps, and product. Bachelor's degree in engineering, computer science or relevant field, or equivalent practical experience Bonus Points (Preferred but not required) Previous experience with Bug Bounty or vulnerability disclosure programs A background in building "paved roads" or secure-by-default internal libraries to eliminate entire classes of vulnerabilities Hands-on experience securing cloud-native platforms and Infrastructure as Code (e.g., Terraform, AWS, GCP, Kubernetes, Docker) Experience working within a fast-paced, high-growth security or SaaS company Working Conditions and Physical Requirements The ideal candidate must be able to complete all physical requirements of the job with or without reasonable accommodation. Sitting and / or standing - Must be able to remain in a stationary position 50% of the time Carrying and / or lifting - Must be able to carry / move laptop as needed throughout the work day. Environment - remote, work-from-home 100% of the time Culture At Bugcrowd, we understand that diversity in the workplace is vital to a company’s success and growth. We strive to make sure that people are included and have a sense of being part of making Bugcrowd not only a great product but a great place to work. We regularly hear from both customers and researchers that Bugcrowd feels like a family, and we strive to maintain that internally as well. Our team consists of a broad range of people: musicians, adventure sports junkies, nature lovers, parents, cereal enthusiasts, night owls, cyclists, artists—you get the point. At Bugcrowd, we are solving security threats and vulnerabilities that are relevant to everyone, therefore we believe solving these problems takes all kinds of backgrounds. We value the perspectives and experiences people from underrepresented backgrounds bring. Disclaimer This position has access to highly confidential, sensitive information relating to the technologies of Bugcrowd. It is essential that the applicant possess the requisite integrity to maintain the information in the strictest confidence. The company is authorized to obtain background checks for employment purposes under state and federal law. Background checks will be conducted for positions that involve access to confidential or proprietary information (including trade secrets). Background checks may include Social Security verification, prior employment verification, personal and professional references, educational verification, and criminal history. Applicants with conviction histories will not be excluded from consideration to the extent required by law. Any personal data you submit in connection with your application will be processed in compliance with Bugcrowd's Privacy Policy, which you may review here: https://www.bugcrowd.com/privacy . Equal Employment Opportunity: Bugcrowd is EOE, Disability/Age Employer. Individuals seeking employment at Bugcrowd are considered without regards to race, color, religion, national origin, age, sex, marital status, ancestry, physical or mental disability, veteran status, gender identity, or sexual orientation. Bugcrowd is committed to the full inclusion of all qualified individuals. In keeping with our commitment, Bugcrowd will take the steps to assure that people with disabilities are provided reasonable accommodations. Accordingly, if reasonable accommodation is required to fully participate in the job application or interview process, to perform the essential functions of the position, and/or to receive all other benefits and privileges of employment, please contact HR at ADA at bugcrowd.com. Apply at: https://www.bugcrowd.com/about/careers/

Location: Singapore, Singapore Workplace: Hybrid ABOUT PAVE BANK Pave Bank is the world’s first programmable business bank. Built by the founders behind Monzo and BigPay, we’re redefining global business banking by combining programmable financial infrastructure with world-class client experiences. ABOUT THE ROLE Pave Bank is building the next generation of programmable banking infrastructure. We’re looking for a Senior Security Engineer who combines strong software engineering experience with a deep security background. You should be someone who understands how software is built, how systems can be attacked, and how to identify and address security vulnerabilities. You'll work closely with our engineering teams to identify weaknesses, conduct security testing, and help build secure systems. This is a hands-on role for someone who is comfortable getting deep into code and systems, with particular experience in Go, Rust, or Java, and who has worked in security within fintech or crypto environments. WHAT YOU'LL DO - Review Pave Bank's platform and product code to identify security vulnerabilities and potential attack paths. - Conduct red team exercises and penetration tests across Pave's applications and systems. - Identify, investigate, and help remediate security vulnerabilities. - Work closely with Product and Engineering teams to build and ship secure solutions. - Review code and system designs from a security perspective. - Write and contribute to internal tools, libraries, and automation to improve security testing and enforcement. - Continuously test internal and external applications for vulnerabilities. - Educate engineering teams on secure coding and security practices. - Stay current on the latest threats, vulnerabilities, and attack techniques relevant to Pave's systems. - Assist with third-party application security reviews and penetration tests. WHAT YOU'LL BRING - Strong software engineering experience with a background in security. - Strong programming experience in one or more of Go, Rust, or Java. - Professional experience working in security within a fintech, banking, payments, crypto, or similar financial technology environment. - Hands-on experience with red teaming and penetration testing. - Strong understanding of attacker tools, techniques, and how software vulnerabilities can be exploited. - An adversary-first mindset when approaching software and system design. - Ability to work independently and take ownership of security problems from identification through remediation. - Strong communication skills, with the ability to work effectively with engineers and explain security issues clearly. - Curiosity and a desire to continuously learn and stay ahead of evolving security threats. NICE TO HAVE - Experience writing secure backend code in Go, Rust, or Java. - Familiarity with authentication and authorization patterns such as OAuth2 and RBAC. - General understanding of blockchain technologies and cryptocurrency systems and their security implications. - Experience working in a fast-paced startup environment. WHY US? - We recently raised $39 million in our Series A (led by Accel), positioning the company for major growth and giving you a rare chance to join while things are still moving fast. - Work alongside a founding team from Monzo and BigPay, bringing top-tier fintech expertise to the company. - Tackle real-world security challenges in a regulated, fast-growing fintech environment. - Learn from and collaborate with experienced engineers while developing your security career.

Location: Athens, Greece Are you a passionate and driven Junior Cyber-Security Engineer looking for an exciting new challenge? EUROPEAN DYNAMICS is seeking a talented individual to join our team and play a crucial role in ensuring the security and integrity of our cutting-edge projects. This is your chance to contribute to the success of a dynamic organization and advance your career in a collaborative and innovative environment. What You'll Do: Assist in the Design, implementation and support of security services, solutions, and infrastructure; Develop and implement tools to assist in the detection, prevention, and analysis of security threats; SIEM Operations (setup, monitoring, reporting); Vulnerability scanning, monitoring and reporting; Assist with the development of reports and documentation. Requirements Must-Have Qualifications: University degree (AEI/ TEI); Linux and Windows administration; Good knowledge of network, systems, and application intrusion techniques; Technical documentation skills; Excellent command of English, both written and spoken. Nice-to-Have Qualifications: Experience in developing, designing, and planning security concepts with Firewalls, IDS/IPS, and VPN systems; MSc in Information/Cyber Security; Familiarity with the ISO27001 Security Standard. Benefits We believe in rewarding talent and dedication. Here's what you can expect as part of our team: Competitive full-time salary; Private Health Coverage on the Company’s group program; Flexible Working Hours; Top-of-the-Line Tools; Professional Development: Benefit from language courses, specialized training, and continuous learning opportunities; Career Growth: Work with some of the most innovative and exciting specialists in the industry; Dynamic Work Environment: Thrive in a setting that offers challenging goals, autonomy, and mentoring, fostering both personal and company growth. If you want an exciting challenge, work with some of the coolest technologies, and enjoy your time doing it, then join us! Submit your detailed CV in English, quoting reference: ( JCSE/11/26 ). You may also consider all our other open vacancies by visiting the career section of our website ( www.eurodyn.com ) and follow us on Twitter (@EURODYN_Careers) and LinkedIn. EUROPEAN DYNAMICS (ED) ( www.eurodyn.com ) is a leading European Software, Information, and Communication Technologies company, operating internationally (Athens, Brussels, Luxembourg, Copenhagen, Berlin, Stockholm, London, Nicosia, Valetta, Vienna, Den Haag, Hong Kong, etc.) The company employs over 1100 engineers, IT experts, and consultants (around 3% PhD, 41% MSc, and 54% BSc). We design and develop software applications using integrated, state-of-the-art technology. Our current IT projects have a value exceeding 300 million EURO. EUROPEAN DYNAMICS is a renowned supplier of IT services to European Union Institutions, international organizations, European Agencies, and national government Administrations in 40 countries and 4 continents. As part of our dedication to the diversity of our workforce, we are committed to Equal Employment Opportunity without regard for race, colour, national origin, ethnicity, gender, disability, sexual orientation, gender identity, or religion. EUROPEAN DYNAMICS (ED) adheres to the General Data Protection Regulation principles by applying its Privacy Policy as published at www.eurodyn.com/privacy . By submitting an application to this position and by sharing your personal data with ED, you acknowledge and accept its Policy and authorize ED to process your personal data for the purposes of the company's recruitment opportunities, in line with the Policy.

Location: Athens, Greece We are seeking a Cyber Security Engineer, who specializes in the deployment and configuration of advanced security tools and methodologies, to expand our Information Security team. Your role will involve leveraging state-of-the-art technologies to strengthen security defenses, using AI-based penetration testing, managing CTI sharing platforms, managing SIEM and IDS/IPS, orchestrating responses with NG-SOAR systems, and engaging in simulation training on cyber-range platforms. This individual should also be fluent in English and willing to serve as an expert in Athens, Greece. The successful candidate will have the opportunity to join a high-performing team comprised of diverse experts working collaboratively towards common objectives. We are searching for someone who exemplifies qualities such as responsiveness, integrity, and reliability and possesses excellent analytical, problem-solving, and organizational skills. Additionally, the ability to work effectively within a team is crucial, as this role involves supporting projects funded by the European Commission and national research frameworks. Initiative, flexibility, and a strong sense of responsibility are qualities we highly value in our ideal candidate. What You'll Do: Design, deploy, and manage AI-based penetration testing initiatives/frameworks to proactively identify vulnerabilities and mitigate potential security threats; Configure, manage, optimize, and maintain CTI sharing platforms such as MISP and OpenCTI, ensuring robust and timely threat intelligence distribution; Implement NG-SIEM solutions/technologies, based on tools such as ELK stack, Graylog, Wazuh, Grafana, Velociraptor, InfluxDB/Telegraf; Deploy, fine-tune, and oversee NG-SOAR platforms/solutions such as Shuffle, Wazuh, TheHIVE, Cortex, and IRIS, streamlining and enhancing incident response capabilities/activities; Configure and maintain behavioral IDS/IPS systems, including Snort, Suricata, and SecurityOnion, to detect and prevent malicious activities; Stay up-to-date with the latest security trends, tools, and practices, including CACAO Standards (STIX 2.1, TAXII) for threat intelligence and sharing; Contribute to the technical documentation; Collaborate with interdisciplinary teams to ensure seamless security operations and incident management. Requirements University degree in Computer Science, Information Security, or related field; preferably with postgraduate qualification at MSc or PhD level; Minimum of 5 years of experience in cyber security engineering, working directly with technical teams with proven track record; Experience in software design and development; Demonstrated experience in deploying and configuring: CTI sharing platforms such as MISP and OpenCTI; NG-SOAR platforms/technologies (Shuffle, Wazuh, TheHIVE, Cortex); NG-SIEM technologies including ELK, Graylog, Wazuh, Grafana, Velociraptor, InfluxDB/Telegraf; IDS/IPS solutions such as Snort, Suricata, and SecurityOnion. Familiarity with CACAO Standards (STIX 2.1, TAXII) is a strong plus; Exceptional problem-solving skills and the ability to work in a dynamic, fast-paced environment; Excellent command of English and Greek, both written and oral; Good interpersonal, organization, and communication skills, with the ability to work in a diverse team environment; Good analytical skills, as well as a proactive attitude towards solving problems; At least 2 years experience specifically in National and European research programs. Benefits We believe in rewarding talent and dedication. Here's what you can expect as part of our team: Competitive full-time salary; Private Health Coverage on the Company’s group program; Flexible Working Hours; Top-of-the-Line Tools; Professional Development: Benefit from language courses, specialized training, and continuous learning opportunities; Career Growth: Work with some of the most innovative and exciting specialists in the industry; Dynamic Work Environment: Thrive in a setting that offers challenging goals, autonomy, and mentoring, fostering both personal and company growth. If you want an exciting challenge, work with some of the coolest technologies, and enjoy your time doing it, then join us! Submit your detailed CV in English, quoting reference: ( CS/11/26 ). You may also consider all our other open vacancies by visiting the career section of our website ( www.eurodyn.com ) and follow us on Twitter (@EURODYN_Careers) and LinkedIn. EUROPEAN DYNAMICS (ED) ( www.eurodyn.com ) is a leading European Software, Information, and Communication Technologies company, operating internationally (Athens, Brussels, Luxembourg, Copenhagen, Berlin, Stockholm, London, Nicosia, Valetta, Vienna, Den Haag, Hong Kong, etc.) The company employs over 1100 engineers, IT experts, and consultants (around 3% PhD, 41% MSc, and 54% BSc). We design and develop software applications using integrated, state-of-the-art technology. Our current IT projects have a value exceeding 300 million EURO. EUROPEAN DYNAMICS is a renowned supplier of IT services to European Union Institutions, international organizations, European Agencies, and national government Administrations in 40 countries and 4 continents. As part of our dedication to the diversity of our workforce, we are committed to Equal Employment Opportunity without regard for race, colour, national origin, ethnicity, gender, disability, sexual orientation, gender identity, or religion. EUROPEAN DYNAMICS (ED) adheres to the General Data Protection Regulation principles by applying its Privacy Policy as published at www.eurodyn.com/privacy . By submitting an application to this position and by sharing your personal data with ED, you acknowledge and accept its Policy and authorize ED to process your personal data for the purposes of the company's recruitment opportunities, in line with the Policy.

Задачи: — проводить penetration testing Web Applications, API, IT-инфраструктуры, сетей, облачных окружений; — искать и подтверждать уязвимости; — проводить security assessments; — готовить технические отчёты; — помогать клиентам устранять найденные проблемы. Требования: — понимание сетей и инфраструктуры; — опыт работы с Windows и Linux; — знание Active Directory, DNS, DHCP; — знание OWASP Top 10.

Задачи: — Анализ защищенности внутренних и внешних сервисов компании с использованием методики OWASP WSTG (black/gray/white box тестирования); — Подготовка рекомендаций (написание отчетов) по повышению уровня защищенности по результатам проведенных работ; — Участие в проектах по тестированию на проникновение и RedTeam в качестве специалиста по разработке и поддержке инструментария, используемого коллегами; — Исследовательская деятельность в области информационной безопасности, тестирование PoC-ов, развитие собственных компетенций. Требования: — Опыт работы/практика в области практического анализа защищенности веб-приложений; — Опыт работы/практика в разработке и автоматизации на языках Python (обязательно), Bash, Ansible, Terraform (желательно), Go, C# и других (дополнительно); — Владение основными инструментами анализа защищенности веб-приложений (в частности, BurpSuite Pro с различными плагинами); — Работа с эксплойтами, их модификация и выполнение; — Знание методик анализа защищенности (PTES, MITRE ATT&CK, OWASP WSTG); — Знание используемых в корпоративной cреде систем и технологий и атаки на них; — Знание сетевых протоколов и протоколов аутентификации и авторизации различных систем; — Умение читать и анализировать исходный код на распространенных языках программирования; — Технический английский.

Location: New York, United States Who We Are At OKX, we believe the future will be reshaped by crypto and blockchain technology. We operate a leading global crypto platform and build products and services designed to expand access to the digital-asset ecosystem. Across our global organization, we value ownership, sound judgment, collaboration, innovation, and the ability to operate effectively in a fast-moving and continuously evolving environment. Recruiting should insert the current approved OKX corporate “Who We Are” language when the position is posted. About the Team The Fraud Investigations Team (FIT) is a First Line of Defense function within OKX’s Risk organization responsible for identifying, assessing, investigating, and helping manage significant internal and external fraud risks affecting the company, its customers, personnel, and operations. FIT conducts and supports complex investigations involving digital assets, internal and external fraud, employee misconduct, insider threats, unauthorized access or misuse of information, vendor and third-party misconduct, account compromise, social engineering, collusion, conflicts of interest, and other significant fraud-related matters. The team works closely with Legal, HR, Information Security,Engineering, Physical Security, Compliance, Finance, Operations, and other functions across OKX. About the Opportunity We are looking for an experienced Senior Analyst, Blockchain Investigations & Fraud Intelligence to join FIT. This is first and foremost a blockchain investigations role requiring significant hands-on expertise tracing digital assets across complex blockchain ecosystems. The successful candidate must be capable of independently conducting sophisticated on-chain investigations, developing and testing attribution hypotheses, identifying relationships among wallets and entities, following assets through multiple chains and protocols, and translating highly technical blockchain activity into clear investigative findings. Blockchain analysis is a specialized investigative discipline. Accordingly, we are seeking someone who understands not only how to operate commercial tracing platforms, but also the underlying blockchain architecture, transactional mechanics, attribution methodologies, clustering techniques, tracing limitations, and evidentiary considerations necessary to reach reliable conclusions. The role extends beyond on-chain analysis. The Senior Analyst will combine blockchain intelligence with enterprise data, system logs, transactional records, open-source information, and other evidence to support complex fraud and insider-risk investigations. The position will also provide analytical support to the Global Physical Security Team (PST) on selected protective-intelligence and threat-assessment matters. The Senior Analyst will directly manage one Analyst and will be expected to serve as a subject-matter resource for blockchain investigations and analytical methodology across FIT. What You’ll Be Doing Blockchain Investigations & Digital-Asset Intelligence Lead and conduct complex blockchain investigations and transaction tracing across multiple wallets, counterparties, entities, blockchains, tokens, protocols, and digital-asset ecosystems. Trace the origin, movement, conversion, layering, consolidation, and ultimate disposition of digital assets , including activity spanning multiple intermediaries and blockchain environments. Conduct investigations using tools such as Chainalysis Reactor , TRM Labs, Elliptic, or comparable blockchain intelligence platforms , while understanding the methodologies and limitations underlying platform-generated attribution. Analyze activity involving centralized exchanges, self-hosted wallets, decentralized exchanges, cross-chain bridges, mixers, privacy-enhancing technologies, DeFi protocols, smart contracts, stablecoins, NFTs, OTC activity, gambling platforms, and other relevant ecosystems . Trace assets across multiple chains and cross-chain transactions , identifying continuity of funds where technically supportable and clearly documenting assumptions or limitations where definitive attribution is not possible. Analyze transaction graphs, address relationships, behavioral patterns, clusters, counterparties, timing, amounts, transaction sequencing, and other relevant blockchain indicators. Understand and appropriately apply wallet-clustering and attribution methodologies , including the limitations and potential for false attribution associated with particular heuristics. Independently evaluate blockchain intelligence rather than relying solely on automated labels, risk scores, or vendor-generated attribution. Corroborate on-chain findings, where appropriate, with internal account records, KYC / KYB information, transaction data, access information, open-source intelligence, legal-process returns, or other available evidence . Identify relationships among blockchain addresses, OKX accounts, external counterparties, individuals, organizations, vendors, affiliates, and other relevant entities. Reconstruct complex transaction flows and create clear fund-flow diagrams, transaction maps, timelines, and visualizations that allow investigators and nontechnical stakeholders to understand the movement of assets. Analyze blockchain activity associated with suspected fraud , theft, account takeover, social engineering, insider activity, collusion, payment diversion, asset misappropriation, or other misconduct . Identify new wallets, counterparties, entities, or transactional patterns that may generate additional investigative leads. Clearly document the methodology, assumptions, confidence level, and limitations associated with blockchain findings. Distinguish between confirmed attribution , vendor attribution, analytical inference, behavioral similarity, and an unverified investigative hypothesis . Avoid presenting blockchain proximity, exposure, clustering, or a commercial risk score alone as proof of ownership, control, intent, or misconduct. Maintain current knowledge of emerging blockchain technologies, protocols, tracing methodologies, obfuscation techniques, fraud typologies, and developments affecting blockchain attribution or investigations . Fraud Investigations & Investigative Intelligence Conduct and support investigations involving internal and external fraud , employee misconduct, insider threats, vendor and third-party misconduct, collusion, conflicts of interest, asset misappropriation, unauthorized access, credential misuse, and other significant fraud risks . Combine blockchain findings with off-chain evidence to develop a comprehensive investigative picture rather than treating blockchain activity in isolation . Develop investigative hypotheses and objectively test those hypotheses against available evidence, including information that supports, contradicts, or fails to establish the hypothesis. Conduct timeline reconstruction, link analysis, relationship mapping, pattern analysis, clustering, and comparative analysis across individuals, accounts, wallets, devices, systems, transactions, and entities. Support investigations involving account takeover, impersonation, social engineering, business-email compromise, payment diversion, affiliate misconduct, and trusted-party abuse , particularly where a digital-asset, employee, vendor, or enterprise nexus exists. Analyze vendor, affiliate, partner, and other third-party activity for indicators of billing irregularities, undisclosed relationships, conflicts of interest, unusual payments, control circumvention, or other potential misconduct. Support investigative interviews by developing transaction timelines, identifying inconsistencies or information gaps, organizing evidence, and identifying appropriate areas for follow-up. Enterprise Data & Insider-Risk Analytics Analyze appropriately authorized information including system and access logs, authentication records, audit trails, customer-account activity, KYC / KYB information, transaction records, payment information, case-management records, vendor information, and relevant security telemetry . Correlate blockchain activity with enterprise data to identify possible connections among wallets, accounts, employees, customers, vendors, devices, transactions, and other relevant entities . Support investigations involving suspected unauthorized access, information misuse or exfiltration, credential compromise, control circumvention, unauthorized disclosure, or abuse of privileged access. Identify anomalous behavior or access patterns that may warrant additional investigation. Develop repeatable analytical methodologies capable of processing and correlating information from disparate systems. Use appropriate scripting, database querying, data visualization, and analytical technologies to efficiently analyze large or complex datasets. Investigative Reporting & Evidence Prepare clear, concise, and well-supported blockchain investigation reports, investigative memoranda, executive summaries, transaction-flow diagrams, link charts, timelines, and other analytical products . Explain complex blockchain concepts and transaction activity in plain language suitable for investigators, senior management, Legal, regulators, or law enforcement , as appropriate. Clearly distinguish among allegations, investigative leads, known facts, third-party attribution , analytical judgments, assumptions, information gaps, and substantiated conclusions . Ensure analytical conclusions are proportionate to the evidence and do not imply greater certainty than the underlying blockchain or other data supports. Maintain sufficient documentation to allow significant blockchain findings to be reviewed, reproduced, and understood by another qualified analyst . Preserve and handle investigative records in accordance with applicable evidence-preservation, chain-of-custody, confidentiality, privacy, access-control, and need-to-know requirements . Support appropriately authorized law-enforcement, regulatory, litigation, or legal matters in coordination with the appropriate company functions. Protective Intelligence & Physical Security Support Provide analytical support to PST on selected matters involving threats or concerning activity directed toward employees, executives, offices, events, or other company interests. Conduct authorized open-source, link, timeline, blockchain, financial, or other analytical research where relevant to understanding the identity, relationships, capabilities, or activity associated with a potential threat. Assist in evaluating available information relating to credibility, corroboration, intent, capability, access or opportunity, targeting, escalation, timing, and other relevant indicators . Prepare objective analytical products identifying known facts, analytical judgments, material information gaps, uncertainties, and appropriate confidence levels. Support PST’s assessment while preserving PST’s responsibility for protective-security decisions and operational response . Leadership & Development Directly manage and develop one Junior Analyst, including work allocation, coaching, technical development, quality assurance, and review of analytical work product . Serve as a FIT subject-matter resource for blockchain investigations and on-chain analytical methodology . Review blockchain analysis for technical accuracy, appropriate methodology, corroboration, reasonable attribution, and evidentiary support. Train and mentor junior personnel in transaction tracing, blockchain intelligence platforms, analytical reasoning, documentation, and investigative methodology. Help establish consistent standards for blockchain investigations, attribution , documentation, quality assurance, and reporting . Participate in time-sensitive investigations affecting a global organization, including occasional work outside normal business hours when required. What We Look For In You 7+ years of relevant investigative or analytical experience , with meaningful professional experience specifically conducting cryptocurrency or blockchain investigations . Demonstrated hands-on expertise independently conducting complex blockchain tracing investigations , rather than solely reviewing blockchain alerts or commercial risk scores. Advanced proficiency with one or more blockchain intelligence platforms such as Chainalysis Reactor , TRM Labs, Elliptic, or comparable technology . Strong understanding of how blockchain intelligence platforms derive attribution, clustering, exposure, and risk information—and the limitations associated with those methodologies . Demonstrated understanding of blockchain fundamentals, including wallets and addresses, transactions, UTXO and account-based models, tokens, smart contracts, block explorers, transaction fees, confirmations, and blockchain-specific transactional structures . Strong understanding of digital-asset ecosystems including centralized exchanges, self-hosted wallets, DeFi , DEXs, stablecoins, cross-chain bridges, mixers, privacy-enhancing mechanisms, and other relevant technologies . Demonstrated ability to trace assets across multiple chains, protocols, and intermediaries and recognize when technical limitations prevent definitive continuity or attribution. Experience conducting transaction-graph analysis, wallet attribution , clustering, counterparty analysis, transaction-flow reconstruction, and investigative link analysis . Ability to critically assess blockchain attribution and distinguish among technical facts, commercial vendor intelligence, analytical inference, and unsupported assumptions . Experience integrating blockchain intelligence with off-chain evidence and enterprise information to develop investigative conclusions. Strong knowledge of fraud-investigation principles including corroboration, source evaluation, evidence preservation, timeline development, hypothesis testing, and documentation. Experience analyzing large or complex datasets and familiarity with tools such as SQL , advanced Excel, Python, Splunk, or comparable data-analysis technologies . Ability to clearly explain technically complex blockchain findings to audiences that may have little or no blockchain expertise. Strong investigative writing skills and demonstrated ability to produce accurate, concise, and defensible analytical products. Sound judgment and ability to work effectively where evidence is incomplete, conflicting, or evolving. Demonstrated discretion when handling sensitive employee, customer, investigative, security, or company information. Demonstrated experience mentoring, supervising, or reviewing the work of junior analysts or investigators. Nice to Haves Experience conducting blockchain investigations within a cryptocurrency exchange, blockchain analytics company, law-enforcement agency, regulatory organization, financial institution, intelligence function, or investigative consulting environment . Experience investigating digital-asset matters involving fraud proceeds, theft, account compromise, insider activity, social engineering, asset tracing, or complex cross-chain movement . Experience supporting asset recovery, law-enforcement referrals, subpoenas/legal process, civil litigation, regulatory inquiries, or other matters requiring defensible blockchain analysis . Experience investigating insider threats, employee misconduct, unauthorized access, data exfiltration, credential compromise, vendor fraud, conflicts of interest, or trusted-party abuse. Experience with OSINT, digital forensics, enterprise logs, security telemetry, or identity and access-management information . Experience creating custom blockchain analytics through APIs, SQL , Python, blockchain explorers, node data, or other raw-data sources , rather than relying exclusively on commercial graphical interfaces. Relevant blockchain-specific training or certifications, including certifications associated with Chainalysis , TRM Labs, or comparable blockchain-analysis platforms . Professional certifications such as CFE, CFCS, CAMS, GIAC, or comparable investigative, fraud , financial-crime, cybersecurity, or intelligence credentials . What Success Looks Like Success in this role requires significantly more than knowing how to enter an address into a blockchain analytics platform. The successful candidate should be able to receive a complex transaction, wallet, allegation, or investigative question and independently determine how to trace the activity, which chains and protocols are involved, what the available data establishes, what additional information is needed, what attribution can reasonably be made, and where the technical or evidentiary limitations prevent a definitive conclusion . The individual should be able to move seamlessly between on-chain and off-chain evidence , recognizing that a blockchain transaction may establish movement of assets without necessarily establishing the identity, knowledge, intent, or conduct of the person behind a wallet. They should also be capable of converting a highly technical blockchain investigation into a concise and defensible explanation that an investigator, attorney, executive, regulator, or law-enforcement partner can understand and act upon. At the same time, this person must be sufficiently versatile to apply the same investigative discipline to internal fraud , insider risk, enterprise data, third-party misconduct, and protective-intelligence matters when required. The hierarchy is much clearer this way: blockchain investigations are the specialized core competency; fraud /investigative intelligence is the broader mission; enterprise analytics and PST support are complementary capabilities. That should materially improve the candidate pool versus a title that makes blockchain expertise appear interchangeable with general data analytics. OKX Statement: OKX is committed to equal employment opportunities regardless of race, color, genetic information, creed, religion, sex, sexual orientation, gender identity, lawful alien status, national origin, age, marital status, and non-job related physical or mental disability, or protected veteran status. Pursuant to the San Francisco Fair Chance Ordinance, we will consider for employment qualified applicants with arrest and conviction records. The salary range for this position is $143,000 - $214,000 The salary offered depends on a variety of factors, including job-related knowledge, skills, experience, and market location. In addition to the salary, a performance bonus and long-term incentives may be provided as part of the compensation package, as well as a full range of medical, financial, and/or other benefits, dependent on the position offered. Applicants should apply via OKX internal or external careers site. Notice: All official OKX vacancies are published on this website. While roles may appear on selected third-party platforms from time to time, information on other sites may be inaccurate or outdated. If in doubt, please apply directly through our official careers website. Information collected and processed as part of the recruitment process of any job application you choose to submit is subject to OKX 's Candidate Privacy Notice .

Location: Warsaw, Mazowieckie, Poland; Sofia City, Bulgaria; Limassol, Cyprus Workplace: hybrid Capital.com's Product Security team protects our web and mobile applications, infrastructure, and external perimeter in a highly regulated environment. As Senior/Staff Application Security Engineer, you will raise the bar for application security across the organisation. This role is measured by leverage: how well you design, automate, and scale security processes so that many engineering teams can build securely by default. You will lead security architecture reviews and threat modelling, increasingly with the help of AI tooling, and turn one-off security work into repeatable, self-service capabilities. The role combines deep hands-on offensive and defensive security expertise with the engineering mindset needed to automate at scale. You will work closely with development, QA, DevOps, and platform teams. Responsibilities: Security Architecture & Threat Modelling: Lead security architecture reviews and threat modelling for new and existing systems, using AI tools to make reviews faster, more consistent, and scalable across teams Act as a security force multiplier by influencing the standards, patterns, and guardrails that let teams move fast and stay secure Security Automation & Tooling: Design, build, and automate scalable security processes that engineering teams can self-serve, covering secure design review, threat modelling, testing, and remediation workflows Integrate and automate security checks across the SDLC and CI/CD pipelines (SAST, DAST, SCA, secrets, and IaC scanning), tuned for strong signal and low friction Own and evolve security tooling such as DefectDojo and SAST, DAST, and SCA platforms, maximising automation, coverage, and integration Apply AI and LLM-based tooling to architecture review, threat modelling, code review, and vulnerability triage, and help define how the team adopts these tools safely Security Testing & Vulnerability Management: Conduct and oversee security assessments of web and mobile applications, APIs, and cloud infrastructure, including manual testing and PoC development Run vulnerability scans across internal infrastructure and the external perimeter, then analyse findings, define remediation, and track issues to closure Support and triage the Bug Bounty Program and external vulnerability reports, automating triage where possible Participate in and help lead red teaming and offensive security exercises Enablement: Drive knowledge sharing on secure development, mentor engineers, and deliver training for development and QA teams Requirements: Experience: 5+ years in application or product security, or equivalent depth, with a track record of senior or staff-level impact Demonstrable experience leading security architecture reviews and threat modelling (e.g. STRIDE, attack trees, data-flow analysis) across multiple teams or products Proven ability to automate and scale security processes by building tooling, integrations, and self-service workflows that reduce manual effort Technical: Strong hands-on security testing skills, including code review and web, mobile, and API application security assessments, as well as the ability to triage and validate external vulnerability reports and bug bounty submissions Strong software engineering ability in at least one language (e.g. Python, Go, JavaScript), with the ability to build automation, not just scripts Deep understanding of the OWASP Top Ten, secure design, and secure coding best practices Experience with SAST, DAST, SCA, and vulnerability management platforms, and integrating them into CI/CD Strong understanding of modern application architectures: REST APIs, microservices, cloud-based systems, and containers Practical experience applying AI and LLM tooling to security work, or clear enthusiasm and aptitude to do so Collaboration: Excellent communication and influencing skills: you can explain security concepts to technical and non-technical stakeholders and drive change without direct authority A self-starter who enjoys solving complex problems, building leverage through automation, mentoring others, and strengthening security culture Nice to have: Experience securing the AI harness: hardening LLM and agent pipelines, prompts, tool and MCP integrations, and model endpoints against prompt injection, data leakage, and insecure agent actions Experience securing Kubernetes, including cluster hardening, RBAC, network policies, admission control, workload isolation, and image and supply-chain security Experience securing AWS infrastructure, including IAM, network and account architecture, key and secret management, and CSPM Experience building AI-assisted security tooling or internal self-service security platforms Experience mentoring or technically leading a security team Offensive or advanced security certifications such as OSAI, OSEP, OSCP, or OSWE What you'll get in return: You will join the company, that cares about work and life balance Annual Bonus based on the performance review cycle Generous Annual Leave Policy Medical Insurance and Pension fund, with additional benefit packages based on the location Hybrid working model (3 days from our modern office and 2 days fully remotely) Comprehensive Workation Policy with 30 more remote days available. Possibility of taking two additional days of paid leave per year to dedicate to volunteering efforts.

Location: Warsaw, Mazowieckie, Poland; Sofia City, Bulgaria; Limassol, Cyprus Workplace: hybrid Capital.com builds and operates web and mobile trading platforms, public and partner APIs, and the backend services behind them, all in a highly regulated environment. As Application Security Architect, you will be the senior design authority for the security of these products. You will set the direction for how we secure software at scale: you will own secure-by-design patterns and standards, lead threat modelling and architecture reviews, and define the application security baseline that engineering teams build against. Working closely with the Product Security team and the Director of Product Security, you will guide AppSec processes and set the vision for your area without direct line management. You will treat security as a shared outcome rather than a gate, balancing strong protection with developer experience and delivery speed, and you will earn adoption through enablement rather than mandates. Responsibilities: Security Architecture & Standards: Define and maintain secure-by-default reference architectures for common patterns: web apps, mobile backends, microservices, public and partner APIs, and event-driven services Own core application security architecture decisions: authentication and authorisation, session management, API security, secrets management, multi-tenant isolation, and security logging and auditing Lead the redesign of user authentication and the delivery of security features into the product Develop and roll out application security standards, secure-coding guidelines, configuration standards, reusable design patterns, and architecture decision records (ADRs) that engineers can apply without a security expert in the room Define internal policies for the safe use of AI-assisted and vibe-coding tools Define security requirements for acquired technology and guide its secure integration Threat Modelling & Design Review: Establish and run a threat-modelling operating model, covering scope, cadence, templates, and facilitation, proportionate to each product's risk tier Own the security review stage of the new product approval process, covering architecture design and configuration Lead design reviews for high-impact initiatives: new products, new auth flows, payment and sensitive-data flows, platform migrations, and major refactors Identify design-level risks and agree practical, prioritised mitigations with engineering teams Secure SDLC, DevSecOps & Supply Chain: Assess the current state of application security, propose improvements, and drive the secure SDLC strategy with Engineering and Security leadership Oversee AppSec processes and own the tooling strategy (SAST, DAST, IAST, SCA, and secrets scanning), including how findings flow back to engineering Embed security controls as guardrails in CI/CD through policy-as-code, with agreed enforcement and escalation paths Partner with DevOps to organise repository management and prevent supply-chain attacks, covering safe component usage, dependency management, SBOMs, and build integrity Improve the security of our internal tools Requirements: Experience: 8+ years in technology, including 5+ years in a dedicated application or product security role, with a strong engineering background and hands-on architecture or design ownership Proven track record creating, documenting, and rolling out security standards, patterns, and best practices across a complex engineering organisation Deep, demonstrable threat-modelling experience across product portfolios Technical: Experience designing and implementing a secure SDLC in a cloud-native environment. Strong AWS knowledge is required, and exposure to GCP or other clouds is welcome Strong command of OWASP standards (Top 10, ASVS) and DevSecOps practice, including AppSec tooling (SAST, DAST, IAST, SCA, secrets scanning) and vulnerability management Deep understanding of modern distributed architectures: microservices, REST and GraphQL APIs, event-driven systems, OAuth2/OIDC, and containerised workloads (Docker, Kubernetes). You should be able to reason about their trust boundaries, attack surface, and data flows across web and mobile clients Collaboration: Exceptional ability to influence and align engineering teams without direct authority, and to brief both engineers and executives Pragmatism and strategic thinking: you balance the ideal with the achievable, protect delivery throughput, and turn long-term direction into an actionable plan Clear written communication through diagrams, ADRs, and patterns, plus a track record of mentoring and cross-functional collaboration Nice to have: Experience in fintech, trading, brokerage, or another regulated environment Awareness of relevant regulatory and compliance drivers: FCA and CySEC operational resilience, GDPR, and PCI DSS Software supply-chain security, including SBOMs and artifact and build integrity Experience securing AI-integrated product features, or using AI to scale an AppSec programme Experience building or running a Security Champions programme CSSLP, GIAC GDSA, or a hands-on offensive security certification. Certifications are valued but secondary to demonstrated experience What you'll get in return: You will join the company, that cares about work and life balance Annual Bonus based on the performance review cycle Generous Annual Leave Policy Medical Insurance and Pension fund, with additional benefit packages based on the location Hybrid working model (3 days from our modern office and 2 days fully remotely) Comprehensive Workation Policy with 30 more remote days available. Possibility of taking two additional days of paid leave per year to dedicate to volunteering efforts.

Задачи: — поиск уязвимостей в коде; — безопасность SDLC; — использование SAST, DAST, SCA; — анализ архитектуры и защита веб-приложений. Требования: — опыт триажа результатов сканеров Semgrep, CodeQL, Svace под C, Go, Java; — знание классов CWE; — middle знания языка C, умение читать код, проходить граф вызовов, понимание работы с указателями и памятью в C; — знание Go, анализ гонок данных, утечек горутин, обработка ошибок; — знание Java, умение читать код, знание основ работы JVM; — знание архитектуры Kubernetes, понимание работы. Условия: — проектный формат работы, загрузка от 6 месяцев; — трудоустройство через ИП или самозанятый, возможен переход в штат по ТК; — локация строго Россия. Суть проекта: — госзаказ, система "Честный знак".