Вакансии

Location: United States, Remote Why Sony Interactive Entertainment? Sony Interactive Entertainment isn’t just the Best Place to Play — it’s also the Best Place to Work. Sony Interactive Entertainment (SIE) is the company behind the PlayStation brand. As a subsidiary of Sony Group Corporation, we’re part of a proud legacy of innovation and excellence. SIE is a dynamic technology company, delivering cutting-edge hardware and network services to more than 100 million people and an entertainment leader, home to some of the most beloved and recognizable intellectual properties (IP) in the world. Our role at SIE is to create and nurture the experiences under the PlayStation brand, a name synonymous with entertainment excellence and creativity. Reporting to the Director of Global Vulnerability Management, you will serve as a Senior Security Research Engineer and technical lead within SIE’s Global Vulnerability Management team. You will lead complex work that advances our Threat Exposure Management capability and supports our transition to a Continuous Threat Exposure Management operating model, while remaining directly engaged in vulnerability research, analysis, security validation, prioritization, and remediation support. You will partner across Information Security, engineering, technology, and business teams to improve how SIE discovers, prioritizes, validates, and mobilizes action on security risks. You will translate annual TEM goals into defined workstreams, delivery plans, success measures, and repeatable operating practices that improve visibility, decision-making, remediation outcomes, and program scale. Responsibilities Lead complex Global Vulnerability Management workstreams that advance SIE’s Threat Exposure Management capability and transition toward a Continuous Threat Exposure Management operating model across discovery, prioritization, validation, and mobilization. Translate annual TEM goals into defined delivery plans, milestones, success measures, dependencies, and repeatable operating practices. Monitor progress, identify barriers, and adjust execution to improve outcomes. Lead hands-on vulnerability research and technical analysis to confirm security conditions, eliminate false positives, characterize exploitability and business impact, and provide actionable remediation or mitigation guidance. Improve the discovery and assessment of vulnerabilities across SIE network, cloud, endpoint, application, container, and other technology environments. Develop risk-based prioritization using vulnerability and threat intelligence, exploitation evidence, asset and business context, control effectiveness, and remediation considerations. Lead security validation activities and develop proofs of concept when appropriate to distinguish material risk, evaluate defensive controls, and support informed decisions. Partner with Information Security teams and technology owners to mobilize remediation, clarify ownership, establish effective handoffs, resolve barriers, and measure progress through remediation, mitigation, or accepted disposition. Evolve GVM platforms, integrations, data, analytics, automation, and AI-enabled workflows to improve coverage, data quality, consistency, decision speed, and operational scale. Communicate vulnerability trends, material risks, remediation progress, and program outcomes to technical, operational, and leadership audiences through clear reports and recommendations. Mentor engineers and partner teams, contribute to technical standards and procedures, and improve the quality of vulnerability analysis, validation, documentation, and delivery. Maintain current knowledge of relevant vulnerabilities, exploitation techniques, threat activity, security technologies, and industry practices. Some travel may be required. Qualifications 8+ years of relevant experience in information security, information technology, systems engineering, or a related field, including substantial experience in vulnerability management, security research, or exposure management. Bachelor’s degree or equivalent in computer science, information security, or a related discipline. Experience leading complex technical workstreams across multiple teams, translating objectives into delivery plans, and achieving measurable outcomes without relying on direct reporting authority. Hands-on experience with vulnerability research, technical analysis, security validation, risk-based prioritization, and remediation or mitigation guidance. Experience assessing vulnerabilities across several technology domains, such as operating systems, networks, cloud services, applications, endpoints, containers, databases, or hybrid infrastructure. Experience with vulnerability discovery, assessment, validation, or exposure-management platforms and their supporting integrations. Knowledge of adversarial tactics, exploitation techniques, threat intelligence, and attack frameworks such as MITRE ATT&CK, with the ability to apply that information to vulnerability prioritization. Experience using scripting, programming, APIs, or automation to improve security analysis and operational workflows. Relevant technologies may include Python, SQL, Bash, PowerShell, JavaScript, or comparable languages. Experience analyzing and contextualizing security data to connect technical findings with asset, service, business, threat, control, and remediation information. Familiarity with software engineering practices such as version control, testing, code review, CI/CD, reusable components, and controlled production releases. Ability to communicate complex security conditions, priorities, tradeoffs, and recommendations clearly to technical, operational, and leadership audiences. Experience mentoring engineers or analysts and influencing technical practices across teams. Desired qualifications Experience helping evolve a traditional vulnerability-management function toward a TEM or CTEM operating model. Experience with continuous security validation, adversarial exposure validation, exploit research, or proof-of-concept development. Experience securing cloud, container, application, or build-pipeline environments and integrating security capabilities into engineering workflows. Experience with security-data and analytics platforms such as Snowflake, Domo, or comparable technologies. Experience applying automation, advanced analytics, or AI-enabled capabilities to vulnerability analysis, prioritization, validation, or remediation workflows. At SIE, we consider several factors when setting each role’s base pay range, including the competitive benchmarking data for the market and geographic location. Please note that the base pay range may vary in line with our hybrid working policy and individual base pay will be determined based on job-related factors which may include knowledge, skills, experience, and location. In addition, this role is eligible for SIE’s top-tier benefits package that includes medical, dental, vision, matching 401(k), paid time off, wellness program and coveted employee discounts for Sony products. This role also may be eligible for a bonus package. Click here to learn more. This is a flexible role that can be remote, with varying pay ranges based on geographic location. For example, if you are based out of Seattle, the estimated base pay range for this role is listed below. $175,500 — $263,300 USD Please note, Sony Interactive Entertainment conducts background checks at the offer stage for all new employees (which may include criminal background checks for some roles) and will need to process personal information to support these checks. Please refer to our Candidate Privacy Notice for more information about what personal information we collect, how we use it, who we share it with, and your data protection rights. Equal Opportunity Statement: Sony is an Equal Opportunity Employer. All persons will receive consideration for employment without regard to gender (including gender identity, gender expression and gender reassignment), race (including colour, nationality, ethnic or national origin), religion or belief, marital or civil partnership status, disability, age, sexual orientation, pregnancy, maternity or parental status, trade union membership or membership in any other legally protected category. We strive to create an inclusive environment, empower employees and embrace diversity. We encourage everyone to respond. Sony Interactive Entertainment is a Fair Chance employer and qualified applicants with arrest and conviction records will be considered for employment.

Location: Remote (US) About Ondo Ondo Finance is building institutional-grade financial infrastructure for tokenized real-world assets. We operate at the intersection of traditional finance and on-chain systems, which means our product surface has to hold up against both the ordinary threats that hit any high-value fintech and the specific ones that follow value on-chain. About the Role We are hiring a Senior Security Engineer - Product Security to own how we ship secure products at Ondo. You will be a security partner for our product engineering teams, driving threat modeling, owning secure code reviews for new products or feature expansions, maintaining and tuning AppSec tooling, and improving the existing SSDLC. You can expect to take ownership of the bug bounty program, new feature to existing product reviews, and similar broad ownership of critical functions paired to a dedicated ProdSec lead. An AI-native approach is welcome, paired with AI-driven approaches should expect to be justified by describing how doing so enables risk outcomes. This is a hands-on IC role. You will read code, run threat models, review architecture proposals, own tooling, and push engineering teams to build products that are secure by default. You partner closely with adjacent security function like AppSec, Infrasec, and SecOps. What You’ll Do Drive threat modeling for new features, integrations, and architectural changes across the product surface. Push threat models past templates into decisions that engineering teams actually implement. Own secure code review for high-risk changes — authentication, session management, cryptographic paths, wallet and signing flows, RPC and third-party integrations, permission and consent surfaces. Expand the AppSec tooling stack and treat “reducing false positives” as a first-class deliverable. AI-native integrations are welcome. Design and evolve our secure SDLC: where security fits in the dev workflow, what triggers a review, what a lightweight security sign-off looks like versus a full one, and how do we validate controls. Run our responsible disclosure and bug bounty program. Set scope, triage inbound reports, decide payouts, and drive findings to closure with engineering. Support and own appropriate scope for the intake and closure of findings from external audits and pentests — coordinate with audit vendors (Coinspect, Cantina, NCC Group, and others), organize findings into our internal risk register, and drive remediation with engineering owners. Partner with engineering leads to align o secure-by-default patterns - libraries, templates, sensible defaults, and paved-road implementations of anything security-relevant. Threat model blockchain-integrated components like wallet flows, RPC integrations, signing infrastructure, on-chain admin actions triggered from off-chain systems in partnership with engineers who own the on-chain code. Contribute to hiring, mentoring, and pushing the technical bar on the Security team. What We’re Looking For 5+ years in Product Security or Application Security, including senior IC time at a fast-moving product company. Deep secure code review skills in at least one modern stack (TypeScript / JavaScript, Python, or Go). Ability to move across stacks at the level required to threat model. Strong threat modeling skills, appropriate to experience - you can drive a real threat model with an engineering team, not just fill in a template. In practice, we look for core understanding of industry-relevant TTPs and IoCs and strong intuitions on how to apply those lessons learned to our products. Practical experience owning or majorly contributing to an AppSec tooling program. You have shipped rules, tuned noise, and measured impact. Comfortable running or building a bug bounty / responsible disclosure program end-to-end assuming properly resourced to do so. Strong working knowledge of modern web and API security - session and auth flows, OAuth and OIDC, browser security model, common web/API vulnerability classes, and their less-common variants. Comfortable reading Terraform, cloud IAM policies, and CI/CD configuration well enough to reason about how a product vulnerability crosses into an infra risk. Strong engineering partnership skills - you engage constructively, understand the “why” before proposing risk controls, you know when to accept risk, and you write things down. Willing to grow into blockchain-adjacent product security on the job, including the specific attack surface introduced by wallet, signing, and on-chain-integration code. Blockchain Exposure Note This role firmly lives in Web2 prodsec. But, it also requires someone who understands what “Web2 vs Web3” terminology means. In other words, how our products interact with blockchains creates unique threat models that all product security teammates must grasp. At a minimum, by Day 1 you should have strong intuitions about how blockchains will make your prodsec experience unique, you should grasp the common terminologies, and you should be able to discuss with colleagues several incident post-mortems that demonstrate how Web2 compromises lead to Web3 funds losses. You do not need to be an expert in smart contract auditing, blockchain security architectures, or decentralized consensus-driven risk controls. Nice to Have Prior work at a crypto, fintech, or other company where products handle high-value or irreversible actions. Familiarity with wallet, signing, or key-management flows. Reading-level familiarity with Solidity or Rust, target: when ProdSec intersects with smart contracts or other on-chain applications, you can parse what the code is likely doing, and work with blockchain security subject matter experts from there. Bug bounty history - reports, CVEs, or published write-ups. Familiarity with browser-extension security, mobile app security, or account-abstraction wallet designs. Public output - talks, blog posts, open-source tools, CVEs. How We Work The Security team values a high trust team environment where respectful candor can thrive. We expect senior engineers to have an opinionated take on how to accomplish a task, accept feedback from the team and other external stakeholders and return it in kind, and to always assume positive intent. Professionalism, ethics, and enabling stakeholders towards common goals are important always.

Location: Espoo Workplace: Hybrid ROLE HIGHLIGHTS: - Senior GRC Engineer (Security) - Location: Espoo, Finland - Department: Product Security - Reports to: VP Product Security - Employment type: Permanent - Workplace model: Hybrid - Employment is subject to applicable security screening (incl. SUPO, where required) WHY THIS ROLE MATTERS:   As Senior GRC Engineer (Security), you'll mature ICEYE's Security Governance, Risk and Compliance program across a multi-country, multi-regulator footprint, including Finland, Germany, Spain, Poland, the UK and Greece amongst others. ICEYE operates at the intersection of commercial space technology and sovereign defence, so our compliance posture (ISO 27001, NIS2, NIST, and national frameworks) has to be credible to customers who include governments and defence agencies. You'll be the person who keeps that posture accurate, current and audit-ready, maps client and national requirements to internal ICEYE requirements, as a senior individual contributor. This role will be working closely with all the ICEYE Security team domains, ICEYE IT, ICEYE product management and the Program Management Office, Engineering and Sales.   WHO WE ARE ICEYE is the world leader in sovereign intelligence from space. We deliver persistent monitoring capabilities to detect and respond to changes in any location on Earth.   ICEYE owns the world's largest and most advanced SAR (synthetic aperture radar) satellite constellation. To our customers we provide intelligence with unmatched quality, latency and revisit times, in any weather, day or night. To governments who choose to operate their own constellation we provide this proven capability as a sovereign system.   ICEYE-built constellations serve customers in defence and intelligence, environmental monitoring, insurance and emergency management. We enable fast decisions that contribute to a safer future.   Founded and headquartered in Finland, ICEYE operates globally with over 1000 employees across Europe, North America, the Middle East, and Asia-Pacific. YOUR DAY-TO-DAY RESPONSIBILITIES The position will evolve according to the needs of the company and the growing team. Initially, the position has two main aspects, which are adjacent and many initiatives will cross both, especially in terms of overlapping requirements and compliance evidence: - Product requirements and compliance: - Ensure clients’ and their national security requirements are at all times clearly translated accurately to ICEYE internal requirements across product, IT, and other ICEYE functions, and we can clearly communicate those towards existing and new clients. - Ensure ICEYE has evidence of fulfilling and complying with the requirements, preferably as compliance-as-code whenever possible. - Support ICEYE’s Product, the Missions business line, PMO and Sales on client requirements. Produce material to support accreditation and acceptance requirements. - Wider Iceye and regulatory compliance: - Continuously improve ICEYE's ISO 27001 ISMS, including risk assessments, the risk register, Statement of Applicability, internal audits and certification/surveillance audit cycles. - Track and operationalise NIS2, CRA and other EU product security obligations across ICEYE's in-scope entities, translating regulatory requirements into concrete policies, controls and evidence. - Prepare clear, concise compliance and risk reporting for senior leadership, including status against certifications, audits and remediation plans. - Maintain information security policies, standards and supporting documentation, ensuring they stay practical and enforceable rather than shelfware. - Act as a day-to-day point of contact for external auditors, certification bodies and regulators on GRC matters.   WHAT WE’RE LOOKING FOR Must haves: - Eligible for being cleared for a Personal Security Clearance as necessary as well as a citizenship or a permanent residency in the European Union. - Technical skills that allow you to interpret compliance requirements towards the product function; this includes being able to fluently discuss modern software architecture and development, deployment and release concepts. - Proven hands-on experience running ISO 27001 (implementation, internal audit, or certification maintenance) in a real organisation, not just theoretical knowledge or external auditing experience. - Working knowledge of NIS2, CRA, and how their obligations translate into practical controls and reporting. - Strong stakeholder management skills, with the ability to influence product management, engineering, IT, legal and leadership without formal authority. - Experience building or maintaining a risk register and running quantified risk assessments. - Comfortable operating independently across multiple countries and regulatory regimes. - Awareness of emerging AI governance frameworks (ISO 42001, NIST AI Risk Management Framework, EU AI Act) as well as NIST frameworks   Nice to haves: - Relevant certifications such as CISSP, CISM, CISA, CRISC, ISO 27001 Lead Implementer or Lead Auditor. - Experience in defence, space, aerospace or another regulated/sovereign-sensitive industry. - Exposure to classified information handling frameworks (EUCI, NATO equivalents, or national security clearance regimes). - A well-rounded skillset of using language models for automation.   APPLICATION PROCESS - Initial screening call with Talent Acquisition - Technical/competency interview with the VP Product Security - Scenario-based exercise on requirements discovery, mapping and prioritisation - Final interview with senior stakeholders including a behavioural interview WORKING AT ICEYE At ICEYE, you’ll join a diverse and highly engaged team united by the ambition to make the impossible possible. As a global scale-up, we combine speed and ambition with the opportunity to take real ownership from day one. Your growth, wellbeing, and success are a priority, with continuous professional development, training opportunities, and a culture where collaboration is how we win. HOW WE WORK (OUR VALUES) Make the impossible possible: We set ambitious goals and stay calm under pressure. We bring grit, optimism, and ownership when things get hard, and we keep moving until we find a way. - Be curious: Go deep, ask questions, listen carefully, and think critically. Understand the “why” behind decisions. - See the big picture: Stay close to what’s happening across the company so you can make better decisions. Consider how your work affects others. - Drive effective teamwork: Create psychological safety, invite different perspectives, and build inclusive teams. There are no bad questions. - Act as one team: We win together. We match tasks to the right owner and stay agile as priorities shift. - Have fun: What we do matters—and it should be enjoyable. Celebrate progress, take pride in results, and share the wins. BENEFITS Our benefits are designed to support your health and wellbeing, at work and beyond. We keep improving them based on employee feedback, and offerings vary by location. Talent Acquisition will confirm what applies for this role and location during the process.   OUR COMMITMENT TO DIVERSITY, EQUITY, AND INCLUSION We want ICEYE to be a place where people can be themselves and do great work. Different backgrounds and perspectives make us stronger, which is why we work to create an environment where people feel included, respected, and able to speak up. Whatever your background, we want you to bring your authentic self to the table. We’re committed to fair, inclusive hiring and equal opportunity. Everyone is welcome to apply. If you need any adjustments or support during the recruitment process, tell us—we’ll do our best to help. Apply now to start your ICEYE journey, and help us continue to make the impossible possible together. Read more about ICEYE and working with us at iceye.com http://iceye.com.

Location: Germany; France; Netherlands; Spain Workplace: Remote Qdrant is an open-source vector search engine powering the next generation of AI applications, from semantic search and retrieval-augmented generation (RAG) to AI agents and real-time recommendations. Trusted by global leaders like Canva, HubSpot, Tripadvisor, Bosch, and Deutsche Telekom, we’re building the retrieval infrastructure layer for modern AI. Recently raising $50M in Series B funding, we are growing rapidly and committed to transforming how AI understands and interacts with data. As a remote-first company, we believe diverse backgrounds, perspectives, and experiences fuel innovation. Here, you’ll own meaningful work, tackle challenges, and grow alongside passionate individuals dedicated to shaping the future of AI. We are looking for a Mid-Level Security Engineer to own the hands-on engineering and operational work within our security program. You will be embedded in the Cloud Engineering team, report into the Security Officer, and work closely together to identify risks, set priorities, and drive security issues through remediation. You will act as a security enabler across all Product & Engineering. WHAT YOU WILL OWN - Run our public bug bounty program: triage reports, reproduce and validate findings, communicate clearly with security researchers, and drive remediation through to closure. - Investigate reported vulnerabilities at the code level, including our Rust core, Go and Python tooling. - Enable engineers to build secure systems: provide tooling, paved-road defaults, documentation, and practical guidance so security is the easy path, not a checkpoint. - Partner with engineering teams to design, review, and verify fixes, and set clear security requirements on changes where the risk warrants it. - Harden and maintain our GitHub organization’s security posture, including secret scanning, push protection, branch protection and rulesets, dependency alerts, and code scanning, in partnership with the engineering teams that use these repositories daily. - Monitor, investigate, and respond to security alerts across AWS, Kubernetes, CI/CD, and related infrastructure. - Track and report security metrics (vulnerability remediation SLAs, MTTR, patch latency, critical findings) and keep reporting current for the Security Officer. - Implement, configure, and maintain security tooling across our development and cloud environments. - Support security incident response, including investigation, containment, remediation, and follow-up. - Maintain clear, complete, and auditable records of vulnerability and incident work in our tracking systems. - Build security automation and guardrails that scale across the development lifecycle: CI/CD security checks, policy-as-code, GitHub automation, and automated cloud security controls, so secure defaults are enforced by tooling rather than review. - Participate in threat modeling and architecture reviews for new services and major changes. We are also building out our ISMS, which creates opportunities to contribute to security-tooling evaluations, technical vendor assessments, and proof-of-concept work. Formal compliance ownership, vendor risk assessments, and customer security questionnaires remain with the Security Officer. This is a hands-on technical role focused on security engineering, vulnerability management, and incident response. The Security Officer owns compliance, formal third-party risk assessments, and customer security questionnaires, allowing you to focus primarily on engineering work. On-call expectations are low: there is no formal rotation, though occasional availability for high-severity incidents is expected. WHO YOU ARE - You can read and navigate an unfamiliar codebase (Rust, Go, Python) well enough to validate a vulnerability report, trace its impact, and judge whether a proposed fix actually closes it. - You write and maintain automation and security tooling comfortably, and can hold a credible technical conversation in code review. - Experience triaging vulnerability reports or working with a bug bounty program, vulnerability disclosure program, product security team, or similar function. - Practical knowledge of cloud and container security, particularly AWS and Kubernetes. - Familiarity with GitHub security features and securing CI/CD pipelines. - The ability to investigate alerts and vulnerabilities methodically, distinguish genuine risk from noise, and recommend proportionate remediation. - Clear written communication skills for working with external researchers and internal engineering teams. - A self-directed approach and comfort independently managing a security queue. - 3+ years in a hands-on security engineering, product security, or vulnerability management role. Nice to have - An offensive security background, such as penetration testing, CTF participation, vulnerability research, or exploit analysis. - Experience working in an open-source company or contributing security improvements to open-source projects. - Familiarity with cloud-native incident response. WHY JOIN US - A remote-first, international team working on cutting-edge AI infrastructure. - A competitive salary with additional perks. - Flexible working hours and async-friendly culture. - High ownership and real impact. - Open-source, engineering-driven culture. - Choose your own laptop equipment. For US-based full-time employees, we also offer a comprehensive benefits package including 401k match, health, dental, and vision insurance, plus flexible PTO policy. Qdrant is an equal-opportunity employer. We believe the best ideas come from diverse teams, and we actively welcome applicants from all backgrounds. If this role excites you but you don't check every single box, we'd still love to hear from you! We don't want to miss out on great people because of a checklist. Come build with us! FOR INFORMATION ON HOW WE HANDLE YOUR PERSONAL DATA, PLEASE REFER TO OUR RECRUITMENT PRIVACY POLICY https://qdrant.tech/legal/recruitment-privacy-policy/ #LI-REMOTE

Location: San Francisco, CA Workplace: OnSite ABOUT US Sierra is the leading platform for customer-facing AI agents, working with many of the world's biggest brands — including The GAP, Rocket Mortgage, SoFi, Sutter Health, and SoftBank — to transform how they serve customers and grow their businesses. We are primarily an in-person company based in San Francisco, with growing offices across North America, Europe, and Asia. We are guided by a set of values that are at the core of our actions and define our culture: Trust, Customer Obsession, Craftsmanship, Intensity, and a commitment to balancing Family along the way. These values are the foundation of our work, and we are committed to upholding them in everything we do. Our co-founders are Bret Taylor https://www.linkedin.com/in/brettaylor/ and Clay Bavor https://www.linkedin.com/in/claybavor/. Bret currently serves as Board Chair of OpenAI. Previously, he was co-CEO of Salesforce (which had acquired the company he founded, Quip) and CTO of Facebook. Bret was also one of Google's earliest product managers and co-creator of Google Maps. Before founding Sierra, Clay spent 18 years at Google, where he most recently led Google Labs. Earlier, he started and led Google’s AR/VR effort, Project Starline, and Google Lens. Before that, Clay led the product and design teams for Google Workspace. WHAT YOU’LL DO - Drive high-impact security and infrastructure initiatives end-to-end. Lead complex, cross-functional programs spanning cloud infrastructure, platform security, identity and access management, detection and response, vulnerability management, and secure software delivery from problem definition through execution and sustained outcomes. - Own execution, planning, and program health. Be accountable for sequencing work, managing dependencies, tracking risk, and ensuring delivery of Sierra’s most critical security programs, with clear milestones and outcomes. - Help shape Sierra’s security strategy. Partner with security and engineering leadership to define priorities, investment areas, and execution plans that align risk reduction with platform growth, customer trust, and long-term scalability. - Build and strengthen security foundations. Drive programs that establish durable security primitives such as identity boundaries, access controls, logging and detection baselines, incident readiness, and secure defaults that future teams and features can confidently build on. - Translate ambiguity into clear execution. Decompose loosely defined security, risk, and compliance challenges particularly in emerging AI domains into structured programs, prioritized workstreams, and measurable outcomes. - Lead communication and alignment. Provide clear updates to leadership on program health, risks, dependencies, and tradeoffs; surface issues early and drive cross-functional alignment. WHO YOU'LL WORK WITH - Engineering: Infrastructure, Data Platform and Agent SDK engineers to shape technical requirements, manage dependencies, and deliver resilient systems. - Security & GRC: Security engineering, risk, compliance, and privacy partners to align on threat models, control strategy, audits, and risk management in a rapidly evolving AI landscape. - Product and GTM: Product, Agent Development, and Sales to operationalize security commitments and respond to sophisticated customer and regulator expectations. - Legal: On security terms, third-party risk, and contractual obligations. - Executive Leadership: Senior leaders who rely on you for clarity, prioritization, and confidence in Sierra’s security strategy and execution. WHAT YOU'LL BRING - Experience running security-focused technical programs in fast-growing SaaS or platform environments. - Strong technical fluency across cloud infrastructure, IAM, infrastructure as code, observability, secure CI/CD, and incident response. - Ability to execute through ambiguity, prioritize effectively, and keep teams moving. - Comfort operating in environments where things aren’t fully built yet and helping decide what needs to be built first. - Clear, concise communication with senior technical and business leaders. - A collaborative, pragmatic style with high ownership and high agency. EVEN BETTER... - Experience scaling security programs globally in AI-first or data-intensive SaaS environments. - Exposure to emerging AI risk, data governance, or agent and model-related security considerations. - Experience supporting security initiatives in public-sector, regulated and/or multi-cloud environments (AWS, GCP, Azure). - Relevant security, cloud, AI or technical program management certifications. - Familiarity with regulatory and compliance frameworks (ISO 27001, PCI DSS, FedRAMP, HIPAA) OUR VALUES - Trust: We build trust with our customers with our accountability, empathy, quality, and responsiveness. We build trust in AI by making it more accessible, safe, and useful. We build trust with each other by showing up for each other professionally and personally, creating an environment that enables all of us to do our best work. - Customer Obsession: We deeply understand our customers’ business goals and relentlessly focus on driving outcomes, not just technical milestones. Everyone at the company knows and spends time with our customers. When our customer is having an issue, we drop everything and fix it. - Craftsmanship: We get the details right, from the words on the page to the system architecture. We have good taste. When we notice something isn’t right, we take the time to fix it. We are proud of the products we produce. We continuously self-reflect to continuously self-improve. - Intensity: We know we don’t have the luxury of patience. We play to win. We care about our product being the best, and when it isn’t, we fix it. When we fail, we talk about it openly and without blame so we succeed the next time. - Family: We know that balance and intensity are compatible, and we model it in our actions and processes. We are the best technology company for parents. We support and respect each other and celebrate each other’s personal and professional achievements. WHAT WE OFFER We want our benefits to reflect our values and offer the following to full-time employees: - Flexible (unlimited) paid time off - Medical, dental, and vision benefits for you and your family - Life insurance and disability benefits - Retirement plan dependent on country of employment - Parental leave - Fertility and family building benefits through Carrot - Lunch, as well as delicious snacks and coffee to keep you energized  - Discretionary benefit stipend giving people the ability to spend where it matters most - Free alphorn lessons These benefits are further detailed in Sierra's policies, may vary by region, and are subject to change at any time, consistent with the terms of any applicable compensation or benefits plans. Eligible full-time employees can participate in Sierra's equity plans subject to the terms of the applicable plans and policies. BE YOU, WITH US We're working to bring the transformative power of AI to every organization in the world. To do so, it is important to us that the diversity of our employees represents the diversity of our customers. We believe that our work and culture are better when we encourage, support, and respect different skills and experiences represented within our team. We encourage you to apply even if your experience doesn't precisely match the job description. We strive to evaluate all applicants consistently without regard to race, color, religion, gender, national origin, age, disability, veteran status, pregnancy, gender expression or identity, sexual orientation, citizenship, or any other legally protected class.

Location: Hong Kong, Hong Kong SAR; Singapore, Singapore Who We Are At OKX, we believe that the future will be reshaped by crypto, and ultimately contribute to every individual's freedom. OKX is a leading crypto exchange, and the developer of OKX Wallet, giving millions access to crypto trading and decentralized crypto applications (dApps). OKX is also a trusted brand by hundreds of large institutions seeking access to crypto markets. We are safe and reliable, backed by our Proof of Reserves. Across our multiple offices globally, we are united by our core principles: We Before Me , Do the Right Thing , and Get Things Done . These shared values drive our culture, shape our processes, and foster a friendly, rewarding, and diverse environment for every OK-er. OKX is part of OKG, a group that brings the value of Blockchain to users around the world, through our leading products OKX, OKX Wallet, OKLink and more. About the Opportunity As a Staff Engineer, y ou'll own the build-out of our security engineering and DevSecOps capabilities: designing and developing the security products, platform services, and SDKs/Agents that embed protection directly into how code is written, built, shipped, and run. This is a role for someone with real depth in security, broad coverage across the stack, and the engineering muscle to ship. Just as important is the ability to drive adoption — security that lands in complex, fast-moving business environments rather than sitting in a policy document. What You’ll Be Doing Architect and build our end-to-end DevSecOps platform and the SDKs/Agents behind our security products, covering code, build, artifacts, images, deployment, and runtime. Lead runtime protection through RASP and Java Agent — bytecode instrumentation, runtime hooking, and detection/interception engines using ASM, ByteBuddy, and Instrumentation, with continuous tuning for performance, stability, and compatibility. Integrate and productise scanning capabilities across SAST, DAST, IAST, SCA, code scanning, and image scanning. You'll embed tools like SonarQube and Coverity deep into CI/CD and close the loop from detection through blocking, remediation, and re-test. Go deep on application security offence and defence — designing detection, remediation, hardening, and counter-measures for XSS, SQL injection, SSRF, deserialisation, command execution, authentication/authorisation flaws, and API security. Bring AI-native security engineering to life. Apply LLMs and AI Agents to vulnerability analysis, rule generation, false-positive attribution, remediation guidance, security knowledge capture, and engineering automation — and build a coherent view of the architecture, mechanics, and security implications. Embed as the security technical expert inside engineering teams, driving security standards, onboarding specifications, release gates, risk tiering, and remediation mechanisms that measurably lift the security baseline and delivery quality. Partner across engineering, architecture, SRE, QA, and business teams on priority projects, solving the genuinely hard security problems and turning the solutions into reusable platform capability and repeatable practice. What We Look For In You Strong computer science and security fundamentals — deep understanding of operating systems, networking, compilers and the JVM, distributed systems, application security, cloud-native security, and supply chain security. Both breadth and depth. Expert-level Java, with hands-on depth in the JVM, ClassLoader, Java Agent, ASM, ByteBuddy, bytecode instrumentation, and performance profiling and tuning. Plus working proficiency in Python or Go. Substantial production experience with RASP, SAST, DAST, IAST, SCA, image security, and code scanning — enough to design a capability, integrate the engine, build the platform around it, and take it to scale independently. Real offensive and defensive experience. You understand the root causes, exploitation paths, detection logic, bypass techniques, and fixes for common web, API, and microservices vulnerabilities — and can design from both the attacker's and defender's point of view. Fluency with LLMs and AI Agents, including a considered view on model capability limits, agent architecture, tool calling, context engineering, evaluation methods, and how AI is reshaping both security engineering and the attack surface. Strong engineering execution paired with product instinct — able to lead the design and delivery of security products, platform modules, and SDKs/Agents while balancing security outcomes against performance overhead, integration cost, and long-term operability. Exceptional ownership, cross-team communication, and the persistence to move security governance, rule enforcement, and remediation through to a clear result. Nice to Haves Security engineering experience at a top-tier internet company, cloud provider, or leading security vendor You've led the build of a DevSecOps platform, application security platform, RASP, code scanning platform, or cloud-native security platform Background in security product development, SDK/Agent engineering, vulnerability research, red team exercises, or purple team work Shipped AI + Security work — security copilots, intelligent rule generation, automated analysis, or remediation recommendation systems Perks & Benefits Competitive total compensation package L&D programs and Education subsidy for employees' growth and development Various team building programs and company events Wellness and meal allowances Comprehensive healthcare schemes for employees and dependants More that we love to tell you along the process! Notice: All official OKX vacancies are published on this website. While roles may appear on selected third-party platforms from time to time, information on other sites may be inaccurate or outdated. If in doubt, please apply directly through our official careers website. Information collected and processed as part of the recruitment process of any job application you choose to submit is subject to OKX 's Candidate Privacy Notice .

Location: EMEA About the team The Security Team is responsible for providing key security capabilities covering application, cloud and enterprise security, incident response, detection and GRC. Our team is looking for an experienced, hands-on security practitioner, who will drive the adoption of modern security processes and tooling, with focus on supporting our engineering and product teams in improving the security posture of our platforms and services. What you will do: - Identify security gaps and vulnerabilities in all ClickHouse offerings triage a wide range of vulnerabilities reported via our bug bounty program, responsible disclosure, GitHub Issues covering web, API and server - client assets including low level memory issues like heap or buffer overflows - Improve and develop security assurance activities - pentests, vulnerability assessments, bug bounty programs, fuzzing - Plan and execute internal red team assessments and penetration tests against ClickHouse infrastructure, cloud environments, designing realistic adversary scenarios to test detection, response and control effectiveness - Assess AI/LLM-specific attack surface across ClickHouse's own AI-powered features and internal AI tooling, including prompt injection, model/data exfiltration, and unsafe agentic tool-use patterns - Build and operate agentic tooling for reconnaissance, exploit-chaining and attack-path discovery, and apply LLM-assisted fuzzing to accelerate vulnerability discovery across ClickHouse's products and infrastructure - Partner with detection engineering to validate and improve detection coverage during red team exercises, measuring and reporting on control effectiveness and time to detect/respond - Handle information security events and incidents across ClickHouse products and services - Develop processes, tooling and automation to scale security processes and mitigate risks to the business What you bring along: - 7+ years of experience in pentesting, red teaming and product security - Experience supporting engineering and product implementation efforts by performing threat assessments, assurance activities, advisory as well as, in some cases, implementation work across distributed systems covering web, API, client/server assets - Hands-on experience conducting offensive security engagements - internal red teaming, penetration testing and adversary simulation - across cloud, network and application environments - Ability to design adversary scenarios grounded in real threat intelligence (e.g. ransomware operators, supply chain attackers, insider threat) tailored to ClickHouse's risk profile as a multi-tenant cloud data platform - Strong written and verbal communication skills, with ability to translate attack chains into clear, actionable findings for engineering and leadership - Experience building or adapting agentic and LLM-assisted tooling for offensive security use cases (recon automation, exploit chaining, fuzzing harnesses), with judgment on where AI genuinely speeds up an engagement versus adds noise - Familiarity with AI/LLM-specific vulnerability classes and testing methodology - Strong knowledge of and experience with one or more cloud service providers (e.g. AWS, GCP, Azure), Kubernetes, Cilium - Experience implementing and operating engineering security tools and processes (e.g. static / dynamic code analysis, software composition analysis, SBOM, OWASP SAMM, client and network fuzzing tools) - Security as code mindset, with focus on solving problems with automation and scale in mind Bonus Points: - BS, MS, or PhD in Computer Science or related field - Previous contributions to open source projects - Security or cloud related certifications (AWS, GCP, Azure) - Previous experience in using AI security harnesses for pentesting purposes - Experience building or operating internal red team tooling and infrastructure from scratch, rather than relying solely on off-the-shelf frameworks - Offensive security certifications (e.g. OSCP, OSCE, OSEP, OSWE) PERKS - Flexible work environment - ClickHouse is a globally distributed company and remote-friendly. We currently operate in over 25 countries. - Healthcare - Employer contributions towards your healthcare. - Equity in the company - Every new team member who joins our company receives stock options. - Time off - Flexible time off in the US, generous entitlement in other countries. - A USD$500 Home office setup if you’re a remote employee. - Global Gatherings – We believe in the power of in-person connection and offer opportunities to engage with colleagues at company-wide offsites. CULTURE - WE ALL SHAPE IT As part of a rapidly scaling start-up, you will be instrumental in shaping our culture. Are you interested in finding out more about our culture? Learn more about our values here https://clickhouse.com/company/careers. Check out our blog posts https://clickhouse.com/blog or follow us on LinkedIn https://www.linkedin.com/company/clickhouseinc/life/0c1ee7f4-2129-488d-b413-e7f6270659fd/?viewAsMember=true to find out more about what’s happening at ClickHouse. EQUAL OPPORTUNITY & PRIVACY ClickHouse provides equal employment opportunities to all employees and applicants and prohibits discrimination and harassment of any type based on factors such as race, color, religion, age, sex, national origin, disability status, genetics, protected veteran status, sexual orientation, gender identity or expression, or any other characteristic protected by federal, state or local laws. Please see here https://clickhouse.com/legal/applicant-privacy-notice for our Privacy Statement.

Location: Boston, MA Workplace: OnSite At WHOOP, we're on a mission to unlock and inspire performance for life. WHOOP empowers members to perform at a higher level and live longer through a deeper understanding of their bodies and daily lives. Protecting our members’ data and ensuring our systems scale securely and reliably is core to this mission. As a Director of Product Security you will play a critical role in shaping, driving, and leading our software engineering teams towards a secure software development lifecycle and strengthening product-facing identity and authentication capabilities that protect our members. This role will strategically craft the roadmap in collaboration with stakeholders across the business and staff the team to fulfill growing security needs across engineering. In addition to core product security responsibilities, you will partner closely with functions across Product, Software, Legal, Compliance, and enterprise security to meaningfully move the security posture of the company. We are seeking a leader and strategic partner with prior experience driving the engineering side of security for software teams. RESPONSIBILITIES - Build, lead, and grow multiple engineering teams executing on product-facing security strategy, including member authentication, code security, cloud security across AWS accounts, privacy by design, and threat modeling. - Lead application vulnerability management programs across bug bounties, code vulnerabilities, container vulnerabilities, and infrastructure vulnerabilities. - Build, integrate, and mature DevSecOps tooling and developer security controls, including SAST, SCA, container scanning, secrets detection, CI/CD security checks, and secure-by-default developer workflows. - Define and communicate long-term product security strategy, product architecture standards, and design principles for product-facing systems. - Partner with engineering, office of the CISO, and compliance leadership to embed privacy and security by design across the software development lifecycle. - Establish and enforce best practices, standards, and processes for secure software development, testing, and deployment. - Provide mentorship, guidance, and career development for engineering managers and individual contributors. - Foster a culture of innovation, teamwork, psychological safety, and continuous learning within the Product Security organization. QUALIFICATIONS - Demonstrated success scaling a security team whilst crafting clear and efficient team domains. - Proven experience as a technical leader managing multiple teams or a growing security engineering organization. - Experience growing high level individual contributor career growth at the staff level or higher. - Deep understanding of product security principles, including vulnerability management, data privacy, threat modeling, secure SDLC practices,and secure-by-default engineering patterns. - Experience building or integrating developer security tooling to improve secure-by-default practices. - Strong technical background in software development, testing, and deployment processes. - Excellent communication, interpersonal, and leadership skills with the ability to influence across teams and levels. BONUS QUALIFICATIONS - Experience with AWS cloud environments and data-driven decision-making. - Hands-on experience with containerized microservice environments. - Background in incident response and post-mortem analysis for security events. - Familiarity with automation frameworks for vulnerability scanning, compliance checks, or infrastructure security. ABOUT YOU - You’re a strategic and people-focused leader who thrives on balancing hands-on technical oversight with long-term organizational growth. - You have experience building and scaling security engineering focused teams. - You’re passionate about creating secure, privacy-first systems that protect member data and enable innovation. - You collaborate effectively across technical and non-technical teams and can operate confidently in both strategic and tactical domains. - Above all, you believe that security enables innovation, and you lead by fostering a culture that supports both speed and safety. Learn more about our Software Org and how to be successful in your engineering career at WHOOP via our Career Framework https://engineering.prod.whoop.com/careerframework.   This role is based in the WHOOP office located in Boston, MA. The successful candidate must be prepared to relocate if necessary to work out of the Boston, MA office.   Interested in the role, but don’t meet every qualification? We encourage you to still apply! At WHOOP, we believe there is much more to a candidate than what is written on paper, and we value character as much as experience. As we continue to build a diverse and inclusive environment, we encourage anyone who is interested in this role to apply.   WHOOP is an Equal Opportunity Employer and participates in E-verify https://www.e-verify.gov/ to determine employment eligibility. It is unlawful in Massachusetts to require or administer a lie detector test as a condition of employment or continued employment. An employer who violates this law shall be subject to criminal penalties and civil liability.

Location: The Netherlands; Poland; Portugal; France; United Kingdom; Spain; Germany; Italy About the team  The Security Team is responsible for providing key security capabilities covering application, cloud and enterprise security, incident response, detection and GRC. Our team is looking for an experienced, hands-on security practitioner, who will drive the adoption of modern security processes and tooling, with focus on supporting our engineering and product teams in improving the security posture of our platforms and services. Note: This position can be fully remote anywhere in the Netherlands. What you will do: - Collaborate with engineering and product on improving existing and building new product features with focus on threat modeling, assurance and secure implementation, some examples of recent work include implementation of secure key management, passwordless authentication, m2m authentication, sandboxing and compute/network/storage isolation - Identify security gaps and vulnerabilities in ClickHouse Cloud and OSS, triage a wide range of vulnerabilities reported via our bug bounty program, responsible disclosure, GitHub Issues covering web, API and server - client assets including low level memory issues like heap or buffer overflows - Improve and develop security assurance activities - pentests, vulnerability assessments, bug bounty programs, fuzzing - Drive implementation and usage of engineering security tools - static, dynamic code analysis, dependency checks, code licensing compliance (working knowledge of Snyk, Semgrep, GitHub CodeQL) - Nurture the engineering - security relationship, identify and implement process and technology improvements - Handle information security events and incidents across ClickHouse products and services - Develop processes, tooling and automation to scale security processes and mitigate risks to the business What you bring along: - Experience supporting engineering and product implementation efforts by performing threat assessments, assurance activities, advisory as well as, in some cases, implementation work across distributed systems covering web, API, client/server assets - Strong knowledge of and experience with one or more cloud service providers (e.g. AWS, GCP, Azure), Kubernetes, Cilium - Experience implementing and operating engineering security tools and processes (e.g. static / dynamic code analysis, software composition analysis, SBOM, OWASP SAMM, client and network fuzzing tools) - Significant development and automation experience, ability to work with C++ code - Security as code mindset, with focus on solving problems with automation and scale in mind Bonus Points: - BS, MS, or PhD in Computer Science or related field - Previous contributions to open source projects - Security or cloud related certifications (AWS, GCP, Azure) PERKS - Flexible work environment - ClickHouse is a globally distributed company and remote-friendly. We currently operate in over 25 countries. - Healthcare - Employer contributions towards your healthcare. - Equity in the company - Every new team member who joins our company receives stock options. - Time off - Flexible time off in the US, generous entitlement in other countries. - A USD$500 Home office setup if you’re a remote employee. - Global Gatherings – We believe in the power of in-person connection and offer opportunities to engage with colleagues at company-wide offsites. CULTURE - WE ALL SHAPE IT As part of a rapidly scaling start-up, you will be instrumental in shaping our culture. Are you interested in finding out more about our culture? Learn more about our values here https://clickhouse.com/company/careers. Check out our blog posts https://clickhouse.com/blog or follow us on LinkedIn https://www.linkedin.com/company/clickhouseinc/life/0c1ee7f4-2129-488d-b413-e7f6270659fd/?viewAsMember=true to find out more about what’s happening at ClickHouse. EQUAL OPPORTUNITY & PRIVACY ClickHouse provides equal employment opportunities to all employees and applicants and prohibits discrimination and harassment of any type based on factors such as race, color, religion, age, sex, national origin, disability status, genetics, protected veteran status, sexual orientation, gender identity or expression, or any other characteristic protected by federal, state or local laws. Please see here https://clickhouse.com/legal/applicant-privacy-notice for our Privacy Statement.

Location: United States Workplace: Remote About the team  The Security Team is responsible for providing key security capabilities covering application, cloud and enterprise security, incident response, detection and GRC. Our team is looking for an experienced, hands-on security practitioner, who will drive the adoption of modern security processes and tooling, with focus on supporting our engineering and product teams in improving the security posture of our platforms and services.  What you will do: - Collaborate with engineering and product on improving existing and building new product features with focus on threat modeling, assurance and secure implementation, some examples of recent work include implementation of secure key management, passwordless authentication, m2m authentication, sandboxing and compute/network/storage isolation - Identify security gaps and vulnerabilities in ClickHouse Cloud and OSS, triage a wide range of vulnerabilities reported via our bug bounty program, responsible disclosure, GitHub Issues covering web, API and server - client assets including low level memory issues like heap or buffer overflows - Improve and develop security assurance activities - pentests, vulnerability assessments, bug bounty programs, fuzzing - Drive implementation and usage of engineering security tools - static, dynamic code analysis, dependency checks, code licensing compliance (working knowledge of Snyk, Semgrep, GitHub CodeQL) - Nurture the engineering - security relationship, identify and implement process and technology improvements - Handle information security events and incidents across ClickHouse products and services - Develop processes, tooling and automation to scale security processes and mitigate risks to the business What you bring along: - Experience supporting engineering and product implementation efforts by performing threat assessments, assurance activities, advisory as well as, in some cases, implementation work across distributed systems covering web, API, client/server assets - Strong knowledge of and experience with one or more cloud service providers (e.g. AWS, GCP, Azure), Kubernetes, Cilium, Crossplane - Experience implementing and operating engineering security tools and processes (e.g. static / dynamic code analysis, software composition analysis, SBOM, OWASP SAMM, client and network fuzzing tools) - Significant development and automation experience, ability to work with C++ code preferred - Security as code mindset, with focus on solving problems with automation and scale in mind Bonus Points: - BS, MS, or PhD in Computer Science or related field - Previous contributions to open source projects - Security or cloud related certifications (AWS, GCP, Azure) PERKS - Flexible work environment - ClickHouse is a globally distributed company and remote-friendly. We currently operate in over 25 countries. - Healthcare - Employer contributions towards your healthcare. - Equity in the company - Every new team member who joins our company receives stock options. - Time off - Flexible time off in the US, generous entitlement in other countries. - A USD$500 Home office setup if you’re a remote employee. - Global Gatherings – We believe in the power of in-person connection and offer opportunities to engage with colleagues at company-wide offsites. CULTURE - WE ALL SHAPE IT As part of a rapidly scaling start-up, you will be instrumental in shaping our culture. Are you interested in finding out more about our culture? Learn more about our values here https://clickhouse.com/company/careers. Check out our blog posts https://clickhouse.com/blog or follow us on LinkedIn https://www.linkedin.com/company/clickhouseinc/life/0c1ee7f4-2129-488d-b413-e7f6270659fd/?viewAsMember=true to find out more about what’s happening at ClickHouse. EQUAL OPPORTUNITY & PRIVACY ClickHouse provides equal employment opportunities to all employees and applicants and prohibits discrimination and harassment of any type based on factors such as race, color, religion, age, sex, national origin, disability status, genetics, protected veteran status, sexual orientation, gender identity or expression, or any other characteristic protected by federal, state or local laws. Please see here https://clickhouse.com/legal/applicant-privacy-notice for our Privacy Statement.

Задачи: — Проектирование и разработка бэкенд-сервисов DSPM: разработка ядра продукта, включая пайплайны сканирования, обработки и парсинга документов, матчеры чувствительной информации, хранение и шифрование результатов. — Проектирование и разработка высоконагруженных отказоустойчивых бэкенд-сервисов, способных обрабатывать терабайты клиентских данных в потоковом режиме с акцентом на производительность, надёжность и стоимость обработки. — Сопровождение сервисов на всём жизненном цикле: от дизайна и код-ревью до выкатки и эксплуатации, включая мониторинг и алерты. Требования: — Уверенное владение Java и понимание JVM, включая принципы многопоточности и внутреннее исполнение кода. — Опыт разработки бэкенд-сервисов в продакшене с использованием Spring Boot, gRPC, баз данных и очередей или топиков. — Инженерная зрелость и продуктовое мышление, внимательность к качеству кода, включая тесты, код-ревью и наблюдаемость. — Способность самостоятельно разбираться в смежных компонентах и доводить задачи до результата.

Location: Boston, MA Workplace: OnSite At WHOOP, we're on a mission to unlock and inspire performance for life. Our wearable technology provides personalized insights that help millions of members better understand their bodies, and make smarter decisions about training, recovery, and lifestyle. WHOOP is seeking a Security Architect to help build and scale the Security Architecture function within the Information Security organization. This role will play a foundational part in defining how security architecture is practiced across the company by establishing standards, governance, reusable design patterns, and trusted partnerships with engineering teams. The successful candidate will bring broad technical expertise across application, infrastructure, cloud, and enterprise security while building strong relationships throughout the organization. They will help create practical security standards, influence technical strategy, mentor engineering teams, and enable the business to move quickly without compromising security. This role requires someone who enjoys working with people as much as solving technical problems and can translate complex security concepts into clear, actionable guidance. Working closely with the Security Architecture Lead and the broader CISO organization, this individual will help shape the long-term vision and operating model for Security Architecture at WHOOP. RESPONSIBILITIES - Partner with Engineering, Product, Infrastructure, IT, and Security teams to provide architectural guidance throughout the software development lifecycle, ensuring security is incorporated early into design decisions. - Help establish and mature WHOOP's Security Architecture practice by defining architecture governance, review methodologies, security standards, and engagement models that scale with the organization. - Develop and maintain security architecture principles, standards, reference architectures, and reusable design patterns that enable engineering teams to build secure systems consistently. - Review application, cloud, infrastructure, AI, and enterprise technology initiatives to identify architectural risks, validate security controls, and recommend practical mitigation strategies. - Lead architecture reviews and collaborate with engineering teams on threat models, trust boundaries, data flows, identity patterns, secure service-to-service communications, and security design decisions. - Provide technical leadership across application security, cloud security, infrastructure security, API security, identity and access management, secrets management, network security, and data protection. - Work closely with Product Security, Infrastructure Security, and Engineering teams to establish consistent security expectations across new products, internal platforms, and third-party integrations. - Evaluate the security architecture of strategic vendors and technology solutions as part of WHOOP's Third-Party Risk Assessment process. - Translate regulatory and compliance requirements—including HIPAA, PCI DSS, ISO 27001, SOC 2, and NIST frameworks—into practical engineering guidance and architectural controls. - Mentor engineers and security team members on secure design principles, helping raise the organization's overall security maturity through collaboration, education, and trusted technical leadership. - Produce clear architectural documentation, technical standards, design reviews, and implementation guidance that can be consistently applied across engineering teams. - Partner with Security leadership to define the long-term vision, operating model, roadmap, and success metrics for Security Architecture as a strategic capability within the Information Security organization. - Serve as a trusted advisor to engineering and business leaders, balancing security, operational efficiency, and business objectives while promoting a secure-by-design culture across WHOOP. QUALIFICATIONS - 8–12+ years of experience in security architecture, application security, cloud security, infrastructure security, or senior security engineering roles supporting modern distributed systems. - Demonstrated experience designing and securing cloud-native applications and infrastructure, with deep knowledge of AWS security services and modern cloud architecture. - Strong understanding of application security, secure software development, infrastructure security, cloud security, API security, identity and access management, enterprise networking, and modern security architecture principles. - Previous software engineering or application development experience with the ability to understand application design, architecture, implementation tradeoffs, and engineering workflows. - Experience performing architecture reviews, security design assessments, and threat modeling for complex distributed systems. - Familiarity with healthcare, regulated environments, or security programs supporting HIPAA, PCI DSS, ISO 27001, SOC 2, NIST 800-53, or similar regulatory and compliance frameworks. - Ability to balance security requirements with business objectives and provide practical, risk-based recommendations that engineering teams can successfully implement. - Exceptional interpersonal, written, and verbal communication skills with a proven ability to build trust, influence technical decisions, and collaborate effectively across engineering, product, IT, and security organizations. - A collaborative, approachable, and service-oriented mindset with the ability to establish strong working relationships across teams and become a trusted partner to engineers and technical leaders. - Comfortable working independently while helping establish new security processes, standards, governance models, and architectural practices in a growing organization. - High integrity, sound judgment, intellectual curiosity, and a pragmatic, solution-oriented approach to solving complex security challenges. - Professional security certifications such as CISSP, CCSP, AWS Certified Security – Specialty, GIAC, TOGAF, or equivalent are considered a plus. This role is based in the WHOOP office located in Boston, MA. The successful candidate must be prepared to relocate if necessary to work out of the Boston, MA office. Interested in the role, but don’t meet every qualification? We encourage you to still apply! At WHOOP, we believe there is much more to a candidate than what is written on paper, and we value character as much as experience. As we continue to build a diverse and inclusive environment, we encourage anyone who is interested in this role to apply. WHOOP is an Equal Opportunity Employer and participates in E-verify https://www.e-verify.gov/to determine employment eligibility The WHOOP compensation philosophy is designed to attract, motivate, and retain exceptional talent by offering competitive base salaries, meaningful equity, and consistent pay practices that reflect our mission and core values. At WHOOP, we view total compensation as the combination of base salary, equity, and benefits, with equity serving as a key differentiator that aligns our employees with the long-term success of the company and allows every member of our corporate team to own part of WHOOP and share in the company’s long-term growth and success. The U.S. base salary range for this full-time position is $155,000 - $195,000. Salary ranges are determined by role, level, and location. Within each range, individual pay is based on factors such as job-related skills, experience, performance, and relevant education or training. In addition to the base salary, the successful candidate will also receive benefits and a generous equity package. These ranges may be modified in the future to reflect evolving market conditions and organizational needs. While most offers will typically fall toward the starting point of the range, total compensation will depend on the candidate’s specific qualifications, expertise, and alignment with the role’s requirements.

Location: Bucharest, Romania; Cluj-Napoca, Romania; Bucuresti, Romania Workplace: remote At TechBiz Global, we are providing recruitment service to our TOP clients from our portfolio. We are currently seeking a Cyber Security Analyst to join one of our clients ' teams. If you're looking for an exciting opportunity to grow in a innovative environment, this could be the perfect fit for you. We are seeking an enthusiastic and motivated individual to provide Managed Cyber Security Services to our valued customers. As a key member of the Optimization Engineering & Analytics team, you will be part of an integral and group that is dedicated to protecting system resources from cyber-attacks and other online threats that could have devastating consequences for millions of end users. Successful candidates will demonstrate foundational Network Security and System Administration with advanced understanding across Endpoint Protection, Threat and Vulnerability Management, Security Automation, and Security Analysis. KEY RESPONSIBILITIES: • Provide client-facing support of our managed security services, including adherence and development of processes and operational frameworks. • Ability to work assigned shift, covering alternate shifts as needed. • Analyze, escalate, and assist in the remediation of critical information security incidents. • Assist with the integration, deployment, on-boarding and management of endpoint defense and attack surface managed customers. • Perform real-time alert monitoring and analyze security event data from network and endpoint environments, peer analysts, customer platforms, and other data sources. • Provide Incident Response (IR) support and assist customers remediation guidance. • Review procedures relating to Cyber threat intelligence, monitoring, incident response, attack surface reduction, and design automated actions to accelerate the triage, validation, eradication, and remediation of security incidents. • Leverage expertise in leading security operations tools and industry standard scripting languages to effectively write playbooks in security orchestration, automation, and response. • Collaborate with team members to create, maintain, and manage a library of automated playbooks for common information security threats and customize these plans for client specific environments. • Actively identify areas of improvement within the processes of the Security Operations Center and Cyber Incident Response with the goal of decreasing response times, increasing effectiveness, eliminating waste, and streamlining security operations. • Integrate new security platform functionality with existing systems and automated processes as threats and controls evolve. • Create well documented and clearly articulated code/ scripts, process, and service documentation. • Perform health checks and optimization activities on client security technologies or systems. • Determine information security risk and facilitate remediation actions of identified vulnerabilities and security risk across the enterprise. • Other, as needed. MINIMUM QUALIFICATIONS • 4+ years of IT experience. • 3+ years of Cyber Security experience. • Advanced operating systems experience, in 2 or more of the following, Microsoft, MacOS, Linux. • General network security and troubleshooting knowledge. • Foundational scripting knowledge preferred in any of the following: PowerShell, Python, Bash. • In-depth knowledge of TCP/IP, UDP, DNS, FTP, SSH, SSL/TLS, and HTTP Protocols, network analysis, and network/security applications. • Good knowledge of common malware threats and attack methodologies. • Passionate about emerging threats and security tools/technologies. • Malware and Threat analysis. • Incident Management. • Able to work under general to minimal supervision. PREFERRED QUALIFICATIONS • 3+ years of experience with endpoint security tools (Trellix ePO, Trellix ENS, Trellix EDR, Trellix HX, CrowdStrike, Microsoft Defender, Microsoft ATP, SentinelOne). • 3+ years managing security endpoints. • 3+ years of experience with SIEM management and tuning in one or more of the following: LogScale formerly Humio, Splunk, Trellix Helix, Trellix ESM, Azure Sentinel, Elastic SIEM, Chronical, or Devo. • Experience with Windows patch management tools (Automox, SCCM, SolarWinds, GFI Languard, etc.) a plus. • Experience creating detection rules in a one ore more SIEM technologies • Certifications a plus: CEH, CRISC, CISA, CGEIT, CISSP, CIPP, GMON, GHIA, GCIH. • Bachelor’s Degree (Math, CS, and Engineering), preferred. • Excellent knowledge of security methodologies, processes (i.e., Cyber Kill Chain/Diamond Models, and the MITRE ATT&CK framework). Benefits package: 20 days of vacation 5 days of employer-paid sick leave (there are additional sick leave benefits beyond that are paid for by the National Health Insurance House) 17 national holidays employees receive  $400/month RON teleworking allowance Public healthcare, public pension, unemployment In addition to the statutory public healthcare, we provide Allianz medical upgrade for the employee-only Contract type and contract duration - will be an EOR (Employee of Record) of Deel.

Location: Almaty, Kazakhstan Workplace: OnSite WHY WORK AT HIGGSFIELD AI? Higgsfield AI is the fastest-scaling generative AI company in history, hitting $500M in annual revenue run rate, 25M+ users worldwide, 6M+ generations per day, and powering 390 of Fortune 500 brands. We're building at the absolute frontier of AI-powered video creation and next-generation creative tools. Joining Higgsfield means becoming part of a high-impact team shaping the future of AI-native experiences, at a company that isn't just moving fast, but rewriting what fast looks like.   Role Overview We're looking for a hands-on Infrastructure Security Engineer to own security across our cloud and ML infrastructure — the platform that trains our models and serves millions of generations a day. The work spans tenant isolation for user-deployed apps, GPU cluster security, and model protection from training pipeline to serving. You'll sit between Security, DevOps, and ML Engineering. You'll own both immediate implementation work and long-term operational responsibility: cloud and ML infrastructure security, vulnerability management, monitoring, and access governance.   KEY RESPONSIBILITIES We are looking for someone with experience in scaling high-growth startups who can make an immediate impact in the following areas: Cloud & Network Security - Evaluate, implement, and maintain cloud security tooling. - Own infrastructure and container vulnerability management across our cloud environments, and drive remediation. - Design and implement network segmentation to tighten internal security boundaries. - Build centralized security monitoring across cloud infrastructure. Corporate Access Control - Own access governance and credential management across cloud and internal tooling. - Partner with Engineering, DevOps, and IT to raise identity and access management standards. Technical Leadership: - Set the technical direction for infrastructure security and lead cross-functional projects turning the standards you set into tooling and guardrails engineers actually ship with. Requirements: Few people will match all of these. If you're strong on some and eager to learn the rest, apply anyway. - 7+ years in infrastructure security or security engineering, including time at a high- growth startup. - Deep hands-on experience securing a major cloud provider and a container orchestrator, managed with infrastructure-as-code (AWS, Kubernetes, Terraform). - Experience securing ML workloads — training or inference infrastructure, GPU clusters, or model-serving platforms. - Solid networking, operating systems, and cryptography fundamentals. - Strong grasp of container and infrastructure security practices and vulnerability management. - Comfortable working cross-functionally with DevOps, Engineering, and ML teams; able to independently find and close security gaps. - High agency. Nice to have - Experience with sandboxing, container isolation, or secure execution environments for untrusted code. - Experience with CSPM rollouts. - Incident response and security monitoring experience. - Familiarity with SOC 2 or similar frameworks. WHAT WE OFFER: - Competitive base salary in USD - Equity: participation in the company’s stock option program, giving you the opportunity to share in the company’s long-term growth. - On-site role in our Almaty office (we will relocate you from anywhere).

Location: United States, Los Angeles, CA Why Sony Interactive Entertainment? Sony Interactive Entertainment isn’t just the Best Place to Play — it’s also the Best Place to Work. Sony Interactive Entertainment (SIE) is the company behind the PlayStation brand. As a subsidiary of Sony Group Corporation, we’re part of a proud legacy of innovation and excellence. SIE is a dynamic technology company, delivering cutting-edge hardware and network services to more than 100 million people and an entertainment leader, home to some of the most beloved and recognizable intellectual properties (IP) in the world. Our role at SIE is to create and nurture the experiences under the PlayStation brand, a name synonymous with entertainment excellence and creativity. Sony Interactive Entertainment is seeking an experienced and collaborative Regional Security Manager to lead physical security operations across the Americas (AMER) region. Reporting to the Director, Global Security Operations, this role will oversee a team responsible for regional security programs, incident response, crisis support, and operational readiness across SIE offices, studios, and events. The ideal candidate brings strong operational leadership, sound judgment, and the ability to build trusted partnerships across a global organization. This position plays a key role in helping create safe, secure, and resilient environments for employees, visitors, and business operations. What You’ll Do Regional Security Leadership Lead and support a regional team of security professionals across the AMER region. Partner with global security teams to help maintain consistent standards, processes, and operational practices. Contribute to the development and execution of regional security strategies aligned with business priorities. Use metrics and operational insights to evaluate effectiveness and identify opportunities for improvement. Support budget planning, resource management, and vendor oversight within the security function. Physical Security Operations Oversee physical security programs, policies, and procedures across offices and studio locations. Conduct risk assessments and coordinate security reviews to identify and address potential vulnerabilities. Collaborate with internal stakeholders and external partners to strengthen site security and emergency preparedness. Manage third-party security providers to ensure quality service delivery and alignment with organizational expectations. Provide guidance and operational support to regional sites on security best practices and compliance. Incident & Crisis Response Lead or support responses to workplace security incidents and safety-related matters. Partner closely with Workplace, Legal, HR/People, and other teams to support investigations and incident management. Prepare clear documentation, reporting, and recommendations following incidents or security reviews. Support emergency planning activities, tabletop exercises, and preparedness initiatives. Coordinate response efforts during significant incidents impacting employees, facilities, or operations. Event Security Support security planning and operational readiness for PlayStation events, activations, and executive engagements. Conduct event-related risk assessments and coordinate appropriate security measures. Provide on-site leadership and incident management support during key regional events. Collaboration & Communication Build strong partnerships with teams across HR, IT, Workplace, Legal, and other business functions. Communicate regularly with leadership regarding security priorities, risks, and operational updates. Maintain relationships with industry peers, security organizations, and external partners to stay informed on emerging trends and best practices. What We’re Looking For 8+ years of experience in physical security, corporate security operations, investigations, law enforcement, military, intelligence, or a related field. Demonstrated experience managing security initiatives across multiple locations or regions. Strong leadership and people management skills, including coaching and team development. Ability to assess complex situations, make informed decisions, and communicate effectively during incidents. Excellent collaboration and stakeholder management skills across diverse teams and functions. Experience managing vendors, contractors, or third-party security providers. Familiarity with crisis management, emergency response, and event security operations. Flexibility to support occasional evening/weekend work and regional travel as needed. Preferred Qualifications Experience in technology, gaming, entertainment, or other fast-paced global organizations. Industry certifications such as CPP (Certified Protection Professional) or similar credentials. Bachelor’s degree in Criminal Justice, Security Management, Emergency Management, Business, or a related field — or equivalent professional experience. Location: This position can be based in one of our California offices, including San Mateo, San Diego, Aliso Viejo, or Los Angeles. * Hybrid role with an expectation to work in-office on average 2 days per week #LI-GM1 At SIE, we consider several factors when setting each role’s base pay range, including the competitive benchmarking data for the market and geographic location. Please note that the base pay range may vary in line with our hybrid working policy and individual base pay will be determined based on job-related factors which may include knowledge, skills, experience, and location. In addition, this role is eligible for SIE’s top-tier benefits package that includes medical, dental, vision, matching 401(k), paid time off, wellness program and coveted employee discounts for Sony products. This role also may be eligible for a bonus package. Click here to learn more. The estimated base pay range for this role is listed below. $150,700 — $226,100 USD Please note, Sony Interactive Entertainment conducts background checks at the offer stage for all new employees (which may include criminal background checks for some roles) and will need to process personal information to support these checks. Please refer to our Candidate Privacy Notice for more information about what personal information we collect, how we use it, who we share it with, and your data protection rights. Equal Opportunity Statement: Sony is an Equal Opportunity Employer. All persons will receive consideration for employment without regard to gender (including gender identity, gender expression and gender reassignment), race (including colour, nationality, ethnic or national origin), religion or belief, marital or civil partnership status, disability, age, sexual orientation, pregnancy, maternity or parental status, trade union membership or membership in any other legally protected category. We strive to create an inclusive environment, empower employees and embrace diversity. We encourage everyone to respond. Sony Interactive Entertainment is a Fair Chance employer and qualified applicants with arrest and conviction records will be considered for employment.

Location: United States, Aliso Viejo, CA Why Sony Interactive Entertainment? Sony Interactive Entertainment isn’t just the Best Place to Play — it’s also the Best Place to Work. Sony Interactive Entertainment (SIE) is the company behind the PlayStation brand. As a subsidiary of Sony Group Corporation, we’re part of a proud legacy of innovation and excellence. SIE is a dynamic technology company, delivering cutting-edge hardware and network services to more than 100 million people and an entertainment leader, home to some of the most beloved and recognizable intellectual properties (IP) in the world. Our role at SIE is to create and nurture the experiences under the PlayStation brand, a name synonymous with entertainment excellence and creativity. Sony Interactive Entertainment is seeking an experienced and collaborative Regional Security Manager to lead physical security operations across the Americas (AMER) region. Reporting to the Director, Global Security Operations, this role will oversee a team responsible for regional security programs, incident response, crisis support, and operational readiness across SIE offices, studios, and events. The ideal candidate brings strong operational leadership, sound judgment, and the ability to build trusted partnerships across a global organization. This position plays a key role in helping create safe, secure, and resilient environments for employees, visitors, and business operations. What You’ll Do Regional Security Leadership Lead and support a regional team of security professionals across the AMER region. Partner with global security teams to help maintain consistent standards, processes, and operational practices. Contribute to the development and execution of regional security strategies aligned with business priorities. Use metrics and operational insights to evaluate effectiveness and identify opportunities for improvement. Support budget planning, resource management, and vendor oversight within the security function. Physical Security Operations Oversee physical security programs, policies, and procedures across offices and studio locations. Conduct risk assessments and coordinate security reviews to identify and address potential vulnerabilities. Collaborate with internal stakeholders and external partners to strengthen site security and emergency preparedness. Manage third-party security providers to ensure quality service delivery and alignment with organizational expectations. Provide guidance and operational support to regional sites on security best practices and compliance. Incident & Crisis Response Lead or support responses to workplace security incidents and safety-related matters. Partner closely with Workplace, Legal, HR/People, and other teams to support investigations and incident management. Prepare clear documentation, reporting, and recommendations following incidents or security reviews. Support emergency planning activities, tabletop exercises, and preparedness initiatives. Coordinate response efforts during significant incidents impacting employees, facilities, or operations. Event Security Support security planning and operational readiness for PlayStation events, activations, and executive engagements. Conduct event-related risk assessments and coordinate appropriate security measures. Provide on-site leadership and incident management support during key regional events. Collaboration & Communication Build strong partnerships with teams across HR, IT, Workplace, Legal, and other business functions. Communicate regularly with leadership regarding security priorities, risks, and operational updates. Maintain relationships with industry peers, security organizations, and external partners to stay informed on emerging trends and best practices. What We’re Looking For 8+ years of experience in physical security, corporate security operations, investigations, law enforcement, military, intelligence, or a related field. Demonstrated experience managing security initiatives across multiple locations or regions. Strong leadership and people management skills, including coaching and team development. Ability to assess complex situations, make informed decisions, and communicate effectively during incidents. Excellent collaboration and stakeholder management skills across diverse teams and functions. Experience managing vendors, contractors, or third-party security providers. Familiarity with crisis management, emergency response, and event security operations. Flexibility to support occasional evening/weekend work and regional travel as needed. Preferred Qualifications Experience in technology, gaming, entertainment, or other fast-paced global organizations. Industry certifications such as CPP (Certified Protection Professional) or similar credentials. Bachelor’s degree in Criminal Justice, Security Management, Emergency Management, Business, or a related field — or equivalent professional experience. Location: This position can be based in one of our California offices, including San Mateo, San Diego, Aliso Viejo, or Los Angeles. * Hybrid role with an expectation to work in-office on average 2 days per week #LI-GM1 At SIE, we consider several factors when setting each role’s base pay range, including the competitive benchmarking data for the market and geographic location. Please note that the base pay range may vary in line with our hybrid working policy and individual base pay will be determined based on job-related factors which may include knowledge, skills, experience, and location. In addition, this role is eligible for SIE’s top-tier benefits package that includes medical, dental, vision, matching 401(k), paid time off, wellness program and coveted employee discounts for Sony products. This role also may be eligible for a bonus package. Click here to learn more. The estimated base pay range for this role is listed below. $150,700 — $226,100 USD Please note, Sony Interactive Entertainment conducts background checks at the offer stage for all new employees (which may include criminal background checks for some roles) and will need to process personal information to support these checks. Please refer to our Candidate Privacy Notice for more information about what personal information we collect, how we use it, who we share it with, and your data protection rights. Equal Opportunity Statement: Sony is an Equal Opportunity Employer. All persons will receive consideration for employment without regard to gender (including gender identity, gender expression and gender reassignment), race (including colour, nationality, ethnic or national origin), religion or belief, marital or civil partnership status, disability, age, sexual orientation, pregnancy, maternity or parental status, trade union membership or membership in any other legally protected category. We strive to create an inclusive environment, empower employees and embrace diversity. We encourage everyone to respond. Sony Interactive Entertainment is a Fair Chance employer and qualified applicants with arrest and conviction records will be considered for employment.

Location: Boston, Massachusetts, United States We take play seriously. We’re looking for curious adventurers ready to find their party, fueled by imagination and drive to build what’s never been built before. At Hasbro and Wizards of the Coast, you’ll collaborate with passionate teams to reimagine our iconic brands and create experiences that spark joy, connection, and community through the magic of play. This is your chance to shape legendary play that lasts a lifetime. Ready to bring your corporate, securities and business skills to one of the world's most iconic play and entertainment companies? Hasbro is looking for a sharp, driven Paralegal with 4+ years of experience to join our Legal Department! In this role you'll be a key part of the corporate legal team, and you'll work where corporate governance and securities compliance meet for a global, publicly traded company. You'll support SEC reporting and filings, Section 16 compliance, board and committee matters, annual meeting preparation, and entity management across Hasbro's worldwide footprint. You'll also partner with colleagues who handle commercial, employment, and litigation matters. If you like a fast pace, a high bar for accuracy, and seeing your work show up at the most senior levels of the company, this is your game! Effective from the date that Hasbro opens its new Boston location, this position will be onsite Tuesday – Thursday at Hasbro’s new HQ location in Boston, MA. In the interim, this position will be onsite Tuesday –Thursday at Hasbro’s HQ in Pawtucket, RI or at Hasbro’s temporary location in Boston, MA. What You Will Do as a Corporate Governance and Securities Compliance Paralegal: Support corporate securities matters, including assisting with SEC filings (Forms 10-K, 10-Q, 8-K, proxy statements), Section 16 reporting, insider trading compliance, and maintenance of the corporate disclosure calendar. Assist with corporate governance functions, including preparing board and committee materials, maintaining minute books, tracking director and officer information, and supporting annual meeting preparations. Draft, review, and manage a broad range of commercial agreements, including vendor contracts, NDAs, services agreements, and other transactional documents; assist with maintaining contract management systems and track key deadlines and renewals. Research federal and state, securities regulations, and commercial law developments to support attorney advice and strategy. Respond to legal inquiries from Finance, and business partners regarding securities compliance, and contract obligations. Assist in managing outside counsel relationships, including tracking invoices, budgets, and matter status. Partner with attorneys and internal business teams to proactively identify legal risks and support policy development and training initiatives. Lead anti‐bribery due diligence for global third parties, conducting risk assessments, reviewing red‐flag findings, and providing formal compliance clearance to mitigate corruption, sanctions, and reputational risks Manage and update electronic code of conduct and compliance training, ensuring alignment with evolving legal, regulatory, and business requirements Review conflict-of-interest disclosures, assess variant responses, and resolve potential conflicts in collaboration with stakeholders. What You Will Bring: 4+ years of relevant paralegal experience spanning corporate securities, or commercial transactions — in a law firm or in-house legal department. Associate's Degree or Paralegal Certificate preferred; Bachelor's Degree a significant plus. Strong interpersonal skills, sound judgment, and commitment to teamwork. Ability to work effectively with attorneys, Finance, and business managers at all levels. Demonstrated ability to prioritize a substantial and diverse workload and meet deadlines in a fast-paced environment. Prior in-house experience a plus. Expertise in anti‐bribery and corruption due diligence, including risk assessments, red‐flag analysis, and compliance clearance for third‐party engagements. Advanced proficiency in Microsoft 365 (Word, Excel, PowerPoint, Outlook, SharePoint, Teams) and external platforms such as Workiva, Diligent, LRN and Docusign. Exceptional organizational, analytical, and written communication skills with the ability to handle sensitive and confidential information with discretion. The pay transparency range for this role is listed below. The hiring range will vary based on factors such as experience, skills, location and market conditions. Additionally, employees may be eligible for annual and long-term incentives as part of their overall compensation package. Pay Range $73,600 — $110,400 USD Employees may be eligible for annual and long-term incentives as part of their overall compensation package, depending on role, location, and eligibility. Benefits and programs may include: Health & Wellness Time Off to Recharge Financial Well-being Life & Family Support Volunteer and Community Initiatives Learning & Development Exclusive Perks Please review our Applicant Privacy Notice to learn how we collect, use, and protect your personal information in connection with the application process.

Location: Serbia Who we are: Action1 is an autonomous endpoint management platform trusted by many Fortune 500 companies. Cloud-native, infinitely scalable, highly secure, and configurable in minutes, it just works—and is always free for the first 200 endpoints, with no functional limitations. By pioneering autonomous OS and third-party patching, peer-to-peer patch distribution, and real-time vulnerability assessment without requiring a VPN, Action1 eliminates routine IT labor, helps prevent ransomware and other security risks, and protects the digital employee experience. In 2025, Action1 was recognized by the Inc. 5000 as the fastest-growing private software company in America. Action1 is founder-led by Alex Vovk and Mike Walters, entrepreneurs who previously founded Netwrix, a multibillion-dollar cybersecurity company. The Role We are looking for a Product Security Engineer to join the team responsible for securing Action1’s multi-tenant SaaS platform. In this role, you will work closely with engineering, product, and security teams to identify risks early, support vulnerability handling, strengthen secure development practices, and make product security practical, clear, and actionable. This is a hands-on role for someone who understands both software engineering and cybersecurity, enjoys working directly with developers, and wants to build security into the product without slowing teams down unnecessarily. What you'll do: Support Product Security Incident Response Team (PSIRT) and vulnerability-handling activities Validate, triage, track, and coordinate security reports Provide practical remediation guidance to engineering teams Help validate security fixes and reduce product security risks Review code, APIs, and system architecture to identify security issues early Conduct threat modeling and security design reviews Improve security automation within engineering workflows Support SAST, SCA, secrets scanning, and other security controls Maintain software bills of materials (SBOMs), dependency visibility, and remediation follow-up Support security assessments, vulnerability assessments, and penetration testing Maintain vulnerability-handling playbooks, product security procedures, and incident response runbooks Requirements What we are looking for: 3+ years of experience in product security, application security, DevSecOps, or a related cybersecurity field Strong software engineering background and the ability to work effectively with engineering teams Understanding of application, API, infrastructure, and software supply chain security risks Experience applying cloud security concepts and practices Understanding of identity and access management, network security, logging, monitoring, and secure cloud architecture patterns Familiarity with vulnerability management, incident response, security assessments, and secure software development lifecycle practices Experience with threat modeling and security design reviews Strong communication skills, including professional communication with external security researchers and vendors Ability to work independently and collaboratively in a fast-moving environment Nice to have: Genuine interest in cybersecurity and motivation to grow as a product security expert Hands-on experience with AWS security controls, best practices, and architecture patterns Hands-on experience with C++ or JavaScript Experience with security testing and automation using scripts, APIs, CI/CD pipelines, or specialized tools Experience conducting threat modeling for SaaS, API, cloud, or on-premises product components Experience with SBOM generation, dependency visibility, or software supply chain security Benefits What we offer: A fully remote work environment The opportunity to work on a real-world security product used by IT and security teams High ownership and a direct impact on product security practices Close collaboration with engineering, product, and security teams A fast-growing software company with low bureaucracy and practical decision-making The opportunity to improve security processes, automation, and engineering workflows A supportive team that values clear thinking, ownership, and continuous learning