Вакансии

Location: PL Workplace: remote Overview: Infrastructure engineering with security embedded across the entire technology stack, including CI/CD, Kubernetes, cloud environments, secrets management, and access control. Key responsibilities: Core Responsibilities Integrate security checks into CI/CD pipelines, including dependency, container image, Infrastructure as Code (IaC), and secret scanning Harden servers, Kubernetes clusters, and cloud environments in accordance with CIS benchmarks Manage secrets, certificates, and the PKI lifecycle using Vault Manage access control (SSO, IAM, least privilege) and conduct regular access reviews Track and remediate vulnerabilities, coordinating patching activities across development and infrastructure teams Support security incident investigations, incident response, audits, and compliance activities Enforce Kubernetes runtime and policy security, including RBAC, network policies, Pod Security Standards (PSS), and Kyverno/OPA Infrastructure Responsibilities Set up and maintain production and staging infrastructure, including updates and incident resolution Improve infrastructure setup and maintenance processes Support and develop GitLab CI pipelines Contribute to the design of complex IT systems Collaborate with product development teams and stakeholders Handle monitoring events, including periodic day and night on-call duties Required Experience: 3+years of experience as a System Engineer, SRE, or DevOps Engineer Solid Linux administration and troubleshooting skills Experience with configuration management tools such as Ansible, SaltStack, Terraform, or Pulumi Experience with Kubernetes and Helm Experience configuring GitLab CI/CD pipelines Experience with Anti-DDoS solutions, WAF, and WAAP (Cloudflare, Fastly, Akamai, etc.) Experience with monitoring tools (Prometheus stack, Zabbix) Strong understanding of information security fundamentals, including least privilege, defense in depth, network security, and TLS/PKI Experience with secrets management solutions such as HashiCorp Vault or similar Strong problem-solving skills Higher technical education English level B1+ and strong command of Russian Main Advantages Private health insurance Sports benefits Comprehensive Mental Health Program Free English lessons (online) Local language courses Paid time off Maternity leave support Referral program rewards Upskilling, internal workshops, and participation in professional conferences and corporate events

Location: Москва Workplace: Гибридный О компании В команду центра целевого маркетинга и управления базой (B2B) мы ищем менеджера продукта, которому предстоит формировать аналитический профиль клиента корпоративного бизнеса МТС Обязанности отвечать за полный цикл построения аналитического профиля клиента: от сбора требований до внедрения; формировать и управлять бэклогом задач для IT-команды, определять приоритеты показателей совместно с бизнес-функциями (продажи, продукты, CVM) на основе их потребностей в сегментации; обеспечивать наполнение профиля релевантными данными для сегментации на разных уровнях: холдинг, компания, пользователь, ЛПР, определять источники данных, обеспечивать их корректность и качество; участвовать в разработке стратегии управления корпоративной базой клиентов через канал CVM для увеличения нового дохода, доли перекрестных продаж (доля ИНН с продуктами) и срока жизни клиента (LTV) на основе данных аналитического профиля; планировать целевые метрики продукта; выстраивать процесс использования аналитического профиля для принятия бизнес-решений, организовывать и вести рабочие группы по согласованию методологий расчета метрик между продажами, продуктами и аналитикой. Требования опыт управления продуктом от 3-х лет; опыт разработки и реализации стратегии продукта; понимание бизнес-процессов корпоративных клиентов и умение выстраивать эффективные коммуникации с B2B-заказчиками; навыки работы с аналитикой, гипотезами и MVP; глубокое понимание данных: концепции аналитики, работа с метриками, понимание архитектуры данных; навык управления бэклогом и взаимодействия с кросс-функциональными командами разработки; стратегическое видение: понимание влияния данных на стратегию удержания клиентов, кросс-продажи и рост выручки. Условия ДМС с первого месяца работы, включая стоматологию. А еще оплачиваем 50% стоимости полиса ДМС для родственников; страхование от несчастных случаев с 1 месяца работы. Материальная помощь в сложных жизненных ситуациях; прием врачей общей практики и массаж в офисе. Консультация психологов и программа поддержки сотрудников; отпуск 28 календарных дней + 3 дня за ненормированный рабочий день; компенсация расходов на выбор сотрудника, например, на спорт, ипотеку или питание. Специальные предложения от партнеров и скидки от продуктов экосистемы МТС; мобильная связь за счет компании и льготные тарифы для близких; подписка на онлайн-кинотеатр KION, сервис МТС Музыка, книжный сервис Строки от МТС, безлимитные мессенджеры и соцсети; cобственный корпоративный университет, онлайн-библиотека и оплачиваемое внешнее обучения для карьерного развития.

Location: Foster City, CA Workplace: Hybrid Replit is the agentic software creation platform that enables anyone to build applications using natural language. With millions of users worldwide, Replit is democratizing software development by removing traditional barriers to application creation. About the role: We are looking for a SOC Engineer to join our Security Operations team and help defend a fast-moving, cloud-native AI vibe-coding platform. In this role, your primary mandate will be building and evolving our security data lake, engineering reliable security telemetry, and owning high-fidelity detection engineering end-to-end. You will unify cloud, identity, endpoint, and application telemetry, staying on top of emerging threats to rapidly build and tune detections across our environment. Alongside this data and detection mandate, you will support incident investigations as needed to translate real-world threats into stronger automated defenses. This is a hands-on engineering role requiring strong technical depth, understanding of modern software engineering and CI/CD systems, familiarity with cloud-native infrastructure (especially GCP), and expertise in security data pipelines and detection workflows. What You'll Do: - Security Data Lake & Detection Engineering: Architect, expand, and maintain our security data lake while designing, testing, and tuning custom detection rules to maximize threat coverage and minimize noise across our cloud-native stack. - Threat Awareness & Rapid Assessment: Continuously monitor emerging threats (0-days, bad actor activity, public exploitation campaigns, bug bounty reports, customer security issues) and rapidly assess their applicability to Replit's infrastructure, SaaS services, internal tools, and platform components. - Investigation & Impact Analysis: Conduct targeted investigations to determine impact, analyze logs, telemetry, and system behaviors using SIEM, metrics, and Cloud Logging and identify gaps in detection/visibility. Required Skills & Experience: - Building and evolving the security data lake, unifying cloud, identity, endpoint, and application telemetry; hands-on experience with SIEM, Cloud Logging, and log-based investigation workflows. - Engineering reliable security infrastructure and automation using infrastructure-as-code to close visibility gaps and perform log-based investigations. - Proven expertise in detection engineering end-to-end, specifically developing, testing, and tuning custom detection rules to maximize threat coverage and reduce noise across complex environments. - Strong understanding of software engineering fundamentals (code structure, build systems, dependencies, package ecosystems). - Understanding of CI/CD pipelines and DevOps workflows. - Solid knowledge of cloud architecture, especially Google Cloud Platform (GCP) services in modern cloud-native deployments. - Familiarity with SaaS architectures, identity systems, and integration patterns. Bonus Qualifications: - Experience with threat intelligence, security research, or vulnerability analysis. - Familiarity with Kubernetes, containers, serverless infrastructure, or modern distributed systems. - Ability to write scripts or small tools for investigation or automation (Python, Go, Bash). - Experience working with bug bounty programs or coordinated vulnerability disclosure workflows. - Experience in fast-paced, cloud-native, or AI/ML-driven environments. Full-Time Employee Benefits Include: 💰 Competitive Salary & Equity 💹 401(k) Program with a 4% match (US Only) ⚕️ Health, Dental, Vision and Life Insurance 🩼 Short Term and Long Term Disability 🚼 Paid Parental, Medical, Caregiver Leave 🏝 Flexible Time Off (FTO) + Holidays 🚗 Commuter Benefits (In-Office & US Only) 📱 Monthly Wellness Stipend 🧑‍💻 Autonomous Work Environment 🖥 In Office Set-Up Reimbursement (In-Office Only) 🚀 Quarterly Team Gatherings ☕ In Office Amenities (In-Office Only) Want to learn more about what we are up to? - Self-driving Company https://replit.com/blog/self-driving-company - Replit Agent at Scale https://replit.com/blog/evaluating-and-improving-agent-at-scale - AI Adoption https://replit.com/blog/ai-adoption - Build Open-Source Apps https://replit.com/build/open-source-app-builder   Interviewing + Culture at Replit - Operating Principles https://blog.replit.com/operating-principles - Reasons not to work at Replit https://blog.replit.com/reasons-not-to-join-replit To achieve our mission of making programming more accessible around the world, we need our team to be representative of the world. We welcome your unique perspective and experiences in shaping this product. We encourage people from all kinds of backgrounds to apply, including and especially candidates from underrepresented and non-traditional backgrounds.

Location: Riyadh, Saudi Arabia Role Summary The SOC L2 Specialist delivers SMC's managed security operations service. The role handles escalated alerts from L1, leads incident response, and supervises day-to-day SOC activity. Key Responsibilities Investigate and triage alerts escalated from L1 analysts, and confirm or close them with clear reasoning Lead incident response: containment, eradication, recovery and root cause analysis Perform deep-dive analysis of logs, network traffic, endpoint telemetry and email threats Tune SIEM correlation rules and use cases to reduce false positives Run threat hunting based on threat intelligence and MITRE ATT&CK Create and maintain incident response playbooks and SOAR workflows Supervise and mentor L1 analysts, review their work, and manage shift handovers Write incident reports and present findings to technical and management stakeholders Report incidents in line with NCA requirements and SMC's escalation matrix Track SOC KPIs such as MTTD, MTTR and SLA compliance. Requirements Bachelor's degree in Cybersecurity, Computer Science, IT or related field 4–6 years in a SOC, with at least 2 years at L2 level Strong hands-on SIEM experience (Splunk, IBM QRadar, Microsoft Sentinel, or similar) Experience with EDR/XDR (CrowdStrike, Defender for Endpoint, SentinelOne) and SOAR platforms Solid knowledge of MITRE ATT&CK, the cyber kill chain, malware analysis basics and network protocols Experience in an enterprise or managed SOC (MSSP) environment Saudi national, fluent in Arabic and English Willing to support on-call or shift rotation if required Preferred Certifications GCIH, GCIA, CySA+, CEH, Splunk Core Certified Power User, Microsoft SC-200, IBM QRadar certification

Location: Remote US At Affirm, we exist for the moments that matter—giving people a clear, predictable way to pay over time, with no hidden fees, no surprises, and no tradeoffs on what matters most. Affirm is reinventing credit to make it more honest and transparent, giving consumers flexible ways to pay without hidden fees or compounding interest. After building a market-leading BNPL network with 30M+ customers, $50B+ GMV and 500k merchants, we’re entering our next ambitious chapter: transforming DTC shopping. At the center of this vision is the Affirm Marketplace, a rapidly scaling, high-leverage platform that connects consumers with merchants in a dynamic, two-sided ecosystem. About the Team The Risk & Analytics team makes crucial decisions that direct Affirm’s business strategy. Our team designs and runs experiments to decide which product features to launch and which marketing campaigns to fund. We analyze performance not just to report on it, but to determine where to invest resources for maximum impact through building tools and analytical frameworks. We take ownership of the entire analytical lifecycle, from initial question to final business decision, ensuring Affirm grows efficiently and intelligently. After building a market-leading BNPL network, we’re entering our next ambitious chapter: transforming DTC shopping. At the center of this vision is the Affirm Marketplace, a rapidly scaling, high-leverage platform that connects consumers with merchants in a dynamic, two-sided ecosystem. We’re looking for a Marketplace Analytics Lead to help architect and optimize the economic engine of our marketplace, balancing supply, demand, pricing, and user experience to drive sustainable growth. This is a high-impact IC role at the intersection of product, growth, and marketplace strategy. What You’ll Do Own marketplace monetization and economics, balancing merchant supply, consumer demand, and pricing to drive engagement, conversion, and profitability Monitor marketplace performance and adjust strategies based on engagement, relevance, merchant outcomes, LTV, and overall health Build and maintain dashboards and reporting to track key Marketplace KPIs and enable data-driven decisions Partner with Sales, Client Success, and Marketing to grow marketplace partners and increase merchant value Collaborate with Product and Engineering to improve the effectiveness, competitiveness, and relevance of Marketplace inventory and offers Analyze supply-side dynamics, including incentives, pricing, and placement, to understand elasticity and drive incremental GMV Lead analyses and experiments to test and refine new placements and optimize marketplace performance Conduct loan-level profitability analyses to ensure offers align with credit and financial goals while balancing consumer and merchant value Evaluate affiliate portfolio performance by integrating network data, identifying trends, and assessing the incremental impact of merchant-funded incentives What We’re Looking For 7+ years in analytics, with experience in marketplaces, ads/affiliate ecosystems, or two-sided platforms Strong intuition for supply-demand dynamics, pricing, and marketplace tradeoffs Experience with data tools such as SQL, Python, DBT, Sigma; comfortable managing ETLs and working with engineering teams to optimize data pipelines Strong curiosity and bias toward leveraging AI tools to accelerate analysis, automate workflows, and increase personal and team productivity Experience working cross-functionally with Product, GTM, and Engineering High ownership, strong judgment, and a bias toward action Pay Grade - M Equity Grade - 5 Employees new to Affirm typically come in at the start of the pay range. Affirm focuses on providing a simple and transparent pay structure which is based on a variety of factors, including location, experience and job-related skills. Base pay is part of a total compensation package that may include monthly stipends for health, wellness and tech spending, and benefits (including 100% subsidized medical coverage, dental and vision for you and your dependents). In addition, the employees may be eligible for equity rewards offered by Affirm Holdings, Inc. (parent company). CAN base pay range per year: $145,000 - $205,000 Additional benefits include: • Type of employment: Contract of Employment • Flexible Spending Wallets for tech, food and lifestyle • Away Days - wellness days to take off work and recharge • Learning & Development programs • Parental benefits • Employee Resource & Community Groups • This role is eligible for creative tax benefits, subject to applicable law and company policy Location - Remote Canada This remote role is open only to candidates residing in Alberta, British Columbia, Manitoba, New Brunswick, Newfoundland and Labrador, Nova Scotia, Ontario, Prince Edward Island, or Saskatchewan. LI-Remote Remote-first with flexibility built in Affirm is proud to be a remote-first company. Most roles can be done from almost anywhere within the country of employment. Some positions may occasionally require in-person work at an Affirm office, and a few are office-based due to the nature of the work. All new hires will be invited to attend an in-person onboarding experience. Benefits designed for you Our benefits reflect our commitment to care, transparency, and flexibility. Here are a few highlights: Health coverage at no cost: We cover 100% of premiums for employees and their dependents. Spending stipends: Monthly stipends support your tech setup, and the ability to choose health and wellness options that are right for you. Time off to recharge: Flexible time off and generous holiday calendars help you rest when you need to. Own a piece of what you build: Our employee stock purchase plan (ESPP) lets you buy Affirm stock at a discount. We’re committed to providing an inclusive interview process, including accommodations for candidates with disabilities. If you need support, we’re happy to help. For positions based in San Francisco or Los Angeles: Affirm considers qualified applicants with arrest and conviction records, as required by law. By clicking "Submit Application," you acknowledge that you have read Affirm's Global Candidate Privacy Notice and consent to the use of your personal information as described.

Location: Remote US At Affirm, we exist for the moments that matter—giving people a clear, predictable way to pay over time, with no hidden fees, no surprises, and no tradeoffs on what matters most. About the Brand & Communications Team The Brand & Communications team crafts and shares Affirm’s story to build trust, elevate our brand, and drive business impact. The Brand Creative team leads conceptually bold, strategically grounded work across channels—from owned content to paid media. The PR & Communications team handles internal and external messaging, ensuring our values show up in media, exec visibility, and employee storytelling. Together, we manage brand strategy, content, campaigns, media relations, and communications. We connect meaningfully with customers, partners, and the public while championing Affirm’s mission. About the Role We want more people to understand what makes Affirm different and choose us with confidence. To make that happen, we need a rigorous understanding of our audiences and a clear, measurable view of whether our story is resonating. The Senior Manager, Narrative Intelligence will build the analytical intelligence function behind Affirm’s Brand & Communications strategy. You’ll connect original research, Affirm’s first-party data, brand and media measurement, behavioral signals, and external datasets to understand our audiences, identify what shapes their perceptions, and find where our story can connect more meaningfully. You’ll turn a complex mix of data into a clear point of view that shapes Affirm’s narrative and the work we put into the world. Then you’ll close the loop: defining how we measure narrative performance, determining what is and isn’t working, and identifying what we should do differently as a result. The ambition is to make intelligence an operating system for the work—not a report that arrives after it—and set a new standard for how Brand & Communications uses data to make decisions What You’ll Do Build an evidence-based understanding of our priority audiences. Lead research and analysis into who they are, what they value, how they behave, what they believe about Affirm and the category, and what could change those beliefs. Use segmentation, surveys, behavioral data, and other analytical approaches to identify the variables that matter most. Develop Affirm’s narrative measurement framework. Define the metrics, methodologies, and baselines we use to evaluate narrative performance across audiences, channels, and time horizons. Partner with Analytics, User Research, Marketing, and other teams to strengthen attribution, experimentation, and our understanding of how narrative and reputation contribute to business outcomes. Build the team’s intelligence system. Create the tools, dashboards, analytical standards, and shared knowledge base that make audience intelligence and performance data easy to find, interpret, and apply. Help the broader team become more analytically confident over time. Own the narrative feedback loop. Build a continuous, data-informed picture of how Affirm’s story is landing. Diagnose what is breaking through, what is being misunderstood or ignored, where perceptions are shifting, and what the evidence suggests we should do next. Connect the evidence. Bring together qualitative research, surveys, brand health, media and social intelligence, search and cultural signals, campaign performance, behavioral data, and Affirm’s own customer and business data. Draw on credible external research about culture, commerce, credit, and the forces shaping how people think and behave. Find patterns, test relationships, surface contradictions, and assess the strength of the evidence. Turn analysis into narrative strategy. Translate findings into clear implications for Affirm’s positioning, messaging, campaigns, content, and communications planning. Partner with the Head of Story to build and evolve Affirm’s narrative based on what the data tells us. Design studies that answer consequential questions. Turn ambiguous business and communications questions into testable hypotheses and rigorous research. Choose the right mix of surveys, experiments, observational analysis, and qualitative inquiry to produce evidence the team can act on. What We Look For You’re driven to understand people through data. You’re curious about the beliefs and motivations beneath human behavior and equally interested in whether the evidence supports the story being told. You’ve spent 12+ years in consumer analytics, audience insights, data science, measurement, strategic intelligence, quantitative research, or a related field. You’ve used analysis to shape brand, communications, marketing, product, or creative strategy. You’re highly fluent in quantitative research and analysis. You’re comfortable with survey design, segmentation, statistical inference, experimentation, measurement design, and large or imperfect datasets. You work directly with data, using tools such as SQL, statistical platforms, data visualization, or business intelligence tools. You know how to build a complete picture from different forms of evidence. You can integrate qualitative insight and quantitative analysis, account for the limits of each source, and translate concepts such as trust, relevance, reputation, and narrative resonance into thoughtful analytical frameworks. You turn analysis into decisions. You can take a messy body of evidence, determine which signals matter, and explain what they mean for the narrative, the work, and the choices in front of us. Your conclusions are clear, memorable, and useful to both analytical and creative audiences. You work well across analytical, strategic, and creative disciplines. You can collaborate credibly with data scientists and researchers, then translate the work for writers, strategists, executives, and communications leaders. You’d rather discover something inconvenient than confirm what everyone already believes. You test assumptions, challenge weak evidence, and follow the data—even when it complicates the current story. Pay Grade - N Equity Grade - 10 Employees new to Affirm typically come in at the start of the pay range . Affirm focuses on providing a simple and transparent pay structure which is based on a variety of factors, including location, experience and job-related skills. Base pay is part of a total compensation package that may include equity rewards, monthly stipends for health, wellness and tech spending, and benefits (including 100% subsidized medical coverage, dental and vision for you and your dependents.) USA base pay range (CA, WA, NY, NJ, CT) per year: $195,000 - $255,000 USA base pay range (all other U.S. states) per year: $173,000 - $213,000 Please note that visa sponsorship is not available for this position. #LI-Remote Remote-first with flexibility built in Affirm is proud to be a remote-first company. Most roles can be done from almost anywhere within the country of employment. Some positions may occasionally require in-person work at an Affirm office, and a few are office-based due to the nature of the work. All new hires will be invited to attend an in-person onboarding experience. Benefits designed for you Our benefits reflect our commitment to care, transparency, and flexibility. Here are a few highlights: Health coverage at no cost: We cover 100% of premiums for employees and their dependents. Spending stipends: Monthly stipends support your tech setup, and the ability to choose health and wellness options that are right for you. Time off to recharge: Flexible time off and generous holiday calendars help you rest when you need to. Own a piece of what you build: Our employee stock purchase plan (ESPP) lets you buy Affirm stock at a discount. We’re committed to providing an inclusive interview process, including accommodations for candidates with disabilities. If you need support, we’re happy to help. For positions based in San Francisco or Los Angeles: Affirm considers qualified applicants with arrest and conviction records, as required by law. By clicking "Submit Application," you acknowledge that you have read Affirm's Global Candidate Privacy Notice and consent to the use of your personal information as described.

Location: New York; San Francisco Workplace: Hybrid ABOUT ALCHEMY Alchemy is the Web3 infrastructure and developer platform that powers millions of users and the world’s most innovative blockchain applications. From enabling $1+ trillion in financial transactions worldwide to scaling L2s and enabling DeFi, Alchemy provides the infrastructure and tools developers need to build reliable, scalable, and accessible experiences. Trusted by companies like JPMorgan, Stripe, Visa, Franklin Templeton, Nike, and backed by a16z, Coatue, Silver Lake, Lightspeed, and Stanford University, Alchemy is building the foundational layer for a decentralized and AI-enabled Web3 ecosystem. For more information, visit alchemy.com http://alchemy.com.   THE ROLE We're looking for a Security Operations Engineer to improve how Alchemy detects threats, investigates incidents, and reduces operational security risk. This is a hands-on individual-contributor role with no people-management responsibilities. You'll investigate suspicious activity and build the systems that make the next investigation faster and more reliable. AI-assisted engineering and investigation should be part of your daily work: connecting evidence, developing detections, building response workflows, and checking the results against source data. You'll also help the team get better at this work. Through shared tooling, code review, pairing, and practical documentation, you'll give teammates capabilities they can use independently.   WHAT YOU WILL DO - Detect and investigate threats. Triage alerts, hunt for suspicious activity, and investigate across cloud infrastructure, corporate systems, identity, endpoints, and production environments. Establish what happened from evidence and communicate uncertainty clearly. - Engineer detection coverage. Build and tune detections, onboard useful telemetry, and maintain reliable log pipelines. Test rules against representative attacks and benign activity; address missing coverage and noisy alerts. - Respond to incidents. Participate in the security on-call rotation and incident response, including scoping, containment, recovery, and post-incident improvements. Preserve evidence and coordinate changes with system owners. - Build AI-assisted security workflows. Automate evidence collection, alert enrichment, investigation timelines, and response preparation. Connect agents to approved tools and data sources so they can complete bounded tasks with traceable results. - Verify before trusting. Evaluate AI-assisted workflows against known cases and adversarial inputs. Require evidence for conclusions, test false-positive and missed-threat behavior, and keep human approval for disruptive containment actions. - Reduce operational exposure. Partner with Infrastructure and IT on vulnerability remediation, cloud and host hardening, identity controls, and attack-surface monitoring. Prioritize findings by exposure and impact, then verify remediation. - Help secure agent operations. Work with platform and product-security partners on operational controls for agent identities, credentials, tool access, and audit logging. Investigate misuse and build detections for suspicious agent behavior. - Improve how the team works. Share reusable code, investigation skills, runbooks, and evaluation cases. Pair with teammates, review automation, and teach approaches they can apply to their own investigations. - Measure defensive outcomes. Track detection coverage, alert quality, investigation effort, response time, and remediation progress. Use those measures to decide what to improve next.   WHAT WE ARE LOOKING FOR - Hands-on security operations experience spanning detection engineering, threat hunting, and incident response. - Strong scripting and software-building ability, especially Python; experience with APIs, version control, tests, and operating automation in production. - Experience with a SIEM such as Panther, Splunk, or an equivalent platform, including detection logic and log analysis. - Working knowledge of cloud security, identity, endpoint telemetry, networking, and Linux systems. Ability to investigate across system boundaries. - Evidence of building and using AI-assisted tools in security or adjacent engineering work. You can show how you validate outputs, handle failures, and protect sensitive information. - Sound incident judgment: you can separate a hypothesis from a finding, preserve evidence, and choose when to escalate or contain. - A record of making teammates more effective through tools, mentoring, code review, or documentation, without needing management authority. - Clear written communication and the willingness to own both urgent investigations and the follow-through that prevents repeat incidents.   HELPFUL EXPERIENCE - AWS, Kubernetes, bare-metal infrastructure, detection-as-code, or SOAR workflows. - Digital forensics, threat intelligence, or testing detections through attack simulation. - Securing AI agents and tool integrations, including prompt injection, credential misuse, and data-exfiltration risks. - Blockchain infrastructure or other environments with sensitive keys and high-impact production systems.   WHAT SUCCESS LOOKS LIKE - Investigations reach evidence-backed conclusions faster. Detection coverage improves, repeat noise declines, and remediation is verified. The team adopts tools and workflows you've built, with clear limits on what agents may do and a tested path for handling failures.   BENEFITS & PERKS 🏥 Private Health Insurance 💪 Gym Reimbursement 🚅 Commuter Benefits 🌴 Flexible Time Off 🥙 In-Office Group Meals 🧠 Learning & Development Stipend 🌎 Company Sponsored Conferences & Events 🎧 Books & Audiobook subscription with Bookster https://landing.bookster.ro/

Location: Riyadh, KSA Workplace: onsite Tabby creates financial freedom in the way people shop, earn and save by reshaping their relationship with money. Over 25 million users choose Tabby to stay in control of their spending and make the most out of their money. The company’s flagship offering allows shoppers to split their payments online and in-store with no interest or fees. Over 70,000 global brands and small businesses, including Amazon, Noon, IKEA, and SHEIN use Tabby to accelerate growth and gain loyal customers by offering easy and flexible payments online and in stores. Tabby generates over $18 billion in annual transaction volume for its partner brands and is the highest-rated, most-reviewed, largest, and fastest-growing FinTech in the GCC region. Tabby launched in 2019 and has since raised +$1 billion in equity and debt funding from global and regional investors, and is now valued at $6,5 billion. As Information Security Engineer , you’ll play a key part in monitoring and defending our infrastructure, applications, and cloud environments from cyber threats. You’ll lead incident response efforts, develop and tune detection rules, investigate security events, and collaborate with cross-functional teams to strengthen our security posture. Key Responsibilities Security Monitoring & Detection Monitor and analyze logs and alerts from a wide range of sources including firewalls, intrusion detection/prevention systems (IDS/IPS), endpoints, servers, and cloud platforms. Perform correlation of events from multiple sources to identify advanced threats and unusual patterns of behavior. Fine-tune alert thresholds and detection logic to reduce false positives and improve signal-to-noise ratio. Maintain dashboards and reporting to provide real-time visibility into security posture. Incident Response & Investigation Serve as a frontline responder for security incidents, managing incidents through their lifecycle – detection, containment, eradication, recovery, and lessons learned. Coordinate with internal stakeholders and external vendors during high-severity incidents or data breaches. Perform root cause analysis and forensic investigations using endpoint and network-based artifacts. Maintain detailed incident documentation and contribute to post-mortem analysis and reports. Threat Intelligence & Detection Rule Development Research emerging threats and trends. Contribute to the creation and tuning of detection rules, threat-hunting queries, and use cases across multiple platforms including cloud environments. Maintaining CTI Platform along with the integration of the CTI feeds with the security controls to have active CTI driven detections. Collaboration and Communication Communicate effectively with cross-functional teams including IT, DevOps, Risk, and Compliance during incidents and investigations. Provide concise and clear updates during incident handling to stakeholders and management. Mentor junior analysts and assist in training efforts within the SOC team. Skills, Knowledge and Expertise 3–4 years of experience in a SOC or cybersecurity operations role, ideally in a fast-paced fintech or enterprise environment. Strong knowledge of security best practices, including incident handling, alert triage, log analysis, and threat modeling. Understanding of online technologies, REST APIs, microservices, and modern application architectures. Experience working in a culturally diverse and collaborative environment. Familiarity with DLP, AV, and anti-malware systems from an operational monitoring perspective. Experience with phishing detection, user behavior analytics, and security awareness campaigns. Security certifications such as Security+, CySA+, eCIR, eCTHPv2, GCIA, or GMON (preferred but not required). Strong communication skills, especially for coordinating incident response and writing clear incident reports. Experience with SIEM platforms , SOAR tools , EDR/XDR , and Threat Intelligence platforms . Familiarity with cloud environments and cloud-native logging and monitoring tools. Scripting experience (e.g., Python ) to automate tasks and improve SOC efficiency.

Location: Москва Workplace: Гибридный Обязанности самостоятельно вести регулярный цикл NPS: анализировать динамику, причины изменений, ключевые факторы и формировать выводы для бизнеса; проводить ad-hoc исследования клиентского опыта и искать новые точки влияния на NPS и бизнес-показатели, формировать и проверять гипотезы; анализировать факторы, влияющие на клиентский опыт, оценивать эффект изменений, инициатив и пилотов; готовить регулярную и разовую аналитическую отчетность для директора департамента и руководства компании, включая материалы уровня CEO / CEO-1; поддерживать смежные CX-задачи департамента: анализ клиентских путей (CJ), автоматизацию аналитики и отчетности, исследования; собирать данные и фактуру от разных подразделений, сводить их в целостную картину и переводить в понятные управленческие выводы и рекомендации; координировать кросс-функциональные задачи и взаимодействовать с аналитиками, продуктами, регионами, техническими и бизнес-командами; развивать инструменты мониторинга и регулярной отчетности по CX / NPS, сокращая время от появления сигнала до аналитического вывода. Требования опыт самостоятельного ведения аналитических или проектных задач от постановки вопроса до итогового вывода и презентации результата; сильное аналитическое мышление: умение находить причины изменений, формулировать гипотезы, работать с неоднозначными и разрозненными данными; понимание метрик клиентского опыта и принципов их применения: NPS, tNPS, CSAT / CSI, CES и смежных показателей; умение связывать CX-метрики с продуктовыми, техническими и бизнес-показателями и объяснять взаимосвязи понятным для бизнеса языком; понимание базовых методов статистического анализа и проверки гипотез, принципов A/B- и alpha/beta-тестирования; уверенные навыки подготовки аналитических и управленческих презентаций, способность кратко и структурно доносить выводы до руководителей; опыт взаимодействия с несколькими командами и управления межфункциональными зависимостями; умение формулировать требования и задачи для аналитиков и смежных команд, контролировать качество и сроки результата; знание SQL и опыт работы с BI-инструментами будут полезны для самостоятельной работы с данными; Python — дополнительное преимущество. Условия программа ДМС с первого месяца работы - это 100% покрытие расходов в частных клиниках, включая стоматологию. Застраховать близких родственников можно со скидкой 50%. Для любителей путешествий - страховка в поездках за границу. А еще есть страхование жизни; очное и онлайн-обучение в Корпоративном университете, у внешних провайдеров, если это полезно для работы, обмен опытом во внутренних профессиональных сообществах, а также доступ к онлайн-библиотеке в полезными книгами и периодикой; оплачиваемые выходные на значимые события в жизни сотрудника; материальная помощь в сложных жизненных ситуациях; корпоративная мобильная связь + интернет, а так же единая подписка МТС Premium (онлайн кинотеатр KION, сервис МТС Music, МТС Строки и т.д.); предложения от партнёров для путешествий, развлечений и занятий спортом; возможность участия в волонтерских программах: мы организуем благотворительные ярмарки, образовательные проекты для детей, конкурсы социальных проектов и экологические проекты; внутренняя спортивная программа «В движении»: забеги, марафоны, турниры по разным видам спорта, медитации и занятия на баланс. Голосуй за МТС в Рейтинге работодателей hh.ru : https://rating.hh.ru/poll Ищи нас в блоке «Технологии и цифровые решения» — направление «Телекоммуникации, связь».

Location: Warsaw, PL We bring startups and disruptive tech companies to the local market, offering engineers the opportunity to work on innovative, high-impact products. Join us and become a member of their R&D team while we take care of employment, HR support, a benefits package, and an enjoyable work environment. We are building a local Polish team for a customer who is a US-based B2B technology company. ‍ They develop an AI-powered skills assessment and workforce development platform. It helps enterprises assess employees’ and candidates’ capabilities, identify skill gaps, and guide development across areas such as AI, data, and technology. Companies use these insights to support hiring, upskilling, and workforce planning. We are looking for a Security Operations Specialist to take ownership of information security operations and collaborate closely with the engineering team to ensure robust security practices are in place. ‍ Please note: ‍ 📌 This is a 6-month project role, with a potential possibility of extention. 📌 The role requires working closely with the US team, with working hours overlapping until 10:00 PM Warsaw time. ‍ Own vulnerability management across cloud infrastructure, applications, APIs, dependencies, containers, secrets, and infrastructure-as-code where applicable; Coordinate penetration testing engagements and drive the remediation of identified findings; Maintain security documentation, metrics, remediation records, and technical response playbooks; Review and improve security processes and controls across the entire engineering organization; Support cross-functional security initiatives, technical readiness efforts, and transitions involving systems, tooling, and controls; Maintain cloud security standards and align processes with security frameworks such as SOC 2 and NIST; Partner with technical teams on security monitoring, logging, identity and access, secure configuration, incident response, and technical risk reduction. Proven experience in security monitoring and vulnerability management; Experience coordinating penetration testing and following up on findings; Practical experience with Cloud Security and industry frameworks such as SOC 2 and NIST; Proactive approach with the ability to work independently, prioritize tasks, and deliver results in a lean team environment. Hands-on experience using AI tools to enhance security operations and streamline workflows. ‍ ‍ ‍ 📌 This is a 6-month project role, with a potential possibility of extention. 📌 The role requires working closely with the US team, with working hours overlapping until 10:00 PM Warsaw time. At On The Spot, we’re creating a workplace people would want to stay in: supportive, well-organized, and fair in terms of conditions and benefits. ‍ We’ll share more about our benefit package during the interviews. In the meantime, you can always check our Glassdoor reviews .

Location: Remote (Ukraine) Workplace: remote ELEKS Information Security Office is looking for a Security Operations Supervisor in Lviv, Ternopil, Kyiv, or Ivano-Frankivsk. Security Operations Supervisor is responsible for designing, implementing and maintenance of ELEKS Security Operations Center (SOC) and related ISMS processes. Specifically, Security Operations Supervisor objective is to ensure efficient execution of Incident Management, Threat Intelligence, Vulnerability Management and Patch Management activities. REQUIREMENTS Working experience in architecture, design and implementation of security systems and countermeasures (e.g. SIEM, EDR, DLP, UEBA, IDS/IPS, vulnerability scanners, anti-virus and anti-malware, firewalls, encryption) Knowledge of Security Operation Center processes, ability to perform supervision of SOC and perform continuous improvement of its operations Working experience in planning and conducting of technical security audits. Knowledge of Information Security (IS) standards/frameworks (ISO 27001/2, SOC2, Cyber Essentials, PCI DSS, HiTrust), ability to establish IS processes in line with these standards Network architecture, security principles, technologies, and tools Detailed technical knowledge of Windows and UNIX operating systems Virtualization technologies and security Identity and access management principles and technologies Subnetting, DNS,DHCP, VPNs, VLANs, VoIP and other network routing methods Network and web related protocols (e.g., TCP/IP, UDP, IPSEC, HTTP, HTTPS, etc.) Solid knowledge of secure coding practices, application security and cryptography technologies, ethical hacking, threat modeling, secure SDLC process Solid knowledge of disaster recovery and business continuity planning Strong analytical and conceptual skills balanced by broad perspective on how security efforts to support realization of business goals and customer satisfaction Proven leadership capabilities and strong communication and interpersonal skills English – upper-intermediate or higher RESPONSIBILITIES Develop and maintain short- and long-term goals and objectives for ELEKS Security Operations Center aligned with Information Security goals Define activities and projects supporting continuous improvement of ELEKS Security Operations Center, addressing the IS gaps identified and enhancing ELEKS security overall Evaluate new technologies and processes that enhance security capabilities. Design, architect, test, analyze, evaluate and implement new security systems and processes Perform program and project management activities to ensure successful execution of ISMS projects assigned. Coordinate the development and review of ISMS policies relevant to SOC activities and other supporting documents, such as Hardening Baselines, IS standards/procedures Effectively inform stakeholders about the status of the ELEKS information security posture. Perform periodic security reporting (both: executive and technical) Coordinate handling of the information security incidents, coordinate investigation activities, communicate with clients and, if needed, escalate to ELEKS senior management, and contact authorities (Police, CERT-UA, etc.) Plan, control, and perform installation, configuration, technical support and administration of security systems and countermeasures (e.g. SIEM, EDR, DLP, UEBA, IDS/IPS, vulnerability scanners, anti-virus and anti-malware, firewalls, encryption) Supervise and perform system hardening, security testing, and vulnerability management Prevent, detect, investigate and respond to cyber threats for the organization’s assets Build and establish plans and controls to protect digital files and information systems against unauthorized access, modification and/or destruction Coordinate configuration, management and running the phishing simulation campaigns Plan, manage and optimize the capacity of ELEKS SOC Provide leadership, training and technical advice to SOC team. Identify/address training and career development needs, provide feedback and conduct performance assessment of subordinates Management of access rights for SOC by participation in approval, review, and removal of access rights (in case of specialist termination, role change and on a regular basis as per Access Control Policy) Resolve security incidents within the SOC team and, if necessary, perform disciplinary actions in conjunction with HR team

Workplace: Москва и Краснодар (гибрид/офис), другие города - удаленно MAGNIT TECH — технологичный драйвер одного из крупнейших ритейлеров страны. Мы создаём будущее: от решений в области автономной логистики с полностью автоматизированными распределительными центрами до исследований потенциала квантовых вычислений. Сейчас мы в поиске Инженера SOC L2 . О продукте Команда защищает современную облачную инфраструктуру компании: Linux, Kubernetes, контейнеры и облачные сервисы. Расследуем инциденты, проактивно ищем угрозы и наводим порядок в конфигурациях безопасности, чтобы инфраструктура работала без сбоев. Работаем с реальной продуктовой средой: собственная облачная платформа, Yandex Cloud, Cloud.ru, Kafka, PostgreSQL, Redis, Object Storage. Каждый инцидент — возможность разобраться, как система устроена изнутри, на уровне процессов, сетей и ядра. Формального опыта в SOC не требуется — нам интересны и инженеры DevOps, DevSecOps, SRE с сильной технической базой, которые хотят развиваться в Cloud Security, Threat Hunting и Incident Response. Для нас важнее практические инженерные навыки и системное мышление. Задачи Расследовать сложные и нетиповые инциденты в Linux, Kubernetes, контейнерной и облачной инфраструктуре; Проводить технический анализ и DFIR: процессы, сетевые соединения, системные журналы, артефакты компрометации; Проводить проактивный поиск угроз (Threat Hunting) на основе гипотез, IoC и техник MITRE ATT&CK; Выявлять векторы атак, находить первопричины инцидентов и давать технические рекомендации по устранению угроз; Расследовать инциденты в Kubernetes: Audit Logs, события, контейнеры, активность внутри кластера; Анализировать техники атак на Kubernetes и контейнеры по MITRE ATT&CK for Containers; Выявлять небезопасные конфигурации: RBAC, NetworkPolicy, Pod Security Standards, Secrets, SecurityContext, Admission Controllers; Анализировать защищённость облачных сервисов: Kafka, S3/Object Storage, PostgreSQL, Redis; Находить ошибки в конфигурациях IAM, сетевого доступа, аутентификации, авторизации, шифрования и управления секретами; Писать скрипты и инструменты для автоматизации расследований, сбора артефактов и проверки конфигураций; Разрабатывать сценарии обнаружения атак и методы проактивного поиска угроз; Исследовать новые техники атак на Linux, Kubernetes и облачные сервисы; Готовить техническую документацию, инструкции и сценарии расследований; Делиться экспертизой с командой и развивать процессы реагирования на инциденты. Требования Уверенное знание Linux: процессы, файловая система, права доступа, systemd, сетевой стек, системные журналы, механизмы аудита; Практический опыт работы с Kubernetes: kubectl, архитектура кластера, Pod, Deployment, DaemonSet, ServiceAccount, RBAC, NetworkPolicy, Secrets; Понимание Docker/containerd, механизмов изоляции контейнеров и возможных векторов атак; Знание основных техник MITRE ATT&CK применительно к Linux, контейнерам и Kubernetes; Понимание принципов безопасной настройки облачных сервисов: IAM, S3/Object Storage, Kafka, СУБД, сетевой доступ, управление секретами; Знание сетевых протоколов TCP/IP, DNS, HTTP(S), TLS; Уверенное владение Bash — самостоятельно пишешь скрипты для автоматизации задач; Понимание Git, CI/CD, Infrastructure as Code и DevOps-практик; Умение технически анализировать проблемы и самостоятельно искать их первопричину. Будет плюсом Опыт в SOC L2/L3, Incident Response, DFIR, DevSecOps или SRE; Практический опыт с российскими облаками или частными облачными платформами; Python / Go и опыт разработки инструментов автоматизации; Опыт с Terraform, Helm, Argo CD / FluxCD, GitLab CI/CD; Знакомство с инструментами безопасности Kubernetes: Falco, Tetragon, Trivy, Kyverno; Опыт работы с Wireshark, osquery и другими DFIR-инструментами; Понимание eBPF, Kubernetes Runtime Security и обнаружения атак на уровне ОС и контейнеров; Опыт технических исследований безопасности и Threat Hunting. Условия Оформление в аккредитованную ИТ-компанию Конкурентоспособную заработную плату (обсуждается индивидуально) ДМС со стоматологией и льготными условиями для членов семьи Технику для работы График работы 5/2 с гибким началом Работу в максимально уютном офисе в Москве на ст. м. Савёловская, в Краснодаре или удаленно из других городов РФ, так же есть ИТ офисы в Санкт-Петербурге (ст. м. Балтийская) и Иннополисе Возможность проведения и участия в митапах, хакатонах, где есть возможность познакомиться с работой других подразделений Возможность реализовать свой опыт и потенциал в интересных и многоплановых проектах, получить новый интересный опыт в решении сложных задач Наличие корпоративных скидок и программ лояльности Наличие корпоративной библиотеки курсов Формат работы Москва и Краснодар (гибрид/офис), другие города - удаленно

Location: Australia; Hong Kong The Global Security Operations Engineer is a senior technical role responsible for strengthening the firm's ability to detect, investigate, respond to, and recover from cybersecurity threats across its global environment. Working as part of the Global Security operations team, the successful candidate will lead complex security investigations, develop and optimize threat detection capabilities, and implement automation to improve the effectiveness and efficiency of security operations. The role combines hands-on incident response with proactive security engineering, helping the firm move from reactive alert management toward an increasingly automated, intelligence-led security operating model. Operating within a geographically distributed organization, the successful candidate will work closely with global and regional technology and security teams, provide technical leadership during significant incidents, and contribute to the continuous improvement of security capabilities. Based in APAC, the role will provide critical regional coverage as part of a coordinated global security operations function. Responsibilities Advanced Investigation and Incident Response Serve as a senior escalation point for security incidents, assuming ownership of complex, ambiguous, and high-severity events that exceed first-line triage capability. Conduct detailed investigations to establish initial access vectors, attacker activities and objectives, scope of compromise, and dwell time, documenting findings to an appropriate evidentiary standard. Perform root cause analysis on confirmed incidents and near misses, identifying underlying security control or process failures rather than simply addressing immediate symptoms. Act as technical lead during significant incidents across containment, eradication, and recovery, coordinating activities across global and regional teams. Conduct host and network forensics and malware triage, engaging specialist forensic providers where investigations exceed internal capabilities. Translate technical findings into clear statements of business risk for leadership and drive post-incident corrective actions through to closure. Investigate identity-based attacks, account compromise, unauthorized access, and suspicious activity across cloud platforms and enterprise applications, including Microsoft 365 and Entra ID. Participate in an on-call rotation and provide out-of-hours escalation support during serious incidents, and undertake additional projects and activities as required. Security Automation & Detection Engineering Design, build, tune, and maintain detection content mapped to the MITRE ATT&CK framework, identifying and reporting coverage gaps against threat actor tactics, techniques, and procedures relevant to the firm. Reduce false-positive volume and analyst alert fatigue through systematic tuning, suppression logic, and automated alert enrichment. Operationalize threat intelligence by translating reporting and indicators of compromise into actionable detections, threat-hunting hypotheses, and preventive controls. Design, develop, and maintain automated response playbooks, including Logic Apps, automation rules, and SOAR workflows, to reduce mean time to detect and respond. Write and maintain queries, scripts, and code (KQL, PowerShell, Python, or equivalent) supporting detection, enrichment, automated triage, and reporting. Integrate security tooling and data sources through APIs and connectors, including onboarding new log sources with appropriate parsing, normalization, and validation. Continuously assess and improve security monitoring, detection, and response capabilities, identifying opportunities to strengthen coverage, reduce operational complexity, and improve effectiveness through automation and technology optimization. Identify opportunities to apply AI-assisted investigation, alert triage, and security automation capabilities to improve detection effectiveness, reduce manual effort, and accelerate incident response. Conduct proactive threat hunting to identify suspicious activity, validate detection effectiveness, and uncover threats that may evade existing security controls. Requirements This is a hands-on technical role requiring demonstrated depth in security operations, sound technical judgment, and the ability to work with limited supervision. We value analytical rigor, curiosity, initiative, and a willingness to share knowledge and develop others as highly as any individual technology or certification. Compulsory Requirements: 5+ years of experience in security operations, incident response, or detection engineering, including demonstrable experience working in a Security Operations Center (SOC). Proven experience leading complex technical investigations end to end, from escalation through root cause analysis to documented remediation. Deep, hands-on expertise with modern SIEM and endpoint detection and response (EDR) platforms, including authoring and optimizing detection logic, conducting investigations, and managing data onboarding. Strong practical automation and scripting abilities, including KQL and at least one of PowerShell or Python, with demonstrated experience developing and operating automation in production. Experience designing and maintaining automated response playbooks using Logic Apps, automation rules, or comparable SOAR capabilities. Advanced knowledge of the MITRE ATT&CK framework, Cyber Kill Chain analysis, and established incident response methodologies, such as PICERL. Strong working knowledge of TCP/IP and networking, Windows and Linux operating systems, Active Directory, Entra cloud identity and authentication, and security operations across cloud and hybrid environments. Experience with host and network forensics, malware triage, and the analysis of malicious email headers, links, and attachments. Strong written and verbal communication skills, including the ability to communicate technical findings and security risks to both technical and nontechnical audiences. Ability to work independently and collaborate effectively with geographically dispersed teams, with flexibility to provide out-of-hours support during significant security incidents. Occasional travel to support global cybersecurity operations and incident response may be required Preferred Requirements: Bachelor's degree in Information Security, Information Technology, Computer Science, or a related discipline, or equivalent professional experience. Industry certifications such as GCIH, GCIA, GCFA, GREM, OSCP, CySA+, SC-200, AZ-500, or CISSP. Hands-on experience with Microsoft security technologies, including Microsoft Sentinel, Microsoft Defender XDR, Microsoft Entra ID, and Microsoft Azure. Experience operating within a global, federated, or shared-services model, ideally in professional services or another highly regulated sector. Familiarity with ISO 27001, the NIST Cybersecurity Framework, or comparable control frameworks Benefits Benefits are aligned with the respective location. The above is intended to describe the general content of and requirements for the performance of this job.  It is not to be construed as an exhaustive statement of essential functions, responsibilities or requirements.

Location: Lisbon, Portugal About the Role iCapital is looking to hire a Cyber Security Operations Associate to join the Information Security team. This role is a first responder for reviewing and responding to cyber security alerts.  The Associate will work alongside the security engineering team to provide situational awareness through detecting, containing and resolving cyber security threats using a comprehensive set of cyber security technologies including IDS, IPS, DLP, SIEM, AWS and firewall technologies. Responsibilities Monitor and respond to security events and alerts from a variety of signals. Triage incidents quickly and effectively, escalating priorities to the appropriate business units. Perform routine tasks to measure and report on the state of cyber security defenses at the company. Develop and curate security detections through the security technology stack. Take charge of responding to and remediating cyber security intrusions. Compile and maintain detailed incident response reports. Assist in developing and updating security procedures, playbooks, and knowledge bases. Conduct open-source threat intelligence research to seek out and investigate new indicators of compromise for application. Qualifications 3-4 years security related experience or in a similar field Bachelor’s degree in information security, information technology or computer science preferred Experience in Splunk or other SIEM; Search and analysis, log aggregation etc. Basic understanding of Agile Frameworks Knowledge of common cyber threats, attack vectors, and security frameworks (NIST, MITRE ATT&CK) Good understanding of TCP/IP protocols Knowledge of Linux, Windows and macOS operating systems Experience with cloud infrastructure systems like AWS is preferred Fast learner with desire to always learn combined with the ability to multi-task Attentive, organized, and detail-oriented Solid problem-solving and analytical skills Excellent communication skills We believe the best ideas and innovation happen when we are together. Employees in this role will work in the office four days, with the flexibility to work remotely one day (Friday). Benefits iCapital offers a comprehensive benefits package that includes a total compensation program consisting of competitive salary, annual performance bonus, and equity for all full-time employees; healthcare with 100% employer-paid health and dental insurance; and generous paid time off (PTO). For additional information on iCapital Network, please visit https://www.icapitalnetwork.com/about-us Twitter: @icapitalnetwork | LinkedIn: https://www.linkedin.com/company/icapital-network-inc

– Уверенные знания SQL/оконные функции/CTE, процедурный язык PostgreSQL. – Опыт работы с BI-инструментами: Report Builder, PowerBI, QlikSense, Superset.

Location: Москва; Санкт-Петербург Workplace: Офис, Гибридный Yandex Cloud Security — это подразделение в публичной облачной платформе Yandex Cloud, которое отвечает за обеспечение безопасности всей экосистемы. Ищем инженера, который возьмёт на себя создание и развитие детектирующего контента для собственных продуктов безопасности Yandex Cloud. Yandex Cloud — это облачная платформа, которая объединяет вычислительные ресурсы, сети, хранилища, базы данных, контейнерные и другие управляемые сервисы. В её основе — множество распределённых высоконагруженных систем и API собственной разработки, которыми пользуются компании и разработчики для создания и эксплуатации своей инфраструктуры и приложений. Команда Yandex Cloud Detection and Response развивает технологии обнаружения и реагирования на угрозы в облачных и гибридных инфраструктурах. Мы исследуем способы улучшения разработки и сопровождения детектирующего контента. Одно из направлений — создание AI-агентов, которые помогают исследовать данные, разрабатывать и тестировать правила, анализировать результаты их работы и автоматизировать повторяемые задачи detection engineering. Мы ищем инженера, который будет отвечать за создание и развитие детектирующего контента для собственных продуктов безопасности Yandex Cloud. В вашей зоне ответственности будет полный жизненный цикл детекта: исследование техники атаки, определение требований к телеметрии, разработка и тестирование правила и последующий контроль качества. Обязанности Разработка детектирующего контента Вы будете создавать и развивать правила обнаружения угроз для продуктов безопасности Yandex Cloud и команды SOC, работать с нормализацией и таксономией событий, тестировать детекты и контролировать их качество после выпуска. Исследование угроз и работа с инцидентами Вам предстоит исследовать техники атакующих, проводить Threat Hunting, участвовать в расследовании сложных инцидентов, превращать полученные результаты в новые способы обнаружения угроз. Отдельное направление работы — endpoint detection для Linux и контейнерных сред, включая телеметрию на основе eBPF. R&D и автоматизация Вы будете автоматизировать разработку, тестирование и выпуск детектирующего контента, а также развивать AI-агентов для анализа данных и проверки детектов. Больше о том, что под капотом платформы Yandex Cloud, — в канале Inside Yandex Cloud Требования * Работали в detection engineering, threat hunting, incident response либо на второй или третьей линии SOC * Разрабатывали и отлаживали правила в SIEM или EDR, работали с Git и CI/CD * Понимаете полный жизненный цикл детекта: гипотеза, требования к данным, реализация, тестирование, внедрение, мониторинг качества * Знаете сетевые протоколы, устройства современных операционных систем и основные техники атак на Active Directory * Понимаете модели безопасности облачных платформ: IAM, ресурсную иерархию и облачные API * Знаете принципы виртуализации, контейнеризации * Разбираетесь в Linux: процессы, системные вызовы, файловая и сетевая подсистемы * Понимаете принципы eBPF и его применения для наблюдаемости и безопасности Linux-систем * Умеете писать код или скрипты для автоматизации — прежде всего на Python или Go * Способны самостоятельно доводить исследование до работающего результата и сопровождать его Будет плюсом * Работали с Yandex Cloud, AWS, Azure или GCP и их событиями безопасности * Разрабатывали детектирующий контент для EDR * Работали с purple teaming, adversary emulation или проверяли детекты воспроизведением техник атак * Использовали eBPF, Falco, Tetragon, Tracee или другие средства runtime security и сбора endpoint-телеметрии * Знаете Sigma, YARA, Suricata или другие форматы детектирующего контента * Разбираетесь в ClickHouse, YDB или других SQL-подобных аналитических системах

Location: Москва Workplace: Офис PayOffline — платёжно-оферинговый продукт Яндекс Финтеха для офлайн-ритейла. Ищем Senior Growth Manager, который возьмёт на себя одно из ключевых направлений роста. Вы будете анализировать бизнес и поведение пользователей, проектировать growth‑механики, управлять запусками и отвечать за бизнес‑эффект. Мы развиваем PayOffline — платёжно-оферинговый продукт Яндекс Финтеха для офлайн‑ритейла. Он объединяет оплату, лояльность и финансовые продукты в приложениях партнёров и Яндекс Пэй. Ищем Senior Growth Manager, который будет развивать одно из ключевых направлений роста PayOffline. Роль предполагает полную самостоятельность: нужно глубоко анализировать бизнес и поведение пользователей, проектировать growth‑механики, организовывать запуск и нести ответственность за измеримый бизнес‑эффект. Обязанности Продуктовая аналитика и оценка бизнес-эффекта Вы будете глубоко анализировать воронки, поведение пользователей и CJM, выявлять первопричины проблем, а не их симптомы, находить факторы, которые влияют на GMV, частотность и retention. Вам предстоит формулировать проверяемые гипотезы, проектировать эксперименты и систему метрик, определять, какие данные нужны для решения задач, и анализировать, как инициативы влияют на GMV, CM, конверсию, средний чек, частотность, CAC, LTV и retention. Нужно будет представлять выводы руководству и корректировать стратегию, если первоначальная гипотеза не сработает. Проектирование growth-механик Вам предстоит создавать механики, которые привлекут и удержат пользователей, развивать инструменты продвижения и искать новые способы рассказывать об оферах. Для каждой гипотезы нужно понять, какое поведение она изменит, как впишется в сценарий взаимодействия с пользователем и какой эффект даст для бизнеса. Управление инвестициями Вы будете собирать инвестиционные кейсы — связывать целевой результат с объёмом инвестиций, разными сценариями достижения цели, сроком окупаемости и ключевыми рисками. Вам нужно будет оценивать инкрементальность, каннибализацию и долгосрочный эффект, сравнивать альтернативы и принимать решения о масштабировании механик, их изменении или остановке. Вместе с партнёрами вы будете искать варианты софинансирования и дополнительный инвентарь для роста бизнеса. Развитие партнёрского бизнеса Вам предстоит изучать бизнес-модель партнёра, его клиентскую базу, операционные ограничения и экономику. На этой основе нужно составить совместный план роста: договориться о взаимных обязательствах и найти решения, которые принесут пользу и Яндексу, и партнёру. Управление запусками Вы будете вести инициативы с командами Яндекса и партнёра — продуктовыми, техническими, аналитическими, маркетинговыми и коммерческими. Вам нужно будет превратить growth-гипотезу в рабочее решение: договориться о приоритетах, управлять зависимостями и довести запуск до результата без формального управления участниками. Требования * Самостоятельно вели growth‑направление или портфель инициатив и отвечали за измеримый бизнес‑результат * Находите точки роста: анализируете воронку, пользовательское поведение и CJM, отделяете симптомы от первопричин * Формулируете проверяемые гипотезы, проектируете эксперименты и доказываете причинно‑следственную связь между механикой и результатом * Свободно работаете с GMV, CM, конверсией, средним чеком, retention, CAC и LTV и понимаете, за счёт каких денежных потоков и изменений поведения окупается механика * Оцениваете инкрементальность и каннибализацию промо, отличаете устойчивый рост от субсидирования органического спроса * Предлагаете несколько принципиально разных решений growth‑задачи, сравниваете их по эффекту, стоимости и рискам и обосновываете выбор * Проектируете новые growth‑механики, продуктовые сценарии и промоинвентарь, а не только оптимизируете существующие кампании * Погружаетесь в бизнес‑модель и клиентскую базу партнёра, строите совместный план роста и договариваетесь о промоподдержке, инвентаре и софинансировании, сохраняя фокус на экономике Яндекса * Собираете инвестиционные кейсы: формулируете целевой эффект, предпосылки и сценарии, определяете бюджет, срок окупаемости и ключевые риски, защищаете расчёт перед руководителями и партнёрами * Ведёте сложные кросс‑функциональные запуски и влияете на команды без административных полномочий, принимаете решения при неполных данных и берёте ответственность за весь цикл: от диагностики до измерения эффекта и следующего инвестиционного решения

Location: Москва Workplace: Гибридный О компании RED Security – открытая экосистема ИБ-решений и экспертизы для комплексной защиты бизнеса. RED Security SOC – центр мониторинга и реагирования на кибератаки. Обязанности расследовать нетиповые инциденты ИБ с различных источников; взаимодействовать с заказчиками по техническим вопросам; участвовать в выездном реагировании в инфраструктуре Заказчика; анализировать полноту и качество анализа инцидентов; принимать участие в разработке методик и инструкций (playbooks) по работе с инцидентами; обеспечивать развитие платформы по реагированию и инструментария для расследования инцидентов; проводить обучение и делиться опытом с другими аналитиками. Требования понимание векторов атак на корпоративные сети и способы противодействия; знание современных методов классификации тактик и техник атакующих (Mitre Attack, Kill Chain); опыт в расследовании инцидентов ИБ; умение анализировать журналы регистрации событий в различных системах (ОС, СЗИ, сетевое оборудование, прикладное ПО, access логи и др); экспертные знания в одном из доменов ИТ инфраструктуры (ОС, сеть, веб, виртуализация, БД). Условия собственную платформу MTS Ocean для получения ИТ-ресурсов, а это значит, что деплой, мониторинг, observability — не будут для тебя проблемой, ты сможешь сосредоточиться на фичах; профессиональные гильдии инженеров, где мы поддерживаем друг друга и помогаем стать лучше; внутреннюю площадку TechTalks для обмена опытом, дискуссий, развития навыков самопрезентации; участие во внешних IT конференциях. Наши эксперты выступают на ведущих профильных конференциях, таких как HighLoad++, DevOps Conf, Joker, AHA!, Матемаркетинг и другие. А еще мы организуем собственную масштабную конференцию True Tech Day и регулярно проводим митапы для разработчиков и инженеров; полезные курсы и вебинары в корпоративном университете и электронную библиотеку; ДМС с первого месяца работы, включая стоматологию; страхование от несчастных случаев с 1 месяца работы. Материальную помощь в сложных жизненных ситуациях; отпуск 28 календарных дней; прием врачей общей практики и массаж в офисе; мобильная связь за счет компании и льготные тарифы для близких; подписка на онлайн-кинотеатр KION, сервис МТС Музыка, книжный сервис Строки от МТС, безлимитные мессенджеры и соцсети; гибридный формат работы при наличии офиса, удаленный формат при отсутствии офиса.