Location: British Columbia
Workplace: Hybrid
Safe Software is looking for a Security Operations Team Lead to build and lead our security operations function. This is a new role, and the person in it will own the programs, processes, and people that make security operations work at Safe. We have an immediate opening and are excited to find the right candidate to join our team.
Reporting to the Director of Information Security, you'll take ownership of the programs on our roadmap — incident response, vulnerability and patch management, system hardening and configuration management, device trust and conditional access, and resiliency planning — and turn them from initiatives into durable, measurable practices. This is also a people-leadership role: you'll manage the Security Operations Engineers who deliver that work, starting with a small team and growing it as the function matures.
It's a leadership role, and a hands-on one. You'll stay close enough to the work to make good technical calls, carry a share of the on-call rotation, and be credible with the engineers you lead. We're looking for someone with a first stretch of leadership behind them who wants substantially more ownership than they've had so far, and the support to grow into it.
You'll also set the tone for how security shows up at Safe. Security only works when it feels like a partnership rather than an obstacle, and the best security operations leaders we've worked with treat other teams as partners with their own pressures and deadlines. That's the disposition we're hiring for.
ABOUT THE TEAM
Information Security at Safe protects the data, systems, and people behind FME and the 25,000+ enterprise customers who rely on it. We're a growing, high-trust team that partners closely with teams across Safe rather than operating as a separate gate.
We're at a genuinely interesting period of growth and opportunity: we're building programs, not just maintaining them. Incident response, resiliency planning, configuration management, and vulnerability management are all being stood up or significantly matured right now, and this role drives much of that work. This means real latitude to decide how security operations should work at Safe.
We also lean on AI and automation to cut toil, sharpen investigations, and move faster. Part of this role is setting both the expectation and the guardrails for how the team experiments with them.
WHAT YOU'LL BE DOING
As the Security Operations Team Lead, you will:
- Build and lead the security operations team, including hiring, onboarding, coaching, performance, and career development. You'll set the bar for how the team works, then grow the team as the function scales.
- Own the incident response program end to end — the process, the runbooks, the on-call rotation, the tabletop exercises, and the post-incident reviews. You'll act as incident commander for significant events, carry a share of the on-call rotation, and make sure every incident makes the next one easier.
- Own the security operations roadmap and its delivery, translating strategy into prioritized, resourced work with clear outcomes, and reporting on progress, risk, and where you need help.
- Drive programs and processes to maturity — automated patch management, CIS benchmark adoption for system hardening and configuration management, device trust and conditional access, vulnerability management with meaningful SLAs, and resiliency planning.
- Set the technical direction for our security tooling, ensuring Rapid7 InsightVM (vulnerability management) and InsightIDR (SIEM), Cisco Secure Endpoint (EDR), Cisco Umbrella, Active Directory, JumpCloud, Google Workspace, and AWS security controls are configured, tuned, and delivering real detection value rather than noise.
- Define and track the metrics that matter — detection and response times, remediation SLAs, hardening and patch coverage, alert quality — and make sure they drive decisions instead of decorating a dashboard.
- Champion AI and automation across the team's workflows, piloting and standardizing tools that reduce toil and sharpen investigations, and establishing sensible guardrails for how AI is used in security work.
- Own Security Operations' contribution to compliance, operating and evidencing controls for ISO 27001, SOC 2, and future frameworks, and building processes where audit evidence falls out of the day-to-day work instead of becoming a fire drill.
- Partner with IT and teams across Safe to embed security into how work already gets done, delivering findings constructively and building the kind of trust that gets people calling you early.
- Represent Security Operations to leadership, communicating risk, incidents, and program status clearly to both technical and non-technical audiences.
QUALIFICATIONS, SKILLS, AND COMPETENCIES
Safers come from a variety of backgrounds with a diversity in skills and knowledge. That said, we find that those who are most successful in this role have experience with the following areas.
REQUIRED SKILLS:
- 5+ years in security operations, incident response, or a closely related security engineering discipline, including 1–2 years leading a team — as a manager, team lead, or technical lead with formal ownership of others' work.
- Meaningful ownership of a security program — incident response, vulnerability management, hardening, or similar — that you helped take from immature to reliably operating.
- Deep hands-on SIEM and EDR experience: building and tuning detections, running investigations, and improving signal-to-noise over time.
- Strong incident response background, including leading or coordinating response for significant incidents, running post-incident reviews, and maintaining runbooks that reflect reality. Familiarity with MITRE ATT&CK.
- Practical experience with vulnerability and patch management at scale, and with hardening and configuration management against a recognized standard such as the CIS Benchmarks.
- Solid network security knowledge, including protocols and architecture, and how to secure both on-premises and cloud environments.
- Solid cloud security knowledge, ideally AWS: IAM, logging, network controls, and posture management, plus experience securing and administering a cloud productivity suite such as Google Workspace.
- Working knowledge of identity and access: SSO, MFA, conditional access, device trust, and least-privilege design.
- Experience supporting or operating controls for ISO 27001, SOC 2, or comparable frameworks, and comfort with the evidence and audit side of the work.
- Excellent written and verbal communication, including the ability to explain risk and incidents clearly to leadership and to deliver difficult findings constructively.
DESIRED SKILLS / BONUS POINTS:
- Direct experience with our stack: Rapid7 InsightVM and InsightIDR, Google Workspace security and admin, Active Directory, AWS, Cisco Umbrella, and Cisco Secure Endpoint.
- Experience standing up or significantly maturing an incident response program, including on-call design and tabletop exercises.
- Demonstrated experience building AI or automation into security operations, and a point of view on how to do it safely.
- Experience with business continuity, disaster recovery, or resiliency planning.
- Experience hiring, growing, and developing a technical team from a small base.
- Scripting or development skills (Python, PowerShell, or similar) sufficient to build and review automation.
- Relevant certifications or a plan to complete certifications such as CISSP, CISM, GIAC, or equivalent.
- A Bachelor's degree in Information Technology, Cybersecurity, Computer Science, or a related field.
If you don't meet every single qualification but are excited about this role, we'd still love to hear from you.
WHAT YOU CAN EXPECT
When you choose a career with Safe Software, you're also choosing…
- Meaningful Work: Make a profound impact across our business, workplace and data integration product.
- A Supportive Environment: Feel empowered to share your ideas and implement them with high autonomy and team support.
- Social Responsibility: Become part of a team that finds meaningful ways to give back. Take paid time off to volunteer for one of our Safe-organized opportunities that align with our core community initiatives.
- Learning & Career Development: We believe in your continuous learning and growth. Take advantage of an annual learning budget and training programs paid for by Safe.
- Flexible Working Hours: Flexible and remote-friendly work arrangements to fit your lifestyle. Work when you want, and how you want to.
- Work-Life Balance: There's no place for burnout at Safe. Maintain a healthy balance of your personal and work life without splitting yourself in two. Enjoy 3 weeks of vacation to recharge, plus an additional paid 6 seasonal days off per year.
- Health & Wellness: Extended health, dental, health or lifestyle spending, and counseling benefits from day 1. That's right, no waiting period.
- Family is important: We are dedicated to supporting our employees through parenthood and offer a Parental Leave Top-Up Program for new parents through childbirth or adoption.
- Shared Success: Share in Safe's success with our bi-annual profit sharing and RRSP/TFSA matching program.
- An Accessible Commute: Regardless of your commute method, we're located close to public transit, and provide complimentary parking and bike storage for our team!
ABOUT SAFE SOFTWARE
Safe Software transforms organizations with FME, the only All-Data Any-AI Enterprise Integration Platform connecting all your data, anywhere, at any velocity.
With over 30 years of expertise and 25,000+ enterprise customers across 125+ countries, we simplify your data journey, wherever it leads.
Founded in 1993, Safe is headquartered in Surrey, BC with over 300 team members and counting. We’re always looking for talented individuals with diverse backgrounds who are determined to learn and grow. Are you ready to join the team?
OUR COMMITMENT TO DIVERSITY AND INCLUSION
Safe Software is an equal opportunity employer and we truly believe that innovation and strength begin with diversity and inclusion.
We welcome all candidates regardless of race, gender identity or expression, sexual orientation, age, ability, disability, national or ethnic origin, political belief, religion, or family status.
Should you require accommodations during the recruitment process, please contact hr_dept@safe.com.
NOTICE REGARDING USE OF AUTOMATED TOOLS IN HIRING
At Safe Software, we use automated tools to help us process applications and identify qualified candidates. These tools may assist in screening resumes and summarizing interview content based on the information you provide. This helps our team review applications efficiently while ensuring every candidate is considered based on the requirements of the role.
Please be assured that the final hiring decision is always made by a member of our team. For more information on how we protect your privacy, please see our policy https://www.safe.com/legal/#applicant-privacy-policy. If you have questions about this process, please contact us at hr_dept@safe.com.
Задачи:
— null
Требования:
— Опыт работы с Power BI (дашборды, DAX, модели) не менее 3х лет
— Уверенный SQL (joins, window functions, оптимизация)
— Опыт работы с ETL/ELT процессами
— Опыт работы с реляционными БД (PostgreSQL / MS SQL / др.)
— Опыт построения Tabular OLAP-кубов (SSAS / Azure Analysis Services / др.)
— Опыт работы с облаками (Azure / AWS / GCP)
Условия:
— Гибридный или удаленный график работы, но полная загрузка
— Только штат и полная занятость, без возможности работать с ИП
— Добровольное медицинское страхование и страхование жизни (ДМС)
— Ежегодный пересмотр заработной платы
— Годовой бонус 15%
— Корпоративные скидки
Задачи:
— разрабатывать и сопровождать отчеты и дашборды в Power BI;
— переводить бизнес-задачи в технические решения;
— писать сложные SQL-запросы, бизнес-логику и расчетные показатели;
— интегрировать данные из CRM, ERP, БД, API, Excel/CSV и других источников;
— контролировать качество данных и устранять расхождения;
— автоматизировать регулярную отчетность и ручные операции;
— оптимизировать производительность отчетов и запросов;
— участвовать в развитии BI-инфраструктуры.
Требования:
— опыт разработки в Power BI от 1–3 лет;
— уверенное владение Power BI Desktop, Power Query и SQL;
— опыт написания сложных SQL-запросов;
— знание принципов построения DWH и аналитических витрин;
— понимание ETL/ELT и моделирования данных;
— опыт работы с различными источниками данных.
Будет плюсом опыт с Tableau / Qlik Sense, а также Power Automate, Power Apps, SharePoint, Microsoft Fabric.
Алматы
Не хотите искать каждый день?
Настройте подбор один раз, и подходящие вакансии будут сами приходить в Telegram.
Настройте подбор, и подходящие вакансии будут приходить в Telegram.
Работа в Uzum Fintech — финтех-направление экосистемы Uzum, которая объединяет электронную коммерцию, платёжные сервисы, цифровой банкинг и логистику в единую платформу.
Языки работы: узбекский и русский.
Формат работы: гибрид.
Location: Remote
Workplace: Remote
We are building AI to simulate the world through merging art and science.
We believe that world models are at the frontier of progress in artificial intelligence. Language models alone won’t solve the world’s hardest problems – robotics, disease, scientific discovery. Real progress requires models that experience the world and learn from their mistakes, the same way that humans do. And this kind of trial and error can be massively accelerated when done in simulation, rather than in the real world.
World models offer the most clear path to general-purpose simulation, changing how stories are told, how scientific progress is made and how the next frontiers of humanity are reached.
Our team consists of creative, open minded, caring and ambitious people who are determined to change the world. We aspire to continuously build impossible things and our ability to do so relies on building an incredible team. If you are driven to do the same, we'd love to hear from you.
*Titles posted to our careers page are updated regularly to best advertise the role and expected seniority, but internally we have a flat titling system with two types of titles: one for individual contributors and one for people managers.
ABOUT THE ROLE
Open to hiring remote — we also have offices in New York, San Francisco, Seattle, London, Paris, and Tel Aviv.
Runway is hiring a Detection & Response Engineer to own how we find and stop attacks against our infrastructure, our research environment and our products.
Securing a company that trains and serves frontier video models is a different problem from securing a typical SaaS product. The environment includes research compute, large training datasets, a fast-moving build pipeline and engineers who work inside AI-assisted tooling every day. Each of those changes what an attack looks like and what you need to see to catch it.
You'll join the Security team and build our detection and response program the way an engineer would: detections as code, response as automation, evidence as something you can query. This is a role with real ownership: you'll own the detection program end to end, from what we log to how quickly we close an incident. You'll report to the head of security, partner with engineers across platform and research, and shape how this function grows from here.
WHAT YOU'LL DO
- Own detection and response end to end: what we log, what we alert on, how we triage and how we recover
- Write and tune detections as code across multiple cloud environments, Kubernetes, identity systems, endpoints and SaaS, and measure them on coverage and precision rather than alert volume
- Lead incident response from the first alert through containment and forensics, then write the post-incident review people actually read
- Build automation that takes toil out of triage, including enrichment, correlation, containment actions and evidence collection, and use LLM-based tooling where it holds up under audit
- Monitor AI agents and developer tooling operating inside our environment, and turn that into concrete telemetry and controls
- Partner with platform and research engineers so new systems ship with logging and response playbooks in place on day one
- Run threat hunts and tabletop exercises against the parts of the environment that worry you most, and fix what you find
- Turn incident and detection metrics into evidence for SOC 2, ISO 27001 and enterprise customer security reviews, working with our GRC team
- Participate in an on-call rotation for security incidents
WHAT YOU'LL NEED
- Hands-on incident response experience: you've triaged live alerts, led investigations and written up what happened afterward
- Experience building and tuning detections in a modern SIEM, ideally managed as code
- Working knowledge of how attackers move through cloud and Kubernetes environments (IAM abuse, container escape, credential theft, supply chain compromise) and what that leaves behind in logs
- Comfort writing Python, Typescript, Rust or another language to automate response work and connect security tools
- Familiarity with at least one major cloud platform and with Kubernetes at the level of audit logs, RBAC and workload identity
- Clear writing. Incident timelines, detection documentation and updates to leadership are all part of the job
- Judgment about what to alert on, what to automate and when to wake someone up
EVEN BETTER IF YOU HAVE
- Experience monitoring GPU or HPC-style infrastructure, or research environments with large datasets
- Experience building detections or guardrails for AI agents, LLM tooling or MCP servers
- Cloud forensics experience: disk and memory acquisition, cloud audit trail reconstruction, chain of custody
- Published open source detection content
Runway strives to recruit and retain exceptional talent from diverse backgrounds while ensuring pay equity for our team. Our salary ranges are based on competitive market rates for our size, stage and industry, and salary is just one part of the overall compensation package we provide.
There are many factors that go into salary determinations, including relevant experience, skill level and qualifications assessed during the interview process, and maintaining internal equity with peers on the team. The range shared below is a general expectation for the function as posted, but we are also open to considering candidates who may be more or less experienced than outlined in the job description. In this case, we will communicate any updates in the expected salary range.
Lastly, the provided range is the expected salary for candidates in the U.S. Outside of those regions, there may be a change in the range, which again, will be communicated to candidates.
WORKING AT RUNWAY
Great things come from great teams. https://www.youtube.com/watch?v=kwmj4ato2kw&ab_channel=Runway We’d love to hear from you.
We’re committed to creating a space where our employees can bring their full selves to work and have equal opportunity to succeed. So regardless of race, gender identity or expression, sexual orientation, religion, origin, ability, age, veteran status, if joining this mission speaks to you, we encourage you to apply.
More about Runway
- Universal World Simulator https://runwayml.com/world-simulator.html
- GWM-1 https://runwayml.com/research/introducing-runway-gwm-1
- Gen-4.5 https://runwayml.com/research/introducing-runway-gen-4.5
- General World Models https://runwayml.com/research/introducing-general-world-models
- Robotics SDK https://runwayml.com/research/introducing-runway-gwm-1#robotics-section
- Conversational Real-time Agents https://runwayml.com/research/introducing-runway-gwm-1#avatars-section
- Runway Studios https://runwayml.com/studios
We're excited to be recognized as a best place to work:
Crain's https://www.crainsnewyork.com/awards/best-places-work-2023 | InHerSight https://www.inhersight.com/companies/best/city/new-york-city-ny | BuiltIn NYC https://builtin.com/awards/new-york-city/2024/best-places-to-work | INC https://www.inc.com/best-workplaces/2024
Location: PL
Workplace: remote
Overview:
SOFTSWISS is hiring a Senior SOC Detection Engineer to join our Security Operations team. We are seeking a hands-on security professional to help build and develop our detection engineering function, strengthening the company’s ability to identify, investigate, and respond to security threats across Windows, Linux, and Kubernetes environments.
Purpose of the role:
You will be responsible for owning the full lifecycle of security detections, from researching attack techniques and defining logging requirements to developing, testing, deploying, and continuously improving detection content in Splunk. Your work will help enhance detection coverage, improve telemetry quality, reduce false positives, and ensure that security teams can reliably identify and respond to real threats.
Key responsibilities:
Develop, test, deploy, and maintain detection and correlation rules in Splunk or a similar SIEM.
Translate incident investigations, threat hunting, and attack research into effective detections.
Analyze false positives, false negatives, and detection gaps.
Improve detection coverage and map detections to MITRE ATT&CK techniques.
Develop and optimize SPL queries, dashboards, reports, and risk-based detections.
Define requirements for logging, parsing, normalization, enrichment, and data quality.
Develop monitoring and health checks for detection rules and data sources.
Contribute to automated detection testing, synthetic events, telemetry replay, and CI/CD workflows.
Participate in incident investigations, threat hunting, purple team exercises, and attack emulation.
Collaborate with SOC, Incident Response, Threat Intelligence, Infrastructure, and Engineering teams.
Document detection logic, data sources, dependencies, limitations, and expected behavior.
Required Experience:
Strong hands-on experience in SOC, Detection Engineering, Threat Hunting, Incident Response, or a related field.
Deep understanding of MITRE ATT&CK, common attack techniques, and detection methodologies.
Strong proficiency in Splunk SPL or another enterprise SIEM platform.
Experience developing complex queries, correlations, dashboards, and reports.
Practical experience tuning detections and managing exceptions and allowlists.
Ability to define and evaluate logging and telemetry requirements.
Proficiency in Python, PowerShell, or Bash for automation.
Experience with Git, code reviews, APIs, and basic CI/CD practices.
Understanding of Windows and Linux security monitoring.
Ability to independently investigate complex problems and drive solutions to completion.
Strong communication skills and the ability to work effectively across teams.
Nice to have:
Experience with Splunk Enterprise Security, CIM, data models, macros, and lookups.
Experience with Sysmon, Windows security auditing, Active Directory, auditd, osquery, Tetragon, Docker, or Kubernetes.
Experience with YARA, CALDERA, Shuffle, or other security automation and attack emulation tools.
Experience building detection quality metrics and automated validation frameworks.
Experience with Terraform, Ansible, or other infrastructure-as-code tools.
Participation in security research, conferences, or the broader security community.
Our technology focus:
Splunk Enterprise Security, MITRE ATT&CK, Windows and Linux telemetry, Kubernetes and container logs, Python, PowerShell, Bash, Git, and CI/CD.
Learn more about our hiring process
here (
link
)
– what to expect, how to prepare, and what makes SOFTSWISS different.
Main Advantages
Private health insurance
Sports benefits
Comprehensive Mental Health Program
Free English lessons (online)
Local language courses
Paid time off
Maternity leave support
Referral program rewards
Upskilling, internal workshops, and participation in professional conferences and corporate events
Location: Москва, удалённая работа или гибрид, RU; Россия
О команде
Наша команда защищает технологическую платформу и офисную инфраструктуру Авито. Мы используем множество современных технологий, поэтому вы получите ценный опыт в обеспечении их безопасности.
Какие задачи вас ждут:
обеспечивать комплексную безопасность корпоративной и продуктовой инфраструктуры компании;
выстраивать непрерывный цикл мониторинга, детектирования и реагирования на киберугрозы;
управлять командой SOC полного цикла;
развивать процесс реагирования на инциденты информационной безопасности;
развивать инфраструктуру и контентную базу SIEM и средств защиты информации;
автоматизировать рутинные операции и оркестрировать процессы реагирования с помощью SOAR.
Мы ждём, что вы:
имеете глубокий практический опыт построения и управления SOC или руководства аналогичным подразделением защиты инфраструктуры;
уверенно разбираетесь в процессах детектирования угроз и реагирования на инциденты;
имеете глубокий практический опыт работы с SIEM — Elastic Stack, MS Sentinel и аналогами, EDR, средствами сетевой безопасности и автоматизации SOAR;
понимаете специфику и имеете опыт моделирования угроз — threat modeling и оценки рисков информационной безопасности применительно к инфраструктурным компонентам и сервисам;
имеете опыт управления командой инженеров SOC или смежных направлений от трёх человек: найм, наставничество, развитие инженеров L1/L2/L3;
обладаете отличными коммуникативными навыками, умеете ясно доносить технические детали и уровень рисков до стейкхолдеров;
эффективно взаимодействуете с DevOps, IT Ops, разработкой и смежными подразделениями в ходе инцидентов и плановых работ.
Работа у нас — это:
расширенная забота о здоровье: ДМС, страхование жизни, онкострахование;
сервис психологической поддержки, а также финансовые, юридические и ЗОЖ-консультации для вас и ваших близких;
корпоративный спорт: групповые тренировки, велбиинг-приложение;
спецпредложения от партнёров и скидки на сервисы Авито: бронирование жилья, услуги продвижения, ипотечное страхование;
компенсация питания;
комфортные офисы с панорамным видом, питанием и зоной отдыха;
прозрачная система целей и возможность влиять на приоритеты компании;
возможность развиваться в сильной команде лидеров и помогать расти другим;
чёткая матрица компетенций с прозрачными ожиданиями на всех уровнях;
уникальный культурный код и сильное экспертное комьюнити;
возможность работать с современными технологиями и инфраструктурой масштаба Авито;
профессиональное развитие: обучение за счёт компании, курсы, тренинги, менторство.
Задачи:
— Взаимодействие с бизнес-заказчиком, согласование проектных решений на техническом и бизнес-уровне
— Оценка трудозатрат и стоимости решения
— Проведение и организация нагрузочного тестирования
— Разработка ETL процессов и data modeling
— Моделирование и написание SQL-процедур
— Оптимизация производительности скриптов и диаграмм интерфейса
— Dashboard design и общий UI/UX дизайн в QlikSense
Требования:
— Опыт работы в QlikSense или Insight более 3 лет
— Более 10 завершенных проектов
— Уверенные навыки взаимодействия с бизнес-заказчиком
— Высокая мотивация и умение самостоятельно находить решения сложных проблем
— Навыки разработки ETL, data modeling
— Навыки моделирования и написания SQL-процедур
— Навыки оптимизации производительности скриптов и диаграмм интерфейса
— Навыки Dashboard design и UI/UX design в QlikSense
Дополнительные требования:
— Сертификация QlikSense
— Знания администрирования QlikSense средствами QMC, QV API, Sense API
— Навыки VBA-программирования
— Опыт написания Extentions и знание JavaScript
— Знания инструментов отчетности Nprinting
— Разработка экстракторов из SAP ERP, SAP BW
— Опыт интеграции QlikSense во внешние среды (websites, SharePoint и др.)
Условия:
— Проектная занятость, фуллтайм
— Долгосрочный срок
— Оформление только ИП (не СЗ, не ТК)
УдалённоseniorГеография найма не уточнена, офис: Россия
Задачи:
— Выбор и внедрение CRM-платформы
— Настройка триггерных цепочек
— Работа с Web/PWA Push, WhatsApp и аналитикой инкрементальности
Требования:
— Опыт построения CRM-инфраструктуры с нуля
— Знание SQL или продуктовая аналитика
— Опыт когортного анализа и проведения A/B-тестов
Условия:
— Полностью удалённая работа
— Гибкий график
— KPI-бонусы за рост CRM-дохода
Ищем hands-on DevSecOps / Security специалиста для проекта в сфере regulated crypto / fintech.
Основная задача — разбирать результаты IT/Security-аудитов и технически закрывать выявленные vulnerabilities, security gaps и audit findings.
Что важно:
• DevSecOps / Application / Infrastructure / ICT Security;
• DORA — обязательно;
• MiCA, ISO 27001 или аналогичные стандарты;
• опыт security/compliance-аудитов;
• понимание regulated crypto / fintech;
• умение самостоятельно делать remediation.
Будет плюсом: Fireblocks, crypto custody, MPC, crypto exchanges, custodians, fintech/payment.
Не рассматриваем чистых Compliance Officers, специалистов только по документации и Backend Developers без Security/DevSecOps опыта.
Location: United Kingdom
Brainlabs is the independent, founder-led agency building the future of media. We have over 1000 Brainlabbers based across the global, all united through the 12 principles laid out in our Culture Code. We're full-service, with people and AI agents working side by side, all aligned to one thing: maximizing our clients' revenue through a genuinely scientific approach to media. If you want to help play your part in achieving this for the world's biggest brands in an environment that will support and challenge you in equal measure, this is where you do it.
So, tell me about the company
Brainlabs is culture-first. You’ve probably heard other companies describe themselves as people, clients, or profit first – but we see people, clients and profit as the building blocks of our ecosystem. Culture powers all three and we know that when the ecosystem is balanced, we all win! That's why the culture we cultivate is a culture of winning together.
To learn more about what it’s like to be a Brainlabber, check out our
culture code.
What you do
Own day-to-day security operations: vulnerability management, connector and MCP approvals, threat model reviews and incident support
Run and extend our SecOps AI agents, which handle Mend triage, MCP assessment, documentation review and incident scribing
Make the security decisions the agents escalate, setting clear conditions rather than blanket blocks
Drive vulnerability remediation with our dev and platform teams, escalating when fixes stall
Keep security posture visible across GCP projects plus AWS and Azure, and partner with SEP2, our external MDR provider
Who you are
You have solid security operations experience, whether from security engineering, appsec or platform security
You know GCP properly: IAM, service accounts, logging and org policy. AWS and Azure familiarity helps
You can read code well enough to judge whether a SAST finding is real
You’re genuinely fluent with AI tooling and you build with it rather than around it
You write clearly, because most of what you produce is a decision someone else has to act on
You’re comfortable saying no with a reason and yes with conditions, and happy owning a function rather than working a queue
How you succeed
You have solid security operations experience, whether from security engineering, appsec or platform security
You know GCP properly: IAM, service accounts, logging and org policy. AWS and Azure familiarity helps
You can read code well enough to judge whether a SAST finding is real
You’re genuinely fluent with AI tooling and you build with it rather than around it
You write clearly, because most of what you produce is a decision someone else has to act on
You’re comfortable saying no with a reason and yes with conditions, and happy owning a function rather than working a queue
What happens next
We know searching for a job is tough and that you want to find the best career and employer for you. We also want to ensure that this position is the best fit for both you and us. Therefore, you will participate in a comprehensive interview process that includes skills interviews with our team. The goal of this process is to allow you to get to know us as we learn more about you.
Brainlabs actively seeks and encourages applications from candidates with diverse backgrounds and identities.
Thank you for your interest in Brainlabs! We look forward to getting to know you!
What happens next?
We know searching for a job is tough and that you want to find the best career and employer for you. We also want to ensure that this position is the best fit for both you and us. Therefore, you will participate in a comprehensive interview process that includes skills interviews with our team. The goal of this process is to allow you to get to know us as we learn more about you.
A note on our offices:
We pride ourselves in being a company with an office-centric culture and, for the majority of roles we expect people to be in commuting distance of the office and come in for around 3 days per week.
Brainlabs actively seeks and encourages applications from candidates with diverse backgrounds and identities. We are proud to be an equal opportunity workplace: we are committed to equal opportunity for all applicants and employees regardless of age, disability, sex, gender reassignment, sexual orientation, pregnancy and maternity, race, religion, or belief, and marriage and civil partnerships. If you have a disability or special need that requires accommodation during the application process, please let us know!
For details regarding our data processing activities, please refer to our
Candidate Privacy Notice
Protect Yourself from Job Scams:
We've been made aware of fraudulent job offers circulating in Brainlabs' name. Your safety is our priority, so please stay vigilant. Brainlabs will never ask you to transfer money, pay for a job opportunity, or request sensitive information such as Social Security numbers, banking details, or passwords via email, WhatsApp, or unsecured channels. Our official hiring communications only come from verified email domains (@brainlabsdigital.com, @brainlabs.ai, @exverus.com, @jacknimble.com.au, @sparro.com.au) and trusted platforms including Greenhouse, Upwork, Yuno Juno, and Remote. If you receive a suspicious message claiming to be from Brainlabs, do not engage. Instead, forward it immediately to
security@brainlabsdigital.com
. We're committed to protecting our community and ensuring a safe candidate experience. Thank you for your vigilance.
Location: Remote - US
About Backblaze
Backblaze is the object storage leader in the open cloud movement, fueling customer success with cloud storage built purposefully to unlock budgets, unburden administrators, and unleash innovators. Together with our partners, we’re helping customers break free from the restrictive, overpriced legacy solutions that hold them back, and blaze forward with the full power of the open cloud in their hands.
Founded in 2007, we scaled the business with less than $3 million in outside funding until 2021, when we did a traditional IPO on the Nasdaq stock exchange. Today, Backblaze generates over $100m in revenue and is the leading specialized storage cloud - managing over three billion gigabytes of data storage for 500K+ customers in 175+ countries, including businesses, developers, IT professionals, and individuals.
But while there is a lot to celebrate in our past, there is almost as much opportunity ahead of us. Backblaze is seeking a highly analytical,
systems-oriented
Director of Security Operations
to drive the planning, forecasting, deployment, and optimization of hardware infrastructure across our global cloud storage platform.
Role Overview
The Director of Security Operations leads the organization's day-to-day cybersecurity operations across traditional and AI-enabled environments. Reporting to the CISO, the Director leads Security Operations while partnering closely with the Director of Security Architecture & Engineering.
This is a hands-on technical leadership role requiring experience implementing and operating security controls as well as leading teams, incidents, and security programs.
Key Responsibilities
Lead security monitoring, incident response, threat hunting, security analytics, vulnerability management, adversary emulation, identity security, and operational resilience.
Establish operational priorities, service objectives, metrics, playbooks, and processes based on organizational risk and business needs.
Serve as incident commander for significant cybersecurity events and ensure lessons learned drive improvements to controls and operations.
Drive responsible adoption of AI-assisted detection, investigation, vulnerability analysis, threat hunting, and response capabilities.
Ensure effective security monitoring and response for AI applications, autonomous agents, workloads, and non-human identities.
Use automation to reduce manual work and compress detection, analysis, containment, and remediation timelines.
Partner with Security Architecture & Engineering to ensure controls are effectively designed, implemented, operationalized, monitored, and validated.
Develop security talent and provide the CISO with clear reporting on incidents, exposure, operational performance, risk, and program maturity.
Qualifications
Experience leading Security Operations, Incident Response, Detection Engineering, Vulnerability Management, IAM, or related cybersecurity functions.
Demonstrated hands-on experience implementing and operating security controls across cloud, infrastructure, applications, identity, endpoints, and networks.
Strong technical understanding of security analytics, detection engineering, exposure management, adversary emulation, and identity security.
Experience leading significant cybersecurity incidents and cross-functional response activities.
Experience implementing security automation and AI-assisted operational capabilities.
Strong leadership, mentoring, communication, and executive presentation skills.
Experience in cloud-native or large-scale distributed environments and familiarity with modern cybersecurity and AI-risk frameworks is preferred.
Backblaze Perks:
Healthcare for family, including dental and vision
Competitive compensation and 401K
RSU grants for full-time employees
ESPP program
Flexible vacation policy
Maternity & paternity leave
MacBook Pro to use for work plus a generous stipend to personalize your workstation
Childcare bonus (human children only)
Fertility treatment and support
Learning & development program
Commuter benefits
Culture that supports a healthy work-life balance
To provide greater transparency to candidates, we share base pay ranges for all US-based job postings regardless of state. We set standard base pay ranges for all roles based on function, level, and country location, benchmarked against similar-stage growth companies. Final offer amounts are determined by multiple factors, including candidate location, skills, depth of work experience, and relevant licenses/credentials, and may vary from the amounts listed below.
The base pay range for this position is $205,000 - $230,000
At Backblaze, we value being fair and good to our customers, partners, and employees. That’s why diversity, equity, and inclusion are at the core of our values. We are committed to fostering a workforce where all employees feel a sense of belonging regardless of race, ethnicity, nationality, gender, sexual orientation, age, religion, socio-economic status, ability, veteran status, and education. We believe that our dedication to cultivating a diverse workspace not only allows us to better serve our customers in over 175 countries, but further reinforces our commitment to doing the right thing.
We are proud to be an Equal Opportunity Employer.
To understand more about the data we collect and process as part of your application, please view our
Backblaze Employee Privacy Notice.
Location: New York; Stockholm; San Francisco
Workplace: OnSite
ABOUT US:
AI NEEDS A NEW INFRASTRUCTURE LAYER. WE'RE BUILDING IT AT MODAL.
Every era of computing brought new workloads that previous infrastructure couldn't support: mainframes, databases, and the cloud. Each time, the company that rebuilt the layer underneath defined the decade. AI is no different, except it touches everything instead of one slice, and the window to build the layer underneath it is open right now.
Our customers include category-defining companies like Ramp https://modal.com/blog/how-ramp-built-a-full-context-background-coding-agent-on-modal, Cognition, DoorDash, and Suno. They rely on Modal for instant GPU access, sub-second container starts, and native storage, so it's simple to serve low-latency inference, fine-tune models, and access production-ready sandboxes at scale.
We've passed $1B in annualized run rate, up 15x from a year ago. In October 2026 we raised a $750M Series D led by Accel at a $15.75B valuation.
Our team includes creators of popular open-source projects (e.g.,Seaborn https://github.com/mwaskom/seaborn,Luigi https://github.com/spotify/luigi), academic researchers, international olympiad medalists, and experienced engineering and product leaders with decades of experience.
THE ROLE:
We’re looking for a Detection & Response Engineer to build the systems that help us identify, investigate, and respond to threats across our platform.
This is an engineering role focused on automation. You’ll build detections, investigation tooling, and response capabilities that scale with our infrastructure, using AI where it meaningfully improves signal, investigation speed, and operational effectiveness.
You’ll work closely with infrastructure, platform, and security engineers to ensure every incident makes the platform more resilient.
WHAT YOU'LL WORK ON:
Detection Engineering
- Design and build high-fidelity detections for attacks, abuse, and anomalous behavior across our infrastructure and production systems
- Continuously improve detections based on telemetry, threat intelligence, and lessons learned from incidents
- Improve visibility across cloud infrastructure, containers, identity systems, and production services
Incident Response
- Lead or participate in investigations spanning production infrastructure, cloud environments, and internal systems
- Build playbooks and automation that reduce investigation time and improve response consistency
- Drive post-incident improvements that eliminate entire classes of future incidents
Security Tooling & Automation
- Build internal tooling that improves detection, investigation, and response workflows
- Leverage LLMs to automate repetitive analysis, accelerate investigations, and surface actionable insights from security telemetry
- Improve the collection, quality, and usability of security telemetry across the platform
Engineering Partnership
- Partner with engineering teams to ensure new systems are observable and secure by default
- Help teams instrument services with the telemetry needed for effective detection and response
- Drive security improvements that make the platform easier to defend over time
YOU MAY BE A FIT IF:
- You have experience in detection engineering, incident response, security engineering, or software engineering with a strong security focus
- You have strong software engineering skills and experience building production systems.
- You’ve investigated security incidents in cloud-native or distributed environments
- You’re familiar with modern cloud infrastructure, Kubernetes, Linux, and networking
- You’ve built detections using logs, telemetry, behavioral signals, or large-scale event data.
- You have strong SQL skills for investigating security events and developing detections
- You’re interested in applying AI and LLMs to detection, investigation, and response, and in understanding emerging threats involving AI-powered systems
- You have strong written and verbal communication skills
NICE-TO-HAVE:
- Experience building AI- or LLM-powered security tooling
- Experience with SIEM, SOAR, or EDR platforms
- Experience with Kubernetes security or large-scale cloud infrastructure
- Experience with threat hunting, malware analysis, or digital forensics
- Experience contributing to security operations in a high-growth engineering organization
Location: United States, San Mateo, CA
Why Sony Interactive Entertainment?
Sony Interactive Entertainment isn’t just the Best Place to Play — it’s also the Best Place to Work. Sony Interactive Entertainment (SIE) is the company behind the PlayStation brand. As a subsidiary of Sony Group Corporation, we’re part of a proud legacy of innovation and excellence. SIE is a dynamic technology company, delivering cutting-edge hardware and network services to more than 100 million people and an entertainment leader, home to some of the most beloved and recognizable intellectual properties (IP) in the world. Our role at SIE is to create and nurture the experiences under the PlayStation brand, a name synonymous with entertainment excellence and creativity.
Sr
Director, Integrated Analytics Partner
(
Platform & Product Analytics
)
San Mateo
, CA
Remote also considered.
Who We Are
At
Sony Interactive Entertainment (SIE) PlayStation, we create unforgettable gaming experiences—and
we're
just as committed to building a world-class team. As a leader in interactive entertainment, PlayStation
operates
at
a massive scale, supporting millions of players worldwide and processing billions of transactions annually across our digital ecosystem.
About the Role
We are seeking a Senior Director, Integrated Analytics Partner – Platform & Product Analytics to serve as the strategic analytics leader embedded within both our Platform Strategy & Product Management organizations. This role is responsible for defining and executing the analytics strategy that helps inform our long-term platform strategy, provides Product Management analytics in support of the ongoing evolution of our player experience, as well as competitive intelligence across the enterprise.
As the primary analytics partner to Platform Strategy & Product Management leadership, this role will translate business priorities into a coordinated analytics portfolio across Reporting, Applied Analytics, and Data Science. The Senior Director will directly lead the Applied Analytics team while providing strategic direction to the Data Science and Reporting squads aligned to Platform & Product initiatives.
The ideal candidate for this role combines a
demonstrated
ability to drive change at scale through the application of analytics, an exceptionally strong strategic orientation,
and
depth of understanding of the Product Management function and how the application of analytics, including rigorous testing, can improve
the consumer
experience. Boundless curiosity,
creativity
and enthusiasm for envisioning and then shaping the future, in a complex category that is ever evolving,
is a welcome trait.
PlayStation may be a market leader, but the analytics team is filled with people
who are obsessed with improving in every area we can, care deeply about their role in catalyzing the success of our stakeholders
,
our partners & creators, and, most importantly, improving the experiences of our players
,
cultivating the joy
of
gaming.
This role will provide a unique perspective on the future of gaming—and, for the right person, the ability to help shape it.
Key Responsibilities
Strategic Analytics Leadership
Define and drive the
Platform &
Product
Analytics strategy
, ensuring alignment with
company
objectives
and long-term platform growth
.
Maintain a
holistic portfolio view across
R
eporting,
A
pplied
A
nalytics, and
D
ata
S
cience initiatives
supporting
Platform &
Product
.
Identify
opportunities to
leverage
analytics to improve
product strategy, roadmap decisions, and investment priorities
.
Executive Partnership and Communication
Serve as the
primary analytics partner to
Platform &
Product
leadership
, acting as the
central point
of contact for analytics strategy and insights.
Deliver executive-level analytics updates and strategic insights to senior stakeholders
on
a regular
cadence
.
Translate complex analytical insights into clear, actionable narratives that influence
Platform &
Product
strategy and investment decisions.
Cross-Functional Collaboration
Enthusiasm for building relationships and deep partnerships, including
a
instinct for seeking opportunities to “win together,” is
absolutely critical
for this role
Partner with the Data Science
and Reporting Leads to
provide
prioritization guidance on their roadmaps
.
Identify
cross-functional opportunities to accelerate impact and
eliminate
redundant analytics
work
across teams.
Ensure business context and strategic priorities are clearly communicated to squads.
Leadership and Team Development
Lead and develop the
Applied Analytics team
,
building strong analytical capabilities and career growth for team members.
Provide dotted-line leadership to
Data Science and Reporting squads supporting
Platform &
Product
,
ensuring alignment with
Platform &
Product
priorities.
Foster a culture of experimentation, analytical rigor, and measurable impact across the analytics organization.
Resource and Portfolio Management
Advocate for analytics investments, including headcount, tooling, and platform capabilities.
Provide recommendations on how best to
a
llocate
analytics resources across initiatives based on strategic importance and business impact.
Make and communicate prioritization decisions across analytics teams supporting
Platform &
Product
initiatives.
Qualifications and Education Requirements
Bachelor’s degree in
Business
,
Computer Science
, Economics, Statistics, Data Science, or a related quantitative field
(Master’s or MBA preferred).
1
8
+ years of experience in
a blend of analytics disciplines, including
product
management
analytics,
testing,
data science,
analytics leadership,
and
business intelligence
, including leadership roles.
Proven experience leading analytics teams and delivering
data-driven insights that influence
product
strategy and
platform development
.
Management consulting experience
as part of
an analytics practice
is
a significant plus when combined with
subsequent
client-side experience
Experience defining and tracking
product performance metrics and analytics frameworks
that guide product decision making.
Demonstrated ability to influence senior leadership and communicate complex analytical concepts to non-technical stakeholders.
Preferred Skills
Deep experience with
product analytics frameworks, including user behavior analysis, product adoption metrics, and feature performance measurement
.
Experience with experimentation frameworks such as A/B testing and product experimentation
.
Strong
proficiency
with analytics and data tools such as
SQL, Python, R, or similar statistical environments
.
Familiarity with competitive intelligence analysis, benchmarking frameworks, and market performance metrics.
Ability to lead complex cross-functional initiatives involving product, data science, and engineering teams.
Exceptional communication and storytelling skills to convey insights and influence strategic decisions
is critical
.
#LI-KS1
At SIE, we consider several factors when setting each role’s base pay range, including the competitive benchmarking data for the market and geographic location.
Please note that the base pay range may vary in line with our hybrid working policy and individual base pay will be determined based on job-related factors which may include knowledge, skills, experience, and location.
In addition, this role
is eligible
for SIE’s top-tier benefits package that includes medical, dental, vision, matching 401(k), paid time off, wellness program and coveted employee discounts for Sony products.
This role also may be eligible for a bonus package.
Click
here
to learn more.
The estimated base pay range for this role is listed below.
$292,300
—
$438,500 USD
Please note, Sony Interactive Entertainment conducts background checks at the offer stage for all new employees (which may include criminal background checks for some roles) and will need to process personal information to support these checks.
Please refer to our Candidate Privacy Notice (where applicable) for more information about what personal information we collect, how we use it, who we share it with, and your data protection rights.
Equal Opportunity Statement:
Sony is an Equal Opportunity Employer. All persons will receive consideration for employment without regard to gender (including gender identity, gender expression and gender reassignment), race (including colour, nationality, ethnic or national origin), religion or belief, marital or civil partnership status, disability, age, sexual orientation, pregnancy, maternity or parental status, trade union membership or membership in any other legally protected category.
We strive to create an inclusive environment, empower employees and embrace diversity. We encourage everyone to respond.
Sony Interactive Entertainment is a Fair Chance employer and qualified applicants with arrest and conviction records will be considered for employment.
Location: Tel Aviv-Yafo, Tel Aviv District, Israel
About Aidoc
Aidoc is the market leader in healthcare AI and has developed the world's largest clinical frontier model, supporting nearly 50 million patients each year.
Aidoc is deployed in more than 2,000 medical centers worldwide. Since our founding in 2016, Aidoc has raised over $500 million and achieved a record number of FDA-cleared solutions.
Medical diagnosis is hitting a breaking point, where the number of physicians hasn't kept up with the rapidly growing patient load. This leads to misdiagnosis and treatment delays that result in hundreds of thousands of deaths every year. Aidoc assists clinicians by precisely highlighting diseases directly on medical images, preventing misdiagnosis and ensuring that urgent patients receive the immediate attention they need.
About this role
As a SecOps Engineer, you will help protect Aidoc’s cloud environments, products, corporate systems, and sensitive healthcare data by investigating SIEM alerts, supporting incident response, and improving the quality of security monitoring and operations.
This is a hands-on security operations role for someone who can analyze security signals, understand real risk, communicate clearly, and help the organization detect, investigate, and respond quickly and effectively to security events.
You will work closely with real production environments, where accurate investigation, clear documentation, and practical escalation are critical to protecting sensitive healthcare data, customer trust, and the reliability of Aidoc’s clinical AI platform.
Responsibilities
Own the end-to-end investigation of SIEM alerts across cloud, product, identity, endpoint, and SaaS environments: analyze the relevant evidence, separate false positives from real threats, and prioritize cases based on risk and impact.
Escalate high-risk findings with a clear summary of what happened, what is affected, why it matters, and what actions are required.
Support incident response by collecting evidence, assisting with containment, tracking remediation, and maintaining clear investigation records for internal reviews, compliance needs, and post-incident learning.
Improve SIEM rules, dashboards, alert logic, playbooks, telemetry coverage, and detection quality to reduce noise and strengthen security monitoring.
Work with Security, IT, DevOps, R&D, Product Security, and Compliance teams to resolve issues and improve security operations.
Requirements
2+ years of experience in Security Operations, SOC analysis, detection and response, incident response, cloud security operations, or a similar hands-on security role.
Hands-on experience with SIEM-based investigations, including alert triage, log analysis, event correlation, evidence review, case prioritization, and escalation.
Experience working with security telemetry from cloud platforms, identity providers, endpoints, SaaS systems, network tools, application logs, and production environments.
Familiarity with cloud-native environments, including IAM, storage access, workloads, Kubernetes, containers, APIs, logging, monitoring, and CI/CD pipelines.
Understanding of common attack techniques, including credential compromise, phishing, privilege escalation, suspicious API activity, malware, data exposure, lateral movement, and cloud misconfigurations.
Experience with identity and endpoint investigation, including SSO, MFA, service accounts, privileged access, EDR alerts, and suspicious user or device activity.
Ability to use query or scripting languages such as KQL, SPL, SQL, Python, Bash, or similar.
Familiarity with incident response workflows, case management, evidence collection, remediation tracking, and post-incident review.
Strong analytical judgment, with the ability to separate false positives from real risk and explain findings clearly.
Ability to work independently, document investigations clearly, and escalate issues with the right level of urgency.
Strong communication skills and the ability to work with Security, IT, DevOps, R&D, Product Security, Compliance, and business stakeholders.
Close attention to detail, strong ownership, and comfort working in a fast-moving production environment.
Additional Strengths
Experience in healthcare, healthtech, medical devices, digital health, or regulated software environments.
Familiarity with HIPAA, GDPR, SOC 2, ISO 27001, NIST CSF, or similar security and privacy frameworks.
Familiarity with MITRE ATT&CK, detection logic, attacker behavior, and investigation playbooks.
Experience with threat hunting, detection engineering, malware analysis, forensics, or advanced incident response.
Experience with SOAR platforms, case management systems, threat intelligence feeds, detection-as-code, or SOC automation.
Experience improving SOC metrics such as alert noise, false-positive rate, time to triage, time to escalation, and investigation quality.
Experience working with sensitive data, PHI/PII, customer-facing environments, or audit-ready evidence collection.
Working at Aidoc
Our Perks:
Be part of something big - using cutting-edge technologies to transform the Healthcare industry (while saving patients’ lives)
We work in a hybrid model, with our new offices located at 34 HaMasger Street in Tel Aviv and parking for employees.
Amazing and healthy breakfasts and lunches prepared daily by our personal chef!
Stocked up kitchen & meal card
Wellness: Aidoc employees-only gym, plus Pilates, Yoga, and functional workouts classes.
Amazing culture - collaborative, transparent & fun!
Attractive compensation package & benefits
Aidoc is deeply committed to creating an inclusive workplace, and to the principle of equal opportunity for all individuals. We prohibit discrimination and harassment based on race, color, religion, sex, sexual orientation, gender identity, national origin, age, disability, veteran status, or any other status protected by law.
Location: Remote - Europe
About Nebius:
Nebius is leading a new era in cloud infrastructure for the global AI economy. We are building a full-stack AI cloud platform that supports developers and enterprises from data and model training through to production deployment, without the cost and complexity of building large in-house AI/ML infrastructure.
Built by engineers, for engineers. From large-scale GPU orchestration to inference optimization, we own the hard problems across compute, storage, networking and applied AI.
Listed on Nasdaq (NBIS) and headquartered in Amsterdam, we have a global footprint with R&D hubs across Europe, the UK, North America and Israel. Our team of 1,500+ includes hundreds of engineers with deep expertise across hardware, software and AI R&D.
Detection and Response
The Detection and Response team is responsible for detection engineering, threat intelligence, and incident response across Nebius Cloud. Its goal is to improve and maintain Nebius's security monitoring capabilities, as well as to build and maintain an end-to-end Security Incident Response program - people, processes, and tools.
The Role
We're hiring a Detection & Response Engineer to build and run our D&R capability from the ground up. You'll work on detection engineering, threat intelligence, and incident response functions across Nebius
Cloud.
You'll be responsible for detection development, handling complex security incidents, forensics, and shaping the D&R strategy.
What you’ll
do
Detection development: maintain low false-positive and false-negative rates. Work closely with alerts consumers (20+ teams) to keep noise low and signal high, ensuring they can act quickly without missing genuine threats.
Architect and operate detection coverage across our
cloud
and bare-metal environments
Build and extend our internal D&R tools and pipelines - onboard new logs, build and automate response runbooks.
Integrate threat intelligence into detection logic and IR playbooks, tracking adversary TTPs relevant to Cloud infrastructure
Lead incident response end-to-end: scoping, containment, root cause analysis, post-incident
reviews and controlling critical action items are closed to prevent future possible incidents.
Partner with Compliance and Engineering teams to detect real threats while meeting the needs of both engineers and regulators.
Define and report on D&R metrics: MTTD, MTTR, detection coverage, false positive rates, etc.
Build and maintain Security Incident Response program: people, processes, tools.
Build tools, runbooks, and on-call processes that scale as the company grows.
What we look for
6+ years in security operations, detection engineering, or incident response.
Deep hands-on experience with cloud-native environments (Kubernetes, Linux workloads, container-based infrastructure).
Strong detection engineering skills: writing and tuning rules/detections in
SIEM platforms
(e.g., Chronicle, Splunk, Elastic) and SQL.
Experience building or operating SOAR workflows and
automating
response at scale (ideally with Golang and Temporal).
Working knowledge of threat intelligence frameworks (MITRE ATT&CK,
Pyramid of Pain, Kill Chain
) and how to operationalize them in detections.
Solid IR fundamentals: memory forensics, log analysis, network traffic analysis, and post-incident reporting.
Stakeholder management: able to coordinate across engineers, compliance, legal, executives during active incident phase. Serve as the primary owner and driver for complex changes, as a result of incidents post-mortem.
Nice to have
Experience with AI/ML and GPU clusters related threats.
Familiarity with eBPF-based detection or runtime security tooling (Falco, Tetragon).
Background in threat hunting.
Why this role at Nebius
Build D&R at a company scaling from startup to global infrastructure provider in real time.
Ability to evolve our internal D&R platform into a new cloud security product, delivering novel security observability for a range of neocloud customers - from big tech to AI startups.
Work alongside world-class engineers on infrastructure that powers frontier AI.
Competitive compensation with equity upside in a Nasdaq-listed, high-growth company.
Flexible, remote-first culture.
Hiring Process
Recruiter's chat (30mins)
Live-coding interview (60mins) to asses basic coding skills
Security interview (60mins) to asses domain expertise
Incident Response interview (90mins) to assess practical experience
Final interview to close the hiring process (45mins)
#LI-CP1
Benefits & Perks:
Competitive compensation
Career growth and learning opportunities
Flexibility and ownership
Collaborative and innovative culture
Opportunity to work on impactful AI projects
International environment and talented teams
What's it like to work at Nebius:
Fast moving - Bold thinking - Constant growth - Meaningful impact - Trust and real ownership - Opportunity to shape the future of AI
Equal Opportunity Statement:
Nebius is an equal opportunity employer. We are committed to fostering an inclusive and diverse workplace and to providing equal employment opportunities in all aspects of employment. We do not discriminate on the basis of race, color, religion, sex (including pregnancy), national origin, ancestry, age, disability, genetic information, marital status, veteran status, sexual orientation, gender identity or expression, or any other characteristic protected by applicable law.
Applicants must be authorized to work in the country in which they apply and will be required to provide proof of employment eligibility as a condition of hire.
If you need accommodations during the application process, please let us know.
Задачи:
— Развертывание и поддержка облачной инфраструктуры в AWS (IaC через Terraform)
— Администрирование кластеров Kubernetes (EKS) и управление деплоем через Helm
— Настройка, оптимизация и защита пайплайнов в GitLab CI и GitHub Actions
— Внедрение инструментов сканирования уязвимостей (SAST/DAST) и управление секретами в HashiCorp Vault
— Настройка сквозного мониторинга и логирования (Prometheus, Grafana, ELK/Loki, Sentry), оперативное реагирование на инциденты
— Участие во внедрении и поддержании практик информационной безопасности по стандарту ISO 27001
— Настройка и поддержка веб-серверов (Nginx), управление VPN, SSL/TLS сертификатами и DNS
Требования:
— Уверенное знание Linux (Ubuntu/RHEL) и владение Bash для автоматизации
— Практический опыт работы с AWS (EKS, IAM, S3, RDS) и Ansible
— Глубокое понимание процессов контейнеризации (Docker, Kubernetes) и автоматизации CI/CD
— Понимание принципов сетевой безопасности, опыт работы с криптографическими протоколами и системами управления секретами
— Знание принципов и практический интерес к внедрению стандартов безопасности ISO 27001
Условия:
— Официальное оформление в соответствии с регламентом МФЦА (AIFC)
— График работы 5/2, гибкий гибридный формат (сочетание офиса в Алматы и удаленки) с гибким началом дня
— Стабильная заработная плата
— Интересные и динамичные digital-проекты (включая AI-интеграции и масштабные веб-платформы)
— Сильная техническая команда, минимум бюрократии и открытость к вашим технологическим инициативам
ГибридseniorАлматы
УдалённоСША; Lastly, the provided range is the expected salary for candidates in the U.S