Вакансии

Location: Tel Aviv, Israel About Nebius: Nebius is leading a new era in cloud infrastructure for the global AI economy. We are building a full-stack AI cloud platform that supports developers and enterprises from data and model training through to production deployment, without the cost and complexity of building large in-house AI/ML infrastructure. Built by engineers, for engineers. From large-scale GPU orchestration to inference optimization, we own the hard problems across compute, storage, networking and applied AI. Listed on Nasdaq (NBIS) and headquartered in Amsterdam, we have a global footprint with R&D hubs across Europe, the UK, North America and Israel. Our team of 1,500+ includes hundreds of engineers with deep expertise across hardware, software and AI R&D. The role Nebius is seeking a deeply experienced Security Analyst - Tier 3 for its Security Operations Center (SOC). This role is a senior individual-contributor position, leading challenging investigations, setting the standards the SOC operates by. This role reports to the SOC Manager, under the Detection and Response function within the CISO Office. Your responsibilities will include: Lead complex, multi-stage, multi-domain investigations end to end, from scoping through deep technical analysis to a clear determination of impact and root cause. Serve as the SOC's senior escalation point and the quality gate for investigations across the team. Support the Incident Response team during confirmed incidents with continued telemetry investigation, scoping, and analytical depth. Continuously sharpen how the SOC investigates, identifying gaps in methods, runbooks, and tooling through daily casework and turning them into concrete improvements. Mentor Tier 1 and Tier 2 analysts through case reviews, coaching, and pairing during investigations. Partner with Security Engineering, Platform Security, Threat Intelligence, SOC Automation, and additional teams to turn what the SOC learns into stronger detection and response across Nebius. Participate in readiness activities - tabletops, post-incident reviews, and purple-team engagements. Participate in the on-call rotation as the senior point of contact outside business hours. We expect you to have: Experience Around 8-10 years of hands-on experience in security operations or incident response, with a track record of leading complex investigations. Technical Expertise Expert-level investigation capability across multiple domains: endpoint, identity, cloud, and network. Solid understanding of cloud-native environments, including containers, Kubernetes. Deep practical fluency with EDR, SIEM query languages, and log analysis. Deep knowledge of Windows and Linux internals, applied to artifact and behavioral analysis. Fluency in attacker TTPs (MITRE ATT&CK), including the Cloud and Containers matrices. Strong scripting and data-analysis skills (Python, SQL/KQL) for investigation at scale, with the ability to validate findings independently and challenge assumptions. Advanced certifications such as GCIH, GCFA, GNFA, GCFE, or OSCP are an advantage. Leadership & Communication Technical leadership through credibility, raising the team's bar without relying on formal authority. Calm and structured during high-severity incidents, making sound decisions amid uncertainty. Excellent written communication, turning complex investigations to clear narratives others can act on. Fluent in English, written and verbal, comfortable working with international teams and stakeholders. Benefits & Perks: Competitive compensation Career growth and learning opportunities Flexibility and ownership Collaborative and innovative culture Opportunity to work on impactful AI projects International environment and talented teams What's it like to work at Nebius: Fast moving - Bold thinking - Constant growth - Meaningful impact - Trust and real ownership - Opportunity to shape the future of AI Equal Opportunity Statement: Nebius is an equal opportunity employer. We are committed to fostering an inclusive and diverse workplace and to providing equal employment opportunities in all aspects of employment. We do not discriminate on the basis of race, color, religion, sex (including pregnancy), national origin, ancestry, age, disability, genetic information, marital status, veteran status, sexual orientation, gender identity or expression, or any other characteristic protected by applicable law. Applicants must be authorized to work in the country in which they apply and will be required to provide proof of employment eligibility as a condition of hire. If you need accommodations during the application process, please let us know.

Location: Warsaw, Poland; Prague, Czechia; Sofia, Bulgaria; Bucharest, Romania; Madrid, Spain; Tbilisi, Georgia CloudLinux is a global remote-first company. We are driven by our principles: do the right thing, employees first, we are remote first, and we deliver high-volume, low-cost Linux infrastructure and security products that help companies to increase the efficiency of their operations. Every person on our team supports each other and does what we can to ensure we all are successful. Check out our website for more information https://cloudlinux.com/ Imunify360 Security Suite is a product of CloudLinux Inc., the maker of the #1 OS in security and stability for hosting providers. Imunify is an innovative security solution designed specifically for shared and VPS/Dedicated servers. The automated, easy-to-use solution with the six-layer approach to security delivers comprehensive and complete attack prevention. The mission We protect web hosting providers and the sites running on their infrastructure through a defense-in-depth stack: web-server-layer WAF, runtime application self-protection for PHP, deep application integrations (WordPress plugins and similar), a malware scanner with cleanup capability, and network-layer firewalls and IP reputation. The pieces talk to each other, and the threat intelligence they generate at scale powers detection across the stack. Node.js is the segment of the hosting market growing fastest, and the next layer we want to build for it is runtime protection inside the Node.js process itself. Most Node.js workloads on managed hosting today are AI-generated web apps deployed by non-technical owners who can't, won't, and shouldn't be expected to patch their own code or audit their own dependencies. We're going to defend those apps anyway — at runtime, without their cooperation, without breaking them. You'll build that runtime protection layer end-to-end. What you'll own The product. A brand-new product line, yours to define — what we intercept, what we don't, what the customer-visible surface looks like. The technical approach. Instrumentation strategy, deployment shape, programming language — all open. You'll consult with our architects but the direction is yours. Implementation, end to end. You'll have the full tooling stack we provide — LLM subscriptions, modern dev infrastructure, the works. Use what makes you fast. Methodology. How you build conviction in your detection logic — your call. Cross-layer signal. Our existing stack produces threat intelligence at unmatched scale: tens of millions of monitored sites, petabyte-scale malware sample storage, real-time domain and URL reputation, IP-level attack feeds. These are available for you to plug into. Use what helps. How we'll measure success The product is held to four numbers: runtime overhead, false positives, false negatives, and customer-escalation volume. They reflect what hosting providers and their customers care about. Hit them well and the product runs inside a meaningful slice of the modern Node.js web. What we're looking for An experienced researcher or engineer who can build and iterate on a brand-new product, driving both the research and the development. The hard part of this work is knowing what's malicious, what's vulnerable, and what's just an unusual but legitimate pattern — and being right about it across the long tail of frameworks, libraries, and customer code we'll encounter in production. Requirements Must have: Proven experience building and shipping a new product, security solution, major feature, or technical system from scratch. Strong evidence of end-to-end technical ownership, from initial investigation and architecture through implementation, release, and production iteration. Strong web application security knowledge and current knowledge of practical exploitation. A working sense of how detection rules behave at scale — what catches attackers without flagging the long tail of legitimate code. Ability to start as the PM, architect, lead engineer, and QA for this product. You ask for resources or help when you need them; you don't wait to be told what to do. Comfort directing AI coding agents to high-quality output. Nice to have: Prior work on runtime-protection products, application firewalls, or instrumentation tooling. Background in malware analysis or incident response. Familiarity with managed-hosting environments. Public security research, vulnerability disclosures, or detection rulesets you've authored. Familiarity with the Node.js runtime and the JavaScript ecosystem. What it's not Not a scope-and-handoff role — you drive the work and own the outcome. Not a "platform team will productize this later" role — you ship to real customer fleets and watch the telemetry quickly. Not a spec-and-review role — you are hands-on every day. Why this matters Most managed-hosting customers are not developers. They cannot patch their apps. They cannot audit their dependencies. They will keep deploying vulnerable code from AI assistants because that's how modern web apps get built now. The textbook advice — "secure your code, audit your dependencies" — does not apply to them. If we don't intercept exploits at runtime, nobody will. The numbers you hit on detection, performance, and false positives will materially affect how much of the modern web stays online when the next exploit class drops. Benefits What's in it for you? A focus on professional development. Interesting and challenging projects. Fully remote work with flexible working hours, that allows you to schedule your day and work from any location worldwide. Paid 24 days of vacation per year, 10 days of national holidays, and unlimited sick leaves. Compensation for private medical insurance. Co-working and gym/sports reimbursement. Budget for education. The opportunity to receive a reward for the most innovative idea that the company can patent. By applying for this position, you consent to the processing of your personal data as described in our Privacy Policy ( https://cloudlinux.com/candidate-privacy-notice ), which provides detailed information on how we maintain and handle your data.

Location: United Kingdom What We Do: Cybercrime is growing, and more businesses are getting hit by threats that used to target only the biggest organizations. That pushes defenders like us to operate at the highest level, and it deepens our need for good people who want to make a meaningful impact. Founded in 2015 by former NSA cyber operators, Huntress is a remote-first team working to make enterprise-grade cybersecurity accessible to businesses of all sizes. We work closely with security teams and service providers protecting complex environments, often without the time or headcount to handle it all. That’s why we build our technology in-house and back it with a 24/7 human-led Security Operations Center (SOC). As a result, our platform is never disconnected from the experts who manage it, ensuring our customers' protection. Huntress now secures more than 6M endpoints and 17M identities worldwide. Those numbers keep growing because more businesses rely on us to help carry the load and operate with more confidence. Every day, you can see that commitment in how we stand with our customers and how we show up for each other. Reports to: Manager, Security Operations Center Location: Remote UK Compensation Range: £62,000 to £70,500 base plus bonus and equity What You’ll Do: Huntress is looking for a Security Operations Center Analyst to add to our growing team. In this role, you will get to triage, investigate, respond, and remediate a variety of intrusions on a daily basis. You’ll be surrounded by passionate individuals who are mission-driven to help protect companies around the world from cyber-attacks and will have daily opportunities to progress your analyst skillset and accelerate your career growth. The Huntress Security Operations Center is an elite team of individuals who wake up every day to combat threat actors. You will have daily opportunities to progress your analysis skills while being at the forefront of what’s happening in the wild. If you’re looking to accelerate your career and skills, this is the team for you! Responsibilities: Triage, investigate, and respond to alerts from the Huntress platform Perform tactical review of EDR telemetry, log sources, and forensic artifacts to determine the root cause of attacks where possible and provide remediations needed to remove the threat Perform tactical malware analysis as part of investigating and triaging alerts Investigate suspicious Microsoft M365 activity and provide remediations Assist in escalations from the Product Support team for threat-related and SOC-relevant questions Contribute to detection engineering creation and tuning efforts Contribute to projects focused on driving better outcomes for our analysts and partners Contribute to our collaboratively mentored team (we're all here to make each other better!) What You Bring To The Team: 2+ years experience in a SOC or Digital Forensics (DFIR) role Demonstrated experience with Windows, Linux, and MacOS as an attack surface Demonstrated experience with basic Threat Actor tools and techniques: (MITRE ATT&CK Framework, PowerShell & Command Prompt Terminals, WMIC, Scheduled Tasks, SCM, Windows Domain and host Enumeration Techniques, Basic Lateral Movement Techniques, Basic Persistence Mechanisms, Basic Defense Evasion Techniques, other offensive/Red Team TTPs) Demonstrated experience with static and dynamic malware analysis concepts Working knowledge of Windows Administration or Enterprise Domain Administration Active Directory, Group Policy, Domain Trusts, etc. Working knowledge of core networking concepts Common ports/protocols, NAT, Public/Private IPs, VLANs, etc. Working knowledge of web technologies and concepts Web servers/applications, OWASP top 10, etc. Effective communication skills, with the ability to explain complex events to less technical audiences, enabling effective cross-functional collaboration within the SOC and across departments Dedicated to prioritizing and addressing customer needs and concerns in all decision-making processes A strong sense of curiosity and a genuine excitement for learning Preferred Qualifications: Previous experience in an MSP/MSSP/MDR role Linux and MacOS investigative experience Experience with scripting languages (such as PowerShell, Python, Bash, PHP, JavaScript, or Ruby) Demonstrated experience on platforms such as HackTheBox, TryHackMe, Blue Team Labs Online, etc. Demonstrated experience with Cloud-based investigations such as M365, Azure, AWS, GCP, etc. Participation in cybersecurity competitions such as Capture the Flags, the Collegiate Cyber Defense Competition, etc. Familiarity with MSP tools such as RMMs What We Offer: 100% remote work environment - since our founding in 2015 New starter home office set-up allowance (€480) Generous personal leave entitlements Digital monthly reimbursement (€111) Travel to the US 1-2 times/year for various company events Pension Access to the BetterUp platform for coaching, personal, and professional growth Huntress is committed to creating a culture of inclusivity where every single member of our team is valued, has a voice, and is empowered to come to work every day just as they are. We do not discriminate based on race, ethnicity, color, ancestry, national origin, religion, sex, sexual orientation, gender identity, disability, veteran status, genetic information, marital status, or any other legally protected status. We do discriminate against hackers who try to exploit businesses of all sizes. Accommodations: If you require reasonable accommodation to complete this application, interview, or pre-employment testing or participate in the employee selection process, please direct your inquiries to accommodations@huntresslabs.com . Please note that non-accommodation requests to this inbox will not receive a response. Huntress uses artificial intelligence tools to assist in reviewing and evaluating job applications, including resume screening, skills assessment, and candidate matching and comparisons. These AI tools support our human recruiters in the initial review process, but do not make final hiring decisions without human involvement. By submitting your application, you acknowledge this use of AI in our recruitment process. Please review our Candidate Privacy Notice for more details on our practices and your data privacy rights. #BI-Remote

Location: Ireland What We Do: Cybercrime is growing, and more businesses are getting hit by threats that used to target only the biggest organizations. That pushes defenders like us to operate at the highest level, and it deepens our need for good people who want to make a meaningful impact. Founded in 2015 by former NSA cyber operators, Huntress is a remote-first team working to make enterprise-grade cybersecurity accessible to businesses of all sizes. We work closely with security teams and service providers protecting complex environments, often without the time or headcount to handle it all. That’s why we build our technology in-house and back it with a 24/7 human-led Security Operations Center (SOC). As a result, our platform is never disconnected from the experts who manage it, ensuring our customers' protection. Huntress now secures more than 6M endpoints and 17M identities worldwide. Those numbers keep growing because more businesses rely on us to help carry the load and operate with more confidence. Every day, you can see that commitment in how we stand with our customers and how we show up for each other. Reports to: Manager, Security Operations Center Location: Remote Ireland Compensation Range: €70,000 to €90,000 base plus bonus and equity What You’ll Do: Huntress is looking for a Security Operations Center Analyst to add to our growing team. In this role, you will get to triage, investigate, respond, and remediate a variety of intrusions on a daily basis. You’ll be surrounded by passionate individuals who are mission-driven to help protect companies around the world from cyber-attacks and will have daily opportunities to progress your analyst skillset and accelerate your career growth. The Huntress Security Operations Center is an elite team of individuals who wake up every day to combat threat actors. You will have daily opportunities to progress your analysis skills while being at the forefront of what’s happening in the wild. If you’re looking to accelerate your career and skills, this is the team for you! Responsibilities: Triage, investigate, and respond to alerts from the Huntress platform Perform tactical review of EDR telemetry, log sources, and forensic artifacts to determine the root cause of attacks where possible and provide remediations needed to remove the threat Perform tactical malware analysis as part of investigating and triaging alerts Investigate suspicious Microsoft M365 activity and provide remediations Assist in escalations from the Product Support team for threat-related and SOC-relevant questions Contribute to detection engineering creation and tuning efforts Contribute to projects focused on driving better outcomes for our analysts and partners Contribute to our collaboratively mentored team (we're all here to make each other better!) What You Bring To The Team: 2+ years experience in a SOC or Digital Forensics (DFIR) role Demonstrated experience with Windows, Linux, and MacOS as an attack surface Demonstrated experience with basic Threat Actor tools and techniques: (MITRE ATT&CK Framework, PowerShell & Command Prompt Terminals, WMIC, Scheduled Tasks, SCM, Windows Domain and host Enumeration Techniques, Basic Lateral Movement Techniques, Basic Persistence Mechanisms, Basic Defense Evasion Techniques, other offensive/Red Team TTPs) Demonstrated experience with static and dynamic malware analysis concepts Working knowledge of Windows Administration or Enterprise Domain Administration Active Directory, Group Policy, Domain Trusts, etc. Working knowledge of core networking concepts Common ports/protocols, NAT, Public/Private IPs, VLANs, etc. Working knowledge of web technologies and concepts Web servers/applications, OWASP top 10, etc. Effective communication skills, with the ability to explain complex events to less technical audiences, enabling effective cross-functional collaboration within the SOC and across departments Dedicated to prioritizing and addressing customer needs and concerns in all decision-making processes A strong sense of curiosity and a genuine excitement for learning Preferred Qualifications: Previous experience in an MSP/MSSP/MDR role Linux and MacOS investigative experience Experience with scripting languages (such as PowerShell, Python, Bash, PHP, JavaScript, or Ruby) Demonstrated experience on platforms such as HackTheBox, TryHackMe, Blue Team Labs Online, etc. Demonstrated experience with Cloud-based investigations such as M365, Azure, AWS, GCP, etc. Participation in cybersecurity competitions such as Capture the Flags, the Collegiate Cyber Defense Competition, etc. Familiarity with MSP tools such as RMMs What We Offer: 100% remote work environment - since our founding in 2015 New starter home office set up reimbursement (£398) Generous personal leave entitlements Digital monthly reimbursement (£92) Travel to the US 1-2 times/year for various company events Pension Access to the BetterUp platform for coaching, personal, and professional growth Huntress is committed to creating a culture of inclusivity where every single member of our team is valued, has a voice, and is empowered to come to work every day just as they are. We do not discriminate based on race, ethnicity, color, ancestry, national origin, religion, sex, sexual orientation, gender identity, disability, veteran status, genetic information, marital status, or any other legally protected status. We do discriminate against hackers who try to exploit businesses of all sizes. Accommodations: If you require reasonable accommodation to complete this application, interview, or pre-employment testing or participate in the employee selection process, please direct your inquiries to accommodations@huntresslabs.com . Please note that non-accommodation requests to this inbox will not receive a response. Huntress uses artificial intelligence tools to assist in reviewing and evaluating job applications, including resume screening, skills assessment, and candidate matching and comparisons. These AI tools support our human recruiters in the initial review process, but do not make final hiring decisions without human involvement. By submitting your application, you acknowledge this use of AI in our recruitment process. Please review our Candidate Privacy Notice for more details on our practices and your data privacy rights. #BI-Remote

Location: United States, Remote Why Sony Interactive Entertainment? Sony Interactive Entertainment isn’t just the Best Place to Play — it’s also the Best Place to Work. Sony Interactive Entertainment (SIE) is the company behind the PlayStation brand. As a subsidiary of Sony Group Corporation, we’re part of a proud legacy of innovation and excellence. SIE is a dynamic technology company, delivering cutting-edge hardware and network services to more than 100 million people and an entertainment leader, home to some of the most beloved and recognizable intellectual properties (IP) in the world. Our role at SIE is to create and nurture the experiences under the PlayStation brand, a name synonymous with entertainment excellence and creativity. Reporting to the Director of Global Vulnerability Management, you will serve as a Senior Security Research Engineer and technical lead within SIE’s Global Vulnerability Management team. You will lead complex work that advances our Threat Exposure Management capability and supports our transition to a Continuous Threat Exposure Management operating model, while remaining directly engaged in vulnerability research, analysis, security validation, prioritization, and remediation support. You will partner across Information Security, engineering, technology, and business teams to improve how SIE discovers, prioritizes, validates, and mobilizes action on security risks. You will translate annual TEM goals into defined workstreams, delivery plans, success measures, and repeatable operating practices that improve visibility, decision-making, remediation outcomes, and program scale. Responsibilities Lead complex Global Vulnerability Management workstreams that advance SIE’s Threat Exposure Management capability and transition toward a Continuous Threat Exposure Management operating model across discovery, prioritization, validation, and mobilization. Translate annual TEM goals into defined delivery plans, milestones, success measures, dependencies, and repeatable operating practices. Monitor progress, identify barriers, and adjust execution to improve outcomes. Lead hands-on vulnerability research and technical analysis to confirm security conditions, eliminate false positives, characterize exploitability and business impact, and provide actionable remediation or mitigation guidance. Improve the discovery and assessment of vulnerabilities across SIE network, cloud, endpoint, application, container, and other technology environments. Develop risk-based prioritization using vulnerability and threat intelligence, exploitation evidence, asset and business context, control effectiveness, and remediation considerations. Lead security validation activities and develop proofs of concept when appropriate to distinguish material risk, evaluate defensive controls, and support informed decisions. Partner with Information Security teams and technology owners to mobilize remediation, clarify ownership, establish effective handoffs, resolve barriers, and measure progress through remediation, mitigation, or accepted disposition. Evolve GVM platforms, integrations, data, analytics, automation, and AI-enabled workflows to improve coverage, data quality, consistency, decision speed, and operational scale. Communicate vulnerability trends, material risks, remediation progress, and program outcomes to technical, operational, and leadership audiences through clear reports and recommendations. Mentor engineers and partner teams, contribute to technical standards and procedures, and improve the quality of vulnerability analysis, validation, documentation, and delivery. Maintain current knowledge of relevant vulnerabilities, exploitation techniques, threat activity, security technologies, and industry practices. Some travel may be required. Qualifications 8+ years of relevant experience in information security, information technology, systems engineering, or a related field, including substantial experience in vulnerability management, security research, or exposure management. Bachelor’s degree or equivalent in computer science, information security, or a related discipline. Experience leading complex technical workstreams across multiple teams, translating objectives into delivery plans, and achieving measurable outcomes without relying on direct reporting authority. Hands-on experience with vulnerability research, technical analysis, security validation, risk-based prioritization, and remediation or mitigation guidance. Experience assessing vulnerabilities across several technology domains, such as operating systems, networks, cloud services, applications, endpoints, containers, databases, or hybrid infrastructure. Experience with vulnerability discovery, assessment, validation, or exposure-management platforms and their supporting integrations. Knowledge of adversarial tactics, exploitation techniques, threat intelligence, and attack frameworks such as MITRE ATT&CK, with the ability to apply that information to vulnerability prioritization. Experience using scripting, programming, APIs, or automation to improve security analysis and operational workflows. Relevant technologies may include Python, SQL, Bash, PowerShell, JavaScript, or comparable languages. Experience analyzing and contextualizing security data to connect technical findings with asset, service, business, threat, control, and remediation information. Familiarity with software engineering practices such as version control, testing, code review, CI/CD, reusable components, and controlled production releases. Ability to communicate complex security conditions, priorities, tradeoffs, and recommendations clearly to technical, operational, and leadership audiences. Experience mentoring engineers or analysts and influencing technical practices across teams. Desired qualifications Experience helping evolve a traditional vulnerability-management function toward a TEM or CTEM operating model. Experience with continuous security validation, adversarial exposure validation, exploit research, or proof-of-concept development. Experience securing cloud, container, application, or build-pipeline environments and integrating security capabilities into engineering workflows. Experience with security-data and analytics platforms such as Snowflake, Domo, or comparable technologies. Experience applying automation, advanced analytics, or AI-enabled capabilities to vulnerability analysis, prioritization, validation, or remediation workflows. At SIE, we consider several factors when setting each role’s base pay range, including the competitive benchmarking data for the market and geographic location. Please note that the base pay range may vary in line with our hybrid working policy and individual base pay will be determined based on job-related factors which may include knowledge, skills, experience, and location. In addition, this role is eligible for SIE’s top-tier benefits package that includes medical, dental, vision, matching 401(k), paid time off, wellness program and coveted employee discounts for Sony products. This role also may be eligible for a bonus package. Click here to learn more. This is a flexible role that can be remote, with varying pay ranges based on geographic location. For example, if you are based out of Seattle, the estimated base pay range for this role is listed below. $175,500 — $263,300 USD Please note, Sony Interactive Entertainment conducts background checks at the offer stage for all new employees (which may include criminal background checks for some roles) and will need to process personal information to support these checks. Please refer to our Candidate Privacy Notice (where applicable) for more information about what personal information we collect, how we use it, who we share it with, and your data protection rights. Equal Opportunity Statement: Sony is an Equal Opportunity Employer. All persons will receive consideration for employment without regard to gender (including gender identity, gender expression and gender reassignment), race (including colour, nationality, ethnic or national origin), religion or belief, marital or civil partnership status, disability, age, sexual orientation, pregnancy, maternity or parental status, trade union membership or membership in any other legally protected category. We strive to create an inclusive environment, empower employees and embrace diversity. We encourage everyone to respond. Sony Interactive Entertainment is a Fair Chance employer and qualified applicants with arrest and conviction records will be considered for employment.

Location: Espoo Workplace: Hybrid ROLE HIGHLIGHTS: - Senior GRC Engineer (Security) - Location: Espoo, Finland - Department: Product Security - Reports to: VP Product Security - Employment type: Permanent - Workplace model: Hybrid - Employment is subject to applicable security screening (incl. SUPO, where required) WHY THIS ROLE MATTERS:   As Senior GRC Engineer (Security), you'll mature ICEYE's Security Governance, Risk and Compliance program across a multi-country, multi-regulator footprint, including Finland, Germany, Spain, Poland, the UK and Greece amongst others. ICEYE operates at the intersection of commercial space technology and sovereign defence, so our compliance posture (ISO 27001, NIS2, NIST, and national frameworks) has to be credible to customers who include governments and defence agencies. You'll be the person who keeps that posture accurate, current and audit-ready, maps client and national requirements to internal ICEYE requirements, as a senior individual contributor. This role will be working closely with all the ICEYE Security team domains, ICEYE IT, ICEYE product management and the Program Management Office, Engineering and Sales.   WHO WE ARE ICEYE is the world leader in sovereign intelligence from space. We deliver persistent monitoring capabilities to detect and respond to changes in any location on Earth.   ICEYE owns the world's largest and most advanced SAR (synthetic aperture radar) satellite constellation. To our customers we provide intelligence with unmatched quality, latency and revisit times, in any weather, day or night. To governments who choose to operate their own constellation we provide this proven capability as a sovereign system.   ICEYE-built constellations serve customers in defence and intelligence, environmental monitoring, insurance and emergency management. We enable fast decisions that contribute to a safer future.   Founded and headquartered in Finland, ICEYE operates globally with over 1000 employees across Europe, North America, the Middle East, and Asia-Pacific. YOUR DAY-TO-DAY RESPONSIBILITIES The position will evolve according to the needs of the company and the growing team. Initially, the position has two main aspects, which are adjacent and many initiatives will cross both, especially in terms of overlapping requirements and compliance evidence: - Product requirements and compliance: - Ensure clients’ and their national security requirements are at all times clearly translated accurately to ICEYE internal requirements across product, IT, and other ICEYE functions, and we can clearly communicate those towards existing and new clients. - Ensure ICEYE has evidence of fulfilling and complying with the requirements, preferably as compliance-as-code whenever possible. - Support ICEYE’s Product, the Missions business line, PMO and Sales on client requirements. Produce material to support accreditation and acceptance requirements. - Wider Iceye and regulatory compliance: - Continuously improve ICEYE's ISO 27001 ISMS, including risk assessments, the risk register, Statement of Applicability, internal audits and certification/surveillance audit cycles. - Track and operationalise NIS2, CRA and other EU product security obligations across ICEYE's in-scope entities, translating regulatory requirements into concrete policies, controls and evidence. - Prepare clear, concise compliance and risk reporting for senior leadership, including status against certifications, audits and remediation plans. - Maintain information security policies, standards and supporting documentation, ensuring they stay practical and enforceable rather than shelfware. - Act as a day-to-day point of contact for external auditors, certification bodies and regulators on GRC matters.   WHAT WE’RE LOOKING FOR Must haves: - Eligible for being cleared for a Personal Security Clearance as necessary as well as a citizenship or a permanent residency in the European Union. - Technical skills that allow you to interpret compliance requirements towards the product function; this includes being able to fluently discuss modern software architecture and development, deployment and release concepts. - Proven hands-on experience running ISO 27001 (implementation, internal audit, or certification maintenance) in a real organisation, not just theoretical knowledge or external auditing experience. - Working knowledge of NIS2, CRA, and how their obligations translate into practical controls and reporting. - Strong stakeholder management skills, with the ability to influence product management, engineering, IT, legal and leadership without formal authority. - Experience building or maintaining a risk register and running quantified risk assessments. - Comfortable operating independently across multiple countries and regulatory regimes. - Awareness of emerging AI governance frameworks (ISO 42001, NIST AI Risk Management Framework, EU AI Act) as well as NIST frameworks   Nice to haves: - Relevant certifications such as CISSP, CISM, CISA, CRISC, ISO 27001 Lead Implementer or Lead Auditor. - Experience in defence, space, aerospace or another regulated/sovereign-sensitive industry. - Exposure to classified information handling frameworks (EUCI, NATO equivalents, or national security clearance regimes). - A well-rounded skillset of using language models for automation.   APPLICATION PROCESS - Initial screening call with Talent Acquisition - Technical/competency interview with the VP Product Security - Scenario-based exercise on requirements discovery, mapping and prioritisation - Final interview with senior stakeholders including a behavioural interview WORKING AT ICEYE At ICEYE, you’ll join a diverse and highly engaged team united by the ambition to make the impossible possible. As a global scale-up, we combine speed and ambition with the opportunity to take real ownership from day one. Your growth, wellbeing, and success are a priority, with continuous professional development, training opportunities, and a culture where collaboration is how we win. HOW WE WORK (OUR VALUES) Make the impossible possible: We set ambitious goals and stay calm under pressure. We bring grit, optimism, and ownership when things get hard, and we keep moving until we find a way. - Be curious: Go deep, ask questions, listen carefully, and think critically. Understand the “why” behind decisions. - See the big picture: Stay close to what’s happening across the company so you can make better decisions. Consider how your work affects others. - Drive effective teamwork: Create psychological safety, invite different perspectives, and build inclusive teams. There are no bad questions. - Act as one team: We win together. We match tasks to the right owner and stay agile as priorities shift. - Have fun: What we do matters—and it should be enjoyable. Celebrate progress, take pride in results, and share the wins. BENEFITS Our benefits are designed to support your health and wellbeing, at work and beyond. We keep improving them based on employee feedback, and offerings vary by location. Talent Acquisition will confirm what applies for this role and location during the process.   OUR COMMITMENT TO DIVERSITY, EQUITY, AND INCLUSION We want ICEYE to be a place where people can be themselves and do great work. Different backgrounds and perspectives make us stronger, which is why we work to create an environment where people feel included, respected, and able to speak up. Whatever your background, we want you to bring your authentic self to the table. We’re committed to fair, inclusive hiring and equal opportunity. Everyone is welcome to apply. If you need any adjustments or support during the recruitment process, tell us—we’ll do our best to help. Apply now to start your ICEYE journey, and help us continue to make the impossible possible together. Read more about ICEYE and working with us at iceye.com http://iceye.com.

Location: Hong Kong, Hong Kong SAR; Singapore, Singapore Who We Are At OKX, we believe that the future will be reshaped by crypto, and ultimately contribute to every individual's freedom. OKX is a leading crypto exchange, and the developer of OKX Wallet, giving millions access to crypto trading and decentralized crypto applications (dApps). OKX is also a trusted brand by hundreds of large institutions seeking access to crypto markets. We are safe and reliable, backed by our Proof of Reserves. Across our multiple offices globally, we are united by our core principles: We Before Me , Do the Right Thing , and Get Things Done . These shared values drive our culture, shape our processes, and foster a friendly, rewarding, and diverse environment for every OK-er. OKX is part of OKG, a group that brings the value of Blockchain to users around the world, through our leading products OKX, OKX Wallet, OKLink and more. About the Opportunity As a Staff Engineer, y ou'll own the build-out of our security engineering and DevSecOps capabilities: designing and developing the security products, platform services, and SDKs/Agents that embed protection directly into how code is written, built, shipped, and run. This is a role for someone with real depth in security, broad coverage across the stack, and the engineering muscle to ship. Just as important is the ability to drive adoption — security that lands in complex, fast-moving business environments rather than sitting in a policy document. What You’ll Be Doing Architect and build our end-to-end DevSecOps platform and the SDKs/Agents behind our security products, covering code, build, artifacts, images, deployment, and runtime. Lead runtime protection through RASP and Java Agent — bytecode instrumentation, runtime hooking, and detection/interception engines using ASM, ByteBuddy, and Instrumentation, with continuous tuning for performance, stability, and compatibility. Integrate and productise scanning capabilities across SAST, DAST, IAST, SCA, code scanning, and image scanning. You'll embed tools like SonarQube and Coverity deep into CI/CD and close the loop from detection through blocking, remediation, and re-test. Go deep on application security offence and defence — designing detection, remediation, hardening, and counter-measures for XSS, SQL injection, SSRF, deserialisation, command execution, authentication/authorisation flaws, and API security. Bring AI-native security engineering to life. Apply LLMs and AI Agents to vulnerability analysis, rule generation, false-positive attribution, remediation guidance, security knowledge capture, and engineering automation — and build a coherent view of the architecture, mechanics, and security implications. Embed as the security technical expert inside engineering teams, driving security standards, onboarding specifications, release gates, risk tiering, and remediation mechanisms that measurably lift the security baseline and delivery quality. Partner across engineering, architecture, SRE, QA, and business teams on priority projects, solving the genuinely hard security problems and turning the solutions into reusable platform capability and repeatable practice. What We Look For In You Strong computer science and security fundamentals — deep understanding of operating systems, networking, compilers and the JVM, distributed systems, application security, cloud-native security, and supply chain security. Both breadth and depth. Expert-level Java, with hands-on depth in the JVM, ClassLoader, Java Agent, ASM, ByteBuddy, bytecode instrumentation, and performance profiling and tuning. Plus working proficiency in Python or Go. Substantial production experience with RASP, SAST, DAST, IAST, SCA, image security, and code scanning — enough to design a capability, integrate the engine, build the platform around it, and take it to scale independently. Real offensive and defensive experience. You understand the root causes, exploitation paths, detection logic, bypass techniques, and fixes for common web, API, and microservices vulnerabilities — and can design from both the attacker's and defender's point of view. Fluency with LLMs and AI Agents, including a considered view on model capability limits, agent architecture, tool calling, context engineering, evaluation methods, and how AI is reshaping both security engineering and the attack surface. Strong engineering execution paired with product instinct — able to lead the design and delivery of security products, platform modules, and SDKs/Agents while balancing security outcomes against performance overhead, integration cost, and long-term operability. Exceptional ownership, cross-team communication, and the persistence to move security governance, rule enforcement, and remediation through to a clear result. Nice to Haves Security engineering experience at a top-tier internet company, cloud provider, or leading security vendor You've led the build of a DevSecOps platform, application security platform, RASP, code scanning platform, or cloud-native security platform Background in security product development, SDK/Agent engineering, vulnerability research, red team exercises, or purple team work Shipped AI + Security work — security copilots, intelligent rule generation, automated analysis, or remediation recommendation systems Perks & Benefits Competitive total compensation package L&D programs and Education subsidy for employees' growth and development Various team building programs and company events Wellness and meal allowances Comprehensive healthcare schemes for employees and dependants More that we love to tell you along the process! Notice: All official OKX vacancies are published on this website. While roles may appear on selected third-party platforms from time to time, information on other sites may be inaccurate or outdated. If in doubt, please apply directly through our official careers website. Information collected and processed as part of the recruitment process of any job application you choose to submit is subject to OKX 's Candidate Privacy Notice .

Location: EMEA About the team The Security Team is responsible for providing key security capabilities covering application, cloud and enterprise security, incident response, detection and GRC. Our team is looking for an experienced, hands-on security practitioner, who will drive the adoption of modern security processes and tooling, with focus on supporting our engineering and product teams in improving the security posture of our platforms and services. What you will do: - Identify security gaps and vulnerabilities in all ClickHouse offerings triage a wide range of vulnerabilities reported via our bug bounty program, responsible disclosure, GitHub Issues covering web, API and server - client assets including low level memory issues like heap or buffer overflows - Improve and develop security assurance activities - pentests, vulnerability assessments, bug bounty programs, fuzzing - Plan and execute internal red team assessments and penetration tests against ClickHouse infrastructure, cloud environments, designing realistic adversary scenarios to test detection, response and control effectiveness - Assess AI/LLM-specific attack surface across ClickHouse's own AI-powered features and internal AI tooling, including prompt injection, model/data exfiltration, and unsafe agentic tool-use patterns - Build and operate agentic tooling for reconnaissance, exploit-chaining and attack-path discovery, and apply LLM-assisted fuzzing to accelerate vulnerability discovery across ClickHouse's products and infrastructure - Partner with detection engineering to validate and improve detection coverage during red team exercises, measuring and reporting on control effectiveness and time to detect/respond - Handle information security events and incidents across ClickHouse products and services - Develop processes, tooling and automation to scale security processes and mitigate risks to the business What you bring along: - 7+ years of experience in pentesting, red teaming and product security - Experience supporting engineering and product implementation efforts by performing threat assessments, assurance activities, advisory as well as, in some cases, implementation work across distributed systems covering web, API, client/server assets - Hands-on experience conducting offensive security engagements - internal red teaming, penetration testing and adversary simulation - across cloud, network and application environments - Ability to design adversary scenarios grounded in real threat intelligence (e.g. ransomware operators, supply chain attackers, insider threat) tailored to ClickHouse's risk profile as a multi-tenant cloud data platform - Strong written and verbal communication skills, with ability to translate attack chains into clear, actionable findings for engineering and leadership - Experience building or adapting agentic and LLM-assisted tooling for offensive security use cases (recon automation, exploit chaining, fuzzing harnesses), with judgment on where AI genuinely speeds up an engagement versus adds noise - Familiarity with AI/LLM-specific vulnerability classes and testing methodology - Strong knowledge of and experience with one or more cloud service providers (e.g. AWS, GCP, Azure), Kubernetes, Cilium - Experience implementing and operating engineering security tools and processes (e.g. static / dynamic code analysis, software composition analysis, SBOM, OWASP SAMM, client and network fuzzing tools) - Security as code mindset, with focus on solving problems with automation and scale in mind Bonus Points: - BS, MS, or PhD in Computer Science or related field - Previous contributions to open source projects - Security or cloud related certifications (AWS, GCP, Azure) - Previous experience in using AI security harnesses for pentesting purposes - Experience building or operating internal red team tooling and infrastructure from scratch, rather than relying solely on off-the-shelf frameworks - Offensive security certifications (e.g. OSCP, OSCE, OSEP, OSWE) PERKS - Flexible work environment - ClickHouse is a globally distributed company and remote-friendly. We currently operate in over 25 countries. - Healthcare - Employer contributions towards your healthcare. - Equity in the company - Every new team member who joins our company receives stock options. - Time off - Flexible time off in the US, generous entitlement in other countries. - A USD$500 Home office setup if you’re a remote employee. - Global Gatherings – We believe in the power of in-person connection and offer opportunities to engage with colleagues at company-wide offsites. CULTURE - WE ALL SHAPE IT As part of a rapidly scaling start-up, you will be instrumental in shaping our culture. Are you interested in finding out more about our culture? Learn more about our values here https://clickhouse.com/company/careers. Check out our blog posts https://clickhouse.com/blog or follow us on LinkedIn https://www.linkedin.com/company/clickhouseinc/life/0c1ee7f4-2129-488d-b413-e7f6270659fd/?viewAsMember=true to find out more about what’s happening at ClickHouse. EQUAL OPPORTUNITY & PRIVACY ClickHouse provides equal employment opportunities to all employees and applicants and prohibits discrimination and harassment of any type based on factors such as race, color, religion, age, sex, national origin, disability status, genetics, protected veteran status, sexual orientation, gender identity or expression, or any other characteristic protected by federal, state or local laws. Please see here https://clickhouse.com/legal/applicant-privacy-notice for our Privacy Statement.

Location: Hong Kong SAR; Kuala Lumpur, Malaysia About Us Established in 2018, Bybit is one of the world’s leading cryptocurrency exchanges and digital financial platforms, serving over 80 million users across more than 200 countries and regions. Powered by world-class technology and a user-first mindset, Bybit delivers a seamless ecosystem across trading, payments, wealth management, custody, institutional services, and Web3 — connecting users to the future of digital finance. Our core values define how we build. We listen, care and improve to create products and experiences that put users first. Backed by a global team of ambitious builders, problem-solvers, and innovators, we foster a high-performance and fast-moving environment where talent is empowered to drive real impact at the global scale. Supported by 24/7 multilingual customer service and a strong commitment to innovation, we are shaping the future of finance through technology, collaboration, and bold execution. Today, Bybit is recognized as one of the most trusted and transparent platforms in the digital asset industry, continuing to expand its global presence while building the infrastructure for the next generation of financial services. Job responsibilities Red-blue confrontation drill Responsible for developing and executing penetration testing, red-blue confrontation, and practical attack and defense drills that simulate real attack scenarios, identifying potential security risks in enterprise networks, applications, cloud environments, work networks, and core business systems. Lead or participate in red-blue confrontation exercises to evaluate the defense team's ability in attack detection, alarm analysis, traceability analysis, emergency response, and recovery. Based on the real attack chain design exercise scenario, covering extranet breakthrough, web vulnerability exploitation, phishing entrance, privilege escalation, lateral movement, Data Discovery, privilege maintenance, and defense bypass stages. Combining the attack review results, promote the continuous optimization of security detection rules, response processes, asset governance, and security base lines. Attack Surface Analysis and Threat Research Identify enterprise network exposure, internet assets, cloud assets, APIs, supply chain components, and third-party access risks, evaluate attack paths, and provide mitigation recommendations. Monitor and collect threat intelligence, track vulnerability exploitation trends, APT attack methods, red team toolchain changes, and apply them to enterprise attack and defense exercises. Combining business scenarios to model attack paths and discover feasible attack chains from external exposure surfaces to core assets. Tracking AI-related security risks, including security issues in large-scale model applications, RAG systems, Agent systems, plug-in/tool calls, MCP services, AI code generation, and automated workflows. AI Security and Large Model Attack and Defense Responsible for the security evaluation of AI applications, intelligent agent systems, RAG Knowledge Base, AI Agent toolchain and model services within the enterprise. Research and verify large-scale model-related attack techniques, including Prompt Injection, Jailbreak, Indirect Prompt Injection, data leakage, unauthorized tool invocation, security risks caused by model illusions, RAG poisoning, vector library pollution, sensitive information leakage, etc. Design AI red team test cases and evaluation framework, and conduct security verification on model input and output, context isolation, permission control, tool call chain, and data access boundary. Participate in the construction of AI security protection plan, including prompt word security policy, content security detection, tool call permission constraints, sensitive data desensitization, audit tracking, Agent sandbox isolation and security evaluation benchmark construction. Explore the application of AI in red team automation, vulnerability analysis, attack path planning, PoC verification, and report generation, and promote the platformization, automation, and intelligence of attack and defense capabilities. Tool and platform development Develop and optimize Red Team-specific tools and scripts for vulnerability mining, information collection, privilege escalation, lateral movement, credential analysis, traffic disguise, defense bypass, and automated report generation. Study and validate new attack techniques, and simulate real threats in combination with enterprise business scenarios. Build or participate in the construction of automated security evaluation platform, integrated vulnerability scanning, audio fingerprint recognition, asset mapping, PoC verification, attack path analysis, AI Agent arrangement and other capabilities. Combining LLM/Agent technology to explore automated penetration testing, intelligent vulnerability verification, code security auditing, and red team task scheduling. Security evaluation and reporting Conduct security evaluations on critical business systems, internal networks, cloud environments, work end points, API services, and AI applications, and output detailed technical reports, attack paths, impact analysis, and repair recommendations. Output AI security evaluation reports for AI applications, including attack examples, risk levels, exploitable paths, data leakage risks, permission boundary issues, and governance recommendations. Assist in improving enterprise security protection mechanisms, promote optimization of WAF, EDR, SIEM, NDR, HIDS, zero trust, identity permissions, and log auditing capabilities. Transform attack and defense discovery into security detection rules, base line specifications, develop security requirements, and continuous governance mechanisms. XFN collaboration Collaborate with the blue team, security operation, infrastructure, R & D, algorithm, data, and business teams to complete attack review, vulnerability repair, detection rule optimization, and security capability building. Provide security support to other departments of the enterprise, including emergency response drills, development security consulting, AI application pre-launch security review, and security training. Participate in the security design review of AI applications and security products, and promote the advance of security capabilities in R & D, testing, and Pushonline. Job requirements Basic skills Proficient in basic knowledge of cyber security, including TCP/IP protocol, network architecture, identity authentication, access control, principles and configurations of common security devices. Proficient in common attack techniques and red team toolchains, such as Sliver, Cobalt Strike, NPS, Burp Suite, Metasploit, Nmap, Masscan, Frida, Impacket, etc. Familiar with mainstream operating systems Windows, Linux, macOS security mechanism, log system, permission model and common use. Familiar with common web frameworks, API architectures, microservice structures, containers, and security risks in Kubernetes environments. Offensive and defensive technical capabilities Proficient in penetration testing and red team processes, including information collection, vulnerability scanning, vulnerability exploitation, intranet penetration, privilege escalation, lateral movement, privilege maintenance, Data Discovery, and trace cleaning. Familiar with the working principles and adversarial methods of enterprise-level security products, including WAF, EDR, SIEM, NDR, HIDS, zero-trust gateway, bastion host, and identity authentication system. Possess independent vulnerability analysis and PoC writing capabilities, able to reproduce, verify, and assess the impact of public vulnerabilities and 0day/1day risks. Proficient in one or more programming/scripting languages, such as Python, Go, Bash, PowerShell, JavaScript, etc., with experience in tool development and automation platform construction. AI security capabilities Familiar with the basic architecture of large-scale model applications, familiar with technical forms such as Prompt, RAG, Embedding, vector databases, Agent, Function Calling, MCP, and plugin systems. Understand or practice AI security testing methods, including Prompt Injection, Jailbreak, RAG data poisoning, sensitive information leakage, unauthorized tool invocation, model output security, Agent permission escape, etc. Able to design security test cases for AI applications, evaluate model input/output, context isolation, data boundaries, permission control, and tool invocation chain risks. Experience in using AI to assist security work, including vulnerability analysis, code auditing, intelligence analysis, attack path planning, report generation, or automated testing. Familiar with AI application security governance ideas, including model call auditing, prompt word security, sensitive data protection, content security detection, permission minimization, and sandbox isolation. Experience requirements More than 5 years of experience in red team, penetration testing, security research, or offensive and defensive exercises. Candidates with experience in large-scale enterprise attack and defense drills, red-blue confrontation, HW/major support, cloud attack and defense, or intranet penetration are preferred. Candidates with experience in AI security, large-scale model security, intelligent agent security, automated penetration testing platform or security tool platform construction are preferred. Familiar with enterprise security construction system, able to promote defense capability, detection capability, and governance process optimization from an attack perspective. Other capabilities Priority will be given to those who hold security-related certifications such as ♀ P, OSCE, CISSP, CISP, CEH, CISSP, CCSP, etc. Possess strong document writing and expression abilities, able to output high-quality technical reports, review documents, attack chain analysis, and security construction plans. Possess good problem analysis ability, learning ability, teamwork ability, and stress resistance. Be sensitive to new technologies, new Attack Surfaces, and new tools, and be able to proactively research and share internally. Bonus points Familiar with Cloud Computing Platform security and cloud attack and defense technologies, such as AWS, Azure, GCP, Tencent Cloud, Alibaba Cloud, etc. Familiar with Kubernetes, containers, Service Mesh, CI/CD, DevSecOps and supply chain security. Possess experience in zero trust, secure operation, threat hunting, Attack Surface management, and vulnerability management platform construction. Familiar with MCP Server, AI Agent framework, RAG system, vector database, LLM API gateway, model security evaluation framework. Experience in Automated Red Team, AI Penetration Testing, Intelligent Vulnerability Verification, Agent Orchestration, Security Knowledge Base or Security RAG System Construction. Experience in vulnerability submission, CVE, technical articles, open source projects, topic sharing, or tool release in the security community. Familiar with security frameworks such as MITRE ATT & CK, OWASP Top 10, OWASP LLM Top 10, NIST AI RMF, etc. Why Join Us At Bybit, we are committed to fostering a supportive and enriching work environment. Our benefits include: - Study Growth Fund: We support your professional development and continuous learning. - Internal Events: Participate in regular team-building activities, workshops, and events designed to promote collaboration and innovation. - Global Collaboration: Be part of a diverse, international team, working alongside colleagues from around the world. - Career Advancement: Access opportunities for growth and advancement within a rapidly expanding global company. - Internal Mobility: Grow with us- Your long-term development is important to us. We offer internal job opportunities to help build your career path.

Location: New York Workplace: Hybrid WHY HARVEY At Harvey, we’re transforming how legal and professional services operate. By combining frontier agentic AI, an enterprise-grade platform, and deep domain expertise, we’re reshaping how critical knowledge work gets done for decades to come. This is a rare chance to help build a generational company at a true inflection point. We have strong product-market fit and world-class investor support. We’re scaling fast and defining a new category in real time. The work is ambitious, the bar is high, and the opportunity for growth — personal, professional, and financial — is unmatched. Our team moves fast, takes ownership, and is deeply committed to the mission — operating with intensity, staying close to our customers, and pushing each other for excellence. We live by three values: Decisiveness, Simplicity, and Job's Not Finished. We act quickly on clear judgment over perfect information, we believe simplicity is what scales, and we're never satisfied with where we are. If you want to do the best work of your career alongside people who share that drive, we'd love to build with you. At Harvey, the future of professional services is being written today — and we’re just getting started. ROLE OVERVIEW Some of the world's largest companies and their law firms use Harvey's AI to deliver world-class client services at unprecedented scale, entrusting Harvey with their most sensitive documents in the process. This role joins Harvey's corporate security function, which secures the company's IT and business systems as Harvey grows rapidly, balancing risk with user experience while validating every assumption through threat modeling and real-world testing rather than relying on best practice alone. It is a strong fit for someone at the intersection of security engineering and enterprise systems- someone who understands how data flows between SaaS applications, can pinpoint where security breaks down in complex integrations, and knows how to build controls that scale. Experience with eDiscovery workflows and legal holds is a meaningful differentiator given the nature of Harvey's customer base. WHAT YOU'LL DO - Enterprise Integrations & SaaS Security: Design, implement, and govern security controls for cross-application data flows, API integrations, OAuth connections, and third-party SaaS platforms. Own the security review lifecycle for new integrations and automate posture monitoring to catch drift early. - eDiscovery & Legal Hold Program: Continue to build and operate Harvey's legal hold infrastructure, including data preservation, collection workflows, and custodian management. Partner with Legal and Compliance to meet litigation readiness requirements across our collaboration and productivity stack. - IT & Business Systems Partnership: Provide security oversight across the SaaS application lifecycle — vendor onboarding assessments, ongoing configuration review, and decommissioning. - Endpoint Security: Support endpoint security policies and vulnerability management, ensuring endpoint telemetry feeds into detection and response workflows. - Security Detection & Response: Develop scripts and integrations that extend visibility across corporate systems, partnering with the Detection & Response team to surface signals from SaaS and business applications. WHAT YOU HAVE - Demonstrated experience securing enterprise SaaS environments, including integration security, API token management, OAuth governance, and cross-application data flow risk — with working knowledge of authentication/authorization standards (SAML, OIDC, SCIM, X.509) and the ability to debug real-world integration failures. - Experience building or managing eDiscovery and legal hold programs, including data preservation workflows, custodian management, and coordination with Legal and outside counsel. Familiarity with tools such as Purview, Vault, Relativity, Everlaw, or similar platforms is a plus. - Strong software engineering fundamentals with proficiency in Python and/or Go, including building integrations against SaaS APIs (not just configuring through consoles), and experience with infrastructure-as-code tooling such as Terraform and/or Pulumi for managing security configurations in a repeatable, auditable way. - Ability to identify risks and vulnerabilities in IT and business systems and communicate that risk clearly to stakeholders across engineering, legal, and executive audiences. - Familiarity with endpoint security for macOS and Windows environments, and experience with tools such as Okta, Google Workspace, Salesforce, Workday, NetSuite, Microsoft Entra/Azure/Intune, JAMF, Tines, or similar platforms. - 4+ years of experience in security engineering, corporate engineering, IT, or a related program management function with a security focus. Experience with generative AI or the legal industry is not required — but genuine curiosity about both will serve you well here. COMPENSATION $220,000 - $330,000 USD DEPENDING ON YOUR LOCATION, AN APPLICANT PRIVACY NOTICE MAY APPLY TO YOU. YOU CAN FIND ALL OF OUR APPLICANT PRIVACY NOTICES HERE https://harveyai.notion.site/Harvey-Candidate-Privacy-Notices-319ac3fcdd7a803bb807d5094f249922?pvs=74. #LI-AH1 Harvey is an equal opportunity employer and does not discriminate on the basis of race, gender, sexual orientation, gender identity/expression, national origin, disability, age, genetic information, veteran status, marital status, pregnancy or related condition, or any other basis protected by law. We are committed to providing reasonable accommodations to applicants with disabilities, and requests can be made by emailing accommodations@harvey.ai

Location: San Francisco Workplace: Hybrid WHY HARVEY At Harvey, we’re transforming how legal and professional services operate. By combining frontier agentic AI, an enterprise-grade platform, and deep domain expertise, we’re reshaping how critical knowledge work gets done for decades to come. This is a rare chance to help build a generational company at a true inflection point. We have strong product-market fit and world-class investor support. We’re scaling fast and defining a new category in real time. The work is ambitious, the bar is high, and the opportunity for growth — personal, professional, and financial — is unmatched. Our team moves fast, takes ownership, and is deeply committed to the mission — operating with intensity, staying close to our customers, and pushing each other for excellence. We live by three values: Decisiveness, Simplicity, and Job's Not Finished. We act quickly on clear judgment over perfect information, we believe simplicity is what scales, and we're never satisfied with where we are. If you want to do the best work of your career alongside people who share that drive, we'd love to build with you. At Harvey, the future of professional services is being written today — and we’re just getting started. ROLE OVERVIEW Some of the world's largest companies and their law firms use Harvey's AI to deliver world-class client services at unprecedented scale, entrusting Harvey with their most sensitive documents in the process. This role joins Harvey's corporate security function, which secures the company's IT and business systems as Harvey grows rapidly, balancing risk with user experience while validating every assumption through threat modeling and real-world testing rather than relying on best practice alone. It is a strong fit for someone at the intersection of security engineering and enterprise systems- someone who understands how data flows between SaaS applications, can pinpoint where security breaks down in complex integrations, and knows how to build controls that scale. Experience with eDiscovery workflows and legal holds is a meaningful differentiator given the nature of Harvey's customer base. WHAT YOU'LL DO - Enterprise Integrations & SaaS Security: Design, implement, and govern security controls for cross-application data flows, API integrations, OAuth connections, and third-party SaaS platforms. Own the security review lifecycle for new integrations and automate posture monitoring to catch drift early. - eDiscovery & Legal Hold Program: Continue to build and operate Harvey's legal hold infrastructure, including data preservation, collection workflows, and custodian management. Partner with Legal and Compliance to meet litigation readiness requirements across our collaboration and productivity stack. - IT & Business Systems Partnership: Provide security oversight across the SaaS application lifecycle — vendor onboarding assessments, ongoing configuration review, and decommissioning. - Endpoint Security: Support endpoint security policies and vulnerability management, ensuring endpoint telemetry feeds into detection and response workflows. - Security Detection & Response: Develop scripts and integrations that extend visibility across corporate systems, partnering with the Detection & Response team to surface signals from SaaS and business applications. WHAT YOU HAVE - Demonstrated experience securing enterprise SaaS environments, including integration security, API token management, OAuth governance, and cross-application data flow risk — with working knowledge of authentication/authorization standards (SAML, OIDC, SCIM, X.509) and the ability to debug real-world integration failures. - Experience building or managing eDiscovery and legal hold programs, including data preservation workflows, custodian management, and coordination with Legal and outside counsel. Familiarity with tools such as Purview, Vault, Relativity, Everlaw, or similar platforms is a plus. - Strong software engineering fundamentals with proficiency in Python and/or Go, including building integrations against SaaS APIs (not just configuring through consoles), and experience with infrastructure-as-code tooling such as Terraform and/or Pulumi for managing security configurations in a repeatable, auditable way. - Ability to identify risks and vulnerabilities in IT and business systems and communicate that risk clearly to stakeholders across engineering, legal, and executive audiences. - Familiarity with endpoint security for macOS and Windows environments, and experience with tools such as Okta, Google Workspace, Salesforce, Workday, NetSuite, Microsoft Entra/Azure/Intune, JAMF, Tines, or similar platforms. - 4+ years of experience in security engineering, corporate engineering, IT, or a related program management function with a security focus. Experience with generative AI or the legal industry is not required — but genuine curiosity about both will serve you well here. COMPENSATION $220,000 - $330,000 USD DEPENDING ON YOUR LOCATION, AN APPLICANT PRIVACY NOTICE MAY APPLY TO YOU. YOU CAN FIND ALL OF OUR APPLICANT PRIVACY NOTICES HERE https://harveyai.notion.site/Harvey-Candidate-Privacy-Notices-319ac3fcdd7a803bb807d5094f249922?pvs=74. #LI-AH1 Harvey is an equal opportunity employer and does not discriminate on the basis of race, gender, sexual orientation, gender identity/expression, national origin, disability, age, genetic information, veteran status, marital status, pregnancy or related condition, or any other basis protected by law. We are committed to providing reasonable accommodations to applicants with disabilities, and requests can be made by emailing accommodations@harvey.ai

Location: Boston, MA Workplace: OnSite At WHOOP, we're on a mission to unlock and inspire performance for life. WHOOP empowers members to perform at a higher level and live longer through a deeper understanding of their bodies and daily lives. Protecting our members’ data and ensuring our systems scale securely and reliably is core to this mission. As a Director of Product Security you will play a critical role in shaping, driving, and leading our software engineering teams towards a secure software development lifecycle and strengthening product-facing identity and authentication capabilities that protect our members. This role will strategically craft the roadmap in collaboration with stakeholders across the business and staff the team to fulfill growing security needs across engineering. In addition to core product security responsibilities, you will partner closely with functions across Product, Software, Legal, Compliance, and enterprise security to meaningfully move the security posture of the company. We are seeking a leader and strategic partner with prior experience driving the engineering side of security for software teams. RESPONSIBILITIES - Build, lead, and grow multiple engineering teams executing on product-facing security strategy, including member authentication, code security, cloud security across AWS accounts, privacy by design, and threat modeling. - Lead application vulnerability management programs across bug bounties, code vulnerabilities, container vulnerabilities, and infrastructure vulnerabilities. - Build, integrate, and mature DevSecOps tooling and developer security controls, including SAST, SCA, container scanning, secrets detection, CI/CD security checks, and secure-by-default developer workflows. - Define and communicate long-term product security strategy, product architecture standards, and design principles for product-facing systems. - Partner with engineering, office of the CISO, and compliance leadership to embed privacy and security by design across the software development lifecycle. - Establish and enforce best practices, standards, and processes for secure software development, testing, and deployment. - Provide mentorship, guidance, and career development for engineering managers and individual contributors. - Foster a culture of innovation, teamwork, psychological safety, and continuous learning within the Product Security organization. QUALIFICATIONS - Demonstrated success scaling a security team whilst crafting clear and efficient team domains. - Proven experience as a technical leader managing multiple teams or a growing security engineering organization. - Experience growing high level individual contributor career growth at the staff level or higher. - Deep understanding of product security principles, including vulnerability management, data privacy, threat modeling, secure SDLC practices,and secure-by-default engineering patterns. - Experience building or integrating developer security tooling to improve secure-by-default practices. - Strong technical background in software development, testing, and deployment processes. - Excellent communication, interpersonal, and leadership skills with the ability to influence across teams and levels. BONUS QUALIFICATIONS - Experience with AWS cloud environments and data-driven decision-making. - Hands-on experience with containerized microservice environments. - Background in incident response and post-mortem analysis for security events. - Familiarity with automation frameworks for vulnerability scanning, compliance checks, or infrastructure security. ABOUT YOU - You’re a strategic and people-focused leader who thrives on balancing hands-on technical oversight with long-term organizational growth. - You have experience building and scaling security engineering focused teams. - You’re passionate about creating secure, privacy-first systems that protect member data and enable innovation. - You collaborate effectively across technical and non-technical teams and can operate confidently in both strategic and tactical domains. - Above all, you believe that security enables innovation, and you lead by fostering a culture that supports both speed and safety. Learn more about our Software Org and how to be successful in your engineering career at WHOOP via our Career Framework https://engineering.prod.whoop.com/careerframework.   This role is based in the WHOOP office located in Boston, MA. The successful candidate must be prepared to relocate if necessary to work out of the Boston, MA office.   Interested in the role, but don’t meet every qualification? We encourage you to still apply! At WHOOP, we believe there is much more to a candidate than what is written on paper, and we value character as much as experience. As we continue to build a diverse and inclusive environment, we encourage anyone who is interested in this role to apply.   WHOOP is an Equal Opportunity Employer and participates in E-verify https://www.e-verify.gov/ to determine employment eligibility. It is unlawful in Massachusetts to require or administer a lie detector test as a condition of employment or continued employment. An employer who violates this law shall be subject to criminal penalties and civil liability.

Location: Kuala Lumpur, Malaysia About Us Established in 2018, Bybit is one of the world’s leading cryptocurrency exchanges and digital financial platforms, serving over 80 million users across more than 200 countries and regions. Powered by world-class technology and a user-first mindset, Bybit delivers a seamless ecosystem across trading, payments, wealth management, custody, institutional services, and Web3 — connecting users to the future of digital finance. Our core values define how we build. We listen, care and improve to create products and experiences that put users first. Backed by a global team of ambitious builders, problem-solvers, and innovators, we foster a high-performance and fast-moving environment where talent is empowered to drive real impact at the global scale. Supported by 24/7 multilingual customer service and a strong commitment to innovation, we are shaping the future of finance through technology, collaboration, and bold execution. Today, Bybit is recognized as one of the most trusted and transparent platforms in the digital asset industry, continuing to expand its global presence while building the infrastructure for the next generation of financial services. Job Summary: Primarily responsible for security auditing and security governance of the company's platform systems. Identify potential risks in business requirements and technical implementation plans, provide solutions, and drive their implementation. Job Responsibilities: Conduct manual code security audits on business code (Java, Golang, JS, C++, etc.) and write audit reports. Track domestic and international security developments; analyze and reproduce the latest security vulnerabilities. Deeply understand and master the company's product business; identify security risks in business architecture, business processes, and business logic; provide corresponding security solutions and drive their implementation. Drive security solution implementation, risk governance, etc. Job Requirements: Associate degree or above; requirements may be relaxed for candidates with strong capabilities. At least 3+ years of business development or audit experience based on Java or Go; has led or participated in SDL (Security Development Lifecycle) implementation. Proficient in the underlying principles, discovery methods, vulnerable code scenarios, and exploitation techniques of common security vulnerabilities (not limited to OWASP Top 10). Expert-level proficiency in Java and/or Go tech stacks; understands language-specific characteristics and common mainstream development frameworks, with relevant code audit experience. Familiar with common white-box audit methodologies, with the ability to track and reproduce the latest vulnerabilities. Familiar with mainstream development frameworks such as SpringMVC, SSM, or Gin, GoZero, etc. Has a solid understanding of penetration testing; proficient in common penetration testing methods and familiar with the principles and exploitation techniques of common vulnerabilities. Able to proficiently use AI tools to enhance security work efficiency. Highly proactive with strong logical thinking; possesses good communication, coordination, organizational skills, and documentation writing ability. Experience with TEE (Trusted Execution Environment) and other security encryption, data protection technical architectures and solution implementation is preferred. Nice to Have: Has submitted high-quality vulnerabilities to domestic or international SRC/bug bounty platforms. Has discovered CVE or CNVD general vulnerabilities. Has Java or Go code audit experience with demonstrated results. Why Join Us At Bybit, we are committed to fostering a supportive and enriching work environment. Our benefits include: - Study Growth Fund: We support your professional development and continuous learning. - Internal Events: Participate in regular team-building activities, workshops, and events designed to promote collaboration and innovation. - Global Collaboration: Be part of a diverse, international team, working alongside colleagues from around the world. - Career Advancement: Access opportunities for growth and advancement within a rapidly expanding global company. - Internal Mobility: Grow with us- Your long-term development is important to us. We offer internal job opportunities to help build your career path.

Location: The Netherlands; Poland; Portugal; France; United Kingdom; Spain; Germany; Italy Workplace: Remote About the team  The Security Team is responsible for providing key security capabilities covering application, cloud and enterprise security, incident response, detection and GRC. Our team is looking for an experienced, hands-on security practitioner, who will drive the adoption of modern security processes and tooling, with focus on supporting our engineering and product teams in improving the security posture of our platforms and services. Note: This position can be fully remote anywhere in the Netherlands. What you will do: - Collaborate with engineering and product on improving existing and building new product features with focus on threat modeling, assurance and secure implementation, some examples of recent work include implementation of secure key management, passwordless authentication, m2m authentication, sandboxing and compute/network/storage isolation - Identify security gaps and vulnerabilities in ClickHouse Cloud and OSS, triage a wide range of vulnerabilities reported via our bug bounty program, responsible disclosure, GitHub Issues covering web, API and server - client assets including low level memory issues like heap or buffer overflows - Improve and develop security assurance activities - pentests, vulnerability assessments, bug bounty programs, fuzzing - Drive implementation and usage of engineering security tools - static, dynamic code analysis, dependency checks, code licensing compliance (working knowledge of Snyk, Semgrep, GitHub CodeQL) - Nurture the engineering - security relationship, identify and implement process and technology improvements - Handle information security events and incidents across ClickHouse products and services - Develop processes, tooling and automation to scale security processes and mitigate risks to the business What you bring along: - Experience supporting engineering and product implementation efforts by performing threat assessments, assurance activities, advisory as well as, in some cases, implementation work across distributed systems covering web, API, client/server assets - Strong knowledge of and experience with one or more cloud service providers (e.g. AWS, GCP, Azure), Kubernetes, Cilium - Experience implementing and operating engineering security tools and processes (e.g. static / dynamic code analysis, software composition analysis, SBOM, OWASP SAMM, client and network fuzzing tools) - Significant development and automation experience, ability to work with C++ code - Security as code mindset, with focus on solving problems with automation and scale in mind Bonus Points: - BS, MS, or PhD in Computer Science or related field - Previous contributions to open source projects - Security or cloud related certifications (AWS, GCP, Azure) PERKS - Flexible work environment - ClickHouse is a globally distributed company and remote-friendly. We currently operate in over 25 countries. - Healthcare - Employer contributions towards your healthcare. - Equity in the company - Every new team member who joins our company receives stock options. - Time off - Flexible time off in the US, generous entitlement in other countries. - A USD$500 Home office setup if you’re a remote employee. - Global Gatherings – We believe in the power of in-person connection and offer opportunities to engage with colleagues at company-wide offsites. CULTURE - WE ALL SHAPE IT As part of a rapidly scaling start-up, you will be instrumental in shaping our culture. Are you interested in finding out more about our culture? Learn more about our values here https://clickhouse.com/company/careers. Check out our blog posts https://clickhouse.com/blog or follow us on LinkedIn https://www.linkedin.com/company/clickhouseinc/life/0c1ee7f4-2129-488d-b413-e7f6270659fd/?viewAsMember=true to find out more about what’s happening at ClickHouse. EQUAL OPPORTUNITY & PRIVACY ClickHouse provides equal employment opportunities to all employees and applicants and prohibits discrimination and harassment of any type based on factors such as race, color, religion, age, sex, national origin, disability status, genetics, protected veteran status, sexual orientation, gender identity or expression, or any other characteristic protected by federal, state or local laws. Please see here https://clickhouse.com/legal/applicant-privacy-notice for our Privacy Statement.

Location: United States Workplace: Remote About the team  The Security Team is responsible for providing key security capabilities covering application, cloud and enterprise security, incident response, detection and GRC. Our team is looking for an experienced, hands-on security practitioner, who will drive the adoption of modern security processes and tooling, with focus on supporting our engineering and product teams in improving the security posture of our platforms and services.  What you will do: - Collaborate with engineering and product on improving existing and building new product features with focus on threat modeling, assurance and secure implementation, some examples of recent work include implementation of secure key management, passwordless authentication, m2m authentication, sandboxing and compute/network/storage isolation - Identify security gaps and vulnerabilities in ClickHouse Cloud and OSS, triage a wide range of vulnerabilities reported via our bug bounty program, responsible disclosure, GitHub Issues covering web, API and server - client assets including low level memory issues like heap or buffer overflows - Improve and develop security assurance activities - pentests, vulnerability assessments, bug bounty programs, fuzzing - Drive implementation and usage of engineering security tools - static, dynamic code analysis, dependency checks, code licensing compliance (working knowledge of Snyk, Semgrep, GitHub CodeQL) - Nurture the engineering - security relationship, identify and implement process and technology improvements - Handle information security events and incidents across ClickHouse products and services - Develop processes, tooling and automation to scale security processes and mitigate risks to the business What you bring along: - Experience supporting engineering and product implementation efforts by performing threat assessments, assurance activities, advisory as well as, in some cases, implementation work across distributed systems covering web, API, client/server assets - Strong knowledge of and experience with one or more cloud service providers (e.g. AWS, GCP, Azure), Kubernetes, Cilium, Crossplane - Experience implementing and operating engineering security tools and processes (e.g. static / dynamic code analysis, software composition analysis, SBOM, OWASP SAMM, client and network fuzzing tools) - Significant development and automation experience, ability to work with C++ code preferred - Security as code mindset, with focus on solving problems with automation and scale in mind Bonus Points: - BS, MS, or PhD in Computer Science or related field - Previous contributions to open source projects - Security or cloud related certifications (AWS, GCP, Azure) PERKS - Flexible work environment - ClickHouse is a globally distributed company and remote-friendly. We currently operate in over 25 countries. - Healthcare - Employer contributions towards your healthcare. - Equity in the company - Every new team member who joins our company receives stock options. - Time off - Flexible time off in the US, generous entitlement in other countries. - A USD$500 Home office setup if you’re a remote employee. - Global Gatherings – We believe in the power of in-person connection and offer opportunities to engage with colleagues at company-wide offsites. CULTURE - WE ALL SHAPE IT As part of a rapidly scaling start-up, you will be instrumental in shaping our culture. Are you interested in finding out more about our culture? Learn more about our values here https://clickhouse.com/company/careers. Check out our blog posts https://clickhouse.com/blog or follow us on LinkedIn https://www.linkedin.com/company/clickhouseinc/life/0c1ee7f4-2129-488d-b413-e7f6270659fd/?viewAsMember=true to find out more about what’s happening at ClickHouse. EQUAL OPPORTUNITY & PRIVACY ClickHouse provides equal employment opportunities to all employees and applicants and prohibits discrimination and harassment of any type based on factors such as race, color, religion, age, sex, national origin, disability status, genetics, protected veteran status, sexual orientation, gender identity or expression, or any other characteristic protected by federal, state or local laws. Please see here https://clickhouse.com/legal/applicant-privacy-notice for our Privacy Statement.

Location: Remote Canada At Affirm, we exist for the moments that matter—giving people a clear, predictable way to pay over time, with no hidden fees, no surprises, and no tradeoffs on what matters most. About the InfoSec & IT Team The Application Security team helps Affirm build and launch products that earn customer trust, meet compliance obligations, and reduce business risk. We partner closely with product, engineering, infrastructure, risk, compliance, and other teams to identify security risks early, recommend pragmatic mitigations, and help teams find safe paths to launch. We are looking for an early-career Application Security Engineer who is curious, collaborative, and comfortable working with code. You will help assess application risks, support vulnerability management efforts, partner with engineering teams on secure design decisions, and contribute lightweight tooling, automation, and code-informed analysis that helps AppSec scale across Affirm. This role is a great fit for someone who has hands-on software or security experience, enjoys reading and reasoning about code, is actively developing offensive security skills, and wants to apply those skills in a product-minded, risk-based way. What You'll Do Partner with product and engineering teams to identify application security risks and help frame them as clear business risks, launch options, and recommended next steps. Read application code, configuration, pull requests, logs, and documentation to understand how systems work and where security risks may exist. Contribute small code changes, scripts, detections, tests, secure defaults, or automation that improve AppSec workflows and reduce recurring issues. Work in GitHub to review code changes, understand engineering context, participate in pull request discussions, track remediation work, and collaborate with engineers. Help evaluate vulnerabilities from internal testing, bug bounty reports, security tooling, penetration tests, and other sources; partner with teams to prioritize and remediate issues based on real-world risk. Contribute to vulnerability management workflows, including triage, validation, severity assessment, remediation guidance, tracking, and reporting. Translate recurring security findings into repeatable mechanisms such as secure coding guidance, checklists, paved paths, lightweight automation, detection logic, reusable review patterns, or developer-facing documentation. Work with engineers to understand system designs, data flows, trust boundaries, authentication and authorization models, code paths, and potential abuse cases. Communicate security issues clearly to both technical and non-technical audiences, including the risk, tradeoffs, recommended mitigations, and residual risk. Build strong relationships across Affirm teams and influence security outcomes without relying on formal authority. Help connect AppSec work to customer trust, regulatory/compliance expectations, operational resilience, and business outcomes. Continue developing hands-on offensive, defensive, and software engineering skills through practical work, labs, tooling, research, certifications, or contributions to internal security programs. What We Look For 4+ years of experience in application security, software engineering, security engineering, vulnerability management, penetration testing, security operations, or equivalent practical experience. Foundational programming ability in one or more languages such as Python, JavaScript/TypeScript, Kotlin, or similar. Comfort reading, navigating, and reasoning about code, even in unfamiliar codebases. Experience using Git and GitHub or similar version-control workflows, including branches, commits, pull requests, code review, issues, or project tracking. Some hands-on experience building, testing, breaking, or securing software. This could include professional experience, internships, security labs, CTFs, bug bounty work, open-source contributions, personal projects, automation scripts, internal tools, or coursework. Ability to write clear, maintainable scripts or small programs to solve practical problems, automate manual workflows, analyze data, validate findings, or improve security processes. Foundational understanding of common web, API, mobile, cloud, and application security risks, such as OWASP Top 10 issues, authentication and authorization flaws, injection, insecure design, secrets exposure, dependency risks, and data protection concerns. Interest in offensive security, such as studying for or completing security certifications, practicing web/API testing, learning exploit development fundamentals, using tools like Burp Suite, or participating in labs and capture-the-flag environments. Exposure to vulnerability management concepts, including triage, severity assessment, remediation tracking, false-positive analysis, compensating controls, and risk-based prioritization. Ability to reason about risk and tradeoffs, not just identify issues. You can explain what could go wrong, how likely it is, what impact it may have, and what options exist to reduce risk. Strong product and engineering empathy. You seek to understand launch goals, technical constraints, user impact, and business priorities before recommending a path forward. Clear written and verbal communication skills, including the ability to explain security findings in practical, actionable terms. A collaborative mindset and comfort working across product, engineering, compliance, risk, infrastructure, and security teams. Curiosity, humility, and a growth mindset. You proactively seek feedback, ask good questions, and continue building your technical depth. Secure-by-design judgment, including the ability to spot patterns, recommend simple controls, and balance launch velocity with meaningful risk reduction. Base Pay Grade - L Equity Grade - 5 Employees new to Affirm typically come in at the start of the pay range. Affirm focuses on providing a simple and transparent pay structure which is based on a variety of factors, including location, experience and job-related skills. Base pay is part of a total compensation package that may include monthly stipends for health, wellness and tech spending, and benefits (including 100% subsidized medical coverage, dental and vision for you and your dependents). In addition, the employees may be eligible for equity rewards offered by Affirm Holdings, Inc. (parent company). CAN base pay range per year: CAD $133,000 - $183,000 Location - Remote Canada This remote role is open only to candidates residing in Alberta, British Columbia, Manitoba, New Brunswick, Newfoundland and Labrador, Nova Scotia, Ontario, Prince Edward Island, or Saskatchewan. #LI-Remote Remote-first with flexibility built in Affirm is proud to be a remote-first company. Most roles can be done from almost anywhere within the country of employment. Some positions may occasionally require in-person work at an Affirm office, and a few are office-based due to the nature of the work. All new hires will be invited to attend an in-person onboarding experience. Benefits designed for you Our benefits reflect our commitment to care, transparency, and flexibility. Here are a few highlights: Health coverage at no cost: We cover 100% of premiums for employees and their dependents. Spending stipends: Monthly stipends support your tech setup, and the ability to choose health and wellness options that are right for you. Time off to recharge: Flexible time off and generous holiday calendars help you rest when you need to. Own a piece of what you build: Our employee stock purchase plan (ESPP) lets you buy Affirm stock at a discount. We’re committed to providing an inclusive interview process, including accommodations for candidates with disabilities. If you need support, we’re happy to help. For positions based in San Francisco or Los Angeles: Affirm considers qualified applicants with arrest and conviction records, as required by law. By clicking "Submit Application," you acknowledge that you have read Affirm's Global Candidate Privacy Notice and consent to the use of your personal information as described.

Location: Boston, MA Workplace: OnSite At WHOOP, we're on a mission to unlock and inspire performance for life. Our wearable technology provides personalized insights that help millions of members better understand their bodies, and make smarter decisions about training, recovery, and lifestyle. WHOOP is seeking a hands-on Security Architect to help strengthen and scale security architecture across our technology environment. This role is an opportunity for an experienced security engineer or architect to expand their impact by shaping secure design practices, solving complex technical challenges, and helping engineering teams build secure systems at scale. The ideal candidate brings strong technical experience in cloud security or application security, with demonstrated experience evaluating system architectures and making sound security design decisions. You don't need to have held the title of Security Architect or previously built an enterprise architecture program, but you should have the technical depth, judgment, and curiosity to identify architectural risks and develop practical solutions. WHOOP operates a modern technology environment spanning cloud platforms, applications, and enterprise systems. As AI-assisted development accelerates how software is built, our approach to security architecture must evolve as well. We're looking for someone who can help move security beyond manual reviews by establishing reusable security patterns, integrating automated controls, and making secure design easier for engineering teams to adopt. Working closely with the Security Architecture Lead, Product Security, Platform Engineering, Software Engineering, IT, and the broader Information Security organization, you'll contribute to the evolution of Security Architecture as an enterprise capability while remaining deeply engaged in hands-on technical work. Responsibilities - Conduct security architecture reviews across cloud platforms, applications, infrastructure, identity systems, and enterprise technologies, identifying security risks and recommending practical mitigations. - Partner with Engineering, Product Security, Platform, and IT teams to incorporate security into system design, development, infrastructure provisioning, and deployment workflows. - Perform threat modeling and security design assessments for Web and Mobile applications, APIs, cloud services, third-party integrations, and new technologies, identifying attack paths, trust boundaries, and sensitive data flows. - Evaluate security controls across cloud and application environments, including IAM, workload identities, authentication, authorization, network segmentation, secrets management, encryption, and data protection. - Develop and promote secure-by-default architecture patterns, reference designs, and reusable security controls that enable engineering teams to implement consistent security practices. - Help translate security architecture requirements into automated guardrails, policy-as-code, and scalable security checks integrated into engineering and deployment workflows. - Collaborate with Engineering teams to identify opportunities to reduce repetitive manual security reviews through standardized designs, preventive controls, and risk-based review approaches. - Assess the security implications of AI-assisted software development, AI-enabled applications, and emerging agentic technologies, including access to sensitive data, tool integrations, identities, and permissions. - Apply automation and AI-assisted analysis where appropriate to improve the efficiency and consistency of architecture assessments and threat modeling, while maintaining appropriate human oversight. - Review findings from penetration tests, vulnerability assessments, cloud security monitoring, and incidents to identify systemic architectural weaknesses and recommend sustainable improvements. - Provide technical security guidance on new technologies, strategic integrations, and architectural changes, balancing security requirements with performance, scalability, and business needs. - Help translate applicable security policies and regulatory requirements into practical technical architecture controls. - Document architecture assessments, technical recommendations, security patterns, and design decisions in a clear, actionable format. - Partner with the Security Architecture Lead to strengthen architecture standards, improve review practices, and expand the adoption of scalable security controls across WHOOP. Qualifications - 7+ years of experience in cloud security, application security, or security architecture, with demonstrated experience designing or evaluating secure systems. - Strong technical expertise in cloud or application security architecture, with a solid understanding of identity, infrastructure, and modern software development practices. - Experience conducting security architecture reviews, threat modeling, and technical risk assessments for complex systems. - Ability to independently identify architectural risks, evaluate design tradeoffs, and recommend practical, scalable security solutions. - Experience developing or implementing security controls, automation, or secure engineering practices within modern technology environments. - Ability to evaluate system designs, technical documentation, and implementation approaches to identify security weaknesses. - Strong communication and collaboration skills, with the ability to influence technical decisions and work effectively across engineering and security teams. Preferred Qualifications - Hands-on software development, cloud engineering, or infrastructure engineering experience. - Experience with secure-by-default architecture patterns, policy-as-code, or automated security controls. - Familiarity with AI-assisted development, AI-enabled applications, or emerging agentic technologies and their security implications. - Experience working across multiple security domains or contributing to enterprise security architecture initiatives. - Familiarity with relevant security or regulatory frameworks (NIST, ISO 27001, SOC 2, HIPAA, PCI DSS) or professional security certifications. This role is based in the WHOOP office located in Boston, MA. The successful candidate must be prepared to relocate if necessary to work out of the Boston, MA office. Interested in the role, but don’t meet every qualification? We encourage you to still apply! At WHOOP, we believe there is much more to a candidate than what is written on paper, and we value character as much as experience. As we continue to build a diverse and inclusive environment, we encourage anyone who is interested in this role to apply. WHOOP is an Equal Opportunity Employer and participates in E-verify https://www.e-verify.gov/to determine employment eligibility The WHOOP compensation philosophy is designed to attract, motivate, and retain exceptional talent by offering competitive base salaries, meaningful equity, and consistent pay practices that reflect our mission and core values. At WHOOP, we view total compensation as the combination of base salary, equity, and benefits, with equity serving as a key differentiator that aligns our employees with the long-term success of the company and allows every member of our corporate team to own part of WHOOP and share in the company’s long-term growth and success. The U.S. base salary range for this full-time position is $155,000 - $195,000. Salary ranges are determined by role, level, and location. Within each range, individual pay is based on factors such as job-related skills, experience, performance, and relevant education or training. In addition to the base salary, the successful candidate will also receive benefits and a generous equity package. These ranges may be modified in the future to reflect evolving market conditions and organizational needs. While most offers will typically fall toward the starting point of the range, total compensation will depend on the candidate’s specific qualifications, expertise, and alignment with the role’s requirements.

Location: Almaty, Kazakhstan Workplace: OnSite WHY WORK AT HIGGSFIELD AI? We're the fastest-scaling generative AI company in history, hitting $1B in annual revenue run rate, 30M+ users worldwide, and powering 390 of Fortune 500 brands. We’re building at the absolute frontier of AI-powered video creation and next-generation creative tools. Joining Higgsfield means becoming part of a high-impact team shaping the future of AI-native experiences, at a company that isn’t just moving fast, but rewriting what fast looks like.   Role Overview We're looking for a hands-on Infrastructure Security Engineer to own security across our cloud and ML infrastructure — the platform that trains our models and serves millions of generations a day. The work spans tenant isolation for user-deployed apps, GPU cluster security, and model protection from training pipeline to serving. You'll sit between Security, DevOps, and ML Engineering. You'll own both immediate implementation work and long-term operational responsibility: cloud and ML infrastructure security, vulnerability management, monitoring, and access governance.   KEY RESPONSIBILITIES We are looking for someone with experience in scaling high-growth startups who can make an immediate impact in the following areas: Cloud & Network Security - Evaluate, implement, and maintain cloud security tooling. - Own infrastructure and container vulnerability management across our cloud environments, and drive remediation. - Design and implement network segmentation to tighten internal security boundaries. - Build centralized security monitoring across cloud infrastructure. Corporate Access Control - Own access governance and credential management across cloud and internal tooling. - Partner with Engineering, DevOps, and IT to raise identity and access management standards. Technical Leadership: - Set the technical direction for infrastructure security and lead cross-functional projects turning the standards you set into tooling and guardrails engineers actually ship with. Requirements: Few people will match all of these. If you're strong on some and eager to learn the rest, apply anyway. - 7+ years in infrastructure security or security engineering, including time at a high- growth startup. - Deep hands-on experience securing a major cloud provider and a container orchestrator, managed with infrastructure-as-code (AWS, Kubernetes, Terraform). - Experience securing ML workloads — training or inference infrastructure, GPU clusters, or model-serving platforms. - Solid networking, operating systems, and cryptography fundamentals. - Strong grasp of container and infrastructure security practices and vulnerability management. - Comfortable working cross-functionally with DevOps, Engineering, and ML teams; able to independently find and close security gaps. - High agency. Nice to have - Experience with sandboxing, container isolation, or secure execution environments for untrusted code. - Experience with CSPM rollouts. - Incident response and security monitoring experience. - Familiarity with SOC 2 or similar frameworks. WHAT WE OFFER: - Competitive base salary in USD - Equity: participation in the company’s stock option program, giving you the opportunity to share in the company’s long-term growth. - On-site role in our Almaty office (we will relocate you from anywhere).