Вакансии

Location: United States, Los Angeles, CA Why Sony Interactive Entertainment? Sony Interactive Entertainment isn’t just the Best Place to Play — it’s also the Best Place to Work. Sony Interactive Entertainment (SIE) is the company behind the PlayStation brand. As a subsidiary of Sony Group Corporation, we’re part of a proud legacy of innovation and excellence. SIE is a dynamic technology company, delivering cutting-edge hardware and network services to more than 100 million people and an entertainment leader, home to some of the most beloved and recognizable intellectual properties (IP) in the world. Our role at SIE is to create and nurture the experiences under the PlayStation brand, a name synonymous with entertainment excellence and creativity. Sony Interactive Entertainment is seeking an experienced and collaborative Regional Security Manager to lead physical security operations across the Americas (AMER) region. Reporting to the Director, Global Security Operations, this role will oversee a team responsible for regional security programs, incident response, crisis support, and operational readiness across SIE offices, studios, and events. The ideal candidate brings strong operational leadership, sound judgment, and the ability to build trusted partnerships across a global organization. This position plays a key role in helping create safe, secure, and resilient environments for employees, visitors, and business operations. What You’ll Do Regional Security Leadership Lead and support a regional team of security professionals across the AMER region. Partner with global security teams to help maintain consistent standards, processes, and operational practices. Contribute to the development and execution of regional security strategies aligned with business priorities. Use metrics and operational insights to evaluate effectiveness and identify opportunities for improvement. Support budget planning, resource management, and vendor oversight within the security function. Physical Security Operations Oversee physical security programs, policies, and procedures across offices and studio locations. Conduct risk assessments and coordinate security reviews to identify and address potential vulnerabilities. Collaborate with internal stakeholders and external partners to strengthen site security and emergency preparedness. Manage third-party security providers to ensure quality service delivery and alignment with organizational expectations. Provide guidance and operational support to regional sites on security best practices and compliance. Incident & Crisis Response Lead or support responses to workplace security incidents and safety-related matters. Partner closely with Workplace, Legal, HR/People, and other teams to support investigations and incident management. Prepare clear documentation, reporting, and recommendations following incidents or security reviews. Support emergency planning activities, tabletop exercises, and preparedness initiatives. Coordinate response efforts during significant incidents impacting employees, facilities, or operations. Event Security Support security planning and operational readiness for PlayStation events, activations, and executive engagements. Conduct event-related risk assessments and coordinate appropriate security measures. Provide on-site leadership and incident management support during key regional events. Collaboration & Communication Build strong partnerships with teams across HR, IT, Workplace, Legal, and other business functions. Communicate regularly with leadership regarding security priorities, risks, and operational updates. Maintain relationships with industry peers, security organizations, and external partners to stay informed on emerging trends and best practices. What We’re Looking For 8+ years of experience in physical security, corporate security operations, investigations, law enforcement, military, intelligence, or a related field. Demonstrated experience managing security initiatives across multiple locations or regions. Strong leadership and people management skills, including coaching and team development. Ability to assess complex situations, make informed decisions, and communicate effectively during incidents. Excellent collaboration and stakeholder management skills across diverse teams and functions. Experience managing vendors, contractors, or third-party security providers. Familiarity with crisis management, emergency response, and event security operations. Flexibility to support occasional evening/weekend work and regional travel as needed. Preferred Qualifications Experience in technology, gaming, entertainment, or other fast-paced global organizations. Industry certifications such as CPP (Certified Protection Professional) or similar credentials. Bachelor’s degree in Criminal Justice, Security Management, Emergency Management, Business, or a related field — or equivalent professional experience. Location: This position can be based in one of our California offices, including San Mateo, San Diego, Aliso Viejo, or Los Angeles. * Hybrid role with an expectation to work in-office on average 2 days per week #LI-GM1 At SIE, we consider several factors when setting each role’s base pay range, including the competitive benchmarking data for the market and geographic location. Please note that the base pay range may vary in line with our hybrid working policy and individual base pay will be determined based on job-related factors which may include knowledge, skills, experience, and location. In addition, this role is eligible for SIE’s top-tier benefits package that includes medical, dental, vision, matching 401(k), paid time off, wellness program and coveted employee discounts for Sony products. This role also may be eligible for a bonus package. Click here to learn more. The estimated base pay range for this role is listed below. $150,700 — $226,100 USD Please note, Sony Interactive Entertainment conducts background checks at the offer stage for all new employees (which may include criminal background checks for some roles) and will need to process personal information to support these checks. Please refer to our Candidate Privacy Notice (where applicable) for more information about what personal information we collect, how we use it, who we share it with, and your data protection rights. Equal Opportunity Statement: Sony is an Equal Opportunity Employer. All persons will receive consideration for employment without regard to gender (including gender identity, gender expression and gender reassignment), race (including colour, nationality, ethnic or national origin), religion or belief, marital or civil partnership status, disability, age, sexual orientation, pregnancy, maternity or parental status, trade union membership or membership in any other legally protected category. We strive to create an inclusive environment, empower employees and embrace diversity. We encourage everyone to respond. Sony Interactive Entertainment is a Fair Chance employer and qualified applicants with arrest and conviction records will be considered for employment.

Location: United States, Aliso Viejo, CA Why Sony Interactive Entertainment? Sony Interactive Entertainment isn’t just the Best Place to Play — it’s also the Best Place to Work. Sony Interactive Entertainment (SIE) is the company behind the PlayStation brand. As a subsidiary of Sony Group Corporation, we’re part of a proud legacy of innovation and excellence. SIE is a dynamic technology company, delivering cutting-edge hardware and network services to more than 100 million people and an entertainment leader, home to some of the most beloved and recognizable intellectual properties (IP) in the world. Our role at SIE is to create and nurture the experiences under the PlayStation brand, a name synonymous with entertainment excellence and creativity. Sony Interactive Entertainment is seeking an experienced and collaborative Regional Security Manager to lead physical security operations across the Americas (AMER) region. Reporting to the Director, Global Security Operations, this role will oversee a team responsible for regional security programs, incident response, crisis support, and operational readiness across SIE offices, studios, and events. The ideal candidate brings strong operational leadership, sound judgment, and the ability to build trusted partnerships across a global organization. This position plays a key role in helping create safe, secure, and resilient environments for employees, visitors, and business operations. What You’ll Do Regional Security Leadership Lead and support a regional team of security professionals across the AMER region. Partner with global security teams to help maintain consistent standards, processes, and operational practices. Contribute to the development and execution of regional security strategies aligned with business priorities. Use metrics and operational insights to evaluate effectiveness and identify opportunities for improvement. Support budget planning, resource management, and vendor oversight within the security function. Physical Security Operations Oversee physical security programs, policies, and procedures across offices and studio locations. Conduct risk assessments and coordinate security reviews to identify and address potential vulnerabilities. Collaborate with internal stakeholders and external partners to strengthen site security and emergency preparedness. Manage third-party security providers to ensure quality service delivery and alignment with organizational expectations. Provide guidance and operational support to regional sites on security best practices and compliance. Incident & Crisis Response Lead or support responses to workplace security incidents and safety-related matters. Partner closely with Workplace, Legal, HR/People, and other teams to support investigations and incident management. Prepare clear documentation, reporting, and recommendations following incidents or security reviews. Support emergency planning activities, tabletop exercises, and preparedness initiatives. Coordinate response efforts during significant incidents impacting employees, facilities, or operations. Event Security Support security planning and operational readiness for PlayStation events, activations, and executive engagements. Conduct event-related risk assessments and coordinate appropriate security measures. Provide on-site leadership and incident management support during key regional events. Collaboration & Communication Build strong partnerships with teams across HR, IT, Workplace, Legal, and other business functions. Communicate regularly with leadership regarding security priorities, risks, and operational updates. Maintain relationships with industry peers, security organizations, and external partners to stay informed on emerging trends and best practices. What We’re Looking For 8+ years of experience in physical security, corporate security operations, investigations, law enforcement, military, intelligence, or a related field. Demonstrated experience managing security initiatives across multiple locations or regions. Strong leadership and people management skills, including coaching and team development. Ability to assess complex situations, make informed decisions, and communicate effectively during incidents. Excellent collaboration and stakeholder management skills across diverse teams and functions. Experience managing vendors, contractors, or third-party security providers. Familiarity with crisis management, emergency response, and event security operations. Flexibility to support occasional evening/weekend work and regional travel as needed. Preferred Qualifications Experience in technology, gaming, entertainment, or other fast-paced global organizations. Industry certifications such as CPP (Certified Protection Professional) or similar credentials. Bachelor’s degree in Criminal Justice, Security Management, Emergency Management, Business, or a related field — or equivalent professional experience. Location: This position can be based in one of our California offices, including San Mateo, San Diego, Aliso Viejo, or Los Angeles. * Hybrid role with an expectation to work in-office on average 2 days per week #LI-GM1 At SIE, we consider several factors when setting each role’s base pay range, including the competitive benchmarking data for the market and geographic location. Please note that the base pay range may vary in line with our hybrid working policy and individual base pay will be determined based on job-related factors which may include knowledge, skills, experience, and location. In addition, this role is eligible for SIE’s top-tier benefits package that includes medical, dental, vision, matching 401(k), paid time off, wellness program and coveted employee discounts for Sony products. This role also may be eligible for a bonus package. Click here to learn more. The estimated base pay range for this role is listed below. $150,700 — $226,100 USD Please note, Sony Interactive Entertainment conducts background checks at the offer stage for all new employees (which may include criminal background checks for some roles) and will need to process personal information to support these checks. Please refer to our Candidate Privacy Notice (where applicable) for more information about what personal information we collect, how we use it, who we share it with, and your data protection rights. Equal Opportunity Statement: Sony is an Equal Opportunity Employer. All persons will receive consideration for employment without regard to gender (including gender identity, gender expression and gender reassignment), race (including colour, nationality, ethnic or national origin), religion or belief, marital or civil partnership status, disability, age, sexual orientation, pregnancy, maternity or parental status, trade union membership or membership in any other legally protected category. We strive to create an inclusive environment, empower employees and embrace diversity. We encourage everyone to respond. Sony Interactive Entertainment is a Fair Chance employer and qualified applicants with arrest and conviction records will be considered for employment.

Location: Serbia Who we are: Action1 is an autonomous endpoint management platform trusted by many Fortune 500 companies. Cloud-native, infinitely scalable, highly secure, and configurable in minutes, it just works—and is always free for the first 200 endpoints, with no functional limitations. By pioneering autonomous OS and third-party patching, peer-to-peer patch distribution, and real-time vulnerability assessment without requiring a VPN, Action1 eliminates routine IT labor, helps prevent ransomware and other security risks, and protects the digital employee experience. In 2025, Action1 was recognized by the Inc. 5000 as the fastest-growing private software company in America. Action1 is founder-led by Alex Vovk and Mike Walters, entrepreneurs who previously founded Netwrix, a multibillion-dollar cybersecurity company. The Role We are looking for a Product Security Engineer to join the team responsible for securing Action1’s multi-tenant SaaS platform. In this role, you will work closely with engineering, product, and security teams to identify risks early, support vulnerability handling, strengthen secure development practices, and make product security practical, clear, and actionable. This is a hands-on role for someone who understands both software engineering and cybersecurity, enjoys working directly with developers, and wants to build security into the product without slowing teams down unnecessarily. What you'll do: Support Product Security Incident Response Team (PSIRT) and vulnerability-handling activities Validate, triage, track, and coordinate security reports Provide practical remediation guidance to engineering teams Help validate security fixes and reduce product security risks Review code, APIs, and system architecture to identify security issues early Conduct threat modeling and security design reviews Improve security automation within engineering workflows Support SAST, SCA, secrets scanning, and other security controls Maintain software bills of materials (SBOMs), dependency visibility, and remediation follow-up Support security assessments, vulnerability assessments, and penetration testing Maintain vulnerability-handling playbooks, product security procedures, and incident response runbooks Requirements What we are looking for: 3+ years of experience in product security, application security, DevSecOps, or a related cybersecurity field Strong software engineering background and the ability to work effectively with engineering teams Understanding of application, API, infrastructure, and software supply chain security risks Experience applying cloud security concepts and practices Understanding of identity and access management, network security, logging, monitoring, and secure cloud architecture patterns Familiarity with vulnerability management, incident response, security assessments, and secure software development lifecycle practices Experience with threat modeling and security design reviews Strong communication skills, including professional communication with external security researchers and vendors Ability to work independently and collaboratively in a fast-moving environment Nice to have: Genuine interest in cybersecurity and motivation to grow as a product security expert Hands-on experience with AWS security controls, best practices, and architecture patterns Hands-on experience with C++ or JavaScript Experience with security testing and automation using scripts, APIs, CI/CD pipelines, or specialized tools Experience conducting threat modeling for SaaS, API, cloud, or on-premises product components Experience with SBOM generation, dependency visibility, or software supply chain security Benefits What we offer: A fully remote work environment The opportunity to work on a real-world security product used by IT and security teams High ownership and a direct impact on product security practices Close collaboration with engineering, product, and security teams A fast-growing software company with low bureaucracy and practical decision-making The opportunity to improve security processes, automation, and engineering workflows A supportive team that values clear thinking, ownership, and continuous learning

Location: Remote - U.S. About Airship Airship is trusted by world’s leading brands such as Alaska Airlines, BBC and The Home Depot to drive revenue growth and customer loyalty with exceptional cross-channel customer experiences. Today, brands are challenged to deliver seamless, unified customer experiences across a fragmented array of channels and devices— apps, websites, email, SMS, wallets and more. Airship’s no-code, AI-powered platform was designed with non-technical, growth-focused teams in mind, making it easy to create, test and orchestrate hyper-personalized experiences across all channels. With the ability to easily enrich customer data and rapidly launch growth experiments, Airship enables brands to deliver consistent, meaningful interactions that accelerate conversion and foster deeper customer relationships. We invite you to be part of our journey in building products and delivering services that touch millions of customers around the world every day. To learn more about us, visit www.airship.com , read our blog or follow us on LinkedIn. About the Role Airship is looking for an Information Security Architect to own the design and evolution of our security architecture across cloud infrastructure, applications, and the CI/CD pipeline. You'll be Airship's technical authority on secure-by-design systems, partnering with Engineering, Platform, and Product teams to embed security into every phase of the development lifecycle. This is a hands-on architecture role. You'll conduct threat modeling, perform architecture reviews, define security standards and reference architectures, and drive secure design patterns across Airship's GCP-based environment. You'll also evaluate emerging technologies, including AI and generative AI platforms, to identify security risks and define secure adoption patterns. Why This Role Depth over breadth. You'll focus on what matters most: securing Airship's cloud infrastructure and CI/CD pipelines, conducting threat modeling, and shaping architecture decisions GCP at the core. Airship runs on Google Cloud Platform. You'll work deeply with GCP-native security capabilities, defining guardrails, segmentation patterns, logging standards, and workload protection across the platform Secure the pipeline, secure the product. CI/CD pipeline security is a primary focus. You'll design and implement controls that protect the software delivery lifecycle from code commit through production deployment AI-forward security. You'll evaluate and secure AI and GenAI platforms, define usage patterns for AI-assisted development tools, and help establish security architecture for Airship's AI-enabled features Fully remote, flexible culture. Airship's Digital First approach means flexible, remote work is the norm, with a team that collaborates across timezones and geographies every day Room to grow. This role is a path toward senior security architecture, security leadership, or deeper cloud security specialization What You'll Do* Design, develop, and maintain Airship's security architecture, including reference architectures, secure design patterns, and technical security standards Perform security architecture reviews for enterprise applications, cloud platforms, infrastructure services, and technology integrations, ensuring alignment with security standards and risk posture Conduct threat modeling and technical risk assessments to identify security gaps and recommend mitigation strategies Define and implement cloud security guardrails, network segmentation patterns, logging standards, and access control models across Airship's GCP environment Partner with Engineering and DevOps teams to integrate security controls into the CI/CD pipeline, including secure build processes, container security, Infrastructure-as-Code (IaC) security, secrets management, and software supply chain integrity Evaluate proposed architecture and design changes from engineering teams, analyze their security impact, and make recommendations Assess emerging technologies (including AI platforms, generative AI tools, and AI-assisted development technologies) to identify security risks and define secure usage patterns Develop security guidance for API security, application authentication (SAML, OAuth2), encryption, and identity and access management Research security trends, emerging attack methods, and new classes of vulnerabilities to proactively reduce the risk of breach Leverage AI-enabled tools and automation to improve security analysis, architecture review workflows, and threat detection Partner with security tooling teams to evaluate enterprise security tools for architectural fit, integration models, and long-term scalability Participate in the Security on-call rotation and respond to incidents Provide technical security guidance for complex customer inquiries that require deep architectural expertise Mentor colleagues across the organization on secure design principles and security best practices *Duties described are not a comprehensive list. Additional tasks may be assigned from time to time, and responsibilities may be amended at any time at the sole discretion of the Employer. What We're Looking For 8+ years of experience in information security, security architecture, cloud security engineering, or a related technical discipline Deep expertise in Google Cloud Platform (GCP) security, including native security capabilities, cloud architecture patterns, and workload protection Hands-on experience securing CI/CD pipelines, including container security, IaC security, secrets management, and DevSecOps practices Experience conducting threat modeling for complex, distributed systems using standard methodologies Experience performing security architecture and design reviews for cloud-native applications and infrastructure Proficiency in at least one scripting language (e.g., Python, Java, Bash/shell) Working knowledge of network security concepts, including segmentation, Zero Trust principles, firewalls, and access control models Working knowledge of identity and access management concepts, including SSO, MFA, federation, and least-privilege access Strong understanding of application security, including OWASP, API security, secure SDLC practices, and authentication protocols (SAML, OAuth2) Working knowledge of how to protect and administer macOS, Linux, and Windows systems Ability to translate security requirements into practical, scalable technical solutions Strong written and verbal communication skills, with a talent for explaining complex security concepts to both technical and non-technical audiences Experience experimenting with AI tools in your personal or professional life We'd Be Delighted If You Also Have One or more industry certifications (e.g., CISSP, CCSP, Google Cloud Professional Security Engineer, OSCP, GIAC certifications) Experience with enterprise security technologies such as Splunk, CrowdStrike, Rapid7, Vanta, Okta, and DLP solutions Familiarity with AI security concepts, secure AI platform adoption, and AI risk frameworks (e.g., NIST AI RMF, ISO 42001) Experience developing security reference architectures, design patterns, and technical standards documentation Experience with Kubernetes security, container orchestration, and cloud-native security tooling (CSPM, CWPP) Knowledge of data security practices including encryption, data classification, DLP, and key management Experience evaluating third-party technologies and conducting technical security assessments for vendor platforms Work Location & Travel Requirements Airship’s ‘Digital First’ approach to work means that for the majority of our roles, work can be performed remotely, either some or most of the time. Airship believes that flexible work contributes to a more productive and more equitable work environment, and that Airshippers are able to collaborate, innovate, and support one another across different locations and timezones. Some roles may require that employees perform their work from a specific location to support business activities, and/or be within proximity to an Airship office location or customer or partner locations, while other roles can be performed 100% remotely. This position is fully remote and may require up to 10% travel based on business needs or as requested by your manager. Compensation Starting Pay Range: $130,000-$160,000 USD per year This is a good faith estimate of the base compensation we reasonably expect to pay for this position upon hire. Actual starting pay may vary based on factors such as relevant skills, work experience, market demands, and location. All offers include stock options so employees have the opportunity to benefit from Airship’s success. Benefits & Perks Competitive medical, dental, and vision insurance options for you and your dependents Flexible time off, company paid holidays, paid parental leave, and paid volunteer time off Support for your overall wellbeing with mental health and wellness resources Employer-subsidized life insurance as well as short-term and long-term disability A digital-first work environment and a monthly stipend to support remote work Mentorship and growth opportunities to build skills and accelerate professional development And more! We use artificial intelligence tools in our recruitment process as decision-support tools only. Airship's People Operations team reviews all AI-generated scores and recommendations before making any hiring determination. No applicant is rejected solely on the basis of an AI-generated output. Depending on your location, you may have the right to request human review of any AI-assisted employment decision or to opt out of AI evaluation. To make a request or learn more about how we use AI in hiring, contact privacy@airship.com or visit airship.com/legal . California residents can view the CCPA disclosure notice here . ** Please Note: To ensure the security of your personal information, Airship will only contact candidates through email addresses ending with “@airship.com”. Hiring Commitment Airship is committed to fostering a diverse work environment and providing equal employment opportunities to all applicants and employees. We welcome your application and our hiring and employment decisions are made irrespective of race, religion, color, national origin, gender, gender expression, sexual orientation, age, marital status, veteran status, disability status or any other characteristic protected by law. In alignment with our commitment to equal opportunity, Airship will consider for employment all qualified applicants, including those with criminal histories, in a way that adheres to the principles of fairness and the requirements of local Fair Chance laws, where applicable. By submitting this application, I affirm that the facts set forth in it are true and complete to the best of my knowledge. I understand that if I am employed, false statements, omissions, or misleading information given in my application, interview(s), or in a background check may result in dismissal.

Location: Paris ABOUT MISTRAL Mistral provides full-stack AI solutions: from frontier models to developer tools, applications, and compute. We partner with enterprises tackling the hardest problems across high-stakes industries like finance, manufacturing, defense, healthcare, and the public sector, co-creating customized AI systems that they can run on their terms. We are a dynamic, collaborative team passionate about AI and its potential to transform society. Our diverse workforce thrives in competitive environments and is committed to driving innovation. Our teams are distributed between Europe, North America, Asia and the Middle East. We are creative, low-ego and team-spirited. Role summary   As a Product Security Engineer within the Cybersecurity organization, you will be the dedicated security partner for one or more product organizations (such as Vibe, Studio or Forge). You will work alongside engineers, researchers and product managers to ensure security is built into every stage of the product lifecycle—from early design and architecture decisions through implementation, production deployment and continuous evolution. Your mission is to help engineering teams build secure products without slowing them down. Rather than acting as a gatekeeper, you will enable teams to make sound security decisions through secure-by-design principles, pragmatic engineering guidance and scalable security automation. You will own the Product Security strategy for your product portfolio, influence engineering decisions, and help define how secure software is built across one of the world's leading AI companies.   What you will do   - Serve as the dedicated Product Security partner for one or more product organizations. - Drive security throughout the entire product lifecycle, from design and architecture reviews to production deployment and ongoing operation. - Lead threat modeling, security architecture reviews and risk assessments for new features, APIs and major architectural changes. - Define pragmatic security requirements and secure-by-default patterns that enable engineering teams to ship safely at high velocity for a specific product. - Review critical designs and code, focusing on authentication, authorization, tenant isolation, data protection, cryptography and other high-impact security controls. - Design product-specific security validation strategies, including targeted testing, abuse-case development and guided agent-based security assessments tailored to each product's architecture and workflows. - Partner with engineering teams to prioritize and remediate vulnerabilities identified through code reviews, penetration testing, bug bounty programs and automated security testing. - Collaborate with Security Engineering to improve reusable security platforms, developer guardrails and security capabilities integrated into the SDLC. - Champion secure software engineering through coaching, technical leadership, reusable design patterns and Security Champion programs. - Define Product Security metrics, continuously improve the security posture of your products and help shape Product Security practices across the company. What we're looking for: - 5+ years of experience in Product Security, Application Security or Software Engineering with a strong security focus. - Strong understanding of modern software architecture, distributed systems, APIs and cloud-native applications. - Demonstrated experience performing threat modeling, architecture reviews and secure design assessments. - Deep understanding of modern software security, including authentication, authorization, cryptography, secrets management, tenant isolation, secure data flows and common vulnerability classes (OWASP Top 10, CWE). - Strong software engineering skills in Python, Go, TypeScript or similar languages, with the ability to review production code and build security automation. - Experience with application security testing techniques, including manual code review, penetration testing, bug bounty programs. - Experience designing product-specific security testing approaches, including security automation or agent-based testing, is highly valued. - Strong understanding of Secure SDLC principles from product design through production deployment and long-term maintenance. - Excellent communication and influencing skills, with the ability to earn trust across engineering organizations and balance security, product delivery and developer experience. - A pragmatic, engineering-first mindset with strong technical judgment and a focus on solving meaningful security problems. WHAT WE OFFER We offer a comprehensive benefits package designed to support your well-being, growth, and work-life balance. Benefits vary by country and may include healthcare coverage, parental leave, retirement plans, relocation support, wellness programs, meal and transportation allowances, and other location-specific perks. For the most up-to-date details on benefits available in your location, please refer to our Benefits page https://app.notion.com/p/mistralai/Benefits-at-Mistral-36e6ba59a7fe836b93dd01737fcc27ef?source=copy_link. PRIVACY POLICY Your privacy matters to us. You can learn more about how we handle your personal data in our Applicant Privacy Policy https://legal.mistral.ai/terms/applicant-privacy-policy.

Location: Almaty, Kazakhstan Workplace: OnSite WHY WORK AT HIGGSFIELD AI? We're the fastest-scaling generative AI company in history, hitting $1B in annual revenue run rate, 30M+ users worldwide, and powering 390 of Fortune 500 brands. We’re building at the absolute frontier of AI-powered video creation and next-generation creative tools. Joining Higgsfield means becoming part of a high-impact team shaping the future of AI-native experiences, at a company that isn’t just moving fast, but rewriting what fast looks like. ABOUT THE ROLE We’re looking for an IT Security Engineer to own and strengthen the security of our corporate technology environment. This is a hands-on role spanning identity and access management, endpoint security, SaaS security, Zero Trust, security automation, and incident response. You’ll work closely with Security, IT, Engineering, and business teams to build secure, scalable systems and automate the controls that protect our people, devices, applications, and data.   WHAT YOU’LL DO IDENTITY & ACCESS MANAGEMENT - Own and strengthen identity and access controls across our corporate environment, with a focus on Microsoft Entra ID. - Implement and maintain SSO/SAML, SCIM provisioning, MFA, Conditional Access, and RBAC. - Build and improve automated joiner, mover, and leaver (JML) workflows. - Regularly review permissions, privileged access, and authentication policies to reduce unnecessary access and security risk. - Help establish identity as the foundation of our Zero Trust security model. ENDPOINT SECURITY - Manage and improve endpoint security through Microsoft Intune/MDM, device compliance policies, and endpoint protection tooling. - Deploy and maintain EDR capabilities across the corporate fleet. - Establish and enforce security baselines for employee devices. - Investigate endpoint security events and remediate compromised or non-compliant devices. SAAS & CORPORATE APPLICATION SECURITY - Assess and improve the security posture of corporate SaaS applications. - Partner with application owners to implement appropriate authentication, authorization, provisioning, and data-access controls. - Identify shadow IT, excessive permissions, insecure configurations, and other SaaS-related risks. - Help establish scalable security standards for onboarding and managing new corporate applications. ZERO TRUST & CORPORATE ACCESS - Design and implement Zero Trust principles across identity, endpoints, applications, and corporate access. - Strengthen controls around privileged access, remote access, and access to sensitive systems. - Apply practical security controls that balance strong protection with employee productivity. SECURITY AUTOMATION - Automate repetitive security and IT workflows using scripts, APIs, and integrations. - Build tooling to automate access reviews, provisioning, compliance checks, alert enrichment, remediation, and other security processes. - Use scripting languages such as Python or JavaScript to improve security operations and reduce manual work. - Look for opportunities to turn manual security processes into scalable, reliable systems. DETECTION & INCIDENT RESPONSE - Monitor and investigate security alerts across identity, endpoint, and corporate systems. - Perform initial investigation and triage of suspicious activity and potential security incidents. - Support incident containment, remediation, and post-incident improvements. - Build lightweight detections and alerts for meaningful risks within the corporate environment. WHAT WE’RE LOOKING FOR - Strong hands-on experience with identity and access management, ideally within Microsoft Entra ID. - Experience implementing or managing SSO/SAML, SCIM, MFA, Conditional Access, RBAC, and JML workflows. - Experience with MDM and endpoint security, ideally Microsoft Intune and modern EDR tooling. - Understanding of SaaS and corporate application security. - Experience implementing or operating within a Zero Trust security model. - Ability to automate workflows using scripts and APIs, with experience in a language such as Python or JavaScript. - Working knowledge of security detection, investigation, and incident response. - Strong security judgment — you can distinguish theoretical risk from meaningful business risk and prioritize accordingly. - Comfortable operating independently in a fast-moving startup environment where priorities can change quickly. - Builder mindset: you look for ways to automate, simplify, and improve systems rather than relying on manual processes. NICE TO HAVE - Experience with reverse engineering, CTFs, security competitions, or similar hands-on security challenges. - Strong understanding of networking fundamentals, including VPNs, network segmentation, authentication protocols, and common lateral-movement techniques. - Experience securing rapidly scaling or highly technical organizations. - Experience working closely with engineering or product security teams. - Familiarity with cloud security concepts and modern security monitoring tools. WHAT WE OFFER: - Competitive base salary in USD - Equity: participation in the company’s stock option program, giving you the opportunity to share in the company’s long-term growth. - On-site role in our Almaty office (we will relocate you from anywhere).

Location: GE; PL Workplace: remote Overview: SOFTSWISS is looking for a Head of Security Business Partnering to drive the execution of the cybersecurity strategy across a diverse technology ecosystem. Purpose of the role: You will coordinate Security Business Partners assigned to individual business units and ensure that security priorities are translated into clear roadmaps, measurable targets and completed actions. You will own the Security Business Partnering operating model, planning cycle and performance framework. You will establish governance, drive continuous improvement of interaction processes, and track security posture, risks and delivery across the ecosystem. You will resolve dependencies and escalate issues that require executive decisions. Central security teams will remain responsible for their domains. Your role is to align priorities, clarify ownership and ensure that agreed actions are delivered. Key responsibilities: Coordinate and develop Security Business Partners across the business units. Set common responsibilities, working practices and performance expectations. Review the performance against agreed KPIs, objectives and delivery commitments. Turn the cybersecurity strategy into business-unit roadmaps, targets and delivery plans. Manage the security portfolio across the ecosystem, including strategic programmes, remediation plans, KPIs, OKRs and SLAs. Track delivery, address delays and require recovery plans when work falls behind. Escalate material risks, missed commitments and unclear ownership. Coordinate initiatives involving several business units or central security teams. Match business demand with the priorities and capacity of central security functions. Explain technical risks in terms of revenue, operations, customers, regulation and market expansion. Identify recurring problems that should be solved through shared capabilities, common standards or secure-by-default solutions. Support the security integration of acquired and newly established business units. Required Experience: Management experience in cybersecurity within a complex technology organisation. Experience coordinating or functionally leading senior security professionals. Experience working across several business units or products in a matrix structure. Strong skills in security planning, governance and delivery management. A record of turning security strategy into measurable business-unit results. Experience managing security KPIs, OKRs, SLAs, roadmaps and remediation programmers. The ability to influence executives, align stakeholders and hold owners accountable. Strong performance-management and stakeholder-management skills. The ability to create structure and transparency where ownership is distributed. Nice to have: Experience in iGaming, FinTech, or another highly regulated digital industry is an advantage. Experience with federated security models, M&A integration or executive governance is also valuable. Main Advantages Private health insurance Sports benefits Comprehensive Mental Health Program Free English lessons (online) Local language courses Paid time off Maternity leave support Referral program rewards Upskilling, internal workshops, and participation in professional conferences and corporate events

Location: Almaty, Kazakhstan Workplace: OnSite WHY WORK AT HIGGSFIELD AI? We're the fastest-scaling generative AI company in history, hitting $1B in annual revenue run rate, 30M+ users worldwide, and powering 390 of Fortune 500 brands. We’re building at the absolute frontier of AI-powered video creation and next-generation creative tools. Joining Higgsfield means becoming part of a high-impact team shaping the future of AI-native experiences, at a company that isn’t just moving fast, but rewriting what fast looks like. ABOUT THE ROLE Break new features before they ship: agentic systems, MCP servers, code-generating agents, user-deployed apps, generative models for image, video, and voice, and enterprise features (SSO, org and team management, roles). It's new ground, and you'll help define how we secure it. You go first. What you'll do: - Pentest new features and products pre-release: web, APIs, admin surfaces. - Work out the attack surface of each new feature yourself. - Hunt authorization flaws across our multi-tenant APIs and retest fixes. - Join design and code reviews early, so flaws die before they're built. - Turn recurring findings into guardrails — paved-road standards and automated checks — so a bug class dies once instead of resurfacing every release. - Bring a working repro to the team that owns the code and see the fix through. Requirements - A track record of finding real vulnerabilities in real systems — appsec work, bug bounty, or research. - The ability to read modern codebases, trace a bug to root cause, and discuss the fix with the engineers who wrote it. - A threat-modeling instinct for spotting the weak spots in a design or architecture before a line is written. - Enough cloud and container fundamentals to follow a bug into the infrastructure it runs on. - High agency. - Working English. Nice to have - LLM/agent security research, public research or CVEs, OSWE/CWEE or equivalent hands-on certificates. WHAT WE OFFER: - Competitive base salary in USD - Equity: participation in the company’s stock option program, giving you the opportunity to share in the company’s long-term growth. - On-site role in our Almaty office (we will relocate you from anywhere).

Location: Remote - US Who we are At Twilio, we’re shaping the future of communications, all from the comfort of our homes. We deliver innovative solutions to hundreds of thousands of businesses and empower millions of developers worldwide to craft personalized customer experiences. Our dedication to remote-first work , and strong culture of connection and global inclusion means that no matter your location, you’re part of a vibrant team with diverse experiences making a global impact each day. As we continue to revolutionize how the world interacts, we’re acquiring new skills and experiences that make work feel truly rewarding. Your career at Twilio is in your hands. . Hiring and how we work We use Artificial Intelligence (AI) to help make our hiring process efficient. That said, every hiring decision is made by real Twilions! Also, while we are a remote-first company, you may be asked to report in person on an ad-hoc basis for team gatherings, functional off-sites or customer meetings. . See yourself at Twilio Join the team as Twilio’s next Senior Security Engineer, Incident Response About the job The Security Incident Response Team (SIRT) is looking for a Senior Security Engineer who is passionate about solving Twilio’s mission of security and reliability by working across the organization to lead the technical response to security events and incidents across Twilio’s global infrastructure, services and applications by effectively conducting triage, containment, remediation and driving post-incident betterments.  You will work within a team that partners with R&D Engineering and R&D Business teams to develop scalable processes and technical solutions. You will be a valued member of a team of deeply technical Security Engineers to focus on creating bespoke and standard Security response processes, enhancing our capabilities for threat mitigation and incident response, and then automating as much as you possibly can (and more)! You will help us to grow our global, scaled team and program. Responsibilities In this role, you’ll: Be an Owner : Lead and support the response to all security events and incidents across Twilio’s complex global infrastructure, services and applications. Write It Down : Be responsible for documentation of incidents and projects you work on and craft best practices as runbooks and standard operating procedures to share knowledge across teams. Wear the customer’s shoes : Work cross-collaboratively to understand and help solve challenges related to a broad spectrum of threat actors and activity. Ruthlessly Prioritize: Work to improve Twilio’s security and reliability posture by driving identified betterments from security events and incidents. Don’t Settle : Rapidly acquire new technical skills and knowledge in a fast-paced, highly disruptive industry environment. Draw the Owl : Own the security incident lifecycle, respond to incidents and participate in on-call rotation and participate in RCAs for security incidents. Empower Others : Build, cultivate, and maintain positive relationships with internal customers to identify and facilitate solutions to increase the impact of the team’s work. Be Inclusive : Provide mentorship, support, and care for the team in a way that enables long-term career development, happiness, and success at scale. Qualifications Twilio values diverse experiences from all kinds of industries, and we encourage everyone who meets the required qualifications to apply. If your career is just starting or hasn't followed a traditional path, don't let that stop you from considering Twilio. We are always looking for people who will bring something new to the table! *Required: Proven experience: 5+ years of security incident response in a production-cloud environment Subject-matter expert on security issues and technologies Ability to utilize AI for comprehensive, complex security incident response activities delivering high fidelity detections Advanced knowledge of service-oriented architectures, as well as experience with security tools and technologies fit for a cloud environment Experience working across a technology stack on difficult security challenges and initiatives Experience with SIEM platforms and the ability to extend their functionality Experience with SOAR tools and automating manual security processes Experience in either AWS, GCP, or other large cloud platform Excellent written and verbal communication skills Ability to influence and build effective working relationships with every level of the organization. Desired: AI Model Security & Posture Management: Support Implementation of  controls and safeguards to prevent AI vulnerabilities, such as prompt injections, model evasion, and data poisoning AI-Driven Threat Response: Utilize GenAI and LLM-based security use cases to rapidly interpret alerts, reduce false positives, and contextualize threat data Artifact & Evidence Triage: Collects intrusion artifacts and forensically sound images to analyze malware, trojans, and source code. Threat Intelligence Integration: Monitors external vendor data and threat intelligence to analyze trends and proactively defend against emerging risks Location This role will be remote, but is not eligible to be hired in CA, CT, NJ, NY, PA, WA. Travel We prioritize connection and opportunities to build relationships with our customers and each other. For this role, you may be required to travel occasionally to participate in project or team in-person meetings. What We Offer Working at Twilio offers many benefits, including competitive pay, generous time off, ample parental and wellness leave, healthcare, a retirement savings program, and much more. Offerings vary by location. Compensation *Please note this role is open to candidates outside of California, Colorado, Hawaii, Illinois, Maryland, Massachusetts, Minnesota, New Jersey, New York, Vermont, Washington D.C., and Washington State. The information below is provided for candidates hired in those locations only. The estimated pay ranges for this role are as follows: Based in Colorado, Hawaii, Illinois, Maryland, Massachusetts, Minnesota, Vermont or Washington D.C. : $141,520.00 - $176,900.00. Based in New York, New Jersey, Washington State, or California (outside of the San Francisco Bay area): $149,840.00 - $187,300.00 Based in the San Francisco Bay area, California: $166,400.00 - $208,000.00. This role may be eligible to participate in Twilio’s equity plan and corporate bonus plan. All roles are generally eligible for the following benefits: health care insurance, 401(k) retirement account, paid sick time, paid personal time off, paid parental leave. The successful candidate’s starting salary will be determined based on permissible, non-discriminatory factors such as skills, experience, and geographic location. Application deadline information Applications for this role are intended to be accepted until 30th of Sept, but may change based on business needs. Twilio thinks big. Do you? We like to solve problems, take initiative, pitch in when needed, and are always up for trying new things. That's why we seek out colleagues who embody our values — something we call Twilio Magic . Additionally, we empower employees to build positive change in their communities by supporting their volunteering and donation efforts. So, if you're ready to unleash your full potential, do your best work, and be the best version of yourself, apply now! If this role isn't what you're looking for, please consider other open positions. . Stay alert to recruitment fraud We care about your safety. Scammers sometimes impersonate Twilio recruiters through fake job postings, emails, websites, or messages. Please ensure you are engaging with an official @ twilio.com email address. We will never ask for payment, gift cards, cryptocurrency, or banking information during the recruiting process. We do not make job offers without a formal interview process or conduct interviews exclusively through text-based messaging apps. . Twilio is proud to be an equal opportunity employer. We do not discriminate based upon race, religion, color, national origin, sex (including pregnancy, childbirth, reproductive health decisions, or related medical conditions), sexual orientation, gender identity, gender expression, age, status as a protected veteran, status as an individual with a disability, genetic information, political views or activity, or other applicable legally protected characteristics. We also consider qualified applicants with criminal histories, consistent with applicable federal, state and local law. Qualified applicants with arrest or conviction records will be considered for employment in accordance with the Los Angeles County Fair Chance Ordinance for Employers and the California Fair Chance Act. Additionally, Twilio participates in the E-Verify program in certain locations, as required by law.

Location: United States of America What We Do: Cybercrime is growing, and more businesses are getting hit by threats that used to target only the biggest organizations. That pushes defenders like us to operate at the highest level, and it deepens our need for good people who want to make a meaningful impact. Founded in 2015 by former NSA cyber operators, Huntress is a remote-first team working to make enterprise-grade cybersecurity accessible to businesses of all sizes. We work closely with security teams and service providers protecting complex environments, often without the time or headcount to handle it all. That’s why we build our technology in-house and back it with a 24/7 human-led Security Operations Center (SOC). As a result, our platform is never disconnected from the experts who manage it, ensuring our customers' protection. Huntress now secures more than 6M endpoints and 17M identities worldwide. Those numbers keep growing because more businesses rely on us to help carry the load and operate with more confidence. Every day, you can see that commitment in how we stand with our customers and how we show up for each other. Reports to: Manager, Product Research Location: Remote, US Compensation Range: $200,000 to $230,000 base plus bonus and equity What You’ll Do: The Huntress Product Research team has the unique honor of waking up every morning knowing we’re going to make hackers regret targeting our partners and customers. As a Principal Product Researcher, we’re looking for someone who wants to pour all of their creativity into building and implementing simple solutions that are disproportionately effective at countering these constantly evolving threats. Competitive candidates have experience managing, deploying, and securing SMB environments utilizing a wide variety of security software, best practices, and automation tools. Familiarity with product management, incident response, social engineering, psychology, education, and managed service provider tools is an additional way to differentiate yourself. As you can imagine, success doesn’t happen in a vacuum. An effective Product Researcher fosters highly collaborative environments between the Product, Engineering, and Security teams to accelerate our mission and secure the 99% of businesses that fall below the enterprise poverty line. This collaboration is needed to produce and prioritize a unified technical vision that ultimately delivers our most impactful features and capabilities. We defend over 5M endpoints for 225,000+ mid-sized and small-business customers, and that number continues to grow each month. Given this market’s tighter budget, it’s not financially feasible to assign human analysts to each client. The Security Operations team addresses this challenge head-on by building and scaling highly automated efficiencies—often lightly augmented by our SOC — that make intruders earn every inch of their access while maintaining affordability and healthy gross margins. Roles and Responsibilities: Identify innovative ways to detect Windows OS threats Develop cross-platform features that leverage telemetry from common OS subsystems such as file system, memory, process, and network activity Research and development of sensor capabilities to provide visibility and detection support for attack techniques across supported Windows OS versions Work collaboratively with internal engineering and detection teams to implement detection logic Identify and evaluate new telemetry opportunities Identify and address gaps in product coverage Respond to product escalations Perform False Positive and False Negative investigations Lead product research initiatives to develop and evaluate security product strategies and technologies Coordinate with Product and Engineering teams to integrate and operationalize solutions developed by Threat Operations teams Applies AI as a practical part of day-to-day product research work to improve the speed, quality, and impact of research outputs Uses AI to support information gathering, analysis, prototyping, and production of clear, decision-useful work products while maintaining accountability for the final output Builds and reuses lightweight prompts, templates, or workflows for recurring research tasks rather than relying on one-off use Develop internal and external technical documentation to educate customers and communicate research findings to adjacent teams about security risks and opportunities Mentor and teach technical expertise to advance the broader community Promote Huntress’ reputation through media interaction, public speaking, CFPs, CTFs, and blogs Qualifications: Expert in Windows OS internals, components, APIs, and design Prior experience with Windows OS kernel coding and device drivers Experience testing EDRs, bypasses, and evasion techniques Comfortable with reverse engineering and using debuggers Proficiency in multiple programming/scripting languages, such as C/C++/C#, PowerShell, and Python Applies AI to improve research quality, speed, and outputs in day-to-day work Commitment to clear documentation of research findings Experience with MITRE ATT&CK matrix, SIGMA, Yara, and Elasticsearch/Kibana What We Offer: 100% remote work environment - since our founding in 2015 Generous paid time off policy, including vacation, sick time, and paid holidays 12 weeks of paid parental leave Highly competitive and comprehensive medical, dental, and vision benefits plans 401(k) with a 5% contribution regardless of employee contribution Life and Disability insurance plans Stock options for all full-time employees One-time $500 reimbursement for building/upgrading home office Annual allowance for education and professional development assistance $75 USD/month digital reimbursement Access to the BetterUp platform for coaching, personal, and professional growth Huntress is committed to creating a culture of inclusivity where every single member of our team is valued, has a voice, and is empowered to come to work every day just as they are. We do not discriminate based on race, ethnicity, color, ancestry, national origin, religion, sex, sexual orientation, gender identity, disability, veteran status, genetic information, marital status, or any other legally protected status. We do discriminate against hackers who try to exploit businesses of all sizes. Accommodations: If you require reasonable accommodation to complete this application, interview, or pre-employment testing or participate in the employee selection process, please direct your inquiries to accommodations@huntresslabs.com . Please note that non-accommodation requests to this inbox will not receive a response. Huntress uses artificial intelligence tools to assist in reviewing and evaluating job applications, including resume screening, skills assessment, and candidate matching and comparisons. These AI tools support our human recruiters in the initial review process, but do not make final hiring decisions without human involvement. By submitting your application, you acknowledge this use of AI in our recruitment process. Please review our Candidate Privacy Notice for more details on our practices and your data privacy rights. #BI-Remote

Location: Spain About the Opportunity Dentons Europe is currently seeking a Information Security Engineer, specializing in Microsoft cloud technologies to play a key role in strengthening and evolving our security landscape. In this role, you will design and implement security controls across cloud and hybrid environments, with a strong focus on Microsoft 365 and Microsoft Azure. You will operate at the intersection of architecture and execution shaping security decisions, guiding technical teams, and ensuring that systems, applications, and integrations meet the firm’s security, compliance, and reliability standards. As a trusted advisor and technical authority, you will work closely with Information Security, IT, and business stakeholders across Europe, embedding security into the design and delivery of technology solutions while continuously improving the organization’s overall security posture. This is an opportunity to make a visible, enterprise-wide impact in a complex, international environment. You will primarily be accountable for Design, implement, and maintain robust security and compliance controls across Microsoft 365, Microsoft Azure, and hybrid environments. Act as a cybersecurity subject-matter expert for Europe and Country IT teams providing clear, practical guidance on secure design and implementation. Assist in embedding security into application, infrastructure, identity, endpoint, and integration architectures (including APIs and data flows), ensuring alignment with secure development lifecycle practices and architectural standards. Collaborate with architects, engineers, project teams, and business stakeholders to define security requirements as integral part of enterprise initiatives and technology solutions from the outset. Work closely with SOC and CSIRT teams to support incident response activities, including investigation, containment, and remediation, and ensure lessons learned are reflected in improved controls and architecture. Lead end-to-end vulnerability management activities, including vulnerability scanning, assessments, penetration testing coordination, and remediation tracking with system owners and technical teams. Identify, assess, and mitigate security risks across cloud and enterprise environments, driving measurable improvements in the firm’s security posture. Provide advanced troubleshooting and technical leadership for complex or high-impact security issues. Develop and maintain security documentation, standards, reports, and control frameworks. Requirements Minimum 3 years of experience in cloud security or enterprise cybersecurity engineering Advanced expertise in Microsoft Azure security, including at least two of: Defender for Cloud Microsoft Sentinel Infrastructure / Network Security (IaaS) Application and API security Storage and database security Advanced expertise in Microsoft 365 security, including at least two of: Microsoft Entra ID, identity and access management Microsoft Purview, data protection and compliance Microsoft 365 Defender suite Intune / Endpoint Manager Strong understanding of: Security architecture principles, including Zero Trust, defense-in-depth and least privilege Hybrid cloud environments and system integrations Vulnerability management, including analyzing penetration testing and coordinating remediation of results API security and modern integration technologies Scripting and automation skills, e.g., PowerShell, Python or Bash Strong interest in security architecture, with a desire to deepen exposure and grow toward architectural responsibilities Professional experience Proven experience designing and implementing secure solutions in Microsoft technologies-based enterprise environments Experience working with large-scale or multi-country IT environments Solid exposure to security operations, incident response and security tooling Experience collaborating across infrastructure, development and business teams Benefits Remuneration and benefits package will reflect the successful candidates experience and country where hired. Please apply with an English resume

Location: Remote - Europe About Nebius: Nebius is leading a new era in cloud infrastructure for the global AI economy. We are building a full-stack AI cloud platform that supports developers and enterprises from data and model training through to production deployment, without the cost and complexity of building large in-house AI/ML infrastructure. Built by engineers, for engineers. From large-scale GPU orchestration to inference optimization, we own the hard problems across compute, storage, networking and applied AI. Listed on Nasdaq (NBIS) and headquartered in Amsterdam, we have a global footprint with R&D hubs across Europe, the UK, North America and Israel. Our team of 1,500+ includes hundreds of engineers with deep expertise across hardware, software and AI R&D. Offensive security The internal offensive security team is responsible for the penetration testing program, red team engagements, and offensive research aimed at uncovering sophisticated attack scenarios targeting high-value assets across the Nebius Cloud stack. The Role We're hiring an Offensive Security Lead to build and run Nebius' red team capability. You'll design and execute adversarial simulation across our cloud platform - attacking the same infrastructure our customers depend on - and translate findings into measurable security improvements. This is a hands-on leadership role within Product Security Team. You will build an internal red team, establish a penetration testing program, and conduct research to uncover sophisticated attack scenarios targeting high-value assets across the Nebius tech stack. What you’ll do Build and lead a red team function within Product Security Team, hiring and developing offensive security engineers. Validate and extend early-stage Secure SDLC threat models via continuous penetration testing , assessing threat severity and mitigation status while challenging assumptions made during threat modeling and system development. Automate routine validations to keep pace with increasing feature flow, reserving manual analysis for genuinely complex cases. Plan and execute full-scoped red team engagements against Nebius cloud platform - including compute, storage, inference, networking, orchestration layers, and internal tooling. Identify threats, which are able to impact an organization's operations. Work closely with Detection & Response and other security engineering teams to run purple team exercises, validate detection coverage, and close gaps collaboratively. Research novel attacks against GPU infrastructure (e.g., closed-source firmware and vendor driver binaries, device passthrough exploits, SR-IOV/IOMMU misconfigurations, RDMA/InfiniBand fabric attacks, etc.), the inference stack (e.g., vLLM, TRT-LLM), and AI platform managed services (e.g., managed Slurm). Assess tenant-isolation boundaries and how they can be broken at the low-level stack Conduct targeted assessments of new products and infrastructure changes before they ship. Deliver clear, actionable reports for both technical audiences and leadership - with prioritized findings and remediation guidance. Establish red team processes, tooling, and a methodology that scales as the platform grows. What we’re looking for 6+ years in offensive security - penetration testing, red teaming, or adversary simulation - with at least 1-2 years leading or mentoring a team. Deep experience attacking cloud-native environments: Kubernetes privilege escalation, cloud IAM abuse, virtualization and container escapes. Strong fundamentals across the attack lifecycle: initial access, persistence, lateral movement, data exfiltration. Proficiency developing custom tooling and post-exploitation capabilities (Python, Go, or similar). Experience running purple team exercises and working constructively with blue teams. Ability to write clear, senior-level reports with business-contextualized risk (not just raw findings) that engineers can easily use. Nice to have Experience attacking ML infrastructure, model serving pipelines, or GPU clusters. Reverse engineering and exploits development experience Application security experience Familiarity with eBPF bypass techniques or kernel-level exploitation. Background in vulnerability research or CVE discovery. Experience with cloud provider internals (hypervisor/networking layers). Presenting your security research at conferences like BlackHat/DefCon, etc. Hiring Process Recruiter's chat (30mins) Live-coding interview (60mins) to asses basic coding skills Security interview (60mins) to asses domain expertise Security System Design interview (90mins) to assess practical experience (Optional) Technical deep dive (90mins) to present a complex and impact project. Final interview to close the hiring process (45mins) Why this role at Nebius Build a red team from scratch at a company operating frontier AI infrastructure. Attack surface that's genuinely novel - GPU clusters, AI platforms, multi-tenant cloud at scale. Work alongside world-class engineers on infrastructure that powers frontier AI. Competitive compensation with equity upside in a Nasdaq-listed, high-growth company. Flexible, remote-first culture #LI-CP1 Benefits & Perks: Competitive compensation Career growth and learning opportunities Flexibility and ownership Collaborative and innovative culture Opportunity to work on impactful AI projects International environment and talented teams What's it like to work at Nebius: Fast moving - Bold thinking - Constant growth - Meaningful impact - Trust and real ownership - Opportunity to shape the future of AI Equal Opportunity Statement: Nebius is an equal opportunity employer. We are committed to fostering an inclusive and diverse workplace and to providing equal employment opportunities in all aspects of employment. We do not discriminate on the basis of race, color, religion, sex (including pregnancy), national origin, ancestry, age, disability, genetic information, marital status, veteran status, sexual orientation, gender identity or expression, or any other characteristic protected by applicable law. Applicants must be authorized to work in the country in which they apply and will be required to provide proof of employment eligibility as a condition of hire. If you need accommodations during the application process, please let us know.

Location: Czechia About the Opportunity Dentons Europe is currently seeking a Information Security Engineer, specializing in Microsoft cloud technologies to play a key role in strengthening and evolving our security landscape. In this role, you will design and implement security controls across cloud and hybrid environments, with a strong focus on Microsoft 365 and Microsoft Azure. You will operate at the intersection of architecture and execution shaping security decisions, guiding technical teams, and ensuring that systems, applications, and integrations meet the firm’s security, compliance, and reliability standards. As a trusted advisor and technical authority, you will work closely with Information Security, IT, and business stakeholders across Europe, embedding security into the design and delivery of technology solutions while continuously improving the organization’s overall security posture. This is an opportunity to make a visible, enterprise-wide impact in a complex, international environment. You will primarily be accountable for Design, implement, and maintain robust security and compliance controls across Microsoft 365, Microsoft Azure, and hybrid environments. Act as a cybersecurity subject-matter expert for Europe and Country IT teams providing clear, practical guidance on secure design and implementation. Assist in embedding security into application, infrastructure, identity, endpoint, and integration architectures (including APIs and data flows), ensuring alignment with secure development lifecycle practices and architectural standards. Collaborate with architects, engineers, project teams, and business stakeholders to define security requirements as integral part of enterprise initiatives and technology solutions from the outset. Work closely with SOC and CSIRT teams to support incident response activities, including investigation, containment, and remediation, and ensure lessons learned are reflected in improved controls and architecture. Lead end-to-end vulnerability management activities, including vulnerability scanning, assessments, penetration testing coordination, and remediation tracking with system owners and technical teams. Identify, assess, and mitigate security risks across cloud and enterprise environments, driving measurable improvements in the firm’s security posture. Provide advanced troubleshooting and technical leadership for complex or high-impact security issues. Develop and maintain security documentation, standards, reports, and control frameworks. Requirements Minimum 3 years of experience in cloud security or enterprise cybersecurity engineering Advanced expertise in Microsoft Azure security, including at least two of: Defender for Cloud Microsoft Sentinel Infrastructure / Network Security (IaaS) Application and API security Storage and database security Advanced expertise in Microsoft 365 security, including at least two of: Microsoft Entra ID, identity and access management Microsoft Purview, data protection and compliance Microsoft 365 Defender suite Intune / Endpoint Manager Strong understanding of: Security architecture principles, including Zero Trust, defense-in-depth and least privilege Hybrid cloud environments and system integrations Vulnerability management, including analyzing penetration testing and coordinating remediation of results API security and modern integration technologies Scripting and automation skills, e.g., PowerShell, Python or Bash Strong interest in security architecture, with a desire to deepen exposure and grow toward architectural responsibilities Professional experience Proven experience designing and implementing secure solutions in Microsoft technologies-based enterprise environments Experience working with large-scale or multi-country IT environments Solid exposure to security operations, incident response and security tooling Experience collaborating across infrastructure, development and business teams Benefits 25 days of vacation/year 3 sick days/year Meal lump-sum MultiSport card Multipass card Home Office allowance

Location: Poland About the Opportunity Dentons Europe is currently seeking a Information Security Engineer, specializing in Microsoft cloud technologies to play a key role in strengthening and evolving our security landscape. In this role, you will design and implement security controls across cloud and hybrid environments, with a strong focus on Microsoft 365 and Microsoft Azure. You will operate at the intersection of architecture and execution shaping security decisions, guiding technical teams, and ensuring that systems, applications, and integrations meet the firm’s security, compliance, and reliability standards. As a trusted advisor and technical authority, you will work closely with Information Security, IT, and business stakeholders across Europe, embedding security into the design and delivery of technology solutions while continuously improving the organization’s overall security posture. This is an opportunity to make a visible, enterprise-wide impact in a complex, international environment. You will primarily be accountable for Design, implement, and maintain robust security and compliance controls across Microsoft 365, Microsoft Azure, and hybrid environments. Act as a cybersecurity subject-matter expert for Europe and Country IT teams providing clear, practical guidance on secure design and implementation. Assist in embedding security into application, infrastructure, identity, endpoint, and integration architectures (including APIs and data flows), ensuring alignment with secure development lifecycle practices and architectural standards. Collaborate with architects, engineers, project teams, and business stakeholders to define security requirements as integral part of enterprise initiatives and technology solutions from the outset. Work closely with SOC and CSIRT teams to support incident response activities, including investigation, containment, and remediation, and ensure lessons learned are reflected in improved controls and architecture. Lead end-to-end vulnerability management activities, including vulnerability scanning, assessments, penetration testing coordination, and remediation tracking with system owners and technical teams. Identify, assess, and mitigate security risks across cloud and enterprise environments, driving measurable improvements in the firm’s security posture. Provide advanced troubleshooting and technical leadership for complex or high-impact security issues. Develop and maintain security documentation, standards, reports, and control frameworks. Requirements Minimum 3 years of experience in cloud security or enterprise cybersecurity engineering Advanced expertise in Microsoft Azure security, including at least two of : Defender for Cloud Microsoft Sentinel Infrastructure / Network Security (IaaS) Application and API security Storage and database security Advanced expertise in Microsoft 365 security, including at least two of: Microsoft Entra ID, identity and access management Microsoft Purview, data protection and compliance Microsoft 365 Defender suite Intune / Endpoint Manager Strong understanding of: Security architecture principles, including Zero Trust, defense-in-depth and least privilege Hybrid cloud environments and system integrations Vulnerability management, including analyzing penetration testing and coordinating remediation of results API security and modern integration technologies Scripting and automation skills, e.g., PowerShell, Python or Bash Strong interest in security architecture, with a desire to deepen exposure and grow toward architectural responsibilities Professional experience Proven experience designing and implementing secure solutions in Microsoft technologies-based enterprise environments Experience working with large-scale or multi-country IT environments Solid exposure to security operations, incident response and security tooling Experience collaborating across infrastructure, development and business teams Benefits Private medical healthcare provided by Medicover MultiSport card Benefit Cafeteria system Option to join a private insurance plan An additional day off for your birthday Tailored learning & development opportunities Hybrid work model with a modern office in Warsaw city center

Location: Remote - United Kingdom Who we are At Twilio, we’re shaping the future of communications, all from the comfort of our homes. We deliver innovative solutions to hundreds of thousands of businesses and empower millions of developers worldwide to craft personalized customer experiences. Our dedication to remote-first work , and strong culture of connection and global inclusion means that no matter your location, you’re part of a vibrant team with diverse experiences making a global impact each day. As we continue to revolutionize how the world interacts, we’re acquiring new skills and experiences that make work feel truly rewarding. Your career at Twilio is in your hands. . Hiring and how we work We use Artificial Intelligence (AI) to help make our hiring process efficient. That said, every hiring decision is made by real Twilions! Also, while we are a remote-first company, you may be asked to report in person on an ad-hoc basis for team gatherings, functional off-sites or customer meetings. . See yourself at Twilio Join the team as Twilio’s next Security Engineer, Incident Response About the job The Security Incident Response Team (SIRT) is looking for a Security Engineer who is passionate about solving Twilio’s mission of security and reliability by working across the organization to lead the technical response to security events and incidents across Twilio’s global infrastructure, services and applications by effectively conducting triage, containment, remediation and driving post-incident betterments.  You will work within a team that partners with R&D Engineering and R&D Business teams to develop scalable processes and technical solutions. You will be a valued member of a team of deeply technical Security Engineers to focus on creating bespoke and standard Security response processes, enhancing our capabilities for threat mitigation and incident response, and then automating as much as you possibly can (and more)! You will help us to grow our global, scaled team and program. Responsibilities In this role, you’ll: Lead and support the response to all security events and incidents across Twilio’s complex global infrastructure, services and applications. Be responsible for documentation of incidents and projects you work on and craft best practices as runbooks and standard operating procedures to share knowledge across teams. Work cross-collaboratively to understand and help solve challenges related to a broad spectrum of threat actors and activity. Work to improve Twilio’s security and reliability posture by driving identified betterments from security events and incidents. Rapidly acquire new technical skills and knowledge in a fast-paced, highly disruptive industry environment. Own the security incident lifecycle, respond to incidents and participate in on-call rotation and participate in RCAs for security incidents. Build, cultivate, and maintain positive relationships with internal customers to identify and facilitate solutions to increase the impact of the team’s work. Provide mentorship, support, and care for the team in a way that enables long-term career development, happiness, and success at scale. Qualifications Twilio values diverse experiences from all kinds of industries, and we encourage everyone who meets the required qualifications to apply. If your career is just starting or hasn't followed a traditional path, don't let that stop you from considering Twilio. We are always looking for people who will bring something new to the table! Required: Proven experience: 3+ years of security incident response in a production-cloud environment Subject-matter expert on security issues and technologies Ability to utilize AI for comprehensive, complex security incident response activities delivering high fidelity detections Advanced knowledge of service-oriented architectures, as well as experience with security tools and technologies fit for a cloud environment Experience working across a technology stack on difficult security challenges and initiatives Experience with SIEM platforms and the ability to extend their functionality Experience with SOAR tools and automating manual security processes Experience in either AWS, GCP, or other large cloud platform Excellent written and verbal communication skills Ability to influence and build effective working relationships with every level of the organization. Desired: AI Model Security & Posture Management: Support Implementation of  controls and safeguards to prevent AI vulnerabilities, such as prompt injections, model evasion, and data poisoning AI-Driven Threat Response: Utilize GenAI and LLM-based security use cases to rapidly interpret alerts, reduce false positives, and contextualize threat data Artifact & Evidence Triage: Collects intrusion artifacts and forensically sound images to analyze malware, trojans, and source code. Threat Intelligence Integration: Monitors external vendor data and threat intelligence to analyze trends and proactively defend against emerging risks. Location This role will be remote, and based in Ireland or U.K. Travel We prioritize connection and opportunities to build relationships with our customers and each other. For this role, you may be required to travel occasionally to participate in project or team in-person meetings. What We Offer Working at Twilio offers many benefits, including competitive pay, generous time off, ample parental and wellness leave, healthcare, a retirement savings program, and much more. Offerings vary by location. Twilio thinks big. Do you? We like to solve problems, take initiative, pitch in when needed, and are always up for trying new things. That's why we seek out colleagues who embody our values — something we call Twilio Magic . Additionally, we empower employees to build positive change in their communities by supporting their volunteering and donation efforts. So, if you're ready to unleash your full potential, do your best work, and be the best version of yourself, apply now! If this role isn't what you're looking for, please consider other open positions. . Stay alert to recruitment fraud We care about your safety. Scammers sometimes impersonate Twilio recruiters through fake job postings, emails, websites, or messages. Please ensure you are engaging with an official @ twilio.com email address. We will never ask for payment, gift cards, cryptocurrency, or banking information during the recruiting process. We do not make job offers without a formal interview process or conduct interviews exclusively through text-based messaging apps. . Twilio is proud to be an equal opportunity employer. We do not discriminate based upon race, religion, color, national origin, sex (including pregnancy, childbirth, reproductive health decisions, or related medical conditions), sexual orientation, gender identity, gender expression, age, status as a protected veteran, status as an individual with a disability, genetic information, political views or activity, or other applicable legally protected characteristics. We also consider qualified applicants with criminal histories, consistent with applicable federal, state and local law. Qualified applicants with arrest or conviction records will be considered for employment in accordance with the Los Angeles County Fair Chance Ordinance for Employers and the California Fair Chance Act. Additionally, Twilio participates in the E-Verify program in certain locations, as required by law.

Location: Remote-Friendly (Travel-Required) | San Francisco, CA | Seattle, WA | New York City, NY About Anthropic Anthropic’s mission is to create reliable, interpretable, and steerable AI systems. We want AI to be safe and beneficial for our users and for society as a whole. Our team is a quickly growing group of committed researchers, engineers, policy experts, and business leaders working together to build beneficial AI systems. About the role Anthropic's Application Security team secures the systems that build, serve, and increasingly are Claude — and as Anthropic's footprint grows, that mandate now extends to companies and codebases we bring in from outside. This role establishes that function. You'll own security due diligence and secure integration for Anthropic's acquisitions — assessing a target's security posture pre-close, writing the security risk readout for leadership, and after close, bringing acquired systems up to Anthropic's bar. Security has been part of every deal to date, but this is the first dedicated role for it: you'll formalize the playbook, the risk model, and the tooling, and make them repeatable. This is an AppSec role first. You'll be an active member of the Application Security team — same rituals, same on-run rotation, same tooling, working alongside engineers securing Anthropic's own agentic product surfaces. The expectation is the same too: we use Claude as our primary tool, and you're expected to automate the repeatable parts of diligence and integration as you go, so each acquisition is easier than the last. When deal flow is quiet, you'll pick up core AppSec project work; when it's active, M&A is your priority. We're upfront that the center of gravity here is M&A rather than core product security. It's burstier, more assessment-heavy, and operates on confidential, time-sensitive work. If you like parachuting into an unfamiliar codebase under time pressure and turning it into a clear risk picture for leadership, this is that job. Key responsibilities Lead pre-close security due diligence on prospective acquisitions — coordinate external penetration testing, threat-model the target's architecture, assess security controls, and deliver the security risk readout for leadership ahead of close and integration planning Drive post-close security integration — stand up static and dynamic analysis coverage on acquired codebases, track high- and critical-severity remediation to closure, fold acquired assets into bug bounty scope, and onboard repositories to Anthropic's automated vulnerability remediation and reporting systems Coordinate adjacent security engineering teams (supply chain, cloud, corporate security, detection & response) on their portions of each integration Work across a wide set of stakeholders on every deal — corporate development, legal, security leadership, and the engineering teams inheriting acquired systems internally; engineering and security counterparts at the target company externally — translating between them and keeping the security workstream legible to all of them Formalize and scale Anthropic's M&A security playbook — risk-scoring model, diligence runbook, integration checklist — and turn as much of it as possible into Claude-powered tooling rather than manual process Share the team's operational on-run rotation (bug bounty escalations, launch consults, incident response), swapping out during periods of active deal work Contribute to core AppSec projects between deals — secure design reviews, threat modeling for agentic systems, and the team's security automation roadmap Minimum qualifications Hands-on application and infrastructure security experience, including cloud and containerized environments Demonstrated ability to rapidly assess an unfamiliar codebase or architecture and produce a clear, prioritized risk assessment for a non-security audience Production-quality coding ability in at least one of Python, Go, Rust, or TypeScript Practical threat-modeling and vulnerability-identification skills — you've found and reasoned about real bugs in real systems Comfort operating with high autonomy, ambiguity, and tightly-held confidential context Clear written and verbal communication across varied audiences — executives, legal and corporate development partners, and engineering counterparts at an acquired company Preferred qualifications 7+ years in application security, security consulting, or security architecture Prior M&A security due diligence, third-party security assessment, or technical due diligence experience Experience standing up or scaling SAST/DAST, bug bounty, or vulnerability management coverage across multiple codebases Track record of building security automation or tooling rather than relying solely on manual review Familiarity with using LLMs as a core part of your security workflow Experience securing agentic, code-execution, or LLM-integrated systems Representative projects Point Anthropic's internal LLM-driven code analysis and AI-assisted scanning at an acquired repository nobody here has seen, and turn the output into a prioritized remediation plan in days rather than weeks Design the risk-scoring framework Anthropic uses to compare security posture across acquisitions of different shapes and sizes Build the automation that onboards an acquired codebase to Anthropic's vulnerability dashboard, dependency auto-patching, and bounty scope without a human running a checklist Write the security risk memo for a live deal and present it to corporate development and security leadership The annual compensation range for this role is listed below. For sales roles, the range provided is the role’s On Target Earnings ("OTE") range, meaning that the range includes both the sales commissions/sales bonuses target and annual base salary for the role. Annual Salary: $320,000 — $485,000 USD Logistics Minimum education: Bachelor’s degree or an equivalent combination of education, training, and/or experience Required field of study: A field relevant to the role as demonstrated through coursework, training, or professional experience Minimum years of experience: Years of experience required will correlate with the internal job level requirements for the position Location-based hybrid policy: Currently, we expect all staff to be in one of our offices at least 25% of the time. However, some roles may require more time in our offices. Visa sponsorship: We do sponsor visas! However, we aren't able to successfully sponsor visas for every role and every candidate. But if we make you an offer, we will make every reasonable effort to get you a visa, and we retain an immigration lawyer to help with this. For roles performing work in California: We will consider for employment all qualified applicants, including those with arrest or conviction records or criminal histories, in a manner consistent with the requirements of applicable state and local laws, including the San Francisco Fair Chance Ordinance, the City of Los Angeles’ Fair Chance Initiative for Hiring Ordinance, the Los Angeles County Fair Chance Ordinance for Employers, and the California Fair Chance Act. We encourage you to apply even if you do not believe you meet every single qualification. Not all strong candidates will meet every single qualification as listed.  Research shows that people who identify as being from underrepresented groups are more prone to experiencing imposter syndrome and doubting the strength of their candidacy, so we urge you not to exclude yourself prematurely and to submit an application if you're interested in this work. We think AI systems like the ones we're building have enormous social and ethical implications. We think this makes representation even more important, and we strive to include a range of diverse perspectives on our team. Your safety matters to us. To protect yourself from potential scams, remember that Anthropic recruiters only contact you from @anthropic.com email addresses. In some cases, we may partner with vetted recruiting agencies who will identify themselves as working on behalf of Anthropic. Be cautious of emails from other domains. Legitimate Anthropic recruiters will never ask for money, fees, or banking information before your first day. If you're ever unsure about a communication, don't click any links—visit anthropic.com/careers directly for confirmed position openings. How we're different We believe that the highest-impact AI research will be big science. At Anthropic we work as a single cohesive team on just a few large-scale research efforts. And we value impact — advancing our long-term goals of steerable, trustworthy AI — rather than work on smaller and more specific puzzles. We view AI research as an empirical science, which has as much in common with physics and biology as with traditional efforts in computer science. We're an extremely collaborative group, and we host frequent research discussions to ensure that we are pursuing the highest-impact work at any given time. As such, we greatly value communication skills. The easiest way to understand our research directions is to read our recent research. This research continues many of the directions our team worked on prior to Anthropic, including: GPT-3, Circuit-Based Interpretability, Multimodal Neurons, Scaling Laws, AI & Compute, Concrete Problems in AI Safety, and Learning from Human Preferences. Come work with us! Anthropic is a public benefit corporation headquartered in San Francisco. We offer competitive compensation and benefits, optional equity donation matching, generous vacation and parental leave, flexible working hours, and a lovely office space in which to collaborate with colleagues. Guidance on Candidates' AI Usage: Learn about our policy for using AI in our application process.

Location: Baku Workplace: onsite ABOUT YOU Xsolla seeks a security engineer to join a new security team during a critical build-out phase. You work across application security and infrastructure security - reviewing code, hardening cloud environments, supporting incident response, and partnering with engineering teams to improve security posture across the company. This is a generalist role well-suited to an early-team hire. You are comfortable working across domains rather than specializing in one, and you grow into deeper expertise as the team and program mature. You collaborate closely with the security program manager and work directly with engineering teams on secure design, findings, and remediation. Our tech stack includes GCP, vSphere/ESX, Kubernetes and container workloads, MariaDB, CockroachDB, Go, PHP, and Python. You do not need expertise in all of these, but you are comfortable navigating a mixed environment and learning what you need. As always true in job descriptions, there is an intangible value that is hard to capture. We look for a diverse set of perspectives and skills. Even if you don't match every requirement, we encourage you to apply if you think you can be highly successful in this role.   ABOUT US   Xsolla is a global commerce company with robust tools and services to help developers solve the inherent challenges of the video game industry. From indie to AAA, companies partner with Xsolla to help them fund, distribute, market, and monetize their games. Grounded in the belief in the future of video games, Xsolla is resolute in the mission to bring opportunities together, and continually make new resources available to creators. Headquartered and incorporated in Los Angeles, California, Xsolla operates as the merchant of record and has helped over 1,500+ game developers to reach more players and grow their businesses around the world. With more paths to profits and ways to win, developers have all the things needed to enjoy the game. For more information, visit xsolla.com. Responsibilities Perform Application Security Reviews - Conduct code reviews, run SAST / DAST and dependency scanning tools, and work with engineering to resolve findings. Participate in Threat Modeling - Contribute to threat modeling sessions for new features and architecture changes, helping identify risks early in the design process. Help Harden Cloud and Container Infrastructure - Work on GCP, Kubernetes, and IAM configurations to strengthen the security of our cloud and container environments. Participate in Pen Test Remediation - Help triage penetration test findings and work with engineering teams to implement fixes, coordinating closely with the security program manager. Partner with Engineering on Secure Design - Review architectures, advise on secure implementation patterns, and help teams make informed security decisions. Identify and Track Security Findings - Document findings, assess severity, and track them through the remediation lifecycle to resolution. Support Incident Response - Help investigate and document security events, contribute to root-cause analysis, and support containment efforts. Write Async Security Guidance - Produce advisories, best-practice documentation, and practical guidance that helps engineering teams build securely across time zones. Support Product Security - Work with partners on the security posture of customer-facing services, contributing to reviews and assessments as needed. What You Bring Foundational AppSec Knowledge - Understands common vulnerability classes, secure coding patterns, and how to conduct a meaningful code review. Cloud Environment Exposure - Has worked with GCP or a similar cloud provider and is comfortable with IAM , networking, and container concepts. Code Literacy - Reads and reviews code in one or more of: Go, Python, PHP. Does not need to be a software engineer, but can follow logic and spot issues. Security Tooling Familiarity - Has used or is familiar with SAST , DAST , or dependency scanning tools and understands how they fit into a development workflow. Strong Written Communication - Writes clear, concise async documentation - findings, advisories, guidance - that works across time zones and audiences. Collaborative Mindset - Partners effectively with engineering teams. Focuses on helping teams build securely rather than just identifying problems. Self-Directed with Growth Mindset - Eager to learn, comfortable with ambiguity, and able to make progress with minimal direction in a new and evolving team. Nice to Have Threat modeling experience; Hands-on Kubernetes or container security experience; Infrastructure security background - Linux, networking, vSphere/ ESX; Familiarity with NIST CSF , PCI , SOC 2, or ISO 27001 from a technical perspective; Detection engineering or incident response experience; Experience building security automation or internal tooling; Relevant certifications ( OSCP , GWAPT , CKS , or similar hands-on certs). Xsolla operates across multiple time zones. Strong written communication is essential - you will need to document your work clearly so findings and context are not lost across handoffs. We value directness, intellectual honesty, and follow-through. If you do not know something, say so and find out. If you find something, explain it clearly and see it through to resolution.

Location: Baku Workplace: onsite ABOUT YOU We are looking for a junior application security specialist to join a growing security team at Xsolla. This is a hands-on role where you will work closely with senior specialists to identify, assess, and help remediate security vulnerabilities across our products and infrastructure. You will be involved in day-to-day AppSec work - code reviews, vulnerability triage, threat modeling, and security testing. You are curious, detail-oriented, and eager to develop deep expertise in application security. You do not need to have all the answers, but you ask the right questions and follow through. This is a strong learning environment. You will be exposed to real-world security challenges in a payment platform operating at scale, and supported by experienced security specialists who will help you grow.   ABOUT US   Xsolla is a global commerce company with robust tools and services to help developers solve the inherent challenges of the video game industry. From indie to AAA, companies partner with Xsolla to help them fund, distribute, market, and monetize their games. Grounded in the belief in the future of video games, Xsolla is resolute in the mission to bring opportunities together, and continually make new resources available to creators. Headquartered and incorporated in Los Angeles, California, Xsolla operates as the merchant of record and has helped over 1,500+ game developers to reach more players and grow their businesses around the world. With more paths to profits and ways to win, developers have all the things needed to enjoy the game. For more information, visit xsolla.com. Responsibilities Triage Security Findings - Assess incoming bug bounty reports and scanner findings. Evaluate validity, calculate real severity, and escalate appropriately with clear written summaries. Assist with Vulnerability Assessments - Participate in security assessments of web applications and APIs. Help identify and document risks in new features and existing systems. Write Clear Security Documentation - Document findings, reproduction steps, and remediation guidance in a way that engineering teams can act on. Support Threat Modeling - Participate in threat modeling sessions. Learn to identify trust boundaries, data flows, and attack surfaces in system designs. Monitor Security Tools - Help operate SAST , DAST , and dependency scanning tooling. Track findings, reduce noise, and support remediation workflows. Support Code Reviews - Review code for common vulnerability classes under guidance of senior specialists. Learn to identify security issues across PHP, Python, and Go codebases. Stay Current - Follow developments in the security community. Bring awareness of new vulnerability classes, CVEs, and attack techniques relevant to our stack. What You Bring Web Security Fundamentals - Solid understanding of common vulnerability classes: OWASP Top 10, CSRF , XSS , IDOR , SQL injection, open redirect, authentication and session management weaknesses. You understand root causes, not just names. Web and Browser Fundamentals - Solid understanding of how web applications work: HTTP request/response cycle, client-server model, REST APIs, how browsers handle same-origin policy, cookies and their attributes, and CORS . This is the foundation everything else builds on. Security Testing Tools - Hands-on experience with Burp Suite or similar web application security testing tools. You have used them to intercept, modify, and replay requests — not just run automated scans. Vulnerability Documentation - Able to reproduce a vulnerability and write it up clearly: reproduction steps, proof of concept, and impact statement. Findings that engineering teams cannot reproduce or understand do not get fixed. Secure Development Awareness - Familiarity with foundational secure coding concepts: input validation, output encoding, parameterized queries, and least privilege. Code Readability - Ability to read and follow code in at least one language relevant to web security - PHP, Python, JavaScript, or Go. You don't need to be a developer, but you need to follow logic and spot security-relevant patterns. Analytical Thinking - You reason through problems methodically. You can explain not just what a vulnerability is but why it exists, how it is exploited, and what fixing it actually requires. Clear Written Communication - You write findings and summaries that are precise, reproducible, and useful to the engineers who need to act on them. Curiosity and Initiative - You dig into problems rather than stopping at the surface. When something looks wrong, you investigate before concluding Nice to Have Participation in bug bounty programs or CTF competitions; Basic scripting ability for automation - Python or Bash; Familiarity with CI/CD pipelines and where security tooling fits; Exposure to cloud environments - GCP, AWS, or Azure; Relevant coursework or certifications - eWPT, CEH , PortSwigger Web Security Academy progress, or similar entry-level credentials. Xsolla operates across multiple time zones. Strong written communication is essential - you will need to document your work clearly so findings and context are not lost across handoffs. We value directness, intellectual honesty, and follow-through. If you do not know something, say so and find out. If you find something, explain it clearly and see it through to resolution.