Вакансии

Location: Austin, TX, United States, Chicago, Illinois, United States, New York, NY, United States, Redwood City, CA, United States, San Francisco, CA, United States, United States WHAT IS BOX? Box (NYSE:BOX) is the leader in Intelligent Content Management. Our platform enables organizations to fuel collaboration, manage the entire content lifecycle, secure critical content, and transform business workflows with enterprise AI. We help companies thrive in the new AI-first era of business. Founded in 2005, Box simplifies work for leading global organizations, including JLL, Morgan Stanley, and Nationwide. Box is headquartered in Redwood City, CA, with offices across the United States, Europe, and Asia. By joining Box, you will have the unique opportunity to continue driving our platform forward. Content powers how we work. It’s the billions of files and information flowing across teams, departments, and key business processes every single day: contracts, invoices, employee records, financials, product specs, marketing assets, and more. Our mission is to bring intelligence to the world of content management and empower our customers to completely transform workflows across their organizations. With the combination of AI and enterprise content, the opportunity has never been greater to transform how the world works together and at Box you will be on the front lines of this massive shift. At Box, we believe unique and diverse experiences benefit our culture, our products, our customers, our company, and our world. We aim to recruit a passionate, high-performing workforce that reflects the world we live in. If you are head-over-heels about this role but unsure if you meet all the requirements, we encourage you to apply! WHY BOX NEEDS YOU We are looking for an experienced and driven GRC Controls Automation Engineer who is looking to put their demonstrated awareness of regulatory standards to help bridge compliance requirements, technical infrastructure and engineering workflows. You will be focused on modernizing, designing, building and scaling frameworks that embed compliance directly into the software development (SDLC) process.  As our GRC Controls Automation Engineer, you will play a key role building a scalable, efficient program and process using your technical leadership focusing on automation within Box. You will work with all functions of this fast-paced, rapidly changing business, and directly with key stakeholders to drive continuous improvement, communication and education with Box's internal customers.  The right person will be excellent at communicating vertically and horizontally across the company and will be comfortable explaining Box's compliance posture internally and externally, working cross-functionally and providing technical and creative guidance to technical teams. WHAT YOU'LL DO Drive improvements in existing processes, process standardization and develop new innovative and efficient solutions Design, develop, and implement controls with a focus on compliance and automation Provide compliance guidance on new product features, deviations, and changes in the infrastructure Participate in cloud and application security strategic planning and execution Implement improvements by assessing the current environment, evaluate trends, and anticipating future enhancements/requirements Assess the existing security and compliance posture, and provide guidance on implementing products into Box's production environment Work across multiple frameworks and regulatory standards, including but not limited to ISO, PCI, NIST, AICPA SOC Support audits by maintaining accurate process documentation Drive improvements in existing processes and develop new innovative and efficient solutions Communicate gaps to management and coordinate cross functional team meetings to remediate and close the control gaps Monitor and identify compliance issues and follow-up Build relationships with internal and external stakeholders WHO YOU ARE We are an AI-first company. This means you approach your work with a growth mindset and find ways to leverage AI to help make faster, smarter decisions that will 10X your impact at Box. 5+ years of professional experience working in a SaaS company in GRC, Information Security or similar function Familiar with GCP cloud computing, AI architectures, Data governance and model validations Deep understanding of global frameworks, such as NIST 800-53, PCI, ISO 27x, and SOC 2 BS degree in Business or Management Information Systems or related field OR equivalent work experience CISSP, CCSK, CISM or other related certifications a plus Excellent written, verbal communication and presentation skills with a willingness to wear different hats and work in areas where needed Amazing organizational skills with a drive to succeed in a fast-paced environment Ability to hustle, get stuff done, and has strong integrity - make mom proud! Box lives its values, with community and in-person collaboration being a core part of our culture. Boxers are expected to work from their assigned office a minimum of 3 days per week.Your Recruiter will share more about how we work and company culture during the hiring process. EQUAL OPPORTUNITY We are an equal opportunity employer and value diversity at our company. We do not discriminate on the basis of race, religion, color, national origin, gender, sexual orientation, age, marital status, veteran status, disability, and any other protected ground of discrimination under applicable human rights legislation. Box strives to respect the dignity and ‎‎independence of people with disabilities and is committed to giving them the same ‎‎opportunity to succeed as all other employees. Inclusiveness is core to our culture at Box, and we strive to ensure you get the most from your interview experience. Box makes reasonable accommodations for applicants with disabilities. If a reasonable accommodation is needed to participate in the job application or interview process, please complete this form . Reasonable accommodations may include scheduling adjustments, document dictation and beyond. Notice to applicants in Los Angeles:  Box, Inc and its related branches will consider for employment, qualified applicants with criminal histories in a manner consistent with the Los Angeles Fair Chair Ordinance.  The Fair Chance Ordinance is provided here . Notice to applicants in San Francisco:  Box, Inc and its related branches will consider for employment, qualified applicants with criminal histories in a manner consistent with the San Francisco Fair Chair Ordinance.  The Fair Chance Ordinance is provided here . For details on how we protect your information when you apply, please see our Personnel Privacy Notice. If you are a California-resident, please read our California Applicant & Candidate Privacy Notice here . NOTICE OF USE OF AI At Box, we believe in the power of AI to improve the recruiting process while keeping people at the heart of every decision. For more information on the use of AI in our hiring process, please visit our webpage here . Box is committed to fair and equitable compensation practices. Actual base salary (or OTE if commissionable role) is dependent upon factors such as: knowledge, skill level, experience, and work location. This role is also eligible for equity and benefits. For more information , check out our benefits and perks . In accordance with OFCCP compliance, here is the Pay Transparency Provision . Austin Pay Range $129,500 — $145,000 USD Box is committed to fair and equitable compensation practices. Actual base salary (or OTE if commissionable role) is dependent upon factors such as: knowledge, skill level, experience, and work location. This role is also eligible for equity and benefits. For more information, check out our benefits and perks . In accordance with OFCCP compliance, here is the Pay Transparency Provision . Chicago Pay Range $117,000 — $145,000 USD Box is committed to fair and equitable compensation practices. Actual base salary (or OTE if commissionable role) is dependent upon factors such as: knowledge, skill level, experience, and work location. This role is also eligible for equity and benefits. For more information, check out our benefits and perks . In accordance with OFCCP compliance, here is the Pay Transparency Provision . New York City Pay Range $11,550 — $145,000 USD Box is committed to fair and equitable compensation practices. Actual base salary (or OTE if commissionable role) is dependent upon factors such as: knowledge, skill level, experience, and work location. This role is also eligible for equity and benefits. For more information , check out our benefits and perks . In accordance with OFCCP compliance, here is the Pay Transparency Provision . San Francisco Pay Range $115,500 — $145,000 USD Box is committed to fair and equitable compensation practices. Actual base salary (or OTE if commissionable role) is dependent upon factors such as: knowledge, skill level, experience, and work location. This role is also eligible for equity and benefits. For more information , check out our benefits and perks . In accordance with OFCCP compliance, here is the Pay Transparency Provision . Redwood City Pay Range $111,500 — $145,000 USD

Location: Hybrid About Us At Cloudflare, we are on a mission to help build a better Internet. Today the company runs one of the world’s largest networks that powers millions of websites and other Internet properties for customers ranging from individual bloggers to SMBs to Fortune 500 companies. Cloudflare protects and accelerates any Internet application online without adding hardware, installing software, or changing a line of code. Internet properties powered by Cloudflare all have web traffic routed through its intelligent global network, which gets smarter with every request. As a result, they see significant improvement in performance and a decrease in spam and other attacks. Cloudflare was named to Entrepreneur Magazine’s Top Company Cultures list and ranked among the World’s Most Innovative Companies by Fast Company. At Cloudflare, we’re not looking for people who wait for a polished roadmap; we’re looking for the builders who see the cracks in the Internet that everyone else has simply learned to live with. We value candidates who have the instinct to spot a "normalized" problem and the AI-native curiosity to create a solution using the latest tools. Our culture is built on iteration, leveraging AI to ship faster today to make it better tomorrow, while ensuring that every improvement, no matter how small, is shared across the team to lift everyone up. If you’re the type of person who values curiosity over bureaucracy, and that AI is a partner in solving tough problems to keep the Internet moving forward, you’ll fit right in. Available Locations: Austin, TX Role Summary As a Product Security Engineer, you will support security assessments and vulnerability operations for Cloudflare’s core software products. In this role, you will analyze system architecture, threat model new features, and ensure that product-related security findings are accurately triaged, routed to the correct engineering owners, and mitigated within our SLAs. On any given day, you might conduct a deep-dive security review on a new feature design, triage a complex bug bounty submission, or work directly with engineering teams to resolve vulnerabilities from different sources like bug bounties, SAST, fuzzing and penetration tests. You will also work autonomously to identify areas where our manual processes slow down. You will write code and integrate AI/LLM solutions to automate initial triage and data enrichment, building tools that help the team handle security findings at scale. In short, your work will sit at the intersection of Product Security, Vulnerability Operations, and internal AI Tooling. Ideally, you have experience in conducting academic/vulnerability research with a focus on systems security. Responsibilities Implement AI Security Solutions: Identify process bottlenecks and build AI-driven tools or scripts to help automate code analysis, optimize triage, and streamline Product Security workflows. Security Reviews & Threat Modeling: Conduct structured security reviews and threat modeling sessions (e.g., STRIDE) across product features, defining security requirements early in the development lifecycle. Product Vulnerability Management: Manage the operational lifecycle of product security findings. Ensure vulnerabilities are verified, mapped to the correct engineering owner, and tracked to mitigation in alignment with established SLAs. Bug Bounty Triage: Perform the technical triage and validation of Cloudflare’s external Bug Bounty submissions, verifying exploitability and evaluating business risk. Pentest Coordination: Support internal and external penetration testing engagements by reviewing findings, clarifying technical context, and assisting development teams with remediation strategies. Engineering Collaboration: Partner closely with DevOps and product teams, acting as a reliable security point of contact and helping developers implement secure coding practices. Desirable Skills, Knowledge, and Experience Product/AppSec Expertise: 5+ years of experience in Product or Application Security within large-scale distributed cloud environments or SaaS platforms. Practical AI & Automation Engineering: Demonstrated ability to build production-grade automation scripts and tools. Must possess hands-on engineering experience leveraging AI/LLMs to solve operational or technical challenges. Threat Modeling & Risk Analysis: Competency in threat modeling methodologies and the ability to evaluate code flaws to determine their actual engineering and security impact. Vulnerability Lifecycle Operations: Experience tracking, routing, and driving the remediation of software vulnerabilities across engineering groups while working against defined SLAs. Strong Collaboration & Communication: Ability to collaborate effectively across teams, clearly communicating technical security risks to software engineers and resolving ownership ambiguity constructively. Bonus points Offensive Security Tooling: Familiarity with modern exploitation techniques, fuzzing frameworks, or automated scanning utilities. Program Management Experience: Experience scaling crowdsourced security programs (e.g., HackerOne, Bugcrowd) or optimizing agile project management workflows within JIRA. Experience in integrating hardware security features into production code bases Equity This role is eligible to participate in Cloudflare’s equity plan. Benefits Cloudflare offers a complete package of benefits and programs to support you and your family.  Our benefits programs can help you pay health care expenses, support caregiving, build capital for the future and make life a little easier and fun!  The below is a description of our benefits for employees in the United States, and benefits may vary for employees based outside the U.S. Health & Welfare Benefits Medical/Rx Insurance Dental Insurance Vision Insurance Flexible Spending Accounts Commuter Spending Accounts Fertility & Family Forming Benefits On-demand mental health support and Employee Assistance Program Global Travel Medical Insurance Financial Benefits Short and Long Term Disability Insurance Life & Accident Insurance 401(k) Retirement Savings Plan Employee Stock Participation Plan Time Off Flexible paid time off covering vacation and sick leave Leave programs, including parental, pregnancy health, medical, and bereavement leave What Makes Cloudflare Special? We’re not just a highly ambitious, large-scale technology company. We’re a highly ambitious, large-scale technology company with a soul. Fundamental to our mission to help build a better Internet is protecting the free and open Internet. Project Galileo : Since 2014, we've equipped more than 2,400 journalism and civil society organizations in 111 countries with powerful tools to defend themselves against attacks that would otherwise censor their work, technology already used by Cloudflare’s enterprise customers--at no cost. Athenian Project : In 2017, we created the Athenian Project to ensure that state and local governments have the highest level of protection and reliability for free, so that their constituents have access to election information and voter registration. Since the project, we've provided services to more than 425 local government election websites in 33 states. 1.1.1.1 : We released 1.1.1.1 to help fix the foundation of the Internet by building a faster, more secure and privacy-centric public DNS resolver. This is available publicly for everyone to use - it is the first consumer-focused service Cloudflare has ever released. Here’s the deal - we don’t store client IP addresses never, ever. We will continue to abide by our privacy commitment and ensure that no user data is sold to advertisers or used to target consumers. Sound like something you’d like to be a part of? We’d love to hear from you! Please note that applicants who progress to the offer stage of the interview process may be asked to attend an in-person interview within one of the Cloudflare Offices or Cloudflare Hubs.  More details about this will be available at that stage of the interview process. This position may require access to information protected under U.S. export control laws, including the U.S. Export Administration Regulations. Please note that any offer of employment may be conditioned on your authorization to receive software or technology controlled under these U.S. export laws without sponsorship for an export license. Cloudflare is proud to be an equal opportunity employer.  We are committed to providing equal employment opportunity for all people and place great value in both diversity and inclusiveness.  All qualified applicants will be considered for employment without regard to their, or any other person's, perceived or actual race, color, religion, sex, gender, gender identity, gender expression, sexual orientation, national origin, ancestry, citizenship, age, physical or mental disability, medical condition, family care status, or any other basis protected by law. We are an AA/Veterans/Disabled Employer. Cloudflare provides reasonable accommodations to qualified individuals with disabilities.  Please tell us if you require a reasonable accommodation to apply for a job. Examples of reasonable accommodations include, but are not limited to, changing the application process, providing documents in an alternate format, using a sign language interpreter, or using specialized equipment.  If you require a reasonable accommodation to apply for a job, please contact us via e-mail at hr@cloudflare.com or via mail at 101 Townsend St. San Francisco, CA 94107.

Location: EMEA About the team The Security Team is responsible for providing key security capabilities covering application, cloud and enterprise security, incident response, detection and GRC. Our team is looking for an experienced, hands-on security practitioner, who will drive the adoption of modern security processes and tooling, with focus on supporting our engineering and product teams in improving the security posture of our platforms and services. What you will do: - Identify security gaps and vulnerabilities in all ClickHouse offerings triage a wide range of vulnerabilities reported via our bug bounty program, responsible disclosure, GitHub Issues covering web, API and server - client assets including low level memory issues like heap or buffer overflows - Improve and develop security assurance activities - pentests, vulnerability assessments, bug bounty programs, fuzzing - Plan and execute internal red team assessments and penetration tests against ClickHouse infrastructure, cloud environments, designing realistic adversary scenarios to test detection, response and control effectiveness - Assess AI/LLM-specific attack surface across ClickHouse's own AI-powered features and internal AI tooling, including prompt injection, model/data exfiltration, and unsafe agentic tool-use patterns - Build and operate agentic tooling for reconnaissance, exploit-chaining and attack-path discovery, and apply LLM-assisted fuzzing to accelerate vulnerability discovery across ClickHouse's products and infrastructure - Partner with detection engineering to validate and improve detection coverage during red team exercises, measuring and reporting on control effectiveness and time to detect/respond - Handle information security events and incidents across ClickHouse products and services - Develop processes, tooling and automation to scale security processes and mitigate risks to the business What you bring along: - 7+ years of experience in pentesting, red teaming and product security - Experience supporting engineering and product implementation efforts by performing threat assessments, assurance activities, advisory as well as, in some cases, implementation work across distributed systems covering web, API, client/server assets - Hands-on experience conducting offensive security engagements - internal red teaming, penetration testing and adversary simulation - across cloud, network and application environments - Ability to design adversary scenarios grounded in real threat intelligence (e.g. ransomware operators, supply chain attackers, insider threat) tailored to ClickHouse's risk profile as a multi-tenant cloud data platform - Strong written and verbal communication skills, with ability to translate attack chains into clear, actionable findings for engineering and leadership - Experience building or adapting agentic and LLM-assisted tooling for offensive security use cases (recon automation, exploit chaining, fuzzing harnesses), with judgment on where AI genuinely speeds up an engagement versus adds noise - Familiarity with AI/LLM-specific vulnerability classes and testing methodology - Strong knowledge of and experience with one or more cloud service providers (e.g. AWS, GCP, Azure), Kubernetes, Cilium - Experience implementing and operating engineering security tools and processes (e.g. static / dynamic code analysis, software composition analysis, SBOM, OWASP SAMM, client and network fuzzing tools) - Security as code mindset, with focus on solving problems with automation and scale in mind Bonus Points: - BS, MS, or PhD in Computer Science or related field - Previous contributions to open source projects - Security or cloud related certifications (AWS, GCP, Azure) - Previous experience in using AI security harnesses for pentesting purposes - Experience building or operating internal red team tooling and infrastructure from scratch, rather than relying solely on off-the-shelf frameworks - Offensive security certifications (e.g. OSCP, OSCE, OSEP, OSWE) PERKS - Flexible work environment - ClickHouse is a globally distributed company and remote-friendly. We currently operate in over 25 countries. - Healthcare - Employer contributions towards your healthcare. - Equity in the company - Every new eligible team member who joins our company receives equity. - Time off - Flexible time off in the US, generous entitlement in other countries. - A USD$500 Home office setup if you’re a remote employee. - Global Gatherings – We believe in the power of in-person connection and offer opportunities to engage with colleagues at company-wide offsites. CULTURE - WE ALL SHAPE IT As part of a rapidly scaling start-up, you will be instrumental in shaping our culture. Are you interested in finding out more about our culture? Learn more about our values here https://clickhouse.com/company/careers. Check out our blog posts https://clickhouse.com/blog or follow us on LinkedIn https://www.linkedin.com/company/clickhouseinc/life/0c1ee7f4-2129-488d-b413-e7f6270659fd/?viewAsMember=true to find out more about what’s happening at ClickHouse. EQUAL OPPORTUNITY & PRIVACY ClickHouse provides equal employment opportunities to all employees and applicants and prohibits discrimination and harassment of any type based on factors such as race, color, religion, age, sex, national origin, disability status, genetics, protected veteran status, sexual orientation, gender identity or expression, or any other characteristic protected by federal, state or local laws. Please see here https://clickhouse.com/legal/applicant-privacy-notice for our Privacy Statement.

Location: Hong Kong SAR; Kuala Lumpur, Malaysia About Us Established in 2018, Bybit is one of the world’s leading cryptocurrency exchanges and digital financial platforms, serving over 80 million users across more than 200 countries and regions. Powered by world-class technology and a user-first mindset, Bybit delivers a seamless ecosystem across trading, payments, wealth management, custody, institutional services, and Web3 — connecting users to the future of digital finance. Our core values define how we build. We listen, care and improve to create products and experiences that put users first. Backed by a global team of ambitious builders, problem-solvers, and innovators, we foster a high-performance and fast-moving environment where talent is empowered to drive real impact at the global scale. Supported by 24/7 multilingual customer service and a strong commitment to innovation, we are shaping the future of finance through technology, collaboration, and bold execution. Today, Bybit is recognized as one of the most trusted and transparent platforms in the digital asset industry, continuing to expand its global presence while building the infrastructure for the next generation of financial services. Job responsibilities Red-blue confrontation drill Responsible for developing and executing penetration testing, red-blue confrontation, and practical attack and defense drills that simulate real attack scenarios, identifying potential security risks in enterprise networks, applications, cloud environments, work networks, and core business systems. Lead or participate in red-blue confrontation exercises to evaluate the defense team's ability in attack detection, alarm analysis, traceability analysis, emergency response, and recovery. Based on the real attack chain design exercise scenario, covering extranet breakthrough, web vulnerability exploitation, phishing entrance, privilege escalation, lateral movement, Data Discovery, privilege maintenance, and defense bypass stages. Combining the attack review results, promote the continuous optimization of security detection rules, response processes, asset governance, and security base lines. Attack Surface Analysis and Threat Research Identify enterprise network exposure, internet assets, cloud assets, APIs, supply chain components, and third-party access risks, evaluate attack paths, and provide mitigation recommendations. Monitor and collect threat intelligence, track vulnerability exploitation trends, APT attack methods, red team toolchain changes, and apply them to enterprise attack and defense exercises. Combining business scenarios to model attack paths and discover feasible attack chains from external exposure surfaces to core assets. Tracking AI-related security risks, including security issues in large-scale model applications, RAG systems, Agent systems, plug-in/tool calls, MCP services, AI code generation, and automated workflows. AI Security and Large Model Attack and Defense Responsible for the security evaluation of AI applications, intelligent agent systems, RAG Knowledge Base, AI Agent toolchain and model services within the enterprise. Research and verify large-scale model-related attack techniques, including Prompt Injection, Jailbreak, Indirect Prompt Injection, data leakage, unauthorized tool invocation, security risks caused by model illusions, RAG poisoning, vector library pollution, sensitive information leakage, etc. Design AI red team test cases and evaluation framework, and conduct security verification on model input and output, context isolation, permission control, tool call chain, and data access boundary. Participate in the construction of AI security protection plan, including prompt word security policy, content security detection, tool call permission constraints, sensitive data desensitization, audit tracking, Agent sandbox isolation and security evaluation benchmark construction. Explore the application of AI in red team automation, vulnerability analysis, attack path planning, PoC verification, and report generation, and promote the platformization, automation, and intelligence of attack and defense capabilities. Tool and platform development Develop and optimize Red Team-specific tools and scripts for vulnerability mining, information collection, privilege escalation, lateral movement, credential analysis, traffic disguise, defense bypass, and automated report generation. Study and validate new attack techniques, and simulate real threats in combination with enterprise business scenarios. Build or participate in the construction of automated security evaluation platform, integrated vulnerability scanning, audio fingerprint recognition, asset mapping, PoC verification, attack path analysis, AI Agent arrangement and other capabilities. Combining LLM/Agent technology to explore automated penetration testing, intelligent vulnerability verification, code security auditing, and red team task scheduling. Security evaluation and reporting Conduct security evaluations on critical business systems, internal networks, cloud environments, work end points, API services, and AI applications, and output detailed technical reports, attack paths, impact analysis, and repair recommendations. Output AI security evaluation reports for AI applications, including attack examples, risk levels, exploitable paths, data leakage risks, permission boundary issues, and governance recommendations. Assist in improving enterprise security protection mechanisms, promote optimization of WAF, EDR, SIEM, NDR, HIDS, zero trust, identity permissions, and log auditing capabilities. Transform attack and defense discovery into security detection rules, base line specifications, develop security requirements, and continuous governance mechanisms. XFN collaboration Collaborate with the blue team, security operation, infrastructure, R & D, algorithm, data, and business teams to complete attack review, vulnerability repair, detection rule optimization, and security capability building. Provide security support to other departments of the enterprise, including emergency response drills, development security consulting, AI application pre-launch security review, and security training. Participate in the security design review of AI applications and security products, and promote the advance of security capabilities in R & D, testing, and Pushonline. Job requirements Basic skills Proficient in basic knowledge of cyber security, including TCP/IP protocol, network architecture, identity authentication, access control, principles and configurations of common security devices. Proficient in common attack techniques and red team toolchains, such as Sliver, Cobalt Strike, NPS, Burp Suite, Metasploit, Nmap, Masscan, Frida, Impacket, etc. Familiar with mainstream operating systems Windows, Linux, macOS security mechanism, log system, permission model and common use. Familiar with common web frameworks, API architectures, microservice structures, containers, and security risks in Kubernetes environments. Offensive and defensive technical capabilities Proficient in penetration testing and red team processes, including information collection, vulnerability scanning, vulnerability exploitation, intranet penetration, privilege escalation, lateral movement, privilege maintenance, Data Discovery, and trace cleaning. Familiar with the working principles and adversarial methods of enterprise-level security products, including WAF, EDR, SIEM, NDR, HIDS, zero-trust gateway, bastion host, and identity authentication system. Possess independent vulnerability analysis and PoC writing capabilities, able to reproduce, verify, and assess the impact of public vulnerabilities and 0day/1day risks. Proficient in one or more programming/scripting languages, such as Python, Go, Bash, PowerShell, JavaScript, etc., with experience in tool development and automation platform construction. AI security capabilities Familiar with the basic architecture of large-scale model applications, familiar with technical forms such as Prompt, RAG, Embedding, vector databases, Agent, Function Calling, MCP, and plugin systems. Understand or practice AI security testing methods, including Prompt Injection, Jailbreak, RAG data poisoning, sensitive information leakage, unauthorized tool invocation, model output security, Agent permission escape, etc. Able to design security test cases for AI applications, evaluate model input/output, context isolation, data boundaries, permission control, and tool invocation chain risks. Experience in using AI to assist security work, including vulnerability analysis, code auditing, intelligence analysis, attack path planning, report generation, or automated testing. Familiar with AI application security governance ideas, including model call auditing, prompt word security, sensitive data protection, content security detection, permission minimization, and sandbox isolation. Experience requirements More than 5 years of experience in red team, penetration testing, security research, or offensive and defensive exercises. Candidates with experience in large-scale enterprise attack and defense drills, red-blue confrontation, HW/major support, cloud attack and defense, or intranet penetration are preferred. Candidates with experience in AI security, large-scale model security, intelligent agent security, automated penetration testing platform or security tool platform construction are preferred. Familiar with enterprise security construction system, able to promote defense capability, detection capability, and governance process optimization from an attack perspective. Other capabilities Priority will be given to those who hold security-related certifications such as ♀ P, OSCE, CISSP, CISP, CEH, CISSP, CCSP, etc. Possess strong document writing and expression abilities, able to output high-quality technical reports, review documents, attack chain analysis, and security construction plans. Possess good problem analysis ability, learning ability, teamwork ability, and stress resistance. Be sensitive to new technologies, new Attack Surfaces, and new tools, and be able to proactively research and share internally. Bonus points Familiar with Cloud Computing Platform security and cloud attack and defense technologies, such as AWS, Azure, GCP, Tencent Cloud, Alibaba Cloud, etc. Familiar with Kubernetes, containers, Service Mesh, CI/CD, DevSecOps and supply chain security. Possess experience in zero trust, secure operation, threat hunting, Attack Surface management, and vulnerability management platform construction. Familiar with MCP Server, AI Agent framework, RAG system, vector database, LLM API gateway, model security evaluation framework. Experience in Automated Red Team, AI Penetration Testing, Intelligent Vulnerability Verification, Agent Orchestration, Security Knowledge Base or Security RAG System Construction. Experience in vulnerability submission, CVE, technical articles, open source projects, topic sharing, or tool release in the security community. Familiar with security frameworks such as MITRE ATT & CK, OWASP Top 10, OWASP LLM Top 10, NIST AI RMF, etc. Why Join Us At Bybit, we are committed to fostering a supportive and enriching work environment. Our benefits include: - Study Growth Fund: We support your professional development and continuous learning. - Internal Events: Participate in regular team-building activities, workshops, and events designed to promote collaboration and innovation. - Global Collaboration: Be part of a diverse, international team, working alongside colleagues from around the world. - Career Advancement: Access opportunities for growth and advancement within a rapidly expanding global company. - Internal Mobility: Grow with us- Your long-term development is important to us. We offer internal job opportunities to help build your career path.

Обязанности: • Работать с системами информационной безопасности (SIEM, SOAR/IRP, NTA) • Заниматься мониторингом и анализом событий ИБ • Регистрировать инциденты ИБ и доводить их до закрытия • Взаимодействовать с коллегами. Требования: • Знание современных тактик и техник атакующих, основных векторов атак на корпоративные инфраструктуры, способов их обнаружения и противодействия; • Опыт работы с KSC, IRP/SOAR системами; • Понимание работы SOC (Security Operation Center) • Понимание работы средств защиты информации (FW, IDS/IPS, АВЗ, SIEM и пр.); • Ответственный подход к решению задач, способность работать в режиме многозадачности; • Высшее техническое образование (ИБ или ИТ); • Опыт работы не менее года. Условия: • Работу в федеральной компании стратегического масштаба; • Сменный график работы (сутки/трое) в комфортных условиях • Широкий стек технологий и проектов, возможность гибко строить свой карьерный трек; • Зарплату, соответствующую опыту и навыкам, прозрачную систему мотивации; • Поддержку профессионального развития - курсы и тренинги внутри департамента; • Расширенный пакет ДМС со стоматологией; • Корпоративная профсоюзная программа; • Комфортный офис рядом с м. ВДНХ; • Материальную помощь к отпуску, конкурентоспособную систему премирования.

Location: New York Workplace: Hybrid WHY HARVEY At Harvey, we’re transforming how legal and professional services operate. By combining frontier agentic AI, an enterprise-grade platform, and deep domain expertise, we’re reshaping how critical knowledge work gets done for decades to come. This is a rare chance to help build a generational company at a true inflection point. We have strong product-market fit and world-class investor support. We’re scaling fast and defining a new category in real time. The work is ambitious, the bar is high, and the opportunity for growth — personal, professional, and financial — is unmatched. Our team moves fast, takes ownership, and is deeply committed to the mission — operating with intensity, staying close to our customers, and pushing each other for excellence. We live by three values: Decisiveness, Simplicity, and Job's Not Finished. We act quickly on clear judgment over perfect information, we believe simplicity is what scales, and we're never satisfied with where we are. If you want to do the best work of your career alongside people who share that drive, we'd love to build with you. At Harvey, the future of professional services is being written today — and we’re just getting started. ROLE OVERVIEW Some of the world's largest companies and their law firms use Harvey's AI to deliver world-class client services at unprecedented scale, entrusting Harvey with their most sensitive documents in the process. This role joins Harvey's corporate security function, which secures the company's IT and business systems as Harvey grows rapidly, balancing risk with user experience while validating every assumption through threat modeling and real-world testing rather than relying on best practice alone. It is a strong fit for someone at the intersection of security engineering and enterprise systems- someone who understands how data flows between SaaS applications, can pinpoint where security breaks down in complex integrations, and knows how to build controls that scale. Experience with eDiscovery workflows and legal holds is a meaningful differentiator given the nature of Harvey's customer base. WHAT YOU'LL DO - Enterprise Integrations & SaaS Security: Design, implement, and govern security controls for cross-application data flows, API integrations, OAuth connections, and third-party SaaS platforms. Own the security review lifecycle for new integrations and automate posture monitoring to catch drift early. - eDiscovery & Legal Hold Program: Continue to build and operate Harvey's legal hold infrastructure, including data preservation, collection workflows, and custodian management. Partner with Legal and Compliance to meet litigation readiness requirements across our collaboration and productivity stack. - IT & Business Systems Partnership: Provide security oversight across the SaaS application lifecycle — vendor onboarding assessments, ongoing configuration review, and decommissioning. - Endpoint Security: Support endpoint security policies and vulnerability management, ensuring endpoint telemetry feeds into detection and response workflows. - Security Detection & Response: Develop scripts and integrations that extend visibility across corporate systems, partnering with the Detection & Response team to surface signals from SaaS and business applications. WHAT YOU HAVE - Demonstrated experience securing enterprise SaaS environments, including integration security, API token management, OAuth governance, and cross-application data flow risk — with working knowledge of authentication/authorization standards (SAML, OIDC, SCIM, X.509) and the ability to debug real-world integration failures. - Experience building or managing eDiscovery and legal hold programs, including data preservation workflows, custodian management, and coordination with Legal and outside counsel. Familiarity with tools such as Purview, Vault, Relativity, Everlaw, or similar platforms is a plus. - Strong software engineering fundamentals with proficiency in Python and/or Go, including building integrations against SaaS APIs (not just configuring through consoles), and experience with infrastructure-as-code tooling such as Terraform and/or Pulumi for managing security configurations in a repeatable, auditable way. - Ability to identify risks and vulnerabilities in IT and business systems and communicate that risk clearly to stakeholders across engineering, legal, and executive audiences. - Familiarity with endpoint security for macOS and Windows environments, and experience with tools such as Okta, Google Workspace, Salesforce, Workday, NetSuite, Microsoft Entra/Azure/Intune, JAMF, Tines, or similar platforms. - 4+ years of experience in security engineering, corporate engineering, IT, or a related program management function with a security focus. Experience with generative AI or the legal industry is not required — but genuine curiosity about both will serve you well here. COMPENSATION $220,000 - $330,000 USD DEPENDING ON YOUR LOCATION, AN APPLICANT PRIVACY NOTICE MAY APPLY TO YOU. YOU CAN FIND ALL OF OUR APPLICANT PRIVACY NOTICES HERE https://harveyai.notion.site/Harvey-Candidate-Privacy-Notices-319ac3fcdd7a803bb807d5094f249922?pvs=74. #LI-AH1 Harvey is an equal opportunity employer and does not discriminate on the basis of race, gender, sexual orientation, gender identity/expression, national origin, disability, age, genetic information, veteran status, marital status, pregnancy or related condition, or any other basis protected by law. We are committed to providing reasonable accommodations to applicants with disabilities, and requests can be made by emailing accommodations@harvey.ai

Location: San Francisco Workplace: Hybrid WHY HARVEY At Harvey, we’re transforming how legal and professional services operate. By combining frontier agentic AI, an enterprise-grade platform, and deep domain expertise, we’re reshaping how critical knowledge work gets done for decades to come. This is a rare chance to help build a generational company at a true inflection point. We have strong product-market fit and world-class investor support. We’re scaling fast and defining a new category in real time. The work is ambitious, the bar is high, and the opportunity for growth — personal, professional, and financial — is unmatched. Our team moves fast, takes ownership, and is deeply committed to the mission — operating with intensity, staying close to our customers, and pushing each other for excellence. We live by three values: Decisiveness, Simplicity, and Job's Not Finished. We act quickly on clear judgment over perfect information, we believe simplicity is what scales, and we're never satisfied with where we are. If you want to do the best work of your career alongside people who share that drive, we'd love to build with you. At Harvey, the future of professional services is being written today — and we’re just getting started. ROLE OVERVIEW Some of the world's largest companies and their law firms use Harvey's AI to deliver world-class client services at unprecedented scale, entrusting Harvey with their most sensitive documents in the process. This role joins Harvey's corporate security function, which secures the company's IT and business systems as Harvey grows rapidly, balancing risk with user experience while validating every assumption through threat modeling and real-world testing rather than relying on best practice alone. It is a strong fit for someone at the intersection of security engineering and enterprise systems- someone who understands how data flows between SaaS applications, can pinpoint where security breaks down in complex integrations, and knows how to build controls that scale. Experience with eDiscovery workflows and legal holds is a meaningful differentiator given the nature of Harvey's customer base. WHAT YOU'LL DO - Enterprise Integrations & SaaS Security: Design, implement, and govern security controls for cross-application data flows, API integrations, OAuth connections, and third-party SaaS platforms. Own the security review lifecycle for new integrations and automate posture monitoring to catch drift early. - eDiscovery & Legal Hold Program: Continue to build and operate Harvey's legal hold infrastructure, including data preservation, collection workflows, and custodian management. Partner with Legal and Compliance to meet litigation readiness requirements across our collaboration and productivity stack. - IT & Business Systems Partnership: Provide security oversight across the SaaS application lifecycle — vendor onboarding assessments, ongoing configuration review, and decommissioning. - Endpoint Security: Support endpoint security policies and vulnerability management, ensuring endpoint telemetry feeds into detection and response workflows. - Security Detection & Response: Develop scripts and integrations that extend visibility across corporate systems, partnering with the Detection & Response team to surface signals from SaaS and business applications. WHAT YOU HAVE - Demonstrated experience securing enterprise SaaS environments, including integration security, API token management, OAuth governance, and cross-application data flow risk — with working knowledge of authentication/authorization standards (SAML, OIDC, SCIM, X.509) and the ability to debug real-world integration failures. - Experience building or managing eDiscovery and legal hold programs, including data preservation workflows, custodian management, and coordination with Legal and outside counsel. Familiarity with tools such as Purview, Vault, Relativity, Everlaw, or similar platforms is a plus. - Strong software engineering fundamentals with proficiency in Python and/or Go, including building integrations against SaaS APIs (not just configuring through consoles), and experience with infrastructure-as-code tooling such as Terraform and/or Pulumi for managing security configurations in a repeatable, auditable way. - Ability to identify risks and vulnerabilities in IT and business systems and communicate that risk clearly to stakeholders across engineering, legal, and executive audiences. - Familiarity with endpoint security for macOS and Windows environments, and experience with tools such as Okta, Google Workspace, Salesforce, Workday, NetSuite, Microsoft Entra/Azure/Intune, JAMF, Tines, or similar platforms. - 4+ years of experience in security engineering, corporate engineering, IT, or a related program management function with a security focus. Experience with generative AI or the legal industry is not required — but genuine curiosity about both will serve you well here. COMPENSATION $220,000 - $330,000 USD DEPENDING ON YOUR LOCATION, AN APPLICANT PRIVACY NOTICE MAY APPLY TO YOU. YOU CAN FIND ALL OF OUR APPLICANT PRIVACY NOTICES HERE https://harveyai.notion.site/Harvey-Candidate-Privacy-Notices-319ac3fcdd7a803bb807d5094f249922?pvs=74. #LI-AH1 Harvey is an equal opportunity employer and does not discriminate on the basis of race, gender, sexual orientation, gender identity/expression, national origin, disability, age, genetic information, veteran status, marital status, pregnancy or related condition, or any other basis protected by law. We are committed to providing reasonable accommodations to applicants with disabilities, and requests can be made by emailing accommodations@harvey.ai

Location: Kuala Lumpur, Malaysia About Us Established in 2018, Bybit is one of the world’s leading cryptocurrency exchanges and digital financial platforms, serving over 80 million users across more than 200 countries and regions. Powered by world-class technology and a user-first mindset, Bybit delivers a seamless ecosystem across trading, payments, wealth management, custody, institutional services, and Web3 — connecting users to the future of digital finance. Our core values define how we build. We listen, care and improve to create products and experiences that put users first. Backed by a global team of ambitious builders, problem-solvers, and innovators, we foster a high-performance and fast-moving environment where talent is empowered to drive real impact at the global scale. Supported by 24/7 multilingual customer service and a strong commitment to innovation, we are shaping the future of finance through technology, collaboration, and bold execution. Today, Bybit is recognized as one of the most trusted and transparent platforms in the digital asset industry, continuing to expand its global presence while building the infrastructure for the next generation of financial services. Job Summary: Primarily responsible for security auditing and security governance of the company's platform systems. Identify potential risks in business requirements and technical implementation plans, provide solutions, and drive their implementation. Job Responsibilities: Conduct manual code security audits on business code (Java, Golang, JS, C++, etc.) and write audit reports. Track domestic and international security developments; analyze and reproduce the latest security vulnerabilities. Deeply understand and master the company's product business; identify security risks in business architecture, business processes, and business logic; provide corresponding security solutions and drive their implementation. Drive security solution implementation, risk governance, etc. Job Requirements: Associate degree or above; requirements may be relaxed for candidates with strong capabilities. At least 3+ years of business development or audit experience based on Java or Go; has led or participated in SDL (Security Development Lifecycle) implementation. Proficient in the underlying principles, discovery methods, vulnerable code scenarios, and exploitation techniques of common security vulnerabilities (not limited to OWASP Top 10). Expert-level proficiency in Java and/or Go tech stacks; understands language-specific characteristics and common mainstream development frameworks, with relevant code audit experience. Familiar with common white-box audit methodologies, with the ability to track and reproduce the latest vulnerabilities. Familiar with mainstream development frameworks such as SpringMVC, SSM, or Gin, GoZero, etc. Has a solid understanding of penetration testing; proficient in common penetration testing methods and familiar with the principles and exploitation techniques of common vulnerabilities. Able to proficiently use AI tools to enhance security work efficiency. Highly proactive with strong logical thinking; possesses good communication, coordination, organizational skills, and documentation writing ability. Experience with TEE (Trusted Execution Environment) and other security encryption, data protection technical architectures and solution implementation is preferred. Nice to Have: Has submitted high-quality vulnerabilities to domestic or international SRC/bug bounty platforms. Has discovered CVE or CNVD general vulnerabilities. Has Java or Go code audit experience with demonstrated results. Why Join Us At Bybit, we are committed to fostering a supportive and enriching work environment. Our benefits include: - Study Growth Fund: We support your professional development and continuous learning. - Internal Events: Participate in regular team-building activities, workshops, and events designed to promote collaboration and innovation. - Global Collaboration: Be part of a diverse, international team, working alongside colleagues from around the world. - Career Advancement: Access opportunities for growth and advancement within a rapidly expanding global company. - Internal Mobility: Grow with us- Your long-term development is important to us. We offer internal job opportunities to help build your career path.

Location: The Netherlands; Poland; Portugal; France; United Kingdom; Spain; Germany; Italy Workplace: Remote About the team  The Security Team is responsible for providing key security capabilities covering application, cloud and enterprise security, incident response, detection and GRC. Our team is looking for an experienced, hands-on security practitioner, who will drive the adoption of modern security processes and tooling, with focus on supporting our engineering and product teams in improving the security posture of our platforms and services. Note: This position can be fully remote anywhere in the Netherlands. What you will do: - Collaborate with engineering and product on improving existing and building new product features with focus on threat modeling, assurance and secure implementation, some examples of recent work include implementation of secure key management, passwordless authentication, m2m authentication, sandboxing and compute/network/storage isolation - Identify security gaps and vulnerabilities in ClickHouse Cloud and OSS, triage a wide range of vulnerabilities reported via our bug bounty program, responsible disclosure, GitHub Issues covering web, API and server - client assets including low level memory issues like heap or buffer overflows - Improve and develop security assurance activities - pentests, vulnerability assessments, bug bounty programs, fuzzing - Drive implementation and usage of engineering security tools - static, dynamic code analysis, dependency checks, code licensing compliance (working knowledge of Snyk, Semgrep, GitHub CodeQL) - Nurture the engineering - security relationship, identify and implement process and technology improvements - Handle information security events and incidents across ClickHouse products and services - Develop processes, tooling and automation to scale security processes and mitigate risks to the business What you bring along: - Experience supporting engineering and product implementation efforts by performing threat assessments, assurance activities, advisory as well as, in some cases, implementation work across distributed systems covering web, API, client/server assets - Strong knowledge of and experience with one or more cloud service providers (e.g. AWS, GCP, Azure), Kubernetes, Cilium - Experience implementing and operating engineering security tools and processes (e.g. static / dynamic code analysis, software composition analysis, SBOM, OWASP SAMM, client and network fuzzing tools) - Significant development and automation experience, ability to work with C++ code - Security as code mindset, with focus on solving problems with automation and scale in mind Bonus Points: - BS, MS, or PhD in Computer Science or related field - Previous contributions to open source projects - Security or cloud related certifications (AWS, GCP, Azure) PERKS - Flexible work environment - ClickHouse is a globally distributed company and remote-friendly. We currently operate in over 25 countries. - Healthcare - Employer contributions towards your healthcare. - Equity in the company - Every new eligible team member who joins our company receives equity. - Time off - Flexible time off in the US, generous entitlement in other countries. - A USD$500 Home office setup if you’re a remote employee. - Global Gatherings – We believe in the power of in-person connection and offer opportunities to engage with colleagues at company-wide offsites. CULTURE - WE ALL SHAPE IT As part of a rapidly scaling start-up, you will be instrumental in shaping our culture. Are you interested in finding out more about our culture? Learn more about our values here https://clickhouse.com/company/careers. Check out our blog posts https://clickhouse.com/blog or follow us on LinkedIn https://www.linkedin.com/company/clickhouseinc/life/0c1ee7f4-2129-488d-b413-e7f6270659fd/?viewAsMember=true to find out more about what’s happening at ClickHouse. EQUAL OPPORTUNITY & PRIVACY ClickHouse provides equal employment opportunities to all employees and applicants and prohibits discrimination and harassment of any type based on factors such as race, color, religion, age, sex, national origin, disability status, genetics, protected veteran status, sexual orientation, gender identity or expression, or any other characteristic protected by federal, state or local laws. Please see here https://clickhouse.com/legal/applicant-privacy-notice for our Privacy Statement.

Location: United States Workplace: Remote About the team  The Security Team is responsible for providing key security capabilities covering application, cloud and enterprise security, incident response, detection and GRC. Our team is looking for an experienced, hands-on security practitioner, who will drive the adoption of modern security processes and tooling, with focus on supporting our engineering and product teams in improving the security posture of our platforms and services.  What you will do: - Collaborate with engineering and product on improving existing and building new product features with focus on threat modeling, assurance and secure implementation, some examples of recent work include implementation of secure key management, passwordless authentication, m2m authentication, sandboxing and compute/network/storage isolation - Identify security gaps and vulnerabilities in ClickHouse Cloud and OSS, triage a wide range of vulnerabilities reported via our bug bounty program, responsible disclosure, GitHub Issues covering web, API and server - client assets including low level memory issues like heap or buffer overflows - Improve and develop security assurance activities - pentests, vulnerability assessments, bug bounty programs, fuzzing - Drive implementation and usage of engineering security tools - static, dynamic code analysis, dependency checks, code licensing compliance (working knowledge of Snyk, Semgrep, GitHub CodeQL) - Nurture the engineering - security relationship, identify and implement process and technology improvements - Handle information security events and incidents across ClickHouse products and services - Develop processes, tooling and automation to scale security processes and mitigate risks to the business What you bring along: - Experience supporting engineering and product implementation efforts by performing threat assessments, assurance activities, advisory as well as, in some cases, implementation work across distributed systems covering web, API, client/server assets - Strong knowledge of and experience with one or more cloud service providers (e.g. AWS, GCP, Azure), Kubernetes, Cilium, Crossplane - Experience implementing and operating engineering security tools and processes (e.g. static / dynamic code analysis, software composition analysis, SBOM, OWASP SAMM, client and network fuzzing tools) - Significant development and automation experience, ability to work with C++ code preferred - Security as code mindset, with focus on solving problems with automation and scale in mind Bonus Points: - BS, MS, or PhD in Computer Science or related field - Previous contributions to open source projects - Security or cloud related certifications (AWS, GCP, Azure) PERKS - Flexible work environment - ClickHouse is a globally distributed company and remote-friendly. We currently operate in over 25 countries. - Healthcare - Employer contributions towards your healthcare. - Equity in the company - Every new eligible team member who joins our company receives equity. - Time off - Flexible time off in the US, generous entitlement in other countries. - A USD$500 Home office setup if you’re a remote employee. - Global Gatherings – We believe in the power of in-person connection and offer opportunities to engage with colleagues at company-wide offsites. CULTURE - WE ALL SHAPE IT As part of a rapidly scaling start-up, you will be instrumental in shaping our culture. Are you interested in finding out more about our culture? Learn more about our values here https://clickhouse.com/company/careers. Check out our blog posts https://clickhouse.com/blog or follow us on LinkedIn https://www.linkedin.com/company/clickhouseinc/life/0c1ee7f4-2129-488d-b413-e7f6270659fd/?viewAsMember=true to find out more about what’s happening at ClickHouse. EQUAL OPPORTUNITY & PRIVACY ClickHouse provides equal employment opportunities to all employees and applicants and prohibits discrimination and harassment of any type based on factors such as race, color, religion, age, sex, national origin, disability status, genetics, protected veteran status, sexual orientation, gender identity or expression, or any other characteristic protected by federal, state or local laws. Please see here https://clickhouse.com/legal/applicant-privacy-notice for our Privacy Statement.

Location: Remote Canada At Affirm, we exist for the moments that matter—giving people a clear, predictable way to pay over time, with no hidden fees, no surprises, and no tradeoffs on what matters most. About the InfoSec & IT Team The Application Security team helps Affirm build and launch products that earn customer trust, meet compliance obligations, and reduce business risk. We partner closely with product, engineering, infrastructure, risk, compliance, and other teams to identify security risks early, recommend pragmatic mitigations, and help teams find safe paths to launch. We are looking for an early-career Application Security Engineer who is curious, collaborative, and comfortable working with code. You will help assess application risks, support vulnerability management efforts, partner with engineering teams on secure design decisions, and contribute lightweight tooling, automation, and code-informed analysis that helps AppSec scale across Affirm. This role is a great fit for someone who has hands-on software or security experience, enjoys reading and reasoning about code, is actively developing offensive security skills, and wants to apply those skills in a product-minded, risk-based way. What You'll Do Partner with product and engineering teams to identify application security risks and help frame them as clear business risks, launch options, and recommended next steps. Read application code, configuration, pull requests, logs, and documentation to understand how systems work and where security risks may exist. Contribute small code changes, scripts, detections, tests, secure defaults, or automation that improve AppSec workflows and reduce recurring issues. Work in GitHub to review code changes, understand engineering context, participate in pull request discussions, track remediation work, and collaborate with engineers. Help evaluate vulnerabilities from internal testing, bug bounty reports, security tooling, penetration tests, and other sources; partner with teams to prioritize and remediate issues based on real-world risk. Contribute to vulnerability management workflows, including triage, validation, severity assessment, remediation guidance, tracking, and reporting. Translate recurring security findings into repeatable mechanisms such as secure coding guidance, checklists, paved paths, lightweight automation, detection logic, reusable review patterns, or developer-facing documentation. Work with engineers to understand system designs, data flows, trust boundaries, authentication and authorization models, code paths, and potential abuse cases. Communicate security issues clearly to both technical and non-technical audiences, including the risk, tradeoffs, recommended mitigations, and residual risk. Build strong relationships across Affirm teams and influence security outcomes without relying on formal authority. Help connect AppSec work to customer trust, regulatory/compliance expectations, operational resilience, and business outcomes. Continue developing hands-on offensive, defensive, and software engineering skills through practical work, labs, tooling, research, certifications, or contributions to internal security programs. What We Look For 4+ years of experience in application security, software engineering, security engineering, vulnerability management, penetration testing, security operations, or equivalent practical experience. Foundational programming ability in one or more languages such as Python, JavaScript/TypeScript, Kotlin, or similar. Comfort reading, navigating, and reasoning about code, even in unfamiliar codebases. Experience using Git and GitHub or similar version-control workflows, including branches, commits, pull requests, code review, issues, or project tracking. Some hands-on experience building, testing, breaking, or securing software. This could include professional experience, internships, security labs, CTFs, bug bounty work, open-source contributions, personal projects, automation scripts, internal tools, or coursework. Ability to write clear, maintainable scripts or small programs to solve practical problems, automate manual workflows, analyze data, validate findings, or improve security processes. Foundational understanding of common web, API, mobile, cloud, and application security risks, such as OWASP Top 10 issues, authentication and authorization flaws, injection, insecure design, secrets exposure, dependency risks, and data protection concerns. Interest in offensive security, such as studying for or completing security certifications, practicing web/API testing, learning exploit development fundamentals, using tools like Burp Suite, or participating in labs and capture-the-flag environments. Exposure to vulnerability management concepts, including triage, severity assessment, remediation tracking, false-positive analysis, compensating controls, and risk-based prioritization. Ability to reason about risk and tradeoffs, not just identify issues. You can explain what could go wrong, how likely it is, what impact it may have, and what options exist to reduce risk. Strong product and engineering empathy. You seek to understand launch goals, technical constraints, user impact, and business priorities before recommending a path forward. Clear written and verbal communication skills, including the ability to explain security findings in practical, actionable terms. A collaborative mindset and comfort working across product, engineering, compliance, risk, infrastructure, and security teams. Curiosity, humility, and a growth mindset. You proactively seek feedback, ask good questions, and continue building your technical depth. Secure-by-design judgment, including the ability to spot patterns, recommend simple controls, and balance launch velocity with meaningful risk reduction. Base Pay Grade - L Equity Grade - 5 Employees new to Affirm typically come in at the start of the pay range. Affirm focuses on providing a simple and transparent pay structure which is based on a variety of factors, including location, experience and job-related skills. Base pay is part of a total compensation package that may include monthly stipends for health, wellness and tech spending, and benefits (including 100% subsidized medical coverage, dental and vision for you and your dependents). In addition, the employees may be eligible for equity rewards offered by Affirm Holdings, Inc. (parent company). CAN base pay range per year: CAD $133,000 - $183,000 Location - Remote Canada This remote role is open only to candidates residing in Alberta, British Columbia, Manitoba, New Brunswick, Newfoundland and Labrador, Nova Scotia, Ontario, Prince Edward Island, or Saskatchewan. #LI-Remote Remote-first with flexibility built in Affirm is proud to be a remote-first company. Most roles can be done from almost anywhere within the country of employment. Some positions may occasionally require in-person work at an Affirm office, and a few are office-based due to the nature of the work. All new hires will be invited to attend an in-person onboarding experience. Benefits designed for you Our benefits reflect our commitment to care, transparency, and flexibility. Here are a few highlights: Health coverage at no cost: We cover 100% of premiums for employees and their dependents. Spending stipends: Monthly stipends support your tech setup, and the ability to choose health and wellness options that are right for you. Time off to recharge: Flexible time off and generous holiday calendars help you rest when you need to. Own a piece of what you build: Our employee stock purchase plan (ESPP) lets you buy Affirm stock at a discount. We’re committed to providing an inclusive interview process, including accommodations for candidates with disabilities. If you need support, we’re happy to help. For positions based in San Francisco or Los Angeles: Affirm considers qualified applicants with arrest and conviction records, as required by law. By clicking "Submit Application," you acknowledge that you have read Affirm's Global Candidate Privacy Notice and consent to the use of your personal information as described.

Location: Boston, MA Workplace: OnSite At WHOOP, we're on a mission to unlock and inspire performance for life. Our wearable technology provides personalized insights that help millions of members better understand their bodies, and make smarter decisions about training, recovery, and lifestyle. WHOOP is seeking a hands-on Security Architect to help strengthen and scale security architecture across our technology environment. This role is an opportunity for an experienced security engineer or architect to expand their impact by shaping secure design practices, solving complex technical challenges, and helping engineering teams build secure systems at scale. The ideal candidate brings strong technical experience in cloud security or application security, with demonstrated experience evaluating system architectures and making sound security design decisions. You don't need to have held the title of Security Architect or previously built an enterprise architecture program, but you should have the technical depth, judgment, and curiosity to identify architectural risks and develop practical solutions. WHOOP operates a modern technology environment spanning cloud platforms, applications, and enterprise systems. As AI-assisted development accelerates how software is built, our approach to security architecture must evolve as well. We're looking for someone who can help move security beyond manual reviews by establishing reusable security patterns, integrating automated controls, and making secure design easier for engineering teams to adopt. Working closely with the Security Architecture Lead, Product Security, Platform Engineering, Software Engineering, IT, and the broader Information Security organization, you'll contribute to the evolution of Security Architecture as an enterprise capability while remaining deeply engaged in hands-on technical work. Responsibilities - Conduct security architecture reviews across cloud platforms, applications, infrastructure, identity systems, and enterprise technologies, identifying security risks and recommending practical mitigations. - Partner with Engineering, Product Security, Platform, and IT teams to incorporate security into system design, development, infrastructure provisioning, and deployment workflows. - Perform threat modeling and security design assessments for Web and Mobile applications, APIs, cloud services, third-party integrations, and new technologies, identifying attack paths, trust boundaries, and sensitive data flows. - Evaluate security controls across cloud and application environments, including IAM, workload identities, authentication, authorization, network segmentation, secrets management, encryption, and data protection. - Develop and promote secure-by-default architecture patterns, reference designs, and reusable security controls that enable engineering teams to implement consistent security practices. - Help translate security architecture requirements into automated guardrails, policy-as-code, and scalable security checks integrated into engineering and deployment workflows. - Collaborate with Engineering teams to identify opportunities to reduce repetitive manual security reviews through standardized designs, preventive controls, and risk-based review approaches. - Assess the security implications of AI-assisted software development, AI-enabled applications, and emerging agentic technologies, including access to sensitive data, tool integrations, identities, and permissions. - Apply automation and AI-assisted analysis where appropriate to improve the efficiency and consistency of architecture assessments and threat modeling, while maintaining appropriate human oversight. - Review findings from penetration tests, vulnerability assessments, cloud security monitoring, and incidents to identify systemic architectural weaknesses and recommend sustainable improvements. - Provide technical security guidance on new technologies, strategic integrations, and architectural changes, balancing security requirements with performance, scalability, and business needs. - Help translate applicable security policies and regulatory requirements into practical technical architecture controls. - Document architecture assessments, technical recommendations, security patterns, and design decisions in a clear, actionable format. - Partner with the Security Architecture Lead to strengthen architecture standards, improve review practices, and expand the adoption of scalable security controls across WHOOP. Qualifications - 7+ years of experience in cloud security, application security, or security architecture, with demonstrated experience designing or evaluating secure systems. - Strong technical expertise in cloud or application security architecture, with a solid understanding of identity, infrastructure, and modern software development practices. - Experience conducting security architecture reviews, threat modeling, and technical risk assessments for complex systems. - Ability to independently identify architectural risks, evaluate design tradeoffs, and recommend practical, scalable security solutions. - Experience developing or implementing security controls, automation, or secure engineering practices within modern technology environments. - Ability to evaluate system designs, technical documentation, and implementation approaches to identify security weaknesses. - Strong communication and collaboration skills, with the ability to influence technical decisions and work effectively across engineering and security teams. Preferred Qualifications - Hands-on software development, cloud engineering, or infrastructure engineering experience. - Experience with secure-by-default architecture patterns, policy-as-code, or automated security controls. - Familiarity with AI-assisted development, AI-enabled applications, or emerging agentic technologies and their security implications. - Experience working across multiple security domains or contributing to enterprise security architecture initiatives. - Familiarity with relevant security or regulatory frameworks (NIST, ISO 27001, SOC 2, HIPAA, PCI DSS) or professional security certifications. This role is based in the WHOOP office located in Boston, MA. The successful candidate must be prepared to relocate if necessary to work out of the Boston, MA office. Interested in the role, but don’t meet every qualification? We encourage you to still apply! At WHOOP, we believe there is much more to a candidate than what is written on paper, and we value character as much as experience. As we continue to build a diverse and inclusive environment, we encourage anyone who is interested in this role to apply. WHOOP is an Equal Opportunity Employer and participates in E-verify https://www.e-verify.gov/to determine employment eligibility The WHOOP compensation philosophy is designed to attract, motivate, and retain exceptional talent by offering competitive base salaries, meaningful equity, and consistent pay practices that reflect our mission and core values. At WHOOP, we view total compensation as the combination of base salary, equity, and benefits, with equity serving as a key differentiator that aligns our employees with the long-term success of the company and allows every member of our corporate team to own part of WHOOP and share in the company’s long-term growth and success. The U.S. base salary range for this full-time position is $155,000 - $195,000. Salary ranges are determined by role, level, and location. Within each range, individual pay is based on factors such as job-related skills, experience, performance, and relevant education or training. In addition to the base salary, the successful candidate will also receive benefits and a generous equity package. These ranges may be modified in the future to reflect evolving market conditions and organizational needs. While most offers will typically fall toward the starting point of the range, total compensation will depend on the candidate’s specific qualifications, expertise, and alignment with the role’s requirements.

Location: Mapbox US Mapbox is the leading real-time location platform for a new generation of location-aware businesses. Mapbox is the only platform that equips organizations with the full set of tools to power the navigation of people, packages, and vehicles everywhere. More than 4 million registered developers have chosen Mapbox because of the platform’s flexibility, security and privacy compliance. Organizations use Mapbox applications, data, SDKs and APIs to create customized and immersive experiences that delight their customers.  As AI becomes embedded in modern engineering workflows, we value engineers who can thoughtfully integrate AI into design, development, and decision-making. Our interview process will include discussion of how you use AI in your engineering workflow. WHAT WE DO Mapbox is looking for a Senior Software Engineer to join our Security & Compliance team. As a member of our diverse and globally distributed team, you’ll help all Mapbox engineers build secure-by-default systems. Engineers on the Security & Compliance team build scanning and threat detection systems to monitor Mapbox’s cloud deployment (AWS-native, mainly container-based, 7 global regions including China) and other digital assets. They conduct risk assessments of new vendor integrations and product launches, and facilitate a bug bounty program that leverages the diverse expertise of a global community of security researchers. Lastly, they build and maintain core standards around security, quality, and privacy—reflected in our compliance certifications—and the automation to monitor and enforce these standards across Mapbox. WHAT YOU'LL DO We’re excited to share our passion for scalable, engineering-driven, security with you, and for your perspective to help shape our team’s goals. You will be responsible for contributing to, operating, and improving all things related to our security and compliance services. In this role, you can expect to: - Conduct AWS security reviews (deep dive into our AWS environment to validate security best practices are being followed). - Make security improvements recommendations and work with our production support teams to implement security improvement in AWS. - Partner with the Lead Security Architect in fixing custom-built security tools bots. - Conduct in-depth security reviews of application code, working closely with developers to code securely from the outset and address issues early during coding and testing phases. - Partner with internal product teams to implement a secure-by-default design into their own products. - Participate in an on-call rotation to ensure our systems remain available to customers 24/7. Team members alternate as the on-call primary responder, which may require immediate response outside normal working hours, including weekends. WHAT WE BELIEVE ARE IMPORTANT FOR THIS ROLE - Bachelor’s or higher degree in Computer Science or similar - 5+ years of experience in product or application security and related software engineering roles - Experience with AWS services like GuardDuty, CloudTrail log review, IAM, Security Groups, CloudFront, CloudFormation, S3, ECS, Lambda, DynamoDB and RDS. - Proficiency in a programming language (e.g. Python, JavaScript or Node.js or TypeScript), testing practices, and documentation. - Subject matter expertise in security best practices and the ability to quickly make correct risk assessments that prioritize the overall benefit to the company.  WHAT WE VALUE In addition to our core values https://www.mapbox.com/about/values/, which are not unique to this position and are necessary for Mapbox leaders: - We value high-performing creative individuals who dig into problems and opportunities. - We believe in individuals being their whole selves at work. We commit to this through supportive health care, parental leave, flexibility for the things that come up in life, and innovating on how we think about supporting our people. - We emphasize an environment of teaching and learning to equip employees with the tools needed to be successful in their function and the company. - We strongly believe in the value of growing a diverse team and encourage people of all backgrounds, genders, ethnicities, abilities, and sexual orientations to apply. HOW WE SUPPORT YOU - Hybrid/Remote Options: Enjoy flexibility to work comfortably from home or periodically from an office where applicable. - Comprehensive Healthcare: Private medical coverage for you and your dependents. - Family-First Support: Generous maternity and paternity leave policies to support your growing family. - Fertility & Family Building: Inclusive fertility support. Grow your family on your terms. - Lifestyle Spending Account: Contributions to support your health, wellness, and personal growth. - Balance & Brainpower: Mental health support for you and your dependents. - Rest & Recharge: Flexible paid time away, company holidays, and generous absence policies. - Time Off to Give Back: Dedicated paid volunteering time in addition to your standard PTO. - Invest & Grow: Retirement plans with competitive matching.   Our annual base compensation for this role ranges from $160,650 - $217,350 for most US locations and 5% to 10% higher for US locations with a higher cost of labor. Job level and actual compensation will be decided based on factors including, but not limited to, individual qualifications objectively assessed during the interview process (including skills and prior relevant experience, potential impact, and scope of role), market demands, and specific work location. Please discuss your specific work location with your recruiter for more information. By applying for this position, you acknowledge that you agree to the Mapbox Privacy Policy https://www.mapbox.com/legal/privacy which is linked here. Mapbox participates in E-Verify to confirm employee work authorization. Please refer to the Notice of E-Verify Participation https://drive.google.com/file/d/1rVYht6vc6QJmVzwML1rlh3BFboC-JkGe/view?usp=drive_link and Right to Work https://drive.google.com/file/d/1Pnzz1t8ueq8iPftJ7kqPOGoTnD5mqi0H/view?usp=drive_link posters for more information. Applications are accepted on an ongoing basis. We are committed to a fair and equitable hiring process. We do not discriminate against any protected class. #LI-Remote

Location: Hybrid About Us At Cloudflare, we are on a mission to help build a better Internet. Today the company runs one of the world’s largest networks that powers millions of websites and other Internet properties for customers ranging from individual bloggers to SMBs to Fortune 500 companies. Cloudflare protects and accelerates any Internet application online without adding hardware, installing software, or changing a line of code. Internet properties powered by Cloudflare all have web traffic routed through its intelligent global network, which gets smarter with every request. As a result, they see significant improvement in performance and a decrease in spam and other attacks. Cloudflare was named to Entrepreneur Magazine’s Top Company Cultures list and ranked among the World’s Most Innovative Companies by Fast Company. At Cloudflare, we’re not looking for people who wait for a polished roadmap; we’re looking for the builders who see the cracks in the Internet that everyone else has simply learned to live with. We value candidates who have the instinct to spot a "normalized" problem and the AI-native curiosity to create a solution using the latest tools. Our culture is built on iteration, leveraging AI to ship faster today to make it better tomorrow, while ensuring that every improvement, no matter how small, is shared across the team to lift everyone up. If you’re the type of person who values curiosity over bureaucracy, and that AI is a partner in solving tough problems to keep the Internet moving forward, you’ll fit right in. Available Location: Singapore or Tokyo, Japan This position is open to experienced candidates, as well as fresh graduates who will be graduating in December 2026 or Jan 2027. About the Team The Cloudflare Customer Support Team solves complicated problems and answers technical questions via phone, email, chat and social media. Whether it is a Wordpress blogger using our services for free or a global Enterprise business with petabytes of web traffic, we are always eager to assist. We are the eyes and ears of Cloudflare, acting as the real-time voice of the customer to help communicate their needs and real-world use cases back to the rest of the company - for better service and future product development. What You'll Do Do you love solving complex technical issues and interacting with people? Are you passionate about providing premium-level support to customers and are a standout colleague? Cloudflare is seeking an experienced Network Security Engineer to join our team and support our largest and most technically sophisticated customers in resolving technical problems, threats or attacks on their infrastructure at OSI Layers 3, 4, and 7. This will span the range of Cloudflare products from Magic Transit Infrastructure Protection, Argo Smart Routing, DDoS mitigation and Network Firewall, to using the Web Application firewall (WAF), Spectrum and Rate Limiting to help customers. Serve as a trusted technical advisor for our enterprise customers, responding to and resolving inquiries and incidents related to network security and performance, while delivering timely, high-quality and personalized assistance. Work directly with customers to diagnose, troubleshoot and resolve complex technical issues involving DDoS mitigation, firewall rules, SSL/TLS, network confirmation, and other security configurations. Create and maintain knowledge base articles, technical guides, and troubleshooting documentation for internal and customer use. Compare traffic signatures and attributes including IP addresses, cookie variations, HTTP headers, and JavaScript footprints to determine what is good traffic and what is malicious DDoS mitigation for OSI layers 3,4, & 7: advise customers on how to filter malicious traffic using Cloudflare tools like Magic Transit, Network Firewall, WAF, IP reputation lists, packet inspection, blocklisting, allowlisting, and rate limiting Work with Engineering and Product teams to improve products and tools Utilize generative AI and automation tools to streamline log analysis, accelerate root-cause analysis during security incidents, and optimize customer response times. What We're Looking For You have a minimum of 4 years experience working as a Network Security Engineer / Technical Support Engineer / Sr. Support Engineer supporting networking or web security products. Exceptional troubleshooting and problem-solving skills, with the ability to simplify complex concepts for customers. Strong customer service orientation and communication skills Ability to work independently and collaboratively in a fast-paced, dynamic environment. Strong understanding of network protocols, including TCP/IP, DNS, HTTP/S, and BGP, with a particular focus on anycast routing concepts and implementation, as well as tools such as iptables and looking glass. Proven experience troubleshooting network connectivity issues, BGP routing, and GRE tunnels, and performing packet capture analysis Confident with command line and tools, including curl, dig, traceroute, openssl, git Experience in a web development and / or hosting environment such as installing and configuring web servers like Apache, Nginx, Caddy and IIS. You are competent at writing scripts in Bash, Python, JavaScript or other scripting languages. You have worked with PostgreSQL, MySQL, MS SQL, and other database servers. Bachelor’s degree in Computer Science, Cybersecurity, or a related field (or equivalent experience). Relevant certifications such as CISSP, GCIA GCIH, GCFA, GCFE or equivalent. What Makes Cloudflare Special? We’re not just a highly ambitious, large-scale technology company. We’re a highly ambitious, large-scale technology company with a soul. Fundamental to our mission to help build a better Internet is protecting the free and open Internet. Project Galileo : Since 2014, we've equipped more than 2,400 journalism and civil society organizations in 111 countries with powerful tools to defend themselves against attacks that would otherwise censor their work, technology already used by Cloudflare’s enterprise customers--at no cost. Athenian Project : In 2017, we created the Athenian Project to ensure that state and local governments have the highest level of protection and reliability for free, so that their constituents have access to election information and voter registration. Since the project, we've provided services to more than 425 local government election websites in 33 states. 1.1.1.1 : We released 1.1.1.1 to help fix the foundation of the Internet by building a faster, more secure and privacy-centric public DNS resolver. This is available publicly for everyone to use - it is the first consumer-focused service Cloudflare has ever released. Here’s the deal - we don’t store client IP addresses never, ever. We will continue to abide by our privacy commitment and ensure that no user data is sold to advertisers or used to target consumers. Sound like something you’d like to be a part of? We’d love to hear from you! Please note that applicants who progress to the offer stage of the interview process may be asked to attend an in-person interview within one of the Cloudflare Offices or Cloudflare Hubs.  More details about this will be available at that stage of the interview process. This position may require access to information protected under U.S. export control laws, including the U.S. Export Administration Regulations. Please note that any offer of employment may be conditioned on your authorization to receive software or technology controlled under these U.S. export laws without sponsorship for an export license. Cloudflare is proud to be an equal opportunity employer.  We are committed to providing equal employment opportunity for all people and place great value in both diversity and inclusiveness.  All qualified applicants will be considered for employment without regard to their, or any other person's, perceived or actual race, color, religion, sex, gender, gender identity, gender expression, sexual orientation, national origin, ancestry, citizenship, age, physical or mental disability, medical condition, family care status, or any other basis protected by law. We are an AA/Veterans/Disabled Employer. Cloudflare provides reasonable accommodations to qualified individuals with disabilities.  Please tell us if you require a reasonable accommodation to apply for a job. Examples of reasonable accommodations include, but are not limited to, changing the application process, providing documents in an alternate format, using a sign language interpreter, or using specialized equipment.  If you require a reasonable accommodation to apply for a job, please contact us via e-mail at hr@cloudflare.com or via mail at 101 Townsend St. San Francisco, CA 94107.

Location: Hybrid About Us At Cloudflare, we are on a mission to help build a better Internet. Today the company runs one of the world’s largest networks that powers millions of websites and other Internet properties for customers ranging from individual bloggers to SMBs to Fortune 500 companies. Cloudflare protects and accelerates any Internet application online without adding hardware, installing software, or changing a line of code. Internet properties powered by Cloudflare all have web traffic routed through its intelligent global network, which gets smarter with every request. As a result, they see significant improvement in performance and a decrease in spam and other attacks. Cloudflare was named to Entrepreneur Magazine’s Top Company Cultures list and ranked among the World’s Most Innovative Companies by Fast Company. At Cloudflare, we’re not looking for people who wait for a polished roadmap; we’re looking for the builders who see the cracks in the Internet that everyone else has simply learned to live with. We value candidates who have the instinct to spot a "normalized" problem and the AI-native curiosity to create a solution using the latest tools. Our culture is built on iteration, leveraging AI to ship faster today to make it better tomorrow, while ensuring that every improvement, no matter how small, is shared across the team to lift everyone up. If you’re the type of person who values curiosity over bureaucracy, and that AI is a partner in solving tough problems to keep the Internet moving forward, you’ll fit right in. Available Locations: Austin, TX About the role As a Senior Product Security Engineer, you will lead security assessments and vulnerability operations for Cloudflare’s core software products. In this role, you will analyze system architecture, threat model new features, and ensure that product-related security findings are accurately triaged, routed to the correct engineering owners, and mitigated within our SLAs. On any given day, you might conduct a deep-dive security review on a new feature design, triage a complex bug bounty submission, or work directly with engineering teams to resolve vulnerabilities from different sources like bug bounties, SAST, fuzzing and penetration tests. You will also work autonomously to identify areas where our manual processes slow down. You will write code and integrate AI/LLM solutions to automate initial triage and data enrichment, building tools that help the team handle security findings at scale. In short, your work will sit at the intersection of Product Security, Vulnerability Operations, and internal AI Tooling. Ideally, you have experience in conducting academic/vulnerability research with a focus on systems security. Responsibilities Autonomously Drive AI Security Innovation: Proactively identify gaps in our current capabilities and independently architect, build, and deploy AI-driven solutions to automate code analysis, optimize triage, and scale Product Security workflows. Security Architecture & Threat Modeling: Lead deep-dive security reviews and complex threat modeling sessions across distributed systems, embedding strict security requirements into product designs before development begins. Product-Focused Vulnerability Management: Own the lifecycle of product security findings. Ensure vulnerabilities are accurately triaged, mapped to the correct engineering owner, and mitigated in alignment with established SLAs. Bug Bounty Leadership: Oversee the technical triage and validation of Cloudflare’s external Bug Bounty program, prioritizing submissions based on real-world exploitability and business risk. Pentest Strategy & Support: Shape the scope of internal and external penetration testing engagements, serving as the technical liaison to ensure findings are deeply understood and remediated by development teams. Strategic Influence & Mentorship: Act as a force-multiplier for security across Cloudflare; mentor junior engineers, cultivate security champions within engineering organizations, and establish modern, paved-road developer guardrails. Desirable Skills, Knowledge, and Experience: Senior-Level Product/AppSec Expertise: Extensive, battle-tested experience in Product or Application Security within large-scale distributed cloud environments or SaaS platforms. Practical AI & Automation Engineering: Demonstrated ability to build production-grade automation scripts and tools . Must possess hands-on engineering experience leveraging AI/LLMs to solve operational or technical challenges. Advanced Threat Modeling & Risk Analysis: Mastery of threat modeling methodologies (e.g., STRIDE) and an analytical mindset capable of translating complex theoretical risks into prioritized, actionable business context. Vulnerability Lifecycle Ownership: Proven track record of managing, routing, and driving the remediation of vulnerabilities across multi-stakeholder engineering organizations while strictly enforcing SLAs. High Influence & Communication: Superb cross-functional leadership skills; the ability to confidently influence senior engineering leaders, resolve ownership ambiguity, and champion security initiatives without explicit authority. Bonus points: Offensive Mastery: Familiarity with offensive security tooling and modern exploitation techniques used during professional penetration testing. Program Management Experience: Experience scaling crowdsourced security programs (e.g., HackerOne, Bugcrowd) or optimizing agile project management workflows within JIRA. Experience in integrating hardware security features into production code bases Equity This role is eligible to participate in Cloudflare’s equity plan. Benefits Cloudflare offers a complete package of benefits and programs to support you and your family.  Our benefits programs can help you pay health care expenses, support caregiving, build capital for the future and make life a little easier and fun!  The below is a description of our benefits for employees in the United States, and benefits may vary for employees based outside the U.S. Health & Welfare Benefits Medical/Rx Insurance Dental Insurance Vision Insurance Flexible Spending Accounts Commuter Spending Accounts Fertility & Family Forming Benefits On-demand mental health support and Employee Assistance Program Global Travel Medical Insurance Financial Benefits Short and Long Term Disability Insurance Life & Accident Insurance 401(k) Retirement Savings Plan Employee Stock Participation Plan Time Off Flexible paid time off covering vacation and sick leave Leave programs, including parental, pregnancy health, medical, and bereavement leave What Makes Cloudflare Special? We’re not just a highly ambitious, large-scale technology company. We’re a highly ambitious, large-scale technology company with a soul. Fundamental to our mission to help build a better Internet is protecting the free and open Internet. Project Galileo : Since 2014, we've equipped more than 2,400 journalism and civil society organizations in 111 countries with powerful tools to defend themselves against attacks that would otherwise censor their work, technology already used by Cloudflare’s enterprise customers--at no cost. Athenian Project : In 2017, we created the Athenian Project to ensure that state and local governments have the highest level of protection and reliability for free, so that their constituents have access to election information and voter registration. Since the project, we've provided services to more than 425 local government election websites in 33 states. 1.1.1.1 : We released 1.1.1.1 to help fix the foundation of the Internet by building a faster, more secure and privacy-centric public DNS resolver. This is available publicly for everyone to use - it is the first consumer-focused service Cloudflare has ever released. Here’s the deal - we don’t store client IP addresses never, ever. We will continue to abide by our privacy commitment and ensure that no user data is sold to advertisers or used to target consumers. Sound like something you’d like to be a part of? We’d love to hear from you! Please note that applicants who progress to the offer stage of the interview process may be asked to attend an in-person interview within one of the Cloudflare Offices or Cloudflare Hubs.  More details about this will be available at that stage of the interview process. This position may require access to information protected under U.S. export control laws, including the U.S. Export Administration Regulations. Please note that any offer of employment may be conditioned on your authorization to receive software or technology controlled under these U.S. export laws without sponsorship for an export license. Cloudflare is proud to be an equal opportunity employer.  We are committed to providing equal employment opportunity for all people and place great value in both diversity and inclusiveness.  All qualified applicants will be considered for employment without regard to their, or any other person's, perceived or actual race, color, religion, sex, gender, gender identity, gender expression, sexual orientation, national origin, ancestry, citizenship, age, physical or mental disability, medical condition, family care status, or any other basis protected by law. We are an AA/Veterans/Disabled Employer. Cloudflare provides reasonable accommodations to qualified individuals with disabilities.  Please tell us if you require a reasonable accommodation to apply for a job. Examples of reasonable accommodations include, but are not limited to, changing the application process, providing documents in an alternate format, using a sign language interpreter, or using specialized equipment.  If you require a reasonable accommodation to apply for a job, please contact us via e-mail at hr@cloudflare.com or via mail at 101 Townsend St. San Francisco, CA 94107.

Location: Serbia Who we are: Action1 is an autonomous endpoint management platform trusted by many Fortune 500 companies. Cloud-native, infinitely scalable, highly secure, and configurable in minutes, it just works—and is always free for the first 200 endpoints, with no functional limitations. By pioneering autonomous OS and third-party patching, peer-to-peer patch distribution, and real-time vulnerability assessment without requiring a VPN, Action1 eliminates routine IT labor, helps prevent ransomware and other security risks, and protects the digital employee experience. In 2025, Action1 was recognized by the Inc. 5000 as the fastest-growing private software company in America. Action1 is founder-led by Alex Vovk and Mike Walters, entrepreneurs who previously founded Netwrix, a multibillion-dollar cybersecurity company. The Role We are looking for a Product Security Engineer to join the team responsible for securing Action1’s multi-tenant SaaS platform. In this role, you will work closely with engineering, product, and security teams to identify risks early, support vulnerability handling, strengthen secure development practices, and make product security practical, clear, and actionable. This is a hands-on role for someone who understands both software engineering and cybersecurity, enjoys working directly with developers, and wants to build security into the product without slowing teams down unnecessarily. What you'll do: Support Product Security Incident Response Team (PSIRT) and vulnerability-handling activities Validate, triage, track, and coordinate security reports Provide practical remediation guidance to engineering teams Help validate security fixes and reduce product security risks Review code, APIs, and system architecture to identify security issues early Conduct threat modeling and security design reviews Improve security automation within engineering workflows Support SAST, SCA, secrets scanning, and other security controls Maintain software bills of materials (SBOMs), dependency visibility, and remediation follow-up Support security assessments, vulnerability assessments, and penetration testing Maintain vulnerability-handling playbooks, product security procedures, and incident response runbooks Requirements What we are looking for: 3+ years of experience in product security, application security, DevSecOps, or a related cybersecurity field Strong software engineering background and the ability to work effectively with engineering teams Understanding of application, API, infrastructure, and software supply chain security risks Experience applying cloud security concepts and practices Understanding of identity and access management, network security, logging, monitoring, and secure cloud architecture patterns Familiarity with vulnerability management, incident response, security assessments, and secure software development lifecycle practices Experience with threat modeling and security design reviews Strong communication skills, including professional communication with external security researchers and vendors Ability to work independently and collaboratively in a fast-moving environment Nice to have: Genuine interest in cybersecurity and motivation to grow as a product security expert Hands-on experience with AWS security controls, best practices, and architecture patterns Hands-on experience with C++ or JavaScript Experience with security testing and automation using scripts, APIs, CI/CD pipelines, or specialized tools Experience conducting threat modeling for SaaS, API, cloud, or on-premises product components Experience with SBOM generation, dependency visibility, or software supply chain security Benefits What we offer: A fully remote work environment The opportunity to work on a real-world security product used by IT and security teams High ownership and a direct impact on product security practices Close collaboration with engineering, product, and security teams A fast-growing software company with low bureaucracy and practical decision-making The opportunity to improve security processes, automation, and engineering workflows A supportive team that values clear thinking, ownership, and continuous learning

Location: Remote - U.S. About Airship Airship is trusted by world’s leading brands such as Alaska Airlines, BBC and The Home Depot to drive revenue growth and customer loyalty with exceptional cross-channel customer experiences. Today, brands are challenged to deliver seamless, unified customer experiences across a fragmented array of channels and devices— apps, websites, email, SMS, wallets and more. Airship’s no-code, AI-powered platform was designed with non-technical, growth-focused teams in mind, making it easy to create, test and orchestrate hyper-personalized experiences across all channels. With the ability to easily enrich customer data and rapidly launch growth experiments, Airship enables brands to deliver consistent, meaningful interactions that accelerate conversion and foster deeper customer relationships. We invite you to be part of our journey in building products and delivering services that touch millions of customers around the world every day. To learn more about us, visit www.airship.com , read our blog or follow us on LinkedIn. About the Role Airship is looking for an Information Security Architect to own the design and evolution of our security architecture across cloud infrastructure, applications, and the CI/CD pipeline. You'll be Airship's technical authority on secure-by-design systems, partnering with Engineering, Platform, and Product teams to embed security into every phase of the development lifecycle. This is a hands-on architecture role. You'll conduct threat modeling, perform architecture reviews, define security standards and reference architectures, and drive secure design patterns across Airship's GCP-based environment. You'll also evaluate emerging technologies, including AI and generative AI platforms, to identify security risks and define secure adoption patterns. Why This Role Depth over breadth. You'll focus on what matters most: securing Airship's cloud infrastructure and CI/CD pipelines, conducting threat modeling, and shaping architecture decisions GCP at the core. Airship runs on Google Cloud Platform. You'll work deeply with GCP-native security capabilities, defining guardrails, segmentation patterns, logging standards, and workload protection across the platform Secure the pipeline, secure the product. CI/CD pipeline security is a primary focus. You'll design and implement controls that protect the software delivery lifecycle from code commit through production deployment AI-forward security. You'll evaluate and secure AI and GenAI platforms, define usage patterns for AI-assisted development tools, and help establish security architecture for Airship's AI-enabled features Fully remote, flexible culture. Airship's Digital First approach means flexible, remote work is the norm, with a team that collaborates across timezones and geographies every day Room to grow. This role is a path toward senior security architecture, security leadership, or deeper cloud security specialization What You'll Do* Design, develop, and maintain Airship's security architecture, including reference architectures, secure design patterns, and technical security standards Perform security architecture reviews for enterprise applications, cloud platforms, infrastructure services, and technology integrations, ensuring alignment with security standards and risk posture Conduct threat modeling and technical risk assessments to identify security gaps and recommend mitigation strategies Define and implement cloud security guardrails, network segmentation patterns, logging standards, and access control models across Airship's GCP environment Partner with Engineering and DevOps teams to integrate security controls into the CI/CD pipeline, including secure build processes, container security, Infrastructure-as-Code (IaC) security, secrets management, and software supply chain integrity Evaluate proposed architecture and design changes from engineering teams, analyze their security impact, and make recommendations Assess emerging technologies (including AI platforms, generative AI tools, and AI-assisted development technologies) to identify security risks and define secure usage patterns Develop security guidance for API security, application authentication (SAML, OAuth2), encryption, and identity and access management Research security trends, emerging attack methods, and new classes of vulnerabilities to proactively reduce the risk of breach Leverage AI-enabled tools and automation to improve security analysis, architecture review workflows, and threat detection Partner with security tooling teams to evaluate enterprise security tools for architectural fit, integration models, and long-term scalability Participate in the Security on-call rotation and respond to incidents Provide technical security guidance for complex customer inquiries that require deep architectural expertise Mentor colleagues across the organization on secure design principles and security best practices *Duties described are not a comprehensive list. Additional tasks may be assigned from time to time, and responsibilities may be amended at any time at the sole discretion of the Employer. What We're Looking For 8+ years of experience in information security, security architecture, cloud security engineering, or a related technical discipline Deep expertise in Google Cloud Platform (GCP) security, including native security capabilities, cloud architecture patterns, and workload protection Hands-on experience securing CI/CD pipelines, including container security, IaC security, secrets management, and DevSecOps practices Experience conducting threat modeling for complex, distributed systems using standard methodologies Experience performing security architecture and design reviews for cloud-native applications and infrastructure Proficiency in at least one scripting language (e.g., Python, Java, Bash/shell) Working knowledge of network security concepts, including segmentation, Zero Trust principles, firewalls, and access control models Working knowledge of identity and access management concepts, including SSO, MFA, federation, and least-privilege access Strong understanding of application security, including OWASP, API security, secure SDLC practices, and authentication protocols (SAML, OAuth2) Working knowledge of how to protect and administer macOS, Linux, and Windows systems Ability to translate security requirements into practical, scalable technical solutions Strong written and verbal communication skills, with a talent for explaining complex security concepts to both technical and non-technical audiences Experience experimenting with AI tools in your personal or professional life We'd Be Delighted If You Also Have One or more industry certifications (e.g., CISSP, CCSP, Google Cloud Professional Security Engineer, OSCP, GIAC certifications) Experience with enterprise security technologies such as Splunk, CrowdStrike, Rapid7, Vanta, Okta, and DLP solutions Familiarity with AI security concepts, secure AI platform adoption, and AI risk frameworks (e.g., NIST AI RMF, ISO 42001) Experience developing security reference architectures, design patterns, and technical standards documentation Experience with Kubernetes security, container orchestration, and cloud-native security tooling (CSPM, CWPP) Knowledge of data security practices including encryption, data classification, DLP, and key management Experience evaluating third-party technologies and conducting technical security assessments for vendor platforms Work Location & Travel Requirements Airship’s ‘Digital First’ approach to work means that for the majority of our roles, work can be performed remotely, either some or most of the time. Airship believes that flexible work contributes to a more productive and more equitable work environment, and that Airshippers are able to collaborate, innovate, and support one another across different locations and timezones. Some roles may require that employees perform their work from a specific location to support business activities, and/or be within proximity to an Airship office location or customer or partner locations, while other roles can be performed 100% remotely. This position is fully remote and may require up to 10% travel based on business needs or as requested by your manager. Compensation Starting Pay Range: $130,000-$160,000 USD per year This is a good faith estimate of the base compensation we reasonably expect to pay for this position upon hire. Actual starting pay may vary based on factors such as relevant skills, work experience, market demands, and location. All offers include stock options so employees have the opportunity to benefit from Airship’s success. Benefits & Perks Competitive medical, dental, and vision insurance options for you and your dependents Flexible time off, company paid holidays, paid parental leave, and paid volunteer time off Support for your overall wellbeing with mental health and wellness resources Employer-subsidized life insurance as well as short-term and long-term disability A digital-first work environment and a monthly stipend to support remote work Mentorship and growth opportunities to build skills and accelerate professional development And more! We use artificial intelligence tools in our recruitment process as decision-support tools only. Airship's People Operations team reviews all AI-generated scores and recommendations before making any hiring determination. No applicant is rejected solely on the basis of an AI-generated output. Depending on your location, you may have the right to request human review of any AI-assisted employment decision or to opt out of AI evaluation. To make a request or learn more about how we use AI in hiring, contact privacy@airship.com or visit airship.com/legal . California residents can view the CCPA disclosure notice here . ** Please Note: To ensure the security of your personal information, Airship will only contact candidates through email addresses ending with “@airship.com”. Hiring Commitment Airship is committed to fostering a diverse work environment and providing equal employment opportunities to all applicants and employees. We welcome your application and our hiring and employment decisions are made irrespective of race, religion, color, national origin, gender, gender expression, sexual orientation, age, marital status, veteran status, disability status or any other characteristic protected by law. In alignment with our commitment to equal opportunity, Airship will consider for employment all qualified applicants, including those with criminal histories, in a way that adheres to the principles of fairness and the requirements of local Fair Chance laws, where applicable. By submitting this application, I affirm that the facts set forth in it are true and complete to the best of my knowledge. I understand that if I am employed, false statements, omissions, or misleading information given in my application, interview(s), or in a background check may result in dismissal.

Location: Remote; Serbia; Poland Workplace: Remote We are looking for a Senior Penetration Tester to strengthen the security of high-load products by identifying vulnerabilities across applications, infrastructure, cloud environments, and payment flows. In this role, you will work closely with engineering, product, fraud, and compliance teams to improve security posture through offensive security assessments and practical remediation. Responsibilities: - Plan and execute penetration testing activities across web applications, APIs, mobile applications, internal and external infrastructure, and AWS cloud environments - Perform offensive security exercises, including red team and assumed-breach scenarios covering privilege escalation, lateral movement, persistence, and data exfiltration - Assess the security of cloud-native services, Kubernetes environments, microservices, and CI/CD pipelines - Identify vulnerabilities affecting payment systems, wallets, KYC/AML processes, bonus mechanisms, affiliate tracking, and other business-critical workflows - Work with Product, Engineering, AppSec, Payments, and Fraud teams to prioritize findings and support remediation efforts - Develop custom scripts and internal tools to improve testing capabilities where standard solutions are insufficient - Contribute to threat modeling activities and support secure-by-design initiatives - Review penetration testing plans, reports, and provide technical guidance to junior and middle security specialists - Research emerging vulnerabilities, MITRE ATT&CK techniques, security advisories, and translate them into actionable improvements - Support security assessments for new products, releases, and market launches, including effort estimation and pre-certification activities - Act as a security advisor for technical and business stakeholders on offensive security matters Requirements: - 4+ years of hands-on experience in penetration testing or offensive security - Proven practical experience in at least three of the following areas: - Web applications / APIs - Internal networks - External infrastructure - Cloud environments (AWS/GCP) - Mobile applications (iOS/Android) - OSCP or an equivalent offensive security certification - Strong knowledge of SAST, SCA, DAST, AWS/GCP, MITRE ATT&CK, OWASP ASVS, OWASP WSTG, and PTES - Good understanding of application architecture, including MVC and data flow principles - Knowledge of supply chain attack techniques - Experience writing scripts in Python and Bash - Understanding of IAM models within at least one major cloud provider - Hands-on experience testing Kubernetes-based environments, cloud-native applications, CI/CD pipelines (GitLab, GitHub Actions, Jenkins) and Infrastructure as Code solutions (Terraform, Helm, CloudFormation) - Strong reporting, documentation, and communication skills - Ability to balance security priorities with business and release deadlines - Solid understanding of security frameworks and compliance standards, including PCI DSS, ISO 27001, NIST, and GDPR - At least Upper-Intermediate level of English Would be a plus: - Advanced offensive security certifications such as OSWE, OSEP, OSED, CRTO, BSCP, ARTE, or GRTE - Experience designing secure architectures for Kubernetes and AWS environments - Previous background in iGaming, fintech, or payment products - Public security research, CVEs, advisories, technical publications, or conference presentations - Completion of HTB Pro Labs or strong CTF achievements - Contributions to open-source offensive or defensive security projects What's in it for you: - Fully remote working format - Competitive salary based on experience - Paid annual leave and sick leave - Opportunities for professional and career growth - Supportive environment focused on continuous development and long-term growth