Location: Москва
Наша команда в тесном взаимодействии с другими производственными командами обеспечивает информационную безопасность компании Сбербанк Технологии.
Обязанности
### Чем предстоит заниматься:
* формирование и развитие целевой архитектуры ИБ, сопровождение ИТ-инициатив с учетом требований безопасности
* формирование требований безопасности к разрабатываемым системам: участие в проектировании, анализ угроз, моделирование угроз, внедрение практик Secure SDLC
* анализ архитектурных изменений и оценка рисков новых решений в части ИБ
* участие в пересмотре и обновлении архитектурной и методологической документации
* внедрение новых практик информационной безопасности: оценка применимости, адаптирование под существующие процессы.
* проработка, пилотирование и внедрение средств защиты информации (СЗИ): оценка новых решений, проведение тестирований, подготовка рекомендаций по внедрению.
* развитие и оптимизация практик контейнерной безопасности: определение политик безопасности Kubernetes, контроль выполнения требований контейнерной безопасности
* разработка и контроль стандартов безопасной конфигурации инфраструктуры (hardening, baseline)
* проведение технических аудитов, выявление и устранение уязвимостей и ошибок конфигурации
* консультирование команд и участие в планировании ИТ-инициатив с точки зрения безопасности.
Требования
### Мы ожидаем:
* опыт работы в ИБ от 3 лет, включая функции архитектора безопасности
* понимание архитектуры систем и способность как проектировать решения, так и реализовывать их руками
* понимание практик AppSec: secure coding, threat modeling, OWASP Top 10.
* опыт внедрения и эксплуатации средств защиты информации
* знание стандартов и best practices: OWASP, NIST, CIS, ГОСТ и др.
* навыки анализа рисков, проектирования архитектурных решений и подготовки документации
* умение планировать работу, расставлять приоритеты и эффективно взаимодействовать с командами
* инструментальное владение AI для анализа, генерации и автоматизации.
**Будет плюсом:**
* опыт пилотирования и выбора новых ИБ-инструментов
* опыт работы в DevOps, DevSecOps. Опыт взаимодействия с командами разработки и DevOps
* опыт работы с контейнерными платформами (Docker, Kubernetes) и инструментами их защиты (например, runtime security, image scanning, policy engines)
* понимание практик настройки безопасности Kubernetes (RBAC, PSP/OPA/Gatekeeper, Network Policies).
Условия
### **Мы предлагаем:**
* годовой бонус и ежегодный пересмотр зарплаты
* расширенный ДМС с первого дня, страхование жизни, корпоративная пенсионная программа
* статус аккредитованной ИТ-компании со всеми преимуществами
* льготная ипотека для сотрудников, подписка Прайм с возможностью шеринга (совместного использования) на трёх близких, скидки от партнеров и сервисов группы компаний
* корпоративный университет Сбера, внутренняя образовательная платформа, участие в IT-конференциях
* офис с видом на набережную, зонами отдыха и спортзалом
* 90 дней удаленной работы из любого региона РФ
* реферальная программа (бонус до 100 000 рублей).
Разработка автоматизированных сценариев и инструментов, облегчающих тестирование и анализ эффективности антивируса. Ручной и автоматизированный поиск дефектов в разрабатываемом ПО, разработка PoC-эксплойтов.
Разрабатывать кластеризованный on-premise build ClickHouse для собственной cloud-инфраструктуры. Внедрять, масштабировать и поддерживать ClickHouse-кластеры в production.
Задачи:
— Участие в Agile-командах и проектных группах в качестве эксперта по защите информации
— Формирование и обоснование требований информационной безопасности к ИТ-системам
— Поиск наилучших решений, отвечающих требованиям безопасности и подходящих под Time2Market
— Техническая проработка и согласование решения по защите информации в ИТ-системах
— Помощь в расследовании инцидентов информационной безопасности
— Участие в построении процессов ИБ при внедрении ИТ-систем
Требования:
— Высшее профильное образование (техническое или ИБ)
— Профильный опыт от года - эксперт ИБ, архитектор ИБ, AppSec, devsecops
— Знание одного или нескольких языков программирования
— Понимание принципов работы DLP, WAF, IDS, IPS, FW, SIEM, VPN, proxy, сканеры уязвимостей, системы антивирусной защиты
— Понимание основных механизмов защиты операционных систем, систем управления базами данных, веб-серверов, типовых сетевых протоколов
— Знание типовых уязвимостей операционных систем и прикладного программного обеспечения, понимание способов их эксплуатации
— Фундаментальные знания IT-составляющей информационных систем: администрирование серверов (Windows, Linux), понимание работы сети на базе TCP/IP, основных сетевых и прикладных протоколов
— Знание основных стандартов и лучших практик в области защиты информации (OWASP, PCI DSS, CIS, NIST, ISO, ГОСТ, РД ФСТЭК, Законодательство РФ)
Условия:
— График работы: 5/2, 09:00 - 18:00, пятница до 16:45
— Гибридный формат работы (50/50) после испытательного срока
— Трудоустройство по ТК РФ
— Годовой бонус по результатам работы (до 20% от годовой зарплаты за отработанное время)
— Социальный пакет
As a Strategic Solution Architect, Presales in JFrog you will... Engage with JFrog’s most strategic customers to ensure their success in their DevSecOps journey leveraging JFrog’s products.
Private family office, Cyprus, is looking for an independent senior security reviewer to assess finished technical work before it goes live. ✔️Requirements: senior hands-on experience in cloud security / AppSec / DevSecOps, proven independent reviews (case examples), clear reporting for non-technical readers.
Location: Warsaw, Mazowieckie, Poland; Sofia City, Bulgaria; Limassol, Cyprus
Workplace: hybrid
Capital.com builds and operates web and mobile trading platforms, public and partner APIs, and the backend services behind them, all in a highly regulated environment. As Application Security Architect, you will be the senior design authority for the security of these products. You will set the direction for how we secure software at scale: you will own secure-by-design patterns and standards, lead threat modelling and architecture reviews, and define the application security baseline that engineering teams build against.
Working closely with the Product Security team and the Director of Product Security, you will guide AppSec processes and set the vision for your area without direct line management. You will treat security as a shared outcome rather than a gate, balancing strong protection with developer experience and delivery speed, and you will earn adoption through enablement rather than mandates.
Responsibilities:
Security Architecture & Standards:
Define and maintain secure-by-default reference architectures for common patterns: web apps, mobile backends, microservices, public and partner APIs, and event-driven services
Own core application security architecture decisions: authentication and authorisation, session management, API security, secrets management, multi-tenant isolation, and security logging and auditing
Lead the redesign of user authentication and the delivery of security features into the product
Develop and roll out application security standards, secure-coding guidelines, configuration standards, reusable design patterns, and architecture decision records (ADRs) that engineers can apply without a security expert in the room
Define internal policies for the safe use of AI-assisted and vibe-coding tools
Define security requirements for acquired technology and guide its secure integration
Threat Modelling & Design Review:
Establish and run a threat-modelling operating model, covering scope, cadence, templates, and facilitation, proportionate to each product's risk tier
Own the security review stage of the new product approval process, covering architecture design and configuration
Lead design reviews for high-impact initiatives: new products, new auth flows, payment and sensitive-data flows, platform migrations, and major refactors
Identify design-level risks and agree practical, prioritised mitigations with engineering teams
Secure SDLC, DevSecOps & Supply Chain:
Assess the current state of application security, propose improvements, and drive the secure SDLC strategy with Engineering and Security leadership
Oversee AppSec processes and own the tooling strategy (SAST, DAST, IAST, SCA, and secrets scanning), including how findings flow back to engineering
Embed security controls as guardrails in CI/CD through policy-as-code, with agreed enforcement and escalation paths
Partner with DevOps to organise repository management and prevent supply-chain attacks, covering safe component usage, dependency management, SBOMs, and build integrity
Improve the security of our internal tools
Requirements:
Experience:
8+ years in technology, including 5+ years in a dedicated application or product security role, with a strong engineering background and hands-on architecture or design ownership
Proven track record creating, documenting, and rolling out security standards, patterns, and best practices across a complex engineering organisation
Deep, demonstrable threat-modelling experience across product portfolios
Technical:
Experience designing and implementing a secure SDLC in a cloud-native environment. Strong AWS knowledge is required, and exposure to GCP or other clouds is welcome
Strong command of OWASP standards (Top 10, ASVS) and DevSecOps practice, including AppSec tooling (SAST, DAST, IAST, SCA, secrets scanning) and vulnerability management
Deep understanding of modern distributed architectures: microservices, REST and GraphQL APIs, event-driven systems, OAuth2/OIDC, and containerised workloads (Docker, Kubernetes). You should be able to reason about their trust boundaries, attack surface, and data flows across web and mobile clients
Collaboration:
Exceptional ability to influence and align engineering teams without direct authority, and to brief both engineers and executives
Pragmatism and strategic thinking: you balance the ideal with the achievable, protect delivery throughput, and turn long-term direction into an actionable plan
Clear written communication through diagrams, ADRs, and patterns, plus a track record of mentoring and cross-functional collaboration
Nice to have:
Experience in fintech, trading, brokerage, or another regulated environment
Awareness of relevant regulatory and compliance drivers: FCA and CySEC operational resilience, GDPR, and PCI DSS
Software supply-chain security, including SBOMs and artifact and build integrity
Experience securing AI-integrated product features, or using AI to scale an AppSec programme
Experience building or running a Security Champions programme
CSSLP, GIAC GDSA, or a hands-on offensive security certification. Certifications are valued but secondary to demonstrated experience
What you'll get in return:
You will join the company, that cares about work and life balance
Annual Bonus based on the performance review cycle
Generous Annual Leave Policy
Medical Insurance and Pension fund, with additional benefit packages based on the location
Hybrid working model (3 days from our modern office and 2 days fully remotely)
Comprehensive Workation Policy with 30 more remote days available.
Possibility of taking two additional days of paid leave per year to dedicate to volunteering efforts.
Ищем QA Intern для тестирования продукта и повышения стабильности платформы SpaceAI — защищённого слоя между ИИ/LLM/AI-агентами и корпоративными системами.
Задачи:
— тестировать web‑интерфейс и API;
— составлять и проходить тест‑кейсы;
— находить, описывать и воспроизводить баги;
— проводить smoke и regression testing;
— работать вместе с разработчиками над качеством релизов.
Требования:
— базовое понимание QA и жизненного цикла разработки;
— понимание HTTP, REST API и client‑server архитектуры;
— желательно знакомство с Postman, DevTools и Git;
— внимательность, самостоятельность и желание быстро расти в QA.
Условия и развитие:
— работа с реальным B2B AI/Security‑продуктом;
— сильная практическая практика на живой платформе;
— возможность вырасти из стажёра в полноценного QA Engineer;
— по задачам: 20% фронт, 80% бэк;
— тестирование интеграций с ИИ‑агентами, упор на негативные кейсы;
— постепенный переход к автоматизации тестирования через ИИ‑подход.
Команда: CEO, CTO, Golang Dev, R&D (математик/ML), AppSec Developer, DevOps, CMO, CPO.
Задачи:
— тестировать web-интерфейс и API;
— составлять и проходить тест-кейсы;
— находить, описывать и воспроизводить баги;
— проводить smoke и regression testing;
— работать вместе с разработчиками над качеством релизов.
Требования:
— базовое понимание QA и жизненного цикла разработки;
— понимание HTTP, REST API и client-server архитектуры;
— желательно знакомство с Postman, DevTools и Git;
— внимательность, самостоятельность и желание быстро расти в QA.
Условия:
— работа с реальным B2B AI/Security-продуктом;
— сильная практика на живой платформе;
— возможность вырасти из стажёра в полноценного QA Engineer;
— удалённая работа, парт-тайм;
— без оплаты, для опыта (пет-проект);
— длительность стажировки по договорённости с кандидатом;
— предоставление документов, закрывающих и рекомендательных писем от ООО.
Дополнительно:
— по задачам: 20% фронт, 80% бэк;
— тестирование интеграций с ИИ агентами, упор на негативные кейсы;
— постепенный переход к автоматизации тестирования через ИИ-подход;
— команда включает CEO, CTO, Golang разработчика, R&D, AppSec Developer, DevOps, CMO, CPO.
Location: Remote
What you’ll be part of
Garner is on a mission to transform the U.S. healthcare system — and we’re the only proven player doing exactly that. We partner with employers to redesign how healthcare works: applying 550+ proprietary clinical metrics across 80+ specialties to a dataset of 320M+ patients to identify the best-performing doctors, then using compelling incentives to steer members to the care that helps them get healthier, faster.
The result is a rare “win win” — better care and lower costs for both members and employers. In just five years, our work has helped over 2.5 million people access higher-quality care and saved $1B in healthcare costs. We recently raised our Series E and have doubled five years running. If you've ever wanted your work to solve a problem that touches every person in this country, this is the opportunity to do exactly that. You'd be joining a team fundamentally reimagining healthcare in the U.S. — and using AI to scale that impact further and faster than anyone else can.
About the role:
We are seeking a Staff Security Engineer to serve as a technical anchor for our security function. This role is critical for leading technical design reviews and ensuring our security posture scales alongside our rapid customer growth. You will be responsible for defining the security standards that protect sensitive healthcare data, ensuring our systems are resilient against evolving threats while maintaining high engineering velocity.
Where you will work:
Garner is headquartered in NYC, but this position is available for individuals who are comfortable with remote work and occasional travel to HQ.
What you will do:
Lead technical security design: Own the technical design and review process for security-critical systems, ensuring all new features meet Garner's high standards for data protection and resilience
Master complex domains: Maintain and apply a mastery of one or more technical security domains (e.g., Cloud Security, AppSec, or Data) to solve the most complex business and technical challenges
Course-correct technical direction: Identify when technical paths are inefficient or insufficient and proactively redirect efforts to capture higher ROI for the firm
Architect automated defenses: Create and implement advanced tools and automation that increase the efficacy of security monitoring and incident response
Translate ambiguity into execution: Take broad, complex security objectives and break them down into well-defined deliverables and architectural requirements for the broader engineering team
Mentor through technical rigor: Raise the bar for the engineering function by providing high-level feedback during code and design reviews, fostering a culture of security-first development
The ideal candidate has:
Exceptional Technical Judgment:
Proven ability to make high-stakes technical decisions that result in positive long-term outcomes for the company's security posture
Strategic Problem-Solving:
Effectively leverages context and data to analyze root causes and prioritize security initiatives that offer the greatest impact on risk reduction
Influential Stakeholder Management:
Builds strong relationships across the organization, conveying complex security risks in a clear and compelling manner to both technical and non-technical partners
Drive for Innovation:
Continuously identifies and implements creative solutions to pay down technical debt and improve the efficiency of our security infrastructure
Reliability Under Pressure:
Handles complex escalations and security incidents with discipline, ensuring rigorous analysis and comprehensive resolution without jumping to conclusions
A desire to be a part of a high-performing, mission-driven team
that operates with intense urgency, a strong sense of individual accountability, and a commitment to authentic feedback
Technologies we use:
Python, Kubernetes, Snowflake, AWS, Terraform, Wiz, Cyberhaven, and more
This is a unique opportunity to join a fast-growing company in a transformative role, helping shape the future of healthcare.
Compensation Transparency:
The target salary range for this position is $258,000 - $310,000. Individual compensation for this role will depend on various factors, including qualifications, skills, and applicable laws. In addition to base compensation, this role is eligible to participate in our equity incentive and competitive benefits plans, including but not limited to: flexible PTO, Medical/Dental/Vision plan options, 401(k), Teladoc Health and more.
Fraud and Security Notice:
Please be aware of recent job scam attempts. Our recruiters use
getgarner.com
and
garnerhealth.com
email domains exclusively. If you have been contacted by someone claiming to be a Garner recruiter or a hiring manager from a different domain about a potential job, please report it to law enforcement
here
and to
candidateprotection@garnerhealth.com
.
Equal Employment Opportunity:
Garner Health is proud to be an Equal Employment Opportunity employer and values diversity in the workplace. We do not discriminate based upon race, religion, color, national origin, sex (including pregnancy, childbirth, reproductive health decisions, or related medical conditions), sexual orientation, gender identity, gender expression, age, status as a protected veteran, status as an individual with a disability, genetic information, political views or activity, or other applicable legally protected characteristics.
Garner Health is committed to providing accommodations for qualified individuals with disabilities in our recruiting process. If you need assistance or an accommodation due to a disability, you may contact us at
talent@garnerhealth.com
.
Location: Salt Lake City, Utah, United States
About the Role
ICapital is looking for a hands-on Application Security practitioner to join a small, high-impact team building a modern AppSec program. This individual will work directly with the Head of AppSec and senior team members, executing secure design, API security, and developer enablement.
Responsibilities
Support threat modeling and design reviews across a broad and growing service portfolio.
Support shift-left security initiatives, security in CI/CD, developer guidance, and SAST and SCA remediation workflows.
Contribute to API security across the organization, assessing API exposure, validating authentication and authorization patterns.
Write Python automation that scales AppSec capacity: triage tooling, finding pipelines, security context enrichment.
Work directly with developers to remediate SAST and SCA findings, reduce false positive noise, and build security habits across engineering.
Qualifications
Hands-on experience across some secure design and threat modeling, API security, offensive security, or SAST/SCA program work
Real understanding of attack patterns and exploitation techniques
Familiar with OWASP Top 10 in practice
API security experience with REST and GraphQL assessment
Able to build and maintain security automation in Python, tooling that scales AppSec capacity
Understanding of web application and API security
Able to operate with autonomy in an environment still building its processes
Relevant certifications, cloud-native environment experience and exposure to AI/LLM security are a plus
Experience as a developer or engineer and fluency in Ruby, Python, and Scala are a plus
Benefits
The base salary range for this role is $100,000 to $130,000. iCapital offers a compensation package which includes salary, equity for all full-time employees, and an annual performance bonus. Employees also receive a comprehensive benefits package that includes an employer matched retirement plan, generously subsidized healthcare with 100% employer paid dental, vision, telemedicine, and virtual mental health counseling, parental leave, and unlimited paid time off (PTO).
We believe the best ideas and innovation happen when we are together. Employees in this role will work in the office Monday-Thursday, with the flexibility to work remotely on Friday.
For additional information on iCapital, please visit
https://www.icapitalnetwork.com/about-us
Twitter: @icapitalnetwork | LinkedIn:
https://www.linkedin.com/company/icapital-network-inc
| Awards Disclaimer:
https://www.icapitalnetwork.com/about-us/recognition/
iCapital is proud to be an Equal Employment Opportunity and Affirmative Action employer. We do not discriminate based upon race, religion, color, national origin, gender, sexual orientation, gender identity, age, status as a protected veteran, status as an individual with a disability, or other applicable legally protected characteristics.
Location: Foster City, CA
Workplace: Hybrid
Replit is the agentic software creation platform that enables anyone to build applications using natural language. With millions of users worldwide, Replit is democratizing software development by removing traditional barriers to application creation.
About the Role
We are looking for an AI Agent Security Architect to function as the primary technical authority for Replit’s autonomous and AI agent security blueprint. In this critical role, you will design, implement, and maintain the runtime defense systems, guardrail frameworks, and sandboxing architectures that govern AI agents executing code, invoking tools, and reasoning across our platform. You will be a key technical contributor—leading high-impact AI security initiatives and bridging the gap between non-deterministic AI behavior and rigorous cybersecurity controls for both engineering and executive leadership.
What You'll Do
- AI Agent Security Strategy & Technical Execution
- AI Agent Security Blueprint: Define the long-term vision and architectural patterns for securing autonomous agent workflows, Model Context Protocol (MCP) integrations, multi-turn reasoning loops, and multi-agent coordination.
- Runtime Guardrails & Policy Enforcement: Architect and deploy dynamic input/output guardrail systems, semantic firewalls, and real-time intent verification filters to prevent goal hijacking, system prompt leaks, and indirect prompt injections.
- Agent Execution & Tool Sandboxing: Partner with Infrastructure and AppSec teams to design secure, short-lived, micro-isolated environments (e.g., microVMs, WebAssembly, container sandboxes) where agents can dynamically execute code, run shell commands, and interact with host operating systems safely.
- Agentic Threat Modeling & Red Teaming: Conduct specialized threat modeling against non-deterministic systems. Lead automated and manual AI red-teaming initiatives to uncover vulnerabilities in RAG context pipelines, vector stores, and tool-calling interfaces.
- Identity, Delegation & Least Privilege: Architect fine-grained permission models and step-up Human-in-the-Loop (HITL) authorization patterns for agents acting on behalf of users—ensuring agents never exceed the delegated privileges of the end user or misuse API keys.
- Context & Memory Boundary Security: Design strict data isolation and poisoning prevention controls for vector databases, retrieval-augmented generation (RAG) pipelines, and long-term conversation memories across multi-tenant workloads.
- Risk Management & Cross-Functional Enablement
- Maintain the AI Security Source of Truth: Define, document, and maintain authoritative secure design patterns and SDKs for engineering teams building internal or customer-facing AI agent capabilities.
- Contribution to Risk Register: Identify, quantify, and document non-deterministic and agentic security risks (e.g., OWASP Top 10 for LLMs & AI Agents, MITRE ATLAS), ensuring they are accurately represented in the Cybersecurity Risk Register.
- Auditability & Observability: Design tamper-evident logging and telemetry standards for agent reasoning chains, tool execution history, and context assembly to support incident response, forensics, and GRC requirements.
- Compliance & Sales Enablement: Partner with GRC to translate complex AI security controls into enterprise-ready audit documentation (e.g., ISO 42001, NIST AI RMF, EU AI Act readiness) and support Sales on complex enterprise security inquiries regarding AI safety.
Required Skills & Experience
- 6+ years of experience in security engineering or security architecture, with at least 2+ years dedicated specifically to AI/ML security, LLM application security, or securing agentic frameworks.
- Deep understanding of agentic architectures and protocols (e.g., Model Context. Protocol (MCP), LangChain, AutoGen, CrewAI, ReAct frameworks, and vector database technologies).
- Hands-on expertise with threat vectors unique to agentic AI: Indirect Prompt
- Injection, Goal Hijacking, Tool Parameter Tampering, Data Poisoning, and Context Contamination.
- Strong background in applying safety standards and risk frameworks such as OWASP Top 10 for LLMs & AI Agents, NIST AI RMF, and MITRE ATLAS.
- Proficiency in Python, Go, or TypeScript/JavaScript with a proven track record of reviewing code and building functional security tooling or guardrails.
- Experience authoring, maintaining, and evangelizing technical security architecture documentation.
- Exceptional ability to communicate complex non-deterministic AI risks to both deep technical engineers and executive stakeholders.
- Proven track record of contributing to an enterprise Cybersecurity Risk Register.
Bonus Qualifications
- Experience designing runtime sandboxing and isolation technologies (e.g., Firecracker, gVisor, Docker, WebAssembly) for dynamic code execution environments.
Full-Time Employee Benefits Include:
💰 Competitive Salary & Equity
💹 401(k) Program with a 4% match (US Only)
⚕️ Health, Dental, Vision and Life Insurance
🩼 Short Term and Long Term Disability
🚼 Paid Parental, Medical, Caregiver Leave
🏝 Flexible Time Off (FTO) + Holidays
🚗 Commuter Benefits (In-Office & US Only)
📱 Monthly Wellness Stipend
🧑💻 Autonomous Work Environment
🖥 In Office Set-Up Reimbursement (In-Office Only)
🚀 Quarterly Team Gatherings
☕ In Office Amenities (In-Office Only)
Want to learn more about what we are up to?
- Self-driving Company https://replit.com/blog/self-driving-company
- Replit Agent at Scale https://replit.com/blog/evaluating-and-improving-agent-at-scale
- AI Adoption https://replit.com/blog/ai-adoption
- Build Open-Source Apps https://replit.com/build/open-source-app-builder
Interviewing + Culture at Replit
- Operating Principles https://blog.replit.com/operating-principles
- Reasons not to work at Replit https://blog.replit.com/reasons-not-to-join-replit
To achieve our mission of making programming more accessible around the world, we need our team to be representative of the world. We welcome your unique perspective and experiences in shaping this product. We encourage people from all kinds of backgrounds to apply, including and especially candidates from underrepresented and non-traditional backgrounds.
Location: Toronto, Ontario, Canada
Workplace: Hybrid
ABOUT SENTRY
Software runs the world and the pace is faster than ever. Sentry helps developers fix errors and performance issues before users notice, so teams can spend less time firefighting and more time building.
Trusted by 200,000+ organizations, Sentry is today’s application monitoring standard and our team is building its AI-native future.
ABOUT THE ROLE
The Security Team is responsible for securing all things Sentry: our customers, our code, and everything in between. We are a small but growing team with broad scope, high trust, and the autonomy to tackle hard security problems with creativity and an engineering mindset. We work at a company with a strong developer culture, building a product that millions of developers genuinely love and rely on. That context shapes everything about how we operate.
We take a pragmatic approach to preventing and responding to security risks. In this role not only will you build and contribute to systems which detect malicious activity, you will have the unique opportunity to implement new controls to prevent future incidents. You will work across detection and response and corporate security domains. You'll contribute to practices that keep Sentry secure as we grow: alert triage for corporate and production, detection engineering, deploying preventative controls, identity and access management, investigations and incident response, and more.
You'll partner with teams across the company to prevent and respond to security incidents. You will work as a technical collaborator who prioritizes preventative controls, defense in depth, and high signal alerting practices. As Sentry expands our agentic product capabilities and development practices, you'll also find yourself at the frontier of a new set of security approaches and challenges.
IN THIS ROLE, YOU WILL
- Maintain, improve, and own detection engineering systems. We own and operate our own detection stack and are building agentic triage with thoughtful security response and orchestration automation.
- Perform investigations, and contribute to security incident response. You will assist and contribute to a breadth of incident types, or Sentry and our customers.
- Contribute to, maintain, and operate identity and access management systems. Access management is a critical component of our security program.
- Have a lot of opportunity to grow and learn across many security domains. We are a highly cross-functional team and you will have opportunities to touch adjacent security projects spanning appsec, infrasec, governance, and privacy.
- Research, identify, and respond to emerging threats relevant to Sentry. We build and operate a complex application and cloud environment, including the novel attack surface introduced by Sentry's agentic product features and AI-assisted engineering practices.
YOU’LL THRIVE IN THIS ROLE IF YOU
- Enjoy operating cross-functionally, building relationships, and influencing with technical expertise as you protect a fast-moving engineering organization.
- Get excited when something new lands on your desk, be it an interesting breach, a sweet exploit, a novel agentic architecture, an unfamiliar cloud primitive, or a bug class you haven't seen before.
- Love working in a developer-forward culture where your colleagues are builders who care deeply about code quality and customer satisfaction.
- Reach for automation first, you'd rather build a scalable, systematic solution to a security problem than make a noisy reactive solution which requires manual triage.
- Thrive with ownership and want more of it, you prefer to drive work end-to-end, and you're energized by the autonomy — and the mentorship — that comes with being on a small, high-trust team.
QUALIFICATIONS
- 2-5 years of industry experience in a detection and response, corporate security, or generalist security engineering role
- Degree in Computer Science or a related field, equivalent training, or professional experience
- Hands-on experience with several of the following: alert triage, detection tuning and writing, detection-as-code, security log ingestion, investigations and security incident response, identity and access management (IAM), phishing response, user access reviews, managing endpoint detection and response tooling
- Experienced and comfortable programing in at least one language (Python preferred) and comfortable using agentic development workflows
- Familiarity with operating distributed cloud technology (AWS, CICD, GCP, Azure, Kubernetes, Docker, Terraform, etc.) and experience with corporate (SSO, SAML, IAM) and defensive security tooling (EDR, SIEM, CNAPP, ZTNA, etc.)
- A collaborative approach to problem solving paired with strong written and verbal communication
Not sure if you meet 100% of the qualifications? We encourage you to apply anyway. We're interested in people are excited about this opportunity and eager to grow.
The base salary range (or hourly wage range, if applicable) that Sentry reasonably expects to pay for this position is $162,000 to $200,000 CAD. A successful candidate’s actual base salary (or hourly wage) amount will be determined by a variety of relevant factors including, without limitation, the candidate’s work location, education, work and other relevant experience, skills, and job-related knowledge. A successful candidate will be eligible to participate in Sentry’s employee benefit plans/programs applicable to the candidate’s position (including incentive compensation, equity grants, paid time off, and group health insurance coverage). See Sentry Benefits https://sentry.io/careers/ for more details about the Company’s benefit plans/programs.
EQUAL OPPORTUNITY AT SENTRY
Sentry is committed to providing equal employment opportunities to its employees and candidates for employment regardless of race, color, ancestry, religion, sex, national origin, sexual orientation, age, citizenship, marital status, disability, gender identity, veteran status, or other legally-protected characteristic. This commitment includes the provision of reasonable accommodations to employees and candidates for employment with physical or mental disabilities who require such accommodations in order to (a) perform the essential functions of their jobs, or (b) seek employment with Sentry. We strive to build a diverse team, with an inclusive culture where every teammate can thrive. Sentry is an open-source company because we believe that everyone, everywhere, should have the ability and tools to make great software. Software should be accessible. That starts with making our industry accessible.
If you need assistance or an accommodation due to a disability, you may contact us at accommodations@sentry.io.
Want to learn more about how Sentry handles applicant data? Get the details in our Applicant Privacy Policy https://sentry.io/careers/applicantprivacy/.
Location: San Francisco, California
Workplace: Hybrid
ABOUT SENTRY
Software runs the world and the pace is faster than ever. Sentry helps developers fix errors and performance issues before users notice, so teams can spend less time firefighting and more time building.
Trusted by 200,000+ organizations, Sentry is today’s application monitoring standard and our team is building its AI-native future.
ABOUT THE ROLE
The Security Team is responsible for securing all things Sentry: our customers, our code, and everything in between. We are a small but growing team with broad scope, high trust, and the autonomy to tackle hard security problems with creativity and an engineering mindset. We work at a company with a strong developer culture, building a product that millions of developers genuinely love and rely on. That context shapes everything about how we operate.
We take a pragmatic approach to preventing and responding to security risks. In this role not only will you build and contribute to systems which detect malicious activity, you will have the unique opportunity to implement new controls to prevent future incidents. You will work across detection and response and corporate security domains. You'll contribute to practices that keep Sentry secure as we grow: alert triage for corporate and production, detection engineering, deploying preventative controls, identity and access management, investigations and incident response, and more.
You'll partner with teams across the company to prevent and respond to security incidents. You will work as a technical collaborator who prioritizes preventative controls, defense in depth, and high signal alerting practices. As Sentry expands our agentic product capabilities and development practices, you'll also find yourself at the frontier of a new set of security approaches and challenges.
IN THIS ROLE, YOU WILL
- Maintain, improve, and own detection engineering systems. We own and operate our own detection stack and are building agentic triage with thoughtful security response and orchestration automation.
- Perform investigations, and contribute to security incident response. You will assist and contribute to a breadth of incident types, or Sentry and our customers.
- Contribute to, maintain, and operate identity and access management systems. Access management is a critical component of our security program.
- Have a lot of opportunity to grow and learn across many security domains. We are a highly cross-functional team and you will have opportunities to touch adjacent security projects spanning appsec, infrasec, governance, and privacy.
- Research, identify, and respond to emerging threats relevant to Sentry. We build and operate a complex application and cloud environment, including the novel attack surface introduced by Sentry's agentic product features and AI-assisted engineering practices.
YOU’LL THRIVE IN THIS ROLE IF YOU
- Enjoy operating cross-functionally, building relationships, and influencing with technical expertise as you protect a fast-moving engineering organization.
- Get excited when something new lands on your desk, be it an interesting breach, a sweet exploit, a novel agentic architecture, an unfamiliar cloud primitive, or a bug class you haven't seen before.
- Love working in a developer-forward culture where your colleagues are builders who care deeply about code quality and customer satisfaction.
- Reach for automation first, you'd rather build a scalable, systematic solution to a security problem than make a noisy reactive solution which requires manual triage.
- Thrive with ownership and want more of it, you prefer to drive work end-to-end, and you're energized by the autonomy — and the mentorship — that comes with being on a small, high-trust team.
QUALIFICATIONS
- 2-5 years of industry experience in a detection and response, corporate security, or generalist security engineering role
- Degree in Computer Science or a related field, equivalent training, or professional experience
- Hands-on experience with several of the following: alert triage, detection tuning and writing, detection-as-code, security log ingestion, investigations and security incident response, identity and access management (IAM), phishing response, user access reviews, managing endpoint detection and response tooling
- Experienced and comfortable programing in at least one language (Python preferred) and comfortable using agentic development workflows
- Familiarity with operating distributed cloud technology (AWS, CICD, GCP, Azure, Kubernetes, Docker, Terraform, etc.) and experience with corporate (SSO, SAML, IAM) and defensive security tooling (EDR, SIEM, CNAPP, ZTNA, etc.)
- A collaborative approach to problem solving paired with strong written and verbal communication
Not sure if you meet 100% of the qualifications? We encourage you to apply anyway. We're interested in people are excited about this opportunity and eager to grow.
The base salary range (or hourly wage range, if applicable) that Sentry reasonably expects to pay for this position is $150,000 to $200,000 USD. A successful candidate’s actual base salary (or hourly wage) amount will be determined by a variety of relevant factors including, without limitation, the candidate’s work location, education, work and other relevant experience, skills, and job-related knowledge. A successful candidate will be eligible to participate in Sentry’s employee benefit plans/programs applicable to the candidate’s position (including incentive compensation, equity grants, paid time off, and group health insurance coverage). See Sentry Benefits https://sentry.io/careers/ for more details about the Company’s benefit plans/programs.
EQUAL OPPORTUNITY AT SENTRY
Sentry is committed to providing equal employment opportunities to its employees and candidates for employment regardless of race, color, ancestry, religion, sex, national origin, sexual orientation, age, citizenship, marital status, disability, gender identity, veteran status, or other legally-protected characteristic. This commitment includes the provision of reasonable accommodations to employees and candidates for employment with physical or mental disabilities who require such accommodations in order to (a) perform the essential functions of their jobs, or (b) seek employment with Sentry. We strive to build a diverse team, with an inclusive culture where every teammate can thrive. Sentry is an open-source company because we believe that everyone, everywhere, should have the ability and tools to make great software. Software should be accessible. That starts with making our industry accessible.
If you need assistance or an accommodation due to a disability, you may contact us at accommodations@sentry.io.
Want to learn more about how Sentry handles applicant data? Get the details in our Applicant Privacy Policy https://sentry.io/careers/applicantprivacy/.
About Scorewarrior
Scorewarrior is an independent game studio with a single mission: to excite and unite players all over the world. For over 10 years they've been pursuing it through Total Battle — a product they continue to actively and successfully grow. The team consists of 230 self-motivated professionals who know and love their craft, and the company has recently begun an active company-wide adoption of AI tools. Their home is a great office in Limassol, Cyprus. They offer a strong relocation package for you and your family, and put real effort into making life on the island genuinely varied and interesting.
Location & format:
Onsite — Limassol, Cyprus. Full relocation support provided.
The mission of this role:
This is a hands-on engineering role: you design and implement solutions yourself, working side by side with Infrastructure, DevOps, and development teams. Leadership experience is not required here and not expected.
Key objectives:
— Strengthen cloud and infrastructure security in practice: secrets management, audit logging and controlled production access.
— Close high-impact risks: start from an honest assessment of the current state and build a consistent picture of gaps and risks as you go.
— Work secure-by-default: wherever possible, remove the security burden from teams through automation and platform-level solutions rather than rules and manual procedures.
— Roll up your sleeves: dive into what Infrastructure, DevOps, and development teams are building right now, understand it from the inside, and make security part of it.
Job requirements:
— Real experience building platform and infrastructure security — you have designed and implemented security solutions yourself: not audited or monitored them, and you can walk us through the architecture, the decisions, and what you'd do differently.
— Cloud security as your core strength: Recent hands-on experience securing cloud environments.
— A strong infrastructure background. You may have grown entirely within security engineering or moved into security from DevOps, SRE, system administration, or network engineering. What matters is that your thinking is an engineer's thinking: architecture first, building over prescribing.
— The ability to explain risks with facts. You have real cases where you make technical teams see why a risk matters and why a change is needed through evidence, architecture, and concrete scenarios.
— AppSec, SIEM, and SOC experience are useful but secondary.
Nice to have:
— Infrastructure-as-Code in practice.
— Container and Kubernetes security experience.
— Scripting and automation as a habit: Python, Go, or Bash — you'd rather automate a control than write a procedure for humans to follow.
— GCP specifically. Their stack is GCP; deep experience with it will shorten your path to impact, though strong AWS/Azure experience translates well.
— Experience with securing AI tool usage.
Who this role is NOT for:
— Your current focus is on monitoring, alert triage and incident analysis.
— Your specialization is threat research, malware analysis, cryptography, or lab-style cybersecurity.
— Your recent work is mostly paper security: policies, compliance documents, and audits.
— You are looking for a management track or ownership of a security function right now — strategy and team building belong to the security leadership role they're hiring separately.
Why join Scorewarrior?
— 99% employee satisfaction, low turnover, and colleagues who genuinely enjoy collaborating.
— Live and work in sunny Cyprus with full relocation and visa support for you and your family.
— Shape a global hit: the only European studio with a 4X strategy title in the world’s top-10.
— Grow fast in a company that’s already strong, independent, financially rock-solid, and expanding at startup speed, with no layoffs.
— Flat structure, collective decision-making, and honest feedback create full transparency and help you grow fast.
— High salaries, a 13th month, performance bonuses, and extra rewards for long service, marriage, or welcoming a child, and lunch every day.
— Private family health insurance, plus a monthly allowance for children’s pre-school, school, and university education.
— Specialized training and certifications, language courses and books to support your growth.
Location: Lisbon, Portugal
About the role:
We are looking for a technically strong Senior Application Security practitioner ready to take on real ownership. You will work directly with the Head of AppSec, contributing to the Secure Design practice and helping drive shift-left security across the organization.
What You'll Do
Help build and mature the Secure Design and Threat Modeling program by defining methodology, review standards, and sign-off criteria across the organization
Drive shift-left security initiatives, embedding security earlier in the development lifecycle through design reviews, developer enablement, and security gating in CI/CD
Own API security as a discipline
Support offensive security initiatives
Build and maintain security automation in Python, tooling that scales AppSec capacity
Work directly with developers on SAST and SCA remediation, scan optimization, and reducing friction in the security feedback loop
Contribute to AI-assisted security pipelines; define escalation paths, SLAs, and accountability structures for vulnerability management
What We're Looking For
Hands-on experience across secure design, threat modeling, API security, and offensive security
Offensive security capability with penetration testing experience and solid understanding of real-world attack and API exploitation patterns
Deep familiarity with OWASP Top 10 in practice
API security depth, experience assessing REST and GraphQL APIs
Python proficiency, comfortable building automation tools that others will depend on
Experience in shift-left programs: security in CI/CD, developer enablement, design review processes
Understanding of web application and API security
Comfortable reading code across languages and engaging with engineering teams at technical depth
Familiarity with cloud-native environments and attack surface management
Demonstrated ability to influence across engineering and product and operate at architecture level
Relevant certifications are a plus: OSCP, OSWE, GWEB, CSSLP, CISSP, CEH
Exposure to AI-assisted security tooling or LLM security is a differentiator
Experience as a developer and fluency in Ruby, Python, and Scala are a plus
We believe the best ideas and innovation happen when we are together. Employees in this role will work in the office four days, with the flexibility to work remotely one day (Friday).
Benefits
iCapital offers a comprehensive benefits package that includes a total compensation program consisting of competitive salary, annual performance bonus, and equity for all full-time employees; healthcare with 100% employer-paid health and dental insurance; and generous paid time off (PTO).
For additional information on iCapital Network, please visit
https://www.icapitalnetwork.com/about-us
Twitter: @icapitalnetwork | LinkedIn:
https://www.linkedin.com/company/icapital-network-inc
ГибридWarsaw, Mazowieckie, Poland; Sofia City, Bulgaria; Limassol, Cyprus
УдалённоГеография найма не уточнена
Salt Lake City, Utah, United States
ГибридСША; 💹 401(k) Program with a 4% match (US Only); 🚗 Commuter Benefits (In-Office & US Only); We encourage people from all kinds of backgrounds to apply, including and especially candidates from underrepresented and non-traditional backgrounds
