Вакансии

Location: Remote (US) About Ondo Ondo Finance is building institutional-grade financial infrastructure for tokenized real-world assets. We operate at the intersection of traditional finance and on-chain systems, which means our product surface has to hold up against both the ordinary threats that hit any high-value fintech and the specific ones that follow value on-chain. About the Role We are hiring a Senior Security Engineer - Product Security to own how we ship secure products at Ondo. You will be a security partner for our product engineering teams, driving threat modeling, owning secure code reviews for new products or feature expansions, maintaining and tuning AppSec tooling, and improving the existing SSDLC. You can expect to take ownership of the bug bounty program, new feature to existing product reviews, and similar broad ownership of critical functions paired to a dedicated ProdSec lead. An AI-native approach is welcome, paired with AI-driven approaches should expect to be justified by describing how doing so enables risk outcomes. This is a hands-on IC role. You will read code, run threat models, review architecture proposals, own tooling, and push engineering teams to build products that are secure by default. You partner closely with adjacent security function like AppSec, Infrasec, and SecOps. What You’ll Do Drive threat modeling for new features, integrations, and architectural changes across the product surface. Push threat models past templates into decisions that engineering teams actually implement. Own secure code review for high-risk changes — authentication, session management, cryptographic paths, wallet and signing flows, RPC and third-party integrations, permission and consent surfaces. Expand the AppSec tooling stack and treat “reducing false positives” as a first-class deliverable. AI-native integrations are welcome. Design and evolve our secure SDLC: where security fits in the dev workflow, what triggers a review, what a lightweight security sign-off looks like versus a full one, and how do we validate controls. Run our responsible disclosure and bug bounty program. Set scope, triage inbound reports, decide payouts, and drive findings to closure with engineering. Support and own appropriate scope for the intake and closure of findings from external audits and pentests — coordinate with audit vendors (Coinspect, Cantina, NCC Group, and others), organize findings into our internal risk register, and drive remediation with engineering owners. Partner with engineering leads to align o secure-by-default patterns - libraries, templates, sensible defaults, and paved-road implementations of anything security-relevant. Threat model blockchain-integrated components like wallet flows, RPC integrations, signing infrastructure, on-chain admin actions triggered from off-chain systems in partnership with engineers who own the on-chain code. Contribute to hiring, mentoring, and pushing the technical bar on the Security team. What We’re Looking For 5+ years in Product Security or Application Security, including senior IC time at a fast-moving product company. Deep secure code review skills in at least one modern stack (TypeScript / JavaScript, Python, or Go). Ability to move across stacks at the level required to threat model. Strong threat modeling skills, appropriate to experience - you can drive a real threat model with an engineering team, not just fill in a template. In practice, we look for core understanding of industry-relevant TTPs and IoCs and strong intuitions on how to apply those lessons learned to our products. Practical experience owning or majorly contributing to an AppSec tooling program. You have shipped rules, tuned noise, and measured impact. Comfortable running or building a bug bounty / responsible disclosure program end-to-end assuming properly resourced to do so. Strong working knowledge of modern web and API security - session and auth flows, OAuth and OIDC, browser security model, common web/API vulnerability classes, and their less-common variants. Comfortable reading Terraform, cloud IAM policies, and CI/CD configuration well enough to reason about how a product vulnerability crosses into an infra risk. Strong engineering partnership skills - you engage constructively, understand the “why” before proposing risk controls, you know when to accept risk, and you write things down. Willing to grow into blockchain-adjacent product security on the job, including the specific attack surface introduced by wallet, signing, and on-chain-integration code. Blockchain Exposure Note This role firmly lives in Web2 prodsec. But, it also requires someone who understands what “Web2 vs Web3” terminology means. In other words, how our products interact with blockchains creates unique threat models that all product security teammates must grasp. At a minimum, by Day 1 you should have strong intuitions about how blockchains will make your prodsec experience unique, you should grasp the common terminologies, and you should be able to discuss with colleagues several incident post-mortems that demonstrate how Web2 compromises lead to Web3 funds losses. You do not need to be an expert in smart contract auditing, blockchain security architectures, or decentralized consensus-driven risk controls. Nice to Have Prior work at a crypto, fintech, or other company where products handle high-value or irreversible actions. Familiarity with wallet, signing, or key-management flows. Reading-level familiarity with Solidity or Rust, target: when ProdSec intersects with smart contracts or other on-chain applications, you can parse what the code is likely doing, and work with blockchain security subject matter experts from there. Bug bounty history - reports, CVEs, or published write-ups. Familiarity with browser-extension security, mobile app security, or account-abstraction wallet designs. Public output - talks, blog posts, open-source tools, CVEs. How We Work The Security team values a high trust team environment where respectful candor can thrive. We expect senior engineers to have an opinionated take on how to accomplish a task, accept feedback from the team and other external stakeholders and return it in kind, and to always assume positive intent. Professionalism, ethics, and enabling stakeholders towards common goals are important always.

Location: EMEA About the team The Security Team is responsible for providing key security capabilities covering application, cloud and enterprise security, incident response, detection and GRC. Our team is looking for an experienced, hands-on security practitioner, who will drive the adoption of modern security processes and tooling, with focus on supporting our engineering and product teams in improving the security posture of our platforms and services. What you will do: - Identify security gaps and vulnerabilities in all ClickHouse offerings triage a wide range of vulnerabilities reported via our bug bounty program, responsible disclosure, GitHub Issues covering web, API and server - client assets including low level memory issues like heap or buffer overflows - Improve and develop security assurance activities - pentests, vulnerability assessments, bug bounty programs, fuzzing - Plan and execute internal red team assessments and penetration tests against ClickHouse infrastructure, cloud environments, designing realistic adversary scenarios to test detection, response and control effectiveness - Assess AI/LLM-specific attack surface across ClickHouse's own AI-powered features and internal AI tooling, including prompt injection, model/data exfiltration, and unsafe agentic tool-use patterns - Build and operate agentic tooling for reconnaissance, exploit-chaining and attack-path discovery, and apply LLM-assisted fuzzing to accelerate vulnerability discovery across ClickHouse's products and infrastructure - Partner with detection engineering to validate and improve detection coverage during red team exercises, measuring and reporting on control effectiveness and time to detect/respond - Handle information security events and incidents across ClickHouse products and services - Develop processes, tooling and automation to scale security processes and mitigate risks to the business What you bring along: - 7+ years of experience in pentesting, red teaming and product security - Experience supporting engineering and product implementation efforts by performing threat assessments, assurance activities, advisory as well as, in some cases, implementation work across distributed systems covering web, API, client/server assets - Hands-on experience conducting offensive security engagements - internal red teaming, penetration testing and adversary simulation - across cloud, network and application environments - Ability to design adversary scenarios grounded in real threat intelligence (e.g. ransomware operators, supply chain attackers, insider threat) tailored to ClickHouse's risk profile as a multi-tenant cloud data platform - Strong written and verbal communication skills, with ability to translate attack chains into clear, actionable findings for engineering and leadership - Experience building or adapting agentic and LLM-assisted tooling for offensive security use cases (recon automation, exploit chaining, fuzzing harnesses), with judgment on where AI genuinely speeds up an engagement versus adds noise - Familiarity with AI/LLM-specific vulnerability classes and testing methodology - Strong knowledge of and experience with one or more cloud service providers (e.g. AWS, GCP, Azure), Kubernetes, Cilium - Experience implementing and operating engineering security tools and processes (e.g. static / dynamic code analysis, software composition analysis, SBOM, OWASP SAMM, client and network fuzzing tools) - Security as code mindset, with focus on solving problems with automation and scale in mind Bonus Points: - BS, MS, or PhD in Computer Science or related field - Previous contributions to open source projects - Security or cloud related certifications (AWS, GCP, Azure) - Previous experience in using AI security harnesses for pentesting purposes - Experience building or operating internal red team tooling and infrastructure from scratch, rather than relying solely on off-the-shelf frameworks - Offensive security certifications (e.g. OSCP, OSCE, OSEP, OSWE) PERKS - Flexible work environment - ClickHouse is a globally distributed company and remote-friendly. We currently operate in over 25 countries. - Healthcare - Employer contributions towards your healthcare. - Equity in the company - Every new team member who joins our company receives stock options. - Time off - Flexible time off in the US, generous entitlement in other countries. - A USD$500 Home office setup if you’re a remote employee. - Global Gatherings – We believe in the power of in-person connection and offer opportunities to engage with colleagues at company-wide offsites. CULTURE - WE ALL SHAPE IT As part of a rapidly scaling start-up, you will be instrumental in shaping our culture. Are you interested in finding out more about our culture? Learn more about our values here https://clickhouse.com/company/careers. Check out our blog posts https://clickhouse.com/blog or follow us on LinkedIn https://www.linkedin.com/company/clickhouseinc/life/0c1ee7f4-2129-488d-b413-e7f6270659fd/?viewAsMember=true to find out more about what’s happening at ClickHouse. EQUAL OPPORTUNITY & PRIVACY ClickHouse provides equal employment opportunities to all employees and applicants and prohibits discrimination and harassment of any type based on factors such as race, color, religion, age, sex, national origin, disability status, genetics, protected veteran status, sexual orientation, gender identity or expression, or any other characteristic protected by federal, state or local laws. Please see here https://clickhouse.com/legal/applicant-privacy-notice for our Privacy Statement.

Location: The Netherlands; Poland; Portugal; France; United Kingdom; Spain; Germany; Italy About the team  The Security Team is responsible for providing key security capabilities covering application, cloud and enterprise security, incident response, detection and GRC. Our team is looking for an experienced, hands-on security practitioner, who will drive the adoption of modern security processes and tooling, with focus on supporting our engineering and product teams in improving the security posture of our platforms and services. Note: This position can be fully remote anywhere in the Netherlands. What you will do: - Collaborate with engineering and product on improving existing and building new product features with focus on threat modeling, assurance and secure implementation, some examples of recent work include implementation of secure key management, passwordless authentication, m2m authentication, sandboxing and compute/network/storage isolation - Identify security gaps and vulnerabilities in ClickHouse Cloud and OSS, triage a wide range of vulnerabilities reported via our bug bounty program, responsible disclosure, GitHub Issues covering web, API and server - client assets including low level memory issues like heap or buffer overflows - Improve and develop security assurance activities - pentests, vulnerability assessments, bug bounty programs, fuzzing - Drive implementation and usage of engineering security tools - static, dynamic code analysis, dependency checks, code licensing compliance (working knowledge of Snyk, Semgrep, GitHub CodeQL) - Nurture the engineering - security relationship, identify and implement process and technology improvements - Handle information security events and incidents across ClickHouse products and services - Develop processes, tooling and automation to scale security processes and mitigate risks to the business What you bring along: - Experience supporting engineering and product implementation efforts by performing threat assessments, assurance activities, advisory as well as, in some cases, implementation work across distributed systems covering web, API, client/server assets - Strong knowledge of and experience with one or more cloud service providers (e.g. AWS, GCP, Azure), Kubernetes, Cilium - Experience implementing and operating engineering security tools and processes (e.g. static / dynamic code analysis, software composition analysis, SBOM, OWASP SAMM, client and network fuzzing tools) - Significant development and automation experience, ability to work with C++ code - Security as code mindset, with focus on solving problems with automation and scale in mind Bonus Points: - BS, MS, or PhD in Computer Science or related field - Previous contributions to open source projects - Security or cloud related certifications (AWS, GCP, Azure) PERKS - Flexible work environment - ClickHouse is a globally distributed company and remote-friendly. We currently operate in over 25 countries. - Healthcare - Employer contributions towards your healthcare. - Equity in the company - Every new team member who joins our company receives stock options. - Time off - Flexible time off in the US, generous entitlement in other countries. - A USD$500 Home office setup if you’re a remote employee. - Global Gatherings – We believe in the power of in-person connection and offer opportunities to engage with colleagues at company-wide offsites. CULTURE - WE ALL SHAPE IT As part of a rapidly scaling start-up, you will be instrumental in shaping our culture. Are you interested in finding out more about our culture? Learn more about our values here https://clickhouse.com/company/careers. Check out our blog posts https://clickhouse.com/blog or follow us on LinkedIn https://www.linkedin.com/company/clickhouseinc/life/0c1ee7f4-2129-488d-b413-e7f6270659fd/?viewAsMember=true to find out more about what’s happening at ClickHouse. EQUAL OPPORTUNITY & PRIVACY ClickHouse provides equal employment opportunities to all employees and applicants and prohibits discrimination and harassment of any type based on factors such as race, color, religion, age, sex, national origin, disability status, genetics, protected veteran status, sexual orientation, gender identity or expression, or any other characteristic protected by federal, state or local laws. Please see here https://clickhouse.com/legal/applicant-privacy-notice for our Privacy Statement.

Location: United States Workplace: Remote About the team  The Security Team is responsible for providing key security capabilities covering application, cloud and enterprise security, incident response, detection and GRC. Our team is looking for an experienced, hands-on security practitioner, who will drive the adoption of modern security processes and tooling, with focus on supporting our engineering and product teams in improving the security posture of our platforms and services.  What you will do: - Collaborate with engineering and product on improving existing and building new product features with focus on threat modeling, assurance and secure implementation, some examples of recent work include implementation of secure key management, passwordless authentication, m2m authentication, sandboxing and compute/network/storage isolation - Identify security gaps and vulnerabilities in ClickHouse Cloud and OSS, triage a wide range of vulnerabilities reported via our bug bounty program, responsible disclosure, GitHub Issues covering web, API and server - client assets including low level memory issues like heap or buffer overflows - Improve and develop security assurance activities - pentests, vulnerability assessments, bug bounty programs, fuzzing - Drive implementation and usage of engineering security tools - static, dynamic code analysis, dependency checks, code licensing compliance (working knowledge of Snyk, Semgrep, GitHub CodeQL) - Nurture the engineering - security relationship, identify and implement process and technology improvements - Handle information security events and incidents across ClickHouse products and services - Develop processes, tooling and automation to scale security processes and mitigate risks to the business What you bring along: - Experience supporting engineering and product implementation efforts by performing threat assessments, assurance activities, advisory as well as, in some cases, implementation work across distributed systems covering web, API, client/server assets - Strong knowledge of and experience with one or more cloud service providers (e.g. AWS, GCP, Azure), Kubernetes, Cilium, Crossplane - Experience implementing and operating engineering security tools and processes (e.g. static / dynamic code analysis, software composition analysis, SBOM, OWASP SAMM, client and network fuzzing tools) - Significant development and automation experience, ability to work with C++ code preferred - Security as code mindset, with focus on solving problems with automation and scale in mind Bonus Points: - BS, MS, or PhD in Computer Science or related field - Previous contributions to open source projects - Security or cloud related certifications (AWS, GCP, Azure) PERKS - Flexible work environment - ClickHouse is a globally distributed company and remote-friendly. We currently operate in over 25 countries. - Healthcare - Employer contributions towards your healthcare. - Equity in the company - Every new team member who joins our company receives stock options. - Time off - Flexible time off in the US, generous entitlement in other countries. - A USD$500 Home office setup if you’re a remote employee. - Global Gatherings – We believe in the power of in-person connection and offer opportunities to engage with colleagues at company-wide offsites. CULTURE - WE ALL SHAPE IT As part of a rapidly scaling start-up, you will be instrumental in shaping our culture. Are you interested in finding out more about our culture? Learn more about our values here https://clickhouse.com/company/careers. Check out our blog posts https://clickhouse.com/blog or follow us on LinkedIn https://www.linkedin.com/company/clickhouseinc/life/0c1ee7f4-2129-488d-b413-e7f6270659fd/?viewAsMember=true to find out more about what’s happening at ClickHouse. EQUAL OPPORTUNITY & PRIVACY ClickHouse provides equal employment opportunities to all employees and applicants and prohibits discrimination and harassment of any type based on factors such as race, color, religion, age, sex, national origin, disability status, genetics, protected veteran status, sexual orientation, gender identity or expression, or any other characteristic protected by federal, state or local laws. Please see here https://clickhouse.com/legal/applicant-privacy-notice for our Privacy Statement.

Location: Montréal ABOUT MISTRAL Mistral provides full-stack AI solutions: from frontier models to developer tools, applications, and compute. We partner with enterprises tackling the hardest problems across high-stakes industries like finance, manufacturing, defense, healthcare, and the public sector, co-creating customized AI systems that they can run on their terms. We are a dynamic, collaborative team passionate about AI and its potential to transform society. Our diverse workforce thrives in competitive environments and is committed to driving innovation. Our teams are distributed between Europe, North America, Asia and the Middle East. We are creative, low-ego and team-spirited. Role Summary We are seeking an Applied AI, Forward Deployed Engineer to build customer use cases on top of the Mistral stack. You will turn "we have agents" into "we shipped something a client uses." This role is about composing cybersecurity-related agentic workflows, configuring harnesses for real-world scenarios, and delivering value directly to clients. As a Forward Deployed Engineer at Mistral, you may also work on use cases outside cybersecurity, bringing the same context engineering, orchestration, and eval work to enterprise workflows in finance, manufacturing, defense, or the public sector. What You Will Do - Client-Facing Agentic Solutions - You'll individually help deploy into production use cases with considerable business impact across various industries, with cybersecurity client assignments as a priority - You'll work on state-of-the-art GenAI applications, driving a crucial technological transformation together with our customers - Tackle iconic use cases that no existing solution on the market can address - from custom configuration of cybersecurity harnesses for cloud defense, to optimizing agentic vulnerability scanning solutions, to customizing agentic red-teaming solutions or penetration testing scenarios - You'll work directly on client use cases, translating security requirements into agentic solutions - You'll be involved in pre-sales calls to understand potential clients' needs, challenges, and aspirations, providing technical guidance on our products and explaining Mistral technologies to various stakeholders - You'll collaborate with our product and science teams to continuously improve our product and model capabilities based on customer feedback How We Work in Applied AI - We care about people and outputs - What matters is what you ship, not the time you spend on it - Bureaucracy is where urgency goes to vanish. You talk to whoever you need to talk to. The best idea wins, whether it comes from a principal engineer or someone in their first week - Always ask why. The best solutions come from deep understanding, not from copying what worked before - We say what we mean. Feedback is direct, timely, and given because we care - No politics. Low ego, high standards - We embrace an unstructured environment and find joy in it About You - You are fluent in English - You have 2+ years as a technical individual contributor (data scientist or software engineer) on AI-based products - You have proven experience in AI or machine learning product implementation with APIs, back-end, and front-end interfaces - You have experience tackling advanced RAG, building agentic use cases, or fine-tuning LLMs - You have a deep understanding of the concepts and algorithms underlying machine learning and LLMs - You have strong technical coding skills in Python - You have strong communication skills, with an ability to explain complex technical concepts in simple terms to both technical and non-technical audiences Ideally, you have: - Contributed to open-source projects, in particular in the space of LLMs - Experience as a Customer Engineer, Forward Deployed Engineer, Sales Engineer, Solutions Architect, or Technical Product Manager - Hands-on experience building agents, LLM orchestration, context engineering, evals, and RAG systems - A bias toward action and delivery - you ship fast - The ability to operate independently with a customer-led mindset - The ability to reuse internal building blocks and components effectively - Strong problem-solving abilities and attention to detail - A collaborative attitude - Pentesting knowledge - Experience developing a cybersecurity product - Experience building agentic harnesses or multi-agent systems end-to-end - A strong background in evals and benchmarking of agent systems - Experience with security tooling or workflows - Prior work on production AI systems in regulated or high-stakes environments WHAT WE OFFER We offer a comprehensive benefits package designed to support your well-being, growth, and work-life balance. Benefits vary by country and may include healthcare coverage, parental leave, retirement plans, relocation support, wellness programs, meal and transportation allowances, and other location-specific perks. For the most up-to-date details on benefits available in your location, please refer to our Benefits page https://app.notion.com/p/mistralai/Benefits-at-Mistral-36e6ba59a7fe836b93dd01737fcc27ef?source=copy_link. PRIVACY POLICY Your privacy matters to us. You can learn more about how we handle your personal data in our Applicant Privacy Policy https://legal.mistral.ai/terms/applicant-privacy-policy.

Location: Almaty, Kazakhstan Workplace: OnSite WHY WORK AT HIGGSFIELD AI? Higgsfield AI is the fastest-scaling generative AI company in history, hitting $500M in annual revenue run rate, 25M+ users worldwide, 6M+ generations per day, and powering 390 of Fortune 500 brands. We're building at the absolute frontier of AI-powered video creation and next-generation creative tools. Joining Higgsfield means becoming part of a high-impact team shaping the future of AI-native experiences, at a company that isn't just moving fast, but rewriting what fast looks like. ABOUT THE ROLE Break new features before they ship: agentic systems, MCP servers, code-generating agents, user-deployed apps, generative models for image, video, and voice, and enterprise features (SSO, org and team management, roles). It's new ground, and you'll help define how we secure it. You go first. What you'll do: - Pentest new features and products pre-release: web, APIs, admin surfaces. - Work out the attack surface of each new feature yourself. - Hunt authorization flaws across our multi-tenant APIs and retest fixes. - Join design and code reviews early, so flaws die before they're built. - Turn recurring findings into guardrails — paved-road standards and automated checks — so a bug class dies once instead of resurfacing every release. - Bring a working repro to the team that owns the code and see the fix through. Requirements - A track record of finding real vulnerabilities in real systems — appsec work, bug bounty, or research. - The ability to read modern codebases, trace a bug to root cause, and discuss the fix with the engineers who wrote it. - A threat-modeling instinct for spotting the weak spots in a design or architecture before a line is written. - Enough cloud and container fundamentals to follow a bug into the infrastructure it runs on. - High agency. - Working English. Nice to have - LLM/agent security research, public research or CVEs, OSWE/CWEE or equivalent hands-on certificates. WHAT WE OFFER: - Competitive base salary in USD - Equity: participation in the company’s stock option program, giving you the opportunity to share in the company’s long-term growth. - On-site role in our Almaty office (we will relocate you from anywhere).

Location: Paris ABOUT MISTRAL Mistral provides full-stack AI solutions: from frontier models to developer tools, applications, and compute. We partner with enterprises tackling the hardest problems across high-stakes industries like finance, manufacturing, defense, healthcare, and the public sector, co-creating customized AI systems that they can run on their terms. We are a dynamic, collaborative team passionate about AI and its potential to transform society. Our diverse workforce thrives in competitive environments and is committed to driving innovation. Our teams are distributed between Europe, North America, Asia and the Middle East. We are creative, low-ego and team-spirited. Role Summary We are seeking an Applied AI, Forward Deployed Engineer to build customer use cases on top of the Mistral stack. You will turn "we have agents" into "we shipped something a client uses." This role is about composing cybersecurity-related agentic workflows, configuring harnesses for real-world scenarios, and delivering value directly to clients. As a Forward Deployed Engineer at Mistral, you may also work on use cases outside cybersecurity, bringing the same context engineering, orchestration, and eval work to enterprise workflows in finance, manufacturing, defense, or the public sector. What You Will Do - Client-Facing Agentic Solutions - You'll individually help deploy into production use cases with considerable business impact across various industries, with cybersecurity client assignments as a priority - You'll work on state-of-the-art GenAI applications, driving a crucial technological transformation together with our customers - Tackle iconic use cases that no existing solution on the market can address - from custom configuration of cybersecurity harnesses for cloud defense, to optimizing agentic vulnerability scanning solutions, to customizing agentic red-teaming solutions or penetration testing scenarios - You'll work directly on client use cases, translating security requirements into agentic solutions - You'll be involved in pre-sales calls to understand potential clients' needs, challenges, and aspirations, providing technical guidance on our products and explaining Mistral technologies to various stakeholders - You'll collaborate with our product and science teams to continuously improve our product and model capabilities based on customer feedback How We Work in Applied AI - We care about people and outputs - What matters is what you ship, not the time you spend on it - Bureaucracy is where urgency goes to vanish. You talk to whoever you need to talk to. The best idea wins, whether it comes from a principal engineer or someone in their first week - Always ask why. The best solutions come from deep understanding, not from copying what worked before - We say what we mean. Feedback is direct, timely, and given because we care - No politics. Low ego, high standards - We embrace an unstructured environment and find joy in it About You - You are fluent in English - You have 2+ years as a technical individual contributor (data scientist or software engineer) on AI-based products - You have proven experience in AI or machine learning product implementation with APIs, back-end, and front-end interfaces - You have experience tackling advanced RAG, building agentic use cases, or fine-tuning LLMs - You have a deep understanding of the concepts and algorithms underlying machine learning and LLMs - You have strong technical coding skills in Python - You have strong communication skills, with an ability to explain complex technical concepts in simple terms to both technical and non-technical audiences Ideally, you have: - Contributed to open-source projects, in particular in the space of LLMs - Experience as a Customer Engineer, Forward Deployed Engineer, Sales Engineer, Solutions Architect, or Technical Product Manager - Hands-on experience building agents, LLM orchestration, context engineering, evals, and RAG systems - A bias toward action and delivery - you ship fast - The ability to operate independently with a customer-led mindset - The ability to reuse internal building blocks and components effectively - Strong problem-solving abilities and attention to detail - A collaborative attitude - Pentesting knowledge - Experience developing a cybersecurity product - Experience building agentic harnesses or multi-agent systems end-to-end - A strong background in evals and benchmarking of agent systems - Experience with security tooling or workflows - Prior work on production AI systems in regulated or high-stakes environments WHAT WE OFFER We offer a comprehensive benefits package designed to support your well-being, growth, and work-life balance. Benefits vary by country and may include healthcare coverage, parental leave, retirement plans, relocation support, wellness programs, meal and transportation allowances, and other location-specific perks. For the most up-to-date details on benefits available in your location, please refer to our Benefits page https://app.notion.com/p/mistralai/Benefits-at-Mistral-36e6ba59a7fe836b93dd01737fcc27ef?source=copy_link. PRIVACY POLICY Your privacy matters to us. You can learn more about how we handle your personal data in our Applicant Privacy Policy https://legal.mistral.ai/terms/applicant-privacy-policy.

Location: Metn, Lebanon The Company Toters is an on-demand e-commerce and delivery platform that enables customers to get anything in their city with the highest level of convenience. At Toters, technology is at the heart of everything we do. Our product teams build features that simplify customers’ lives, while our engineers create scalable solutions to deliver faster and more cost-effectively. If you thrive in a high-growth startup environment and want to help reshape how people shop across the Middle East, join us. Role Overview As a Senior Offensive Security Engineer (L5), you will own complex offensive security initiatives that span multiple teams. You will lead advanced penetration testing, red team exercises, and adversarial simulations to uncover systemic weaknesses in our web applications, APIs, mobile apps, cloud infrastructure, identity, payment-adjacent flows, and overall attack surface. You will act as a hands-on technical leader : influencing secure design decisions with evidence, mentoring mid-level and junior offensive engineers, and driving improvements that meaningfully reduce risk. Description In this senior role, you will take end-to-end ownership of offensive security efforts with a focus on high-impact outcomes. Your responsibilities include: Lead comprehensive penetration tests and red team / assumed-breach exercises targeting web applications, APIs, mobile applications, cloud infrastructure, and authentication systems (including identity and privileged-access paths). Lead mobile offensive testing on Android and iOS, including evaluation and bypass/validation of runtime protection, tamper resistance, certificate pinning / Certificate Transparency, and key/secret shielding using DexProtector or similar RASP / app-shielding tools, plus complementary tooling such as MobSF. Perform in-depth threat modeling and identify complex attack paths across services and trust boundaries (including authorization flaws, tenant isolation, token/session issues, edge/WAF bypass, and client-secret exposure). Deliver high-quality security assessment reports with clear risk ratings, business impact analysis, practical remediation guidance, and evidence quality that engineering and audit stakeholders can use in a SOC 2 and PCI DSS context—then re-test and validate fixes before closure. Collaborate with Engineering, DevOps, Product, and the Security Engineer track to influence secure architecture decisions and ensure vulnerabilities are addressed at the root cause. Develop and improve offensive security methodologies, tools, and automation to increase efficiency and coverage. AI-assisted testing is a must. Mentor mid-level and junior offensive security engineers, conduct offensive-focused code/design reviews, and help raise the overall security capability of the team. Participate in purple team exercises with the detection and incident response teams to improve defenses based on real attack simulations. Stay at the forefront of offensive security research, emerging threats, and TTPs, and assess their relevance to Toters. Contribute offensive input to security standards, policies, and secure development practices across the engineering organization (you advise; you do not own policy issuance or GRC evidence packs). Support structured disclosure (VDP / researcher reports) through reproduce, rate, de-duplicate, and validate. Key Qualifications Bachelor’s degree in Computer Science, Cybersecurity, or a related field, or equivalent practical experience. 6+ years of hands-on experience in offensive security, penetration testing, or red teaming. Strong expertise in web application, API, and mobile security testing (Android and iOS). Working knowledge of DexProtector or similar mobile shielding / RASP tooling: what it protects, how testers evaluate residual risk, and how to validate that hardening holds. Advanced proficiency with offensive security tools (Burp Suite, Metasploit, Cobalt Strike or equivalent adversary-emulation platforms, custom tooling, etc.). Proficient in writing robust, reusable scripts and small tools for automation (Python preferred, Bash for quick tasks). Solid experience with cloud security testing (AWS preferred) and infrastructure attack techniques. Proven ability to lead complex security assessments from scoping to reporting and remediation validation. Strong risk assessment and threat modeling skills, with the ability to communicate technical risks clearly to both technical and non-technical stakeholders. Familiarity with SOC 2 and PCI DSS as they apply to offensive work (scoped pentests, application/API/payment-adjacent testing, evidence-quality reporting). This role does not own control design or audit evidence collection. Experience mentoring engineers and influencing cross-team security practices. Excellent written and verbal communication skills in English. Nice to Have Industry-recognized certifications such as OSCP, OSCE, OSEP, CRTO, or PNPT. Experience running full-scope red team or assumed-breach exercises. Experience developing custom exploits, tooling, or automation for offensive security. Knowledge of MITRE ATT&CK and adversary emulation. AI and AI pentesting: testing LLM/agent applications (prompt injection, tool/plugin abuse, data-exfil via agents) and using AI-assisted pentest workflows with mandatory human review. Previous experience in high-scale e-commerce, delivery, or fintech environments, including payment API / tokenization / third-party PSP testing as a tester (not as PCI control owner). Fluency in Arabic and English (French is a plus). What We Offer Competitive compensation package. Discounts on Toters orders. First-class medical insurance. Ready to own offensive security at scale and help build a safer platform for millions across the Middle East? Apply now!

Location: South Africa; Egypt; Ethiopia; Morocco; Jamaica; Philippines About Huzzle At Huzzle, we connect exceptional talent with top opportunities at leading companies across the UK, US, Canada, Europe, and Australia. Our clients include fast-growing startups and established businesses in SaaS, MarTech, FinTech, and EdTech. Unlike traditional outsourcing, you’ll be placed directly with a client as a core member of their team—giving you real ownership, career progression, and long-term stability. Role Type: Full-time Engagement: Independent Contractor About the company Our client is a fast-growing cybersecurity firm specializing in the intersection of AI governance and advanced threat protection. Operating as both a strategic partner for enterprise CISOs and a go-to-market engine for security startups, the team provides a sophisticated suite of solutions including agentic workflow security, browser-based GenAI DLP, and automated pentesting. They focus on helping organizations across the UK and Europe navigate the modern threat landscape by implementing guardrails for emerging technologies while streamlining compliance for frameworks like DORA and ISO 27001. This innovative company bridges the gap between cutting-edge security technology and real-world enterprise needs. By vetting and deploying elite solutions—ranging from deception-based honeypots to intent-based email security—the team ensures businesses remain resilient against next-gen risks. With a high-performance culture centered on hands-on execution and technical excellence, they offer a unique environment where employees can work at the forefront of AI security and European market expansion. Job Summary As enterprises rush to deploy GenAI and agentic AI workflows, the need for robust security has never been higher. This company acts as the specialist bridge between cutting-edge AI security innovators and the global enterprises that need them. We are looking for a high-energy, independent Mid-Level SDR to join a growth-stage team with established processes. This is a high-volume, high-reward role designed for someone who thrives on the phones and wants to transition into a closing role within 4 to 6 months. Key Responsibilities Execute high-volume outbound prospecting, making 100-300 calls daily via a dedicated dialing platform. Identify and qualify new business opportunities to maintain a target of 7 qualified meetings per week (minimum 20 completed meetings per month). Own the front-end of the sales cycle, including lead sourcing, territory planning, and pipeline management. Utilize LinkedIn Sales Navigator and Microsoft Office to research and engage key decision-makers in the cybersecurity and AI space. Manage a territory independently, ensuring a consistent flow of qualified leads for the sales team. Requirements Experience: Proven track record in SaaS or Tech sales. Skills: Expertise in lead sourcing, qualification, and territory planning. Tools: Mastery of Microsoft Office and LinkedIn Sales Navigator is a must. Communication: Fluent in English with strong verbal and written communication skills. Driven Personality: A self-starter who is comfortable with high-volume dialing and performance-led targets. Nice-to-Haves 1+ year of previous SDR experience with demonstrable success metrics, ideally within the cybersecurity sector. Familiarity with Apollo.io. Multilingual capabilities in German, Spanish, or French. Benefits 🌎 Fully remote role with flexible working hours 🚀 Work with high-growth international companies 🎯 Performance-based bonuses and incentives 🧠 Ongoing training, mentorship, and sales development support

Location: London, UK; Ontario, CAN; Remote-Friendly, United States; San Francisco, CA About Anthropic Anthropic’s mission is to create reliable, interpretable, and steerable AI systems. We want AI to be safe and beneficial for our users and for society as a whole. Our team is a quickly growing group of committed researchers, engineers, policy experts, and business leaders working together to build beneficial AI systems. Applications are now open for our January cohort - apply here by October 30. Anthropic Fellows Program overview The Anthropic Fellows Program is designed to foster AI research and engineering talent. We provide funding and mentorship to promising technical talent - regardless of previous experience. Fellows will primarily use external infrastructure (e.g. open-source models, public APIs) to work on an empirical project aligned with our research priorities, with the goal of producing a public output (e.g. a paper submission). In one of our earlier cohorts, over 80% of fellows produced papers. We run multiple cohorts of Fellows each year and review applications on a rolling basis. What to expect 4 months of full-time research Direct mentorship from Anthropic researchers Access to a shared workspace (in either Berkeley, California or London, UK) Connection to the broader AI safety and security research community Weekly stipend of 3,850 USD / 2,310 GBP / 4,300 CAD + benefits (these vary by country) Funding for compute (~$15k/month) and other research expenses Interview process The interview process will include an initial application & reference check, technical assessments & interviews, and a research discussion. We encourage you to apply even if you do not believe you meet every single qualification. Not all strong candidates will meet every single qualification as listed. Research shows that people who identify as being from underrepresented groups are more prone to experiencing imposter syndrome and doubting the strength of their candidacy, so we urge you not to exclude yourself prematurely and to submit an application if you're interested in this work. We think AI systems like the ones we're building have enormous social and ethical implications. We think this makes representation even more important, and we strive to include a range of diverse perspectives on our team. Compensation The expected base stipend for this role is 3,850 USD / 2,310 GBP / 4,300 CAD per week, with an expectation of 40 hours per week for 4 months (with possible extension). Across the workstreams, you may be a good fit if you: Are motivated by making sure AI is safe and beneficial for society as a whole Are excited to transition into empirical AI research and would be interested in a full-time role at Anthropic Have a strong technical background in computer science, mathematics, or physics Thrive in fast-paced, collaborative environments Can implement ideas quickly and communicate clearly Strong candidates may also have: Strong background in a discipline relevant to a specific Fellows workstream (e.g. economics, social sciences, or cybersecurity) Experience in areas of research or engineering related to their workstream Candidates must be: Fluent in Python programming Available to work full-time on the Fellows program AI Safety Fellows Mentors, research areas, & past projects Fellows will undergo a project selection & mentor matching process. Potential mentors include: Sam Bowman Sara Price Alex Tamkin Nina Panickssery Trenton Bricken Logan Graham Jascha Sohl-Dickstein Joe Benton Collin Burns Fabien Roger Samuel Marks Kyle Fish Ethan Perez Our mentors will lead projects in select AI safety research areas, such as: Scalable Oversight: Developing techniques to keep highly capable models helpful and honest, even as they surpass human-level intelligence in various domains. Adversarial Robustness and AI Control: Creating methods to ensure advanced AI systems remain safe and harmless in unfamiliar or adversarial scenarios. Model Organisms: Creating model organisms of misalignment to improve our empirical understanding of how alignment failures might arise. Model Internals / Mechanistic Interpretability: Advancing our understanding of the internal workings of large language models to enable more targeted interventions and safety measures. AI Welfare: Improving our understanding of potential AI welfare and developing related evaluations and mitigations. On our Alignment Science and Frontier Red Team blogs, you can read about past projects, including: Subliminal Learning: Language Models Transmit Behavioral Traits via Hidden Signals in Data: Alex Cloud and Minh Le, et al., mentors including Samuel Marks and Owain Evans Open-source circuits: Michael Hanna and Mateusz Piotrowski with mentorship from Emmanuel Ameisen and Jack Lindsey For a full list of representative projects for each area, please see these blog posts: Introducing the Anthropic Fellows Program for AI Safety Research , Recommendations for Technical AI Safety Research Directions . Unique candidate criteria You might be a particularly great fit for this workstream if you: Are motivated by reducing catastrophic risks from advanced AI systems Have experience with empirical ML research projects Have experience working with large language models Have experience in one of the research areas mentioned above Have a track record of open-source contributions AI Security Fellows Mentors, research areas, & past projects Fellows will undergo a project selection & mentor matching process. Potential mentors include: Nicholas Carlini Keri Warr Evyatar Ben Asher Keane Lucas Newton Cheng On our Alignment Science and Frontier Red Team blogs, you can read about some past Fellows projects, including: AI agents find $4.6M in blockchain smart contract exploits: Winnie Xiao and Cole Killian, mentored by Nicholas Carlini and Alwin Peng Strengthening Red Teams: A Modular Scaffold for Control Evaluations: Chloe Loughridge et al., mentored by Jon Kutasov and Joe Benton Unique candidate criteria You might be a particularly great fit for this workstream if you: Are motivated by reducing catastrophic risks from advanced AI systems Have contributed to open-source projects in LLM- or security-adjacent repositories Have demonstrated success in bringing clarity and ownership to ambiguous technical problems Have experience with pentesting, vulnerability research, or other offensive security work Have a demonstrated willingness to do the "dirty work" that produces high-quality outputs Have reported CVEs or been awarded bug bounties Have experience with empirical ML research projects Have experience with deep learning frameworks and experiment management Logistics Logistics Requirements: To participate in the Fellows program, you must have work authorization in the US, UK, or Canada and be located in that country during the program. Workspace Locations: We have designated shared workspaces in London and Berkeley where fellows will work from and mentors will visit. We are also open to remote fellows in the UK, US, or Canada . We will ask you about your availability to work from Berkeley or London (full- or part-time) during the program. Visa Sponsorship: We are not currently able to sponsor visas for fellows. To participate in the Fellows program, you need to have or independently obtain full-time work authorization in the UK, the US, or Canada. Program Duration: The program runs for 4 months, full-time. If you can't commit to the full duration, please still apply and note your constraints in the application. We review these requests on a case-by-case basis. Please note: We do not guarantee that we will make any full-time offers to fellows. However, strong performance during the program may indicate that a Fellow would be a good fit for full-time roles at Anthropic. In previous cohorts, 25-50% of fellows received a full-time offer, and we’ve supported many more to go on to do great work on AI safety and security at other organizations. Applications and interviews are managed by Constellation , our recruiting and program partner. Constellation also runs the Berkeley workspace and provides program support for fellows working on AI safety and security; fellows on capabilities-focused projects are supported directly by Anthropic. All applicants currently use the same application portal but we are working to separate applications for safety/security and capabilities-focused projects in future rounds. Apply here by October 30. The below are Anthropic's policies for full-time roles. These do NOT apply to the Fellows Program. Logistics Minimum education: Bachelor’s degree or an equivalent combination of education, training, and/or experience Required field of study: A field relevant to the role as demonstrated through coursework, training, or professional experience Minimum years of experience: Years of experience required will correlate with the internal job level requirements for the position Location-based hybrid policy: Currently, we expect all staff to be in one of our offices at least 25% of the time. However, some roles may require more time in our offices. Visa sponsorship: We do sponsor visas! However, we aren't able to successfully sponsor visas for every role and every candidate. But if we make you an offer, we will make every reasonable effort to get you a visa, and we retain an immigration lawyer to help with this. We encourage you to apply even if you do not believe you meet every single qualification. Not all strong candidates will meet every single qualification as listed.  Research shows that people who identify as being from underrepresented groups are more prone to experiencing imposter syndrome and doubting the strength of their candidacy, so we urge you not to exclude yourself prematurely and to submit an application if you're interested in this work. We think AI systems like the ones we're building have enormous social and ethical implications. We think this makes representation even more important, and we strive to include a range of diverse perspectives on our team. Your safety matters to us. To protect yourself from potential scams, remember that Anthropic recruiters only contact you from @anthropic.com email addresses. In some cases, we may partner with vetted recruiting agencies who will identify themselves as working on behalf of Anthropic. Be cautious of emails from other domains. Legitimate Anthropic recruiters will never ask for money, fees, or banking information before your first day. If you're ever unsure about a communication, don't click any links—visit anthropic.com/careers directly for confirmed position openings. How we're different We believe that the highest-impact AI research will be big science. At Anthropic we work as a single cohesive team on just a few large-scale research efforts. And we value impact — advancing our long-term goals of steerable, trustworthy AI — rather than work on smaller and more specific puzzles. We view AI research as an empirical science, which has as much in common with physics and biology as with traditional efforts in computer science. We're an extremely collaborative group, and we host frequent research discussions to ensure that we are pursuing the highest-impact work at any given time. As such, we greatly value communication skills. The easiest way to understand our research directions is to read our recent research. This research continues many of the directions our team worked on prior to Anthropic, including: GPT-3, Circuit-Based Interpretability, Multimodal Neurons, Scaling Laws, AI & Compute, Concrete Problems in AI Safety, and Learning from Human Preferences. Come work with us! Anthropic is a public benefit corporation headquartered in San Francisco. We offer competitive compensation and benefits, optional equity donation matching, generous vacation and parental leave, flexible working hours, and a lovely office space in which to collaborate with colleagues. Guidance on Candidates' AI Usage: Learn about our policy for using AI in our application process.

Location: US / Remote Workplace: remote Why Us? CertiK is a pioneer in blockchain security, leveraging best-in-class AI technology to protect and monitor blockchain protocols and smart contracts. Founded in 2018 by professors from Yale University and Columbia University, CertiK’s mission is to secure the web3 world. CertiK applies cutting-edge innovations from academia to enterprise, enabling mission-critical applications to scale with safety and correctness. About the Role The primary responsibility of this role is for CertiK’s security-related services. Intersecting cybersecurity and blockchain, CertiK’s security offerings include security consulting, security reviews, security auditing of smart contracts and blockchains, verification of smart contracts, penetration testing, and more. We are looking to hire someone with a passion for application security and penetration testing. This is a fun and challenging full-time position. If you are excited about hacking, threat modeling, scanning, auditing, designing, and enhancing the security of applications across the board then you will thrive in this role. While you work with clients, we will also provide you with plenty of opportunities to get involved with research and development efforts to help us raise the standards of blockchain security. Responsibilities Perform security assessments on web, mobile, thick client applications, and browser extensions Conduct external and internal network penetration tests Perform security source code reviews Perform cloud security reviews Develop comprehensive pentest reports for both technical and non-technical audiences Research and develop innovative techniques, tools, and methodologies for pentesting applications in the blockchain space Contribute to the community by developing tools, presentations, and blog posts Requirements Passionate about cryptocurrency, DeFi, and blockchain, with a willingness to learn Web3 technologies such as smart contracts Minimum of 4 years of experience in application security and penetration testing Experienced in source code review for different languages, with a strong understanding of JavaScript and TypeScript Experienced in mobile application penetration testing Familiar with cloud platforms and their security risks, such as AWS, Azure, and GCP Experience in programming with scripting languages such as Python and Bash Solid understanding of cryptography BS/MS/PhD in Computer Science or Information Security Strong spoken and written communication skills Bonus Points Experienced in pentesting Web3 applications such as crypto exchanges, wallets, Dapps, and key custodian solutions Experienced in smart contract security audits Familiar with browser extension architecture and security risks Actively participate in the blockchain security community OSCP, OSWE, OSCE, GWAPT, or comparable certification Participated in bug bounty programs and audit contests Published security-related blog posts and spoken at security conferences and/or local meetups About the Company One of the fastest-growing and most trusted companies in blockchain security, CertiK is a true market leader. To date, CertiK has worked with over 3,200 Enterprise clients, secured over $310 billion worth of digital assets, and has detected over 60,000 vulnerabilities in blockchain code. Our clients include leading projects such as Aave, Polygon, Binance Smart Chain, Terra, Yearn, and Chiliz. Investors = Insight Partners, Sequoia, Tiger Global, Coatue Management, Lightspeed, Advent International, SoftBank, Hillhouse Capital, Goldman Sachs, Coinbase Ventures, Binance, Shunwei Capital, IDG Capital, Wing, Legend Star, Danhua Capital and other investors. Compensation Target annual base salary for this role performed in the US is $100,000 - $180,000. The exact compensation at which this job is filled will be determined by the skills and experience of qualified candidates. #LI-Remote #blockchain #startups #hiring CertiK is proud to offer medical, vision, and dental insurance, 401(k) plan with company matching, life and accidental death and dismemberment insurance, HSA (with high deductible plan), FSA, and other benefits to all full-time employees, along with flexible paid time off and holidays. CertiK also offers a variable commission program for business development sales roles.   In compliance with federal law, all persons hired will be required to verify identity and eligibility to work in the United States and to complete the required employment eligibility verification form upon hire.   CertiK is proud to be an equal opportunity employer. We will not discriminate against any applicant or employee on the basis of age, race, color, creed, religion, sex, sexual orientation, gender, gender identity or expression, medical condition, national origin, ancestry, citizenship, marital status or civil partnership/union status, physical or mental disability, pregnancy, childbirth, genetic information, military and veteran status, or any other basis prohibited by applicable federal, state or local law.   CertiK will consider for employment qualified applicants with criminal histories in a manner consistent with local and federal requirements. https://www.eeoc.gov/sites/default/files/migrated_files/employers/poster_screen_reader_optimized.pdf   All CertiK employees are expected to actively support diversity on their teams, and in the Company.