Вакансии

Location: Remote - Europe Workplace: Hybrid ABOUT CONSENSYS Consensys Incorporated is an independent blockchain infrastructure company, spun out of Consensys Software Inc. — one of the world's leading blockchain technology companies and the primary development organization behind the Ethereum ecosystem. We build and operate neutral, institutional-grade blockchain infrastructure that connects banks, asset managers, custodians, and financial market infrastructures to digital asset networks, meeting the non-negotiable standards of institutional finance: privacy, scalability, resilience, security, and regulatory readiness. Headquartered in Miami, Florida, and operating across the US, Europe, and Australia, Consensys Incorporated launched as an independent entity in September 2026 and is building the team to match its ambition. WHY THIS ROLE EXISTS Following Consensys's strategic transition into two independent entities (MetaMask for consumer platforms and Consensys focusing on protocols and institutional infrastructure), we are seeking an experienced Security Operations Center (SOC) Analyst to join our security organization. Consensys powers the core infrastructure driving the decentralized web, including Linea mainnet and the open-source Lineth ZK rollup stack recently donated to Linux Foundation Decentralized Trust. The SOC Analyst will be responsible for architecting, building, and operating a comprehensive 24/7 monitoring and alerting ecosystem across our entire digital asset footprint. This role spans enterprise IT SaaS environments, core blockchain infrastructure, and Web3 smart contract security. The SOC Analyst will bridge traditional cybersecurity operations with cutting-edge Web3 threat detection, protecting our corporate IT stack (JumpCloud, AWS, Google Workspace, GitHub, Notion, Zoom), Linea mainnet infrastructure, and ecosystem DeFi protocols against emerging cyber threats and exploits using tools such as Hypernative, Hexagate, and Blockaid. WHAT YOU’LL OWN 1. Enterprise IT Security & SaaS Monitoring - Architect and maintain centralized log collection, SIEM integration, and incident response services across AWS (utilizing Amazon GuardDuty and AWS CloudTrail) and corporate IT services including JumpCloud, Google Workspace, GitHub, Notion, and Zoom. - Develop custom detection rules and alert logic to detect unauthorized access, privilege escalation, credential compromise, and anomalous user activity. - Ensure complete security logging visibility, audit readiness, and access control management across all corporate platforms. 2. Infrastructure & ZK-Rollup Monitoring (Linea & Lineth) - Establish real-time security monitoring for Linea mainnet and the open-source Lineth ZK rollup stack (including Besu execution layer, Maru consensus, coordinator, and provers). - Monitor RPC endpoints, sequencer performance, L1/L2 messaging reliability, state root finalization, and infrastructure telemetry. - Collaborate with the DevOps team and core engineering teams to detect and mitigate infrastructure threats, DDoS attacks, and zero-day vulnerabilities. 3. Web3 & Smart Contract Threat Detection - Implement and tune real-time Web3 threat monitoring platforms including Hypernative, Hexagate, and Blockaid. - Build automated alerts to detect suspicious smart contract interactions, flash loan attacks, reentrancy exploits, liquidity drains, and unauthorized bridge activity on Linea mainnet. - Perform onchain forensics and transaction trace analysis to safeguard ecosystem DeFi protocols and institutional assets. 4. Incident Response & Threat Hunting - Serve as a primary responder for security alerts originating from IT SaaS, cloud infrastructure, and Web3 protocol layers, utilizing Grafana Cloud IRM to manage on-call rotations and incident management. - Lead triage, investigation, containment, and post-mortem root cause analysis for confirmed security incidents. - Proactively conduct threat hunting across system logs, cloud environments, and onchain transaction streams. 5. Security Automation & Detection Engineering - Automate incident response playbooks and triage workflows using SOAR tools and custom scripts (Python, Go, Bash). - Continuously refine detection rules to reduce false positives and improve Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR). - Integrate automated containment mechanisms across access management, cloud IAM, and Web3 security providers. 6. Compliance, Governance, and Reporting - Maintain detailed incident records, forensic evidence, and documentation in alignment with SOC2 and ISO compliance frameworks. - Prepare security operational metrics, alert volume analysis, and threat reports for leadership. - Ensure compliance with corporate security policies and access controls across all environments. 7. Threat Intelligence & Ecosystem Collaboration - Monitor Web3 threat landscapes, tracking emerging smart contract exploit techniques and threat actors targeting L2 ecosystems. - Coordinate with external security researchers, bug bounty programs, and Web3 security alliances to share intelligence. - Participate in incident response drills, security reviews, and audit remediation with external security partners. WHAT WE ARE LOOKING FOR - 3–5+ years of experience in Security Operations, Detection Engineering, or Incident Response within cloud-native or Web3 environments. - Hands-on experience configuring and maintaining monitoring, threat detection, and incident analysis services for AWS (such as Amazon GuardDuty and AWS CloudTrail) and enterprise IT platforms (JumpCloud, Google Workspace, GitHub, Notion, and Zoom). - Direct experience using Web3 security and onchain monitoring tools such as Hypernative, Hexagate, and Blockaid. - Deep technical understanding of Ethereum, L2 scaling architectures, ZK-rollups (Lineth stack, Besu execution, prover systems), and smart contract vulnerabilities. - Proficiency in log management, monitoring platforms (such as Grafana), SIEM/SOAR platforms, and scripting languages (Python, Go, Bash, or SQL). - Familiarity with SOC2, ISO 27001, NIST, or SANS security frameworks. - Strong communication, problem-solving, and analytical skills in a fast-paced, remote-first environment. BENEFITS OF THIS ROLE - The opportunity to safeguard cutting-edge Web3 and ZK-rollup infrastructure at the forefront of blockchain technology. - A dynamic and collaborative work environment with a passionate and talented team. - Competitive compensation package, including salary, benefits, and performance-based incentives. - A platform to influence the future of decentralized technologies and financial systems. REPORTING STRUCTURE - Reports to: Head of Security. - Team: Working closely with our dedicated DevOps team, Head of Security, and Site Reliability Engineer, this role will serve as the founding member of the incident response team. WORKING AT CONSENSYS We are a fully remote, globally distributed company. We hire the best people wherever they are, work asynchronously, and judge each other on impact rather than hours or location. We offer competitive compensation, meaningful equity, and the chance to work on genuinely open source software at the frontier of web3. Consensys is an equal opportunities employer. We celebrate diversity and are committed to building an inclusive environment for all employees.

Location: United States of America What We Do: Cybercrime is growing, and more businesses are getting hit by threats that used to target only the biggest organizations. That pushes defenders like us to operate at the highest level, and it deepens our need for good people who want to make a meaningful impact. Founded in 2015 by former NSA cyber operators, Huntress is a remote-first team working to make enterprise-grade cybersecurity accessible to businesses of all sizes. We work closely with security teams and service providers protecting complex environments, often without the time or headcount to handle it all. That’s why we build our technology in-house and back it with a 24/7 human-led Security Operations Center (SOC). As a result, our platform is never disconnected from the experts who manage it, ensuring our customers' protection. Huntress now secures more than 6M endpoints and 17M identities worldwide. Those numbers keep growing because more businesses rely on us to help carry the load and operate with more confidence. Every day, you can see that commitment in how we stand with our customers and how we show up for each other. Reports to: Director, Engineering Location: Remote US, Only Compensation: $165,000 to $190,000 base plus bonus and equity What You’ll Do: Huntress is building an Agentic SOC. When our detection pipeline raises a signal, an LLM-based agent picks it up and investigates it end-to-end. It gathers telemetry across our products, reconstructs what happened, and makes a well-documented determination about whether the activity is malicious. Over time, it will take on more of the work itself, growing from resolving routine cases to acting fast when it finds an attack and handing analysts cases with the evidence already assembled. This system is meant to augment our analysts, not replace them. It takes the high-volume, repetitive work off their plates so they can focus on complex cases and hands-on keyboard intrusions where human expertise matters most. It also reduces toil in the rest of their day by using LLMs to pre-process the output of the tools analysts use constantly, so they start from a clear picture instead of raw telemetry. This isn’t a chatbot bolted onto a dashboard. The system investigates a large volume of signals a day across thousands of customer organizations. Many signals are benign, but some are live intrusions where minutes matter. The telemetry the system reads comes from environments where attackers are actively operating. Because the system makes real decisions, like closing an investigation or isolating a host, it has to be right, it has to show its work, and it has to know when to hand off to a person. As a Senior Software Engineer on the Agentic SOC team, you’ll build and ship core parts of this system. You’ll work closely with the team’s technical leads, SOC analysts, product researchers, and product managers. You’ll own significant pieces end-to-end, from an ambiguous problem to a production feature you can show is working. We make full use of AI coding tools to enable you to accelerate your development. We don’t cap token usage. We expect you to use AI and all tools responsibly. Responsibilities: Build the investigation system. You design, build, and ship the components that make agentic investigation work: the tools agents use to query telemetry, the logic that drives an investigation, and the structured, evidence-backed output that analysts and customers see. Turn analyst expertise into agent behavior. You sit with SOC analysts and product researchers to understand how they triage and investigate a given kind of Signal, then encode that into what the agent looks for, what it gathers, and how it explains its conclusions. Take toil off analysts’ plates. You build LLM-powered features that pre-process the output of tools analysts use every day. They summarize, correlate, and highlight what matters, so analysts spend their time on judgment instead of assembly. Measure what you ship. You build and extend the evaluations that tell us whether the system is getting better or worse, and you back your changes with evidence rather than a handful of good-looking examples. Build with a security mindset. The agent reads attacker-influenced data, runs across thousands of customer tenants, and can take action in customer environments. You think about how what you build could be misused or manipulated, and you design for it. Build for production. You write reliable, observable, cost-conscious code that behaves well when models are slow, wrong, or unavailable. You operate what you build and help keep the system healthy as new detections and products come online. Collaborate and raise the bar. You give thoughtful code reviews, help teammates get unstuck, share what you learn about building with LLMs, and contribute to technical discussions and design reviews with clear reasoning about tradeoffs. Balance rigor with pragmatism. You know when to prototype quickly to learn something and when to slow down because the cost of being wrong is high. What You Bring To The Team: 6+ years of professional software development experience, including building and operating production backend systems Experience building applications with LLMs, including tool use, structured output, prompt and context design, and evaluation. Experience shipping agents to production is a strong plus An understanding of how LLM-based systems fail, and good habits for testing and debugging non-deterministic behavior Solid backend fundamentals, including APIs, background jobs and queues, concurrency, relational databases such as Postgres, and data stores such as Redis Strong skills in one or more backend languages and the ability to pick up new ones quickly. Our primary stack is Ruby on Rails. Prior Rails experience isn’t required, and we expect you to become fluent in it Security awareness: you think about untrusted input, access control, and keeping one customer’s data separate from another’s Curiosity about how security analysts think and work, and a willingness to spend real time learning from them Experience with AWS, Azure, or other public cloud environments Experience with AI coding tools, such as Claude Code BS or MS in Computer Science or Engineering, or equivalent experience Bonus Points: Experience working in or building for a SOC, incident response, threat hunting, or detection engineering. It isn’t required, but it helps a lot, because we build these workflows around how our analysts actually investigate Familiarity with endpoint, identity, and Microsoft 365 telemetry and with attacker tradecraft (e.g., MITRE ATT&CK) Experience building evaluation pipelines or datasets for ML or LLM systems Experience with Ruby on Rails What We Offer: 100% remote work environment - since our founding in 2015 Generous paid time off policy, including vacation, sick time, and paid holidays 12 weeks of paid parental leave Highly competitive and comprehensive medical, dental, and vision benefits plans 401(k) with a 5% contribution regardless of employee contribution Life and Disability insurance plans Stock options for all full-time employees One-time $500 reimbursement for building/upgrading home office Annual allowance for education and professional development assistance $75 USD/month digital reimbursement Access to the BetterUp platform for coaching, personal, and professional growth #BI-REMOTE Huntress is committed to creating a culture of inclusivity where every single member of our team is valued, has a voice, and is empowered to come to work every day just as they are. We do not discriminate based on race, ethnicity, color, ancestry, national origin, religion, sex, sexual orientation, gender identity, disability, veteran status, genetic information, marital status, or any other legally protected status. We do discriminate against hackers who try to exploit businesses of all sizes. Accommodations: If you require reasonable accommodation to complete this application, interview, or pre-employment testing or participate in the employee selection process, please direct your inquiries to accommodations@huntresslabs.com . Please note that non-accommodation requests to this inbox will not receive a response. Huntress uses artificial intelligence tools to assist in reviewing and evaluating job applications, including resume screening, skills assessment, and candidate matching and comparisons. These AI tools support our human recruiters in the initial review process, but do not make final hiring decisions without human involvement. By submitting your application, you acknowledge this use of AI in our recruitment process. Please review our Candidate Privacy Notice for more details on our practices and your data privacy rights. #BI-Remote

Location: AU: Melbourne: (260 Burwood Rd); AU: Sydney (45 Clarence St) Workplace: Hybrid The role and its impact When something goes wrong in security at Xero, our Response team are first on the scene. We're looking for a Senior Security Operations Analyst who loves incident response, enjoys building things, and wants a hand in shaping what a SOC looks like when AI agents are part of the team. You'll lead our complex investigations and take command of medium and high impact incidents, keeping people calm, decisions moving and stakeholders in the loop. When things settle down, you'll make sure what we learnt changes something, whether that's a detection, a runbook or the way we train. You'll also help us build. Our Analysts improve the queue as well as working it, so part of your time will go on creating automations and AI-assisted workflows that take repetitive work off the team and leave more room for the investigations that need a person. The team and how they connect Response is a follow-the-sun global team. You'll be in the Southern Hemisphere half, based in New Zealand or Australia, and at the end of your day you'll hand over to colleagues in the UK and North America, who hand back to us the next morning. You'll work business hours in your time zone and take a share of our on-call roster for after-hours incidents. You won't be doing it on your own. You'll join a cohort of Senior Analysts who share the load on complex work and lead our initiatives, with a Lead Analyst alongside for the hardest problems. Our XFLT, a cross-functional leadership team of Security Operations Managers, our Lead Analyst and our Product Manager, sets the direction and clears the way, so there's always someone to think out loud with. The team is currently working on / Initially, you will focus on We're building towards an agentic SOC, where AI agents and automation carry more of the first pass, and analysts direct them and step in where judgement matters. We're working through it carefully: which low-risk work agents can take on, where the guardrails and human approvals belong, and how we'll know it's working. People still make the big calls, because our robots aren't that good yet. You don't need to be an AI expert. We'd love you to be curious, to have tried a few things, and to want to help us get this right. You’ll also: - Lead complex investigations and step up as Incident Commander for medium and high impact incidents - Be a go-to escalation point for our Graduate, Associate and Analyst crew, and coach them through the tricky stuff - Run post incident reviews that lead to real change in detections, runbooks and training - Lead initiatives with our Product Manager and Security Operations Managers, turning goals into work that gets delivered - Build and improve automations and AI-assisted workflows, with guardrails and human sign-off where they matter - Work with our Defence engineers on detection and response logic, and test new capabilities in real incidents - Turn threat intelligence into practical action for Xero - Give customers and internal teams clear, timely answers to their security concerns Where and how you can work We support a flexible working model that empowers you to balance your professional and personal life. You will have the option to work in a hybrid capacity, combining the focus of remote work with the collaboration of our office spaces and team boost days to foster connection and alignment. Here are some of the things we're looking for Incident response comes first for us, so we're looking for: - Solid experience in security operations, and a real passion for incident response - A track record of leading complex investigations and incidents through to resolution, including coordinating people and making calls under pressure - Sound technical judgement and good knowledge of attack and defence techniques, particularly in cloud and SaaS environments - Confidence writing queries in a SIEM or log platform - Clear, calm communication and a generous approach to sharing what you know It'd be great if you also have: - Scripting skills (Python or similar) and experience building automations in a SOAR platform. We use Tines, and we're happy to teach it. - Hands-on experience with AI tools in security work, or a clear view of where they help and where they don't - Intermediate or advanced certifications in incident response, threat hunting or cloud security - Experience in a distributed team working across time zones If you're strong on incident response and the builder side is still growing, we'd still love to hear from you. You'll do work that matters to millions of small businesses and their advisors, in a team that shares what it knows and backs each other up, with a real say in how an AI-powered SOC works in practice. Apply even if your experience isn't a perfect match! At Xero, we hire based on your skills, passion, and the unique perspective you can bring to enhance our culture and team.

Location: Belgrade; Lisbon Workplace: OnSite Aghanim is an integrated commerce, liveops automation, community engagement, and payments platform for video games.   Mobile games have traditionally depended on app stores for distribution, payments, and player relationships. We believe there is a better way. Aghanim helps game studios build direct relationships with players, sell directly, and build their future on their own terms. Today, more than 100 games worldwide are already building this future with Aghanim.   Our team brings together people across Los Angeles, New York, Seoul, Beijing, London, Lisbon, Belgrade and other locations around the globe, with deep expertise in gaming, fintech and technology. We move quickly, keep communication direct, and focus on getting things done. We believe the best people thrive when they have autonomy, ownership, and a stake in the company's success. [https://app.ashbyhq.com/api/images/user-content/4f457f07-466b-477b-b552-fbbabd850111/2de3a7cd-8843-41a9-8bbe-ceb897a42c4a/Logo%20(horizontal).svg] We’re looking for a hands-on DevSecOps Engineer to build security into our cloud infrastructure and delivery pipelines. You’ll work closely with DevOps and development teams to establish practical security standards as our platform grows. KEY RESPONSIBILITIES - Own cloud security on GCP: IAM, org policies, network security, and edge protection with Cloudflare. - Harden our GKE clusters and container supply chain. - Build automated security checks into CI/CD (SAST, dependency, container, and IaC scanning). - Own secrets management and least-privilege access across the platform. - Drive vulnerability and cloud posture management to remediation. - Build security monitoring and lead incident response. - Actively drive SOC 2 Type 2 and PCI DSS Level 1 work: implement controls, prepare evidence. REQUIRED QUALIFICATIONS - 5+ years in DevSecOps, cloud security, or a security-heavy DevOps/Platform role. - Strong production experience with GCP (AWS/Azure acceptable). - Hands-on experience securing Kubernetes and Terraform-managed infrastructure. - Practical knowledge of CI/CD security, cloud IAM, secrets, vulnerability management, and security monitoring. - Ability to build security practices from scratch and get teams to adopt them. - Strong English communication skills. NICE TO HAVE - Experience with Cloudflare, Datadog, Wiz, Drata, or GitHub Actions. - Prior SOC 2 or PCI DSS audit experience. - Background in payments, gaming, or high-load products. WHY JOIN US - World-class team – work alongside experienced professionals from around the globe who have built products used by millions of players - High growth, high impact – be part of a fast-growing company where ideas turn into products and reach customers in days, not months - Autonomy and ownership – we trust people to make decisions, take initiative, and drive results - Modern tools and technology – use AI, automation, and modern tools as part of your everyday work - Equity – participate in the company's growth and long-term success

Location: Madrid, Spain Workplace: hybrid Are you ready to join our digital revolution journey?    At Aleph, we’re not just part of the digital advertising landscape—we’re shaping its future. Representing the world’s leading platforms, including TikTok, Amazon, Google, and nearly 55 others, we operate in 130+ markets across new and existing geographies.   Our mission is to empower advertisers and brands to unlock the full potential of these platforms' advertising capabilities. By fostering long-lasting partnerships, we create limitless opportunities for people and businesses to advertise effectively at both local and global levels.   With a presence spanning continents, Aleph offers you the chance to be part of a fast-growing, innovative team where your work makes a direct impact. If you’re ambitious, forward-thinking, and eager to thrive in a dynamic, global environment, Aleph is the perfect place to build your career. We are looking for an experienced and operationally sharp Security Operations & Incident Response Analyst (L3) to join Aleph's global IT Security team. Reporting to the Global CISO, you will be the first line of defence when incidents occur and the engine behind the team's threat detection and response capabilities. You will own the end-to-end incident response process, lead threat hunting and intelligence activities, and manage the vulnerability and identity governance programmes — ensuring Aleph is both able to detect threats quickly and respond to them effectively across a complex, globally distributed environment. What you'll do: Incident Response Own and coordinate the end-to-end incident response process : identification, triage, containment, eradication, recovery, and post-incident review (lessons learned). Serve as the primary point of contact for security incidents escalated from IT Operations, the Security Engineer, and external sources. Maintain and continuously improve incident response playbooks for the most relevant threat scenarios (ransomware, phishing, account compromise, data breach, insider threat, etc.). Manage the security incident log and register : track all incidents, document timelines and actions, and produce trend analysis and reporting for the CISO. Coordinate with external SOC or MDR providers where applicable: review daily reports, validate alert quality, and manage escalation workflows. Data Breach Management Lead data breach investigations : scope the breach, gather and preserve evidence, assess PII exposure, and coordinate response with Legal, Privacy, and HR. Produce breach investigation reports with findings, root cause, and recommendations. Threat Hunting & Intelligence Conduct proactive threat hunting across the environment: develop hypotheses based on threat intelligence, search for indicators of compromise (IoCs), and investigate anomalous behaviour. Manage the Threat Intelligence function : track relevant threat actors, TTPs (MITRE ATT&CK), and sector-specific threat campaigns; integrate intelligence into SIEM/XDR detection rules and hunting queries. Produce threat intelligence summaries and briefings for the CISO and relevant stakeholders. Vulnerability Management Own the vulnerability management programme : schedule and execute periodic vulnerability scans across infrastructure, endpoints, and cloud environments. Analyse scan results, prioritise findings by risk and exploitability, and coordinate remediation with IT Operations within agreed SLAs. Track remediation progress, produce vulnerability metrics, and report status to the CISO. Validate remediation effectiveness through re-scanning and spot-checks. Identity & Access Management (IAM) Manage periodic access reviews : coordinate with system owners and HR to review and certify user permissions across critical systems, ensuring least privilege is maintained. Oversee the Privileged Access Management (PAM) programme: define PAM policies, monitor privileged account usage, and review access rights for administrator-level accounts. Investigate and respond to identity-related anomalies and access policy violations. What we are looking for: 3–5 years in a SOC analyst, incident response, or security operations role, with at least 1–2 years at L3 level is a plus. Experience implementing or managing IAM and PAM solutions Experience working within international or multinational environments. Hands-on experience with incident response engagements (internal or consulting) is strongly valued. Relevant certifications: GCIH, GCFE, GCFA, CEH, CompTIA CySA+ , or equivalent. OSCP is a plus. Strong hands-on experience with SIEM platforms (alert triage, rule writing, query development) and EDR/XDR tools . Solid knowledge of the MITRE ATT&CK framework and its application to threat hunting and incident response. Experience conducting vulnerability scans using tools such as Tenable Nessus, Qualys, Rapid7, or similar. Familiarity with IAM and PAM concepts and platforms (e.g. CyberArk, BeyondTrust, Azure PIM, or equivalent). Experience with digital forensics and incident response (DFIR) methodologies: evidence collection, log analysis, and timeline reconstruction. Knowledge of threat intelligence platforms and feeds (e.g. MISP, VirusTotal, threat intel feeds). Understanding of ISO 27001 incident management controls, NIS2 incident reporting obligations, and PCI DSS requirement 12.10 . Calm and decisive under pressure. Strong investigative mindset with structured problem-solving approach, excellent documentation skills. Ability to communicate incident status and findings clearly to both technical teams and executive stakeholders. Collaborative and proactive, comfortable working asynchronously across time zones. English : full professional proficiency (C1/C2) — primary working language. Spanish : professional proficiency is a plus. In line with the EU Pay Transparency Directive, we are committed to fair and open compensation practices. For this role, the minimum gross annual base salary is EUR 48,000 EUR. In addition to base salary, this role includes a variable component, paid annually. The final offer will reflect your experience, skills, and the scope of the role.   #Aleph Why Join Us?   Aleph is a place of many cultures, perspectives, and talents. We support each other, creating an environment of giving and receiving. We value partnership and communication because we believe it takes a group of people to achieve great things. We are energized by our ever-changing industry, our curiosity keeps us learning and seeking out new opportunities.     We stay flexible and adaptable, and believe in moving with the speed of change. We encourage everyone to strive for more, providing our internal talent with growth opportunities and the ability to learn together.    #ALEPH

Location: Remote Workplace: Remote We are building AI to simulate the world through merging art and science. We believe that world models are at the frontier of progress in artificial intelligence. Language models alone won’t solve the world’s hardest problems – robotics, disease, scientific discovery. Real progress requires models that experience the world and learn from their mistakes, the same way that humans do. And this kind of trial and error can be massively accelerated when done in simulation, rather than in the real world. World models offer the most clear path to general-purpose simulation, changing how stories are told, how scientific progress is made and how the next frontiers of humanity are reached. Our team consists of creative, open minded, caring and ambitious people who are determined to change the world. We aspire to continuously build impossible things and our ability to do so relies on building an incredible team. If you are driven to do the same, we'd love to hear from you. *Titles posted to our careers page are updated regularly to best advertise the role and expected seniority, but internally we have a flat titling system with two types of titles: one for individual contributors and one for people managers. ABOUT THE ROLE Open to hiring remote — we also have offices in New York, San Francisco, Seattle, London, Paris, and Tel Aviv. Runway is hiring a Detection & Response Engineer to own how we find and stop attacks against our infrastructure, our research environment and our products. Securing a company that trains and serves frontier video models is a different problem from securing a typical SaaS product. The environment includes research compute, large training datasets, a fast-moving build pipeline and engineers who work inside AI-assisted tooling every day. Each of those changes what an attack looks like and what you need to see to catch it. You'll join the Security team and build our detection and response program the way an engineer would: detections as code, response as automation, evidence as something you can query. This is a role with real ownership: you'll own the detection program end to end, from what we log to how quickly we close an incident. You'll report to the head of security, partner with engineers across platform and research, and shape how this function grows from here. WHAT YOU'LL DO - Own detection and response end to end: what we log, what we alert on, how we triage and how we recover - Write and tune detections as code across multiple cloud environments, Kubernetes, identity systems, endpoints and SaaS, and measure them on coverage and precision rather than alert volume - Lead incident response from the first alert through containment and forensics, then write the post-incident review people actually read - Build automation that takes toil out of triage, including enrichment, correlation, containment actions and evidence collection, and use LLM-based tooling where it holds up under audit - Monitor AI agents and developer tooling operating inside our environment, and turn that into concrete telemetry and controls - Partner with platform and research engineers so new systems ship with logging and response playbooks in place on day one - Run threat hunts and tabletop exercises against the parts of the environment that worry you most, and fix what you find - Turn incident and detection metrics into evidence for SOC 2, ISO 27001 and enterprise customer security reviews, working with our GRC team - Participate in an on-call rotation for security incidents WHAT YOU'LL NEED - Hands-on incident response experience: you've triaged live alerts, led investigations and written up what happened afterward - Experience building and tuning detections in a modern SIEM, ideally managed as code - Working knowledge of how attackers move through cloud and Kubernetes environments (IAM abuse, container escape, credential theft, supply chain compromise) and what that leaves behind in logs - Comfort writing Python, Typescript, Rust or another language to automate response work and connect security tools - Familiarity with at least one major cloud platform and with Kubernetes at the level of audit logs, RBAC and workload identity - Clear writing. Incident timelines, detection documentation and updates to leadership are all part of the job - Judgment about what to alert on, what to automate and when to wake someone up EVEN BETTER IF YOU HAVE - Experience monitoring GPU or HPC-style infrastructure, or research environments with large datasets - Experience building detections or guardrails for AI agents, LLM tooling or MCP servers - Cloud forensics experience: disk and memory acquisition, cloud audit trail reconstruction, chain of custody - Published open source detection content Runway strives to recruit and retain exceptional talent from diverse backgrounds while ensuring pay equity for our team. Our salary ranges are based on competitive market rates for our size, stage and industry, and salary is just one part of the overall compensation package we provide. There are many factors that go into salary determinations, including relevant experience, skill level and qualifications assessed during the interview process, and maintaining internal equity with peers on the team. The range shared below is a general expectation for the function as posted, but we are also open to considering candidates who may be more or less experienced than outlined in the job description. In this case, we will communicate any updates in the expected salary range. Lastly, the provided range is the expected salary for candidates in the U.S. Outside of those regions, there may be a change in the range, which again, will be communicated to candidates. WORKING AT RUNWAY Great things come from great teams. https://www.youtube.com/watch?v=kwmj4ato2kw&ab_channel=Runway We’d love to hear from you. We’re committed to creating a space where our employees can bring their full selves to work and have equal opportunity to succeed. So regardless of race, gender identity or expression, sexual orientation, religion, origin, ability, age, veteran status, if joining this mission speaks to you, we encourage you to apply. More about Runway - Universal World Simulator https://runwayml.com/world-simulator.html - GWM-1 https://runwayml.com/research/introducing-runway-gwm-1 - Gen-4.5 https://runwayml.com/research/introducing-runway-gen-4.5 - General World Models https://runwayml.com/research/introducing-general-world-models - Robotics SDK https://runwayml.com/research/introducing-runway-gwm-1#robotics-section - Conversational Real-time Agents https://runwayml.com/research/introducing-runway-gwm-1#avatars-section - Runway Studios https://runwayml.com/studios We're excited to be recognized as a best place to work: Crain's https://www.crainsnewyork.com/awards/best-places-work-2023 | InHerSight https://www.inhersight.com/companies/best/city/new-york-city-ny | BuiltIn NYC https://builtin.com/awards/new-york-city/2024/best-places-to-work | INC https://www.inc.com/best-workplaces/2024

Location: PL Workplace: remote Overview: SOFTSWISS is hiring a Senior SOC Detection Engineer to join our Security Operations team. We are seeking a hands-on security professional to help build and develop our detection engineering function, strengthening the company’s ability to identify, investigate, and respond to security threats across Windows, Linux, and Kubernetes environments. Purpose of the role: You will be responsible for owning the full lifecycle of security detections, from researching attack techniques and defining logging requirements to developing, testing, deploying, and continuously improving detection content in Splunk. Your work will help enhance detection coverage, improve telemetry quality, reduce false positives, and ensure that security teams can reliably identify and respond to real threats. Key responsibilities: Develop, test, deploy, and maintain detection and correlation rules in Splunk or a similar SIEM. Translate incident investigations, threat hunting, and attack research into effective detections. Analyze false positives, false negatives, and detection gaps. Improve detection coverage and map detections to MITRE ATT&CK techniques. Develop and optimize SPL queries, dashboards, reports, and risk-based detections. Define requirements for logging, parsing, normalization, enrichment, and data quality. Develop monitoring and health checks for detection rules and data sources. Contribute to automated detection testing, synthetic events, telemetry replay, and CI/CD workflows. Participate in incident investigations, threat hunting, purple team exercises, and attack emulation. Collaborate with SOC, Incident Response, Threat Intelligence, Infrastructure, and Engineering teams. Document detection logic, data sources, dependencies, limitations, and expected behavior. Required Experience: Strong hands-on experience in SOC, Detection Engineering, Threat Hunting, Incident Response, or a related field. Deep understanding of MITRE ATT&CK, common attack techniques, and detection methodologies. Strong proficiency in Splunk SPL or another enterprise SIEM platform. Experience developing complex queries, correlations, dashboards, and reports. Practical experience tuning detections and managing exceptions and allowlists. Ability to define and evaluate logging and telemetry requirements. Proficiency in Python, PowerShell, or Bash for automation. Experience with Git, code reviews, APIs, and basic CI/CD practices. Understanding of Windows and Linux security monitoring. Ability to independently investigate complex problems and drive solutions to completion. Strong communication skills and the ability to work effectively across teams. Nice to have: Experience with Splunk Enterprise Security, CIM, data models, macros, and lookups. Experience with Sysmon, Windows security auditing, Active Directory, auditd, osquery, Tetragon, Docker, or Kubernetes. Experience with YARA, CALDERA, Shuffle, or other security automation and attack emulation tools. Experience building detection quality metrics and automated validation frameworks. Experience with Terraform, Ansible, or other infrastructure-as-code tools. Participation in security research, conferences, or the broader security community. Our technology focus: Splunk Enterprise Security, MITRE ATT&CK, Windows and Linux telemetry, Kubernetes and container logs, Python, PowerShell, Bash, Git, and CI/CD. Learn more about our hiring process here ( link ) – what to expect, how to prepare, and what makes SOFTSWISS different. Main Advantages Private health insurance Sports benefits Comprehensive Mental Health Program Free English lessons (online) Local language courses Paid time off Maternity leave support Referral program rewards Upskilling, internal workshops, and participation in professional conferences and corporate events

Location: Москва, удалённая работа или гибрид, RU; Россия О команде Наша команда защищает технологическую платформу и офисную инфраструктуру Авито. Мы используем множество современных технологий, поэтому вы получите ценный опыт в обеспечении их безопасности. Какие задачи вас ждут: обеспечивать комплексную безопасность корпоративной и продуктовой инфраструктуры компании; выстраивать непрерывный цикл мониторинга, детектирования и реагирования на киберугрозы; управлять командой SOC полного цикла; развивать процесс реагирования на инциденты информационной безопасности; развивать инфраструктуру и контентную базу SIEM и средств защиты информации; автоматизировать рутинные операции и оркестрировать процессы реагирования с помощью SOAR. Мы ждём, что вы: имеете глубокий практический опыт построения и управления SOC или руководства аналогичным подразделением защиты инфраструктуры; уверенно разбираетесь в процессах детектирования угроз и реагирования на инциденты; имеете глубокий практический опыт работы с SIEM — Elastic Stack, MS Sentinel и аналогами, EDR, средствами сетевой безопасности и автоматизации SOAR; понимаете специфику и имеете опыт моделирования угроз — threat modeling и оценки рисков информационной безопасности применительно к инфраструктурным компонентам и сервисам; имеете опыт управления командой инженеров SOC или смежных направлений от трёх человек: найм, наставничество, развитие инженеров L1/L2/L3; обладаете отличными коммуникативными навыками, умеете ясно доносить технические детали и уровень рисков до стейкхолдеров; эффективно взаимодействуете с DevOps, IT Ops, разработкой и смежными подразделениями в ходе инцидентов и плановых работ. Работа у нас — это: расширенная забота о здоровье: ДМС, страхование жизни, онкострахование; сервис психологической поддержки, а также финансовые, юридические и ЗОЖ-консультации для вас и ваших близких; корпоративный спорт: групповые тренировки, велбиинг-приложение; спецпредложения от партнёров и скидки на сервисы Авито: бронирование жилья, услуги продвижения, ипотечное страхование; компенсация питания; комфортные офисы с панорамным видом, питанием и зоной отдыха; прозрачная система целей и возможность влиять на приоритеты компании; возможность развиваться в сильной команде лидеров и помогать расти другим; чёткая матрица компетенций с прозрачными ожиданиями на всех уровнях; уникальный культурный код и сильное экспертное комьюнити; возможность работать с современными технологиями и инфраструктурой масштаба Авито; профессиональное развитие: обучение за счёт компании, курсы, тренинги, менторство.

Ищем hands-on DevSecOps / Security специалиста для проекта в сфере regulated crypto / fintech. Основная задача — разбирать результаты IT/Security-аудитов и технически закрывать выявленные vulnerabilities, security gaps и audit findings. Что важно: • DevSecOps / Application / Infrastructure / ICT Security; • DORA — обязательно; • MiCA, ISO 27001 или аналогичные стандарты; • опыт security/compliance-аудитов; • понимание regulated crypto / fintech; • умение самостоятельно делать remediation. Будет плюсом: Fireblocks, crypto custody, MPC, crypto exchanges, custodians, fintech/payment. Не рассматриваем чистых Compliance Officers, специалистов только по документации и Backend Developers без Security/DevSecOps опыта.

Location: Remote - US About Backblaze Backblaze is the object storage leader in the open cloud movement, fueling customer success with cloud storage built purposefully to unlock budgets, unburden administrators, and unleash innovators. Together with our partners, we’re helping customers break free from the restrictive, overpriced legacy solutions that hold them back, and blaze forward with the full power of the open cloud in their hands. Founded in 2007, we scaled the business with less than $3 million in outside funding until 2021, when we did a traditional IPO on the Nasdaq stock exchange. Today, Backblaze generates over $100m in revenue and is the leading specialized storage cloud - managing over three billion gigabytes of data storage for 500K+ customers in 175+ countries, including businesses, developers, IT professionals, and individuals. But while there is a lot to celebrate in our past, there is almost as much opportunity ahead of us. Backblaze is seeking a highly analytical, systems-oriented Director of Security Operations to drive the planning, forecasting, deployment, and optimization of hardware infrastructure across our global cloud storage platform. Role Overview The Director of Security Operations leads the organization's day-to-day cybersecurity operations across traditional and AI-enabled environments. Reporting to the CISO, the Director leads Security Operations while partnering closely with the Director of Security Architecture & Engineering. This is a hands-on technical leadership role requiring experience implementing and operating security controls as well as leading teams, incidents, and security programs. Key Responsibilities Lead security monitoring, incident response, threat hunting, security analytics, vulnerability management, adversary emulation, identity security, and operational resilience. Establish operational priorities, service objectives, metrics, playbooks, and processes based on organizational risk and business needs. Serve as incident commander for significant cybersecurity events and ensure lessons learned drive improvements to controls and operations. Drive responsible adoption of AI-assisted detection, investigation, vulnerability analysis, threat hunting, and response capabilities. Ensure effective security monitoring and response for AI applications, autonomous agents, workloads, and non-human identities. Use automation to reduce manual work and compress detection, analysis, containment, and remediation timelines. Partner with Security Architecture & Engineering to ensure controls are effectively designed, implemented, operationalized, monitored, and validated. Develop security talent and provide the CISO with clear reporting on incidents, exposure, operational performance, risk, and program maturity. Qualifications Experience leading Security Operations, Incident Response, Detection Engineering, Vulnerability Management, IAM, or related cybersecurity functions. Demonstrated hands-on experience implementing and operating security controls across cloud, infrastructure, applications, identity, endpoints, and networks. Strong technical understanding of security analytics, detection engineering, exposure management, adversary emulation, and identity security. Experience leading significant cybersecurity incidents and cross-functional response activities. Experience implementing security automation and AI-assisted operational capabilities. Strong leadership, mentoring, communication, and executive presentation skills. Experience in cloud-native or large-scale distributed environments and familiarity with modern cybersecurity and AI-risk frameworks is preferred. Backblaze Perks: Healthcare for family, including dental and vision Competitive compensation and 401K RSU grants for full-time employees ESPP program Flexible vacation policy Maternity & paternity leave MacBook Pro to use for work plus a generous stipend to personalize your  workstation Childcare bonus (human children only) Fertility treatment and support Learning & development program Commuter benefits Culture that supports a healthy work-life balance To provide greater transparency to candidates, we share base pay ranges for all US-based job postings regardless of state. We set standard base pay ranges for all roles based on function, level, and country location, benchmarked against similar-stage growth companies. Final offer amounts are determined by multiple factors, including candidate location, skills, depth of work experience, and relevant licenses/credentials, and may vary from the amounts listed below. The base pay range for this position is $205,000 - $230,000 At Backblaze, we value being fair and good to our customers, partners, and employees. That’s why diversity, equity, and inclusion are at the core of our values. We are committed to fostering a workforce where all employees feel a sense of belonging regardless of race, ethnicity, nationality, gender, sexual orientation, age, religion, socio-economic status, ability, veteran status, and education. We believe that our dedication to cultivating a diverse workspace not only allows us to better serve our customers in over 175 countries, but further reinforces our commitment to doing the right thing. We are proud to be an Equal Opportunity Employer. To understand more about the data we collect and process as part of your application, please view our Backblaze Employee Privacy Notice.

Location: Lisbon, Portugal About the Role iCapital is looking to hire a SOC Manager to join its Global Information Security team, based in Lisbon, Portugal. This role manages the day-to-day operations of the Security Operations Center (SOC) and leads the team of analysts who monitor, triage, and respond to security alerts. The SOC Manager provides situational awareness through detecting, containing, and resolving cyber security threats using a comprehensive set of technologies including IDS, IPS, DLP, SIEM, SOAR, AWS, SaaS Security, and firewall technologies. This is a people-management role focused on keeping the SOC running smoothly – coverage, runbooks, triage, and escalation – while developing the analyst team. The SOC Manager works closely with the Cyber Case Manager to ensure incidents flow into case management and are tracked through to closure, and partners with Threat Detection Engineering, Cloud Security, Incident Response, and other Information Security teams to strengthen the firm’s overall cyber resiliency. Based in Lisbon, the role helps provide security operations coverage across global time zones. This role reports to the Security Operations Leader. Responsibilities Manage the day-to-day operations of the Security Operations Center, ensuring monitoring, alerting, triage, and incident response run effectively across the operating day. Lead, mentor, and develop a team of SOC analysts – including scheduling, shift and on-call coverage, performance management, hiring, and onboarding. Establish and maintain runbooks, playbooks, incident-handling procedures, and daily, weekly, and monthly security checklists. Operate, tune, and manage the SIEM and SOAR platforms; maintain alerts and dashboards that surface key security events and provide security assurance. Triage and escalate incidents quickly and effectively, setting priorities for the SOC team and coordinating response with other teams across the firm. Partner closely with the Cyber Case Manager to ensure incidents flow into case management and are tracked to closure, and to keep the team aligned to case-driven priorities. Work alongside Threat Detection Engineering, Cloud Security, Incident Response, and other Information Security teams to improve the firm’s security posture. Measure and report on the state of the firm’s cyber security defenses, including operational metrics and regular reporting to leadership. Serve as an escalation point for high-severity incidents, including outside standard business hours as needed. Drive the evaluation, selection, and configuration of key security tools to enhance Cyber Security Operations. Qualifications 5-8 years of experience in security operations, including 1-3 years leading or managing a SOC or security operations team. Demonstrated people-management experience – leading, mentoring, scheduling, and developing analysts. Hands-on experience with the setup and management of a SIEM, preferably Splunk. Experience with SOAR and a strong understanding of the incident-response lifecycle and frameworks such as NIST and MITRE ATT&CK. Knowledge of Linux, Windows, and macOS operating systems. Experience with cloud infrastructure, AWS preferred. Strong coordination and stakeholder-management skills, with the ability to liaise across teams and report to leadership. Professional fluency in English to support a global team. Attentive, organized, and detail-oriented, with solid problem-solving and analytical skills. Excellent written and verbal communication skills.. We believe the best ideas and innovation happen when we are together. Employees in this role will work in the office four days, with the flexibility to work remotely one day (Friday). Benefits iCapital offers a comprehensive benefits package that includes a total compensation program consisting of competitive salary, annual performance bonus, and equity for all full-time employees; healthcare with 100% employer-paid health and dental insurance; and generous paid time off (PTO). For additional information on iCapital Network, please visit https://www.icapitalnetwork.com/about-us Twitter: @icapitalnetwork | LinkedIn: https://www.linkedin.com/company/icapital-network-inc

Location: New York; Stockholm; San Francisco Workplace: OnSite ABOUT US: AI NEEDS A NEW INFRASTRUCTURE LAYER. WE'RE BUILDING IT AT MODAL. Every era of computing brought new workloads that previous infrastructure couldn't support: mainframes, databases, and the cloud. Each time, the company that rebuilt the layer underneath defined the decade. AI is no different, except it touches everything instead of one slice, and the window to build the layer underneath it is open right now. Our customers include category-defining companies like Ramp https://modal.com/blog/how-ramp-built-a-full-context-background-coding-agent-on-modal, Cognition, DoorDash, and Suno. They rely on Modal for instant GPU access, sub-second container starts, and native storage, so it's simple to serve low-latency inference, fine-tune models, and access production-ready sandboxes at scale. We've passed $1B in annualized run rate, up 15x from a year ago. In October 2026 we raised a $750M Series D led by Accel at a $15.75B valuation. Our team includes creators of popular open-source projects (e.g.,Seaborn https://github.com/mwaskom/seaborn,Luigi https://github.com/spotify/luigi), academic researchers, international olympiad medalists, and experienced engineering and product leaders with decades of experience. THE ROLE: We’re looking for a Detection & Response Engineer to build the systems that help us identify, investigate, and respond to threats across our platform. This is an engineering role focused on automation. You’ll build detections, investigation tooling, and response capabilities that scale with our infrastructure, using AI where it meaningfully improves signal, investigation speed, and operational effectiveness. You’ll work closely with infrastructure, platform, and security engineers to ensure every incident makes the platform more resilient. WHAT YOU'LL WORK ON: Detection Engineering - Design and build high-fidelity detections for attacks, abuse, and anomalous behavior across our infrastructure and production systems - Continuously improve detections based on telemetry, threat intelligence, and lessons learned from incidents - Improve visibility across cloud infrastructure, containers, identity systems, and production services Incident Response - Lead or participate in investigations spanning production infrastructure, cloud environments, and internal systems - Build playbooks and automation that reduce investigation time and improve response consistency - Drive post-incident improvements that eliminate entire classes of future incidents Security Tooling & Automation - Build internal tooling that improves detection, investigation, and response workflows - Leverage LLMs to automate repetitive analysis, accelerate investigations, and surface actionable insights from security telemetry - Improve the collection, quality, and usability of security telemetry across the platform Engineering Partnership - Partner with engineering teams to ensure new systems are observable and secure by default - Help teams instrument services with the telemetry needed for effective detection and response - Drive security improvements that make the platform easier to defend over time YOU MAY BE A FIT IF: - You have experience in detection engineering, incident response, security engineering, or software engineering with a strong security focus - You have strong software engineering skills and experience building production systems. - You’ve investigated security incidents in cloud-native or distributed environments - You’re familiar with modern cloud infrastructure, Kubernetes, Linux, and networking - You’ve built detections using logs, telemetry, behavioral signals, or large-scale event data. - You have strong SQL skills for investigating security events and developing detections - You’re interested in applying AI and LLMs to detection, investigation, and response, and in understanding emerging threats involving AI-powered systems - You have strong written and verbal communication skills NICE-TO-HAVE: - Experience building AI- or LLM-powered security tooling - Experience with SIEM, SOAR, or EDR platforms - Experience with Kubernetes security or large-scale cloud infrastructure - Experience with threat hunting, malware analysis, or digital forensics - Experience contributing to security operations in a high-growth engineering organization

Location: United Kingdom What We Do: Cybercrime is growing, and more businesses are getting hit by threats that used to target only the biggest organizations. That pushes defenders like us to operate at the highest level, and it deepens our need for good people who want to make a meaningful impact. Founded in 2015 by former NSA cyber operators, Huntress is a remote-first team working to make enterprise-grade cybersecurity accessible to businesses of all sizes. We work closely with security teams and service providers protecting complex environments, often without the time or headcount to handle it all. That’s why we build our technology in-house and back it with a 24/7 human-led Security Operations Center (SOC). As a result, our platform is never disconnected from the experts who manage it, ensuring our customers' protection. Huntress now secures more than 6M endpoints and 17M identities worldwide. Those numbers keep growing because more businesses rely on us to help carry the load and operate with more confidence. Every day, you can see that commitment in how we stand with our customers and how we show up for each other. Reports to: Manager, Security Operations Center Location: Remote UK Compensation Range: £62,000 to £70,500 base plus bonus and equity What You’ll Do: Huntress is looking for a Security Operations Center Analyst to add to our growing team. In this role, you will get to triage, investigate, respond, and remediate a variety of intrusions on a daily basis. You’ll be surrounded by passionate individuals who are mission-driven to help protect companies around the world from cyber-attacks and will have daily opportunities to progress your analyst skillset and accelerate your career growth. The Huntress Security Operations Center is an elite team of individuals who wake up every day to combat threat actors. You will have daily opportunities to progress your analysis skills while being at the forefront of what’s happening in the wild. If you’re looking to accelerate your career and skills, this is the team for you! Responsibilities: Triage, investigate, and respond to alerts from the Huntress platform Perform tactical review of EDR telemetry, log sources, and forensic artifacts to determine the root cause of attacks where possible and provide remediations needed to remove the threat Perform tactical malware analysis as part of investigating and triaging alerts Investigate suspicious Microsoft M365 activity and provide remediations Assist in escalations from the Product Support team for threat-related and SOC-relevant questions Contribute to detection engineering creation and tuning efforts Contribute to projects focused on driving better outcomes for our analysts and partners Contribute to our collaboratively mentored team (we're all here to make each other better!) What You Bring To The Team: 2+ years experience in a SOC or Digital Forensics (DFIR) role Demonstrated experience with Windows, Linux, and MacOS as an attack surface Demonstrated experience with basic Threat Actor tools and techniques: (MITRE ATT&CK Framework, PowerShell & Command Prompt Terminals, WMIC, Scheduled Tasks, SCM, Windows Domain and host Enumeration Techniques, Basic Lateral Movement Techniques, Basic Persistence Mechanisms, Basic Defense Evasion Techniques, other offensive/Red Team TTPs) Demonstrated experience with static and dynamic malware analysis concepts Working knowledge of Windows Administration or Enterprise Domain Administration Active Directory, Group Policy, Domain Trusts, etc. Working knowledge of core networking concepts Common ports/protocols, NAT, Public/Private IPs, VLANs, etc. Working knowledge of web technologies and concepts Web servers/applications, OWASP top 10, etc. Effective communication skills, with the ability to explain complex events to less technical audiences, enabling effective cross-functional collaboration within the SOC and across departments Dedicated to prioritizing and addressing customer needs and concerns in all decision-making processes A strong sense of curiosity and a genuine excitement for learning Preferred Qualifications: Previous experience in an MSP/MSSP/MDR role Linux and MacOS investigative experience Experience with scripting languages (such as PowerShell, Python, Bash, PHP, JavaScript, or Ruby) Demonstrated experience on platforms such as HackTheBox, TryHackMe, Blue Team Labs Online, etc. Demonstrated experience with Cloud-based investigations such as M365, Azure, AWS, GCP, etc. Participation in cybersecurity competitions such as Capture the Flags, the Collegiate Cyber Defense Competition, etc. Familiarity with MSP tools such as RMMs What We Offer: 100% remote work environment - since our founding in 2015 New starter home office set-up allowance (€480) Generous personal leave entitlements Digital monthly reimbursement (€111) Travel to the US 1-2 times/year for various company events Pension Access to the BetterUp platform for coaching, personal, and professional growth Huntress is committed to creating a culture of inclusivity where every single member of our team is valued, has a voice, and is empowered to come to work every day just as they are. We do not discriminate based on race, ethnicity, color, ancestry, national origin, religion, sex, sexual orientation, gender identity, disability, veteran status, genetic information, marital status, or any other legally protected status. We do discriminate against hackers who try to exploit businesses of all sizes. Accommodations: If you require reasonable accommodation to complete this application, interview, or pre-employment testing or participate in the employee selection process, please direct your inquiries to accommodations@huntresslabs.com . Please note that non-accommodation requests to this inbox will not receive a response. Huntress uses artificial intelligence tools to assist in reviewing and evaluating job applications, including resume screening, skills assessment, and candidate matching and comparisons. These AI tools support our human recruiters in the initial review process, but do not make final hiring decisions without human involvement. By submitting your application, you acknowledge this use of AI in our recruitment process. Please review our Candidate Privacy Notice for more details on our practices and your data privacy rights. #BI-Remote

Location: Ireland What We Do: Cybercrime is growing, and more businesses are getting hit by threats that used to target only the biggest organizations. That pushes defenders like us to operate at the highest level, and it deepens our need for good people who want to make a meaningful impact. Founded in 2015 by former NSA cyber operators, Huntress is a remote-first team working to make enterprise-grade cybersecurity accessible to businesses of all sizes. We work closely with security teams and service providers protecting complex environments, often without the time or headcount to handle it all. That’s why we build our technology in-house and back it with a 24/7 human-led Security Operations Center (SOC). As a result, our platform is never disconnected from the experts who manage it, ensuring our customers' protection. Huntress now secures more than 6M endpoints and 17M identities worldwide. Those numbers keep growing because more businesses rely on us to help carry the load and operate with more confidence. Every day, you can see that commitment in how we stand with our customers and how we show up for each other. Reports to: Manager, Security Operations Center Location: Remote Ireland Compensation Range: €70,000 to €90,000 base plus bonus and equity What You’ll Do: Huntress is looking for a Security Operations Center Analyst to add to our growing team. In this role, you will get to triage, investigate, respond, and remediate a variety of intrusions on a daily basis. You’ll be surrounded by passionate individuals who are mission-driven to help protect companies around the world from cyber-attacks and will have daily opportunities to progress your analyst skillset and accelerate your career growth. The Huntress Security Operations Center is an elite team of individuals who wake up every day to combat threat actors. You will have daily opportunities to progress your analysis skills while being at the forefront of what’s happening in the wild. If you’re looking to accelerate your career and skills, this is the team for you! Responsibilities: Triage, investigate, and respond to alerts from the Huntress platform Perform tactical review of EDR telemetry, log sources, and forensic artifacts to determine the root cause of attacks where possible and provide remediations needed to remove the threat Perform tactical malware analysis as part of investigating and triaging alerts Investigate suspicious Microsoft M365 activity and provide remediations Assist in escalations from the Product Support team for threat-related and SOC-relevant questions Contribute to detection engineering creation and tuning efforts Contribute to projects focused on driving better outcomes for our analysts and partners Contribute to our collaboratively mentored team (we're all here to make each other better!) What You Bring To The Team: 2+ years experience in a SOC or Digital Forensics (DFIR) role Demonstrated experience with Windows, Linux, and MacOS as an attack surface Demonstrated experience with basic Threat Actor tools and techniques: (MITRE ATT&CK Framework, PowerShell & Command Prompt Terminals, WMIC, Scheduled Tasks, SCM, Windows Domain and host Enumeration Techniques, Basic Lateral Movement Techniques, Basic Persistence Mechanisms, Basic Defense Evasion Techniques, other offensive/Red Team TTPs) Demonstrated experience with static and dynamic malware analysis concepts Working knowledge of Windows Administration or Enterprise Domain Administration Active Directory, Group Policy, Domain Trusts, etc. Working knowledge of core networking concepts Common ports/protocols, NAT, Public/Private IPs, VLANs, etc. Working knowledge of web technologies and concepts Web servers/applications, OWASP top 10, etc. Effective communication skills, with the ability to explain complex events to less technical audiences, enabling effective cross-functional collaboration within the SOC and across departments Dedicated to prioritizing and addressing customer needs and concerns in all decision-making processes A strong sense of curiosity and a genuine excitement for learning Preferred Qualifications: Previous experience in an MSP/MSSP/MDR role Linux and MacOS investigative experience Experience with scripting languages (such as PowerShell, Python, Bash, PHP, JavaScript, or Ruby) Demonstrated experience on platforms such as HackTheBox, TryHackMe, Blue Team Labs Online, etc. Demonstrated experience with Cloud-based investigations such as M365, Azure, AWS, GCP, etc. Participation in cybersecurity competitions such as Capture the Flags, the Collegiate Cyber Defense Competition, etc. Familiarity with MSP tools such as RMMs What We Offer: 100% remote work environment - since our founding in 2015 New starter home office set up reimbursement (£398) Generous personal leave entitlements Digital monthly reimbursement (£92) Travel to the US 1-2 times/year for various company events Pension Access to the BetterUp platform for coaching, personal, and professional growth Huntress is committed to creating a culture of inclusivity where every single member of our team is valued, has a voice, and is empowered to come to work every day just as they are. We do not discriminate based on race, ethnicity, color, ancestry, national origin, religion, sex, sexual orientation, gender identity, disability, veteran status, genetic information, marital status, or any other legally protected status. We do discriminate against hackers who try to exploit businesses of all sizes. Accommodations: If you require reasonable accommodation to complete this application, interview, or pre-employment testing or participate in the employee selection process, please direct your inquiries to accommodations@huntresslabs.com . Please note that non-accommodation requests to this inbox will not receive a response. Huntress uses artificial intelligence tools to assist in reviewing and evaluating job applications, including resume screening, skills assessment, and candidate matching and comparisons. These AI tools support our human recruiters in the initial review process, but do not make final hiring decisions without human involvement. By submitting your application, you acknowledge this use of AI in our recruitment process. Please review our Candidate Privacy Notice for more details on our practices and your data privacy rights. #BI-Remote

Location: Remote - Europe About Nebius: Nebius is leading a new era in cloud infrastructure for the global AI economy. We are building a full-stack AI cloud platform that supports developers and enterprises from data and model training through to production deployment, without the cost and complexity of building large in-house AI/ML infrastructure. Built by engineers, for engineers. From large-scale GPU orchestration to inference optimization, we own the hard problems across compute, storage, networking and applied AI. Listed on Nasdaq (NBIS) and headquartered in Amsterdam, we have a global footprint with R&D hubs across Europe, the UK, North America and Israel. Our team of 1,500+ includes hundreds of engineers with deep expertise across hardware, software and AI R&D. Detection and Response The Detection and Response team is responsible for detection engineering, threat intelligence, and incident response across Nebius Cloud. Its goal is to improve and maintain Nebius's security monitoring capabilities, as well as to build and maintain an end-to-end Security Incident Response program - people, processes, and tools. The Role We're hiring a Detection & Response Engineer to build and run our D&R capability from the ground up. You'll work on detection engineering, threat intelligence, and incident response functions across Nebius Cloud. You'll be responsible for detection development, handling complex security incidents, forensics, and shaping the D&R strategy. What you’ll do Detection development: maintain low false-positive and false-negative rates. Work closely with alerts consumers (20+ teams) to keep noise low and signal high, ensuring they can act quickly without missing genuine threats. Architect and operate detection coverage across our cloud and bare-metal environments Build and extend our internal D&R tools and pipelines - onboard new logs, build and automate response runbooks. Integrate threat intelligence into detection logic and IR playbooks, tracking adversary TTPs relevant to Cloud infrastructure Lead incident response end-to-end: scoping, containment, root cause analysis, post-incident reviews and controlling critical action items are closed to prevent future possible incidents. Partner with Compliance and Engineering teams to detect real threats while meeting the needs of both engineers and regulators. Define and report on D&R metrics: MTTD, MTTR, detection coverage, false positive rates, etc. Build and maintain Security Incident Response program: people, processes, tools. Build tools, runbooks, and on-call processes that scale as the company grows. What we look for 6+ years in security operations, detection engineering, or incident response. Deep hands-on experience with cloud-native environments (Kubernetes, Linux workloads, container-based infrastructure). Strong detection engineering skills: writing and tuning rules/detections in SIEM platforms (e.g., Chronicle, Splunk, Elastic) and SQL. Experience building or operating SOAR workflows and automating response at scale (ideally with Golang and Temporal). Working knowledge of threat intelligence frameworks (MITRE ATT&CK, Pyramid of Pain, Kill Chain ) and how to operationalize them in detections. Solid IR fundamentals: memory forensics, log analysis, network traffic analysis, and post-incident reporting. Stakeholder management: able to coordinate across engineers, compliance, legal, executives during active incident phase. Serve as the primary owner and driver for complex changes, as a result of incidents post-mortem. Nice to have Experience with AI/ML and GPU clusters related threats. Familiarity with eBPF-based detection or runtime security tooling (Falco, Tetragon). Background in threat hunting. Why this role at Nebius Build D&R at a company scaling from startup to global infrastructure provider in real time. Ability to evolve our internal D&R platform into a new cloud security product, delivering novel security observability for a range of neocloud customers - from big tech to AI startups. Work alongside world-class engineers on infrastructure that powers frontier AI. Competitive compensation with equity upside in a Nasdaq-listed, high-growth company. Flexible, remote-first culture. Hiring Process Recruiter's chat (30mins) Live-coding interview (60mins) to asses basic coding skills Security interview (60mins) to asses domain expertise Incident Response interview (90mins) to assess practical experience Final interview to close the hiring process (45mins) #LI-CP1 Benefits & Perks: Competitive compensation Career growth and learning opportunities Flexibility and ownership Collaborative and innovative culture Opportunity to work on impactful AI projects International environment and talented teams What's it like to work at Nebius: Fast moving - Bold thinking - Constant growth - Meaningful impact - Trust and real ownership - Opportunity to shape the future of AI Equal Opportunity Statement: Nebius is an equal opportunity employer. We are committed to fostering an inclusive and diverse workplace and to providing equal employment opportunities in all aspects of employment. We do not discriminate on the basis of race, color, religion, sex (including pregnancy), national origin, ancestry, age, disability, genetic information, marital status, veteran status, sexual orientation, gender identity or expression, or any other characteristic protected by applicable law. Applicants must be authorized to work in the country in which they apply and will be required to provide proof of employment eligibility as a condition of hire. If you need accommodations during the application process, please let us know.

Обязанности: — Развертывание и поддержка облачной инфраструктуры в AWS (IaC через Terraform) — Администрирование…

Задачи: — Развертывание и поддержка облачной инфраструктуры в AWS (IaC через Terraform) — Администрирование кластеров Kubernetes (EKS) и управление деплоем через Helm — Настройка, оптимизация и защита пайплайнов в GitLab CI и GitHub Actions — Внедрение инструментов сканирования уязвимостей (SAST/DAST) и управление секретами в HashiCorp Vault — Настройка сквозного мониторинга и логирования (Prometheus, Grafana, ELK/Loki, Sentry), оперативное реагирование на инциденты — Участие во внедрении и поддержании практик информационной безопасности по стандарту ISO 27001 — Настройка и поддержка веб-серверов (Nginx), управление VPN, SSL/TLS сертификатами и DNS Требования: — Уверенное знание Linux (Ubuntu/RHEL) и владение Bash для автоматизации — Практический опыт работы с AWS (EKS, IAM, S3, RDS) и Ansible — Глубокое понимание процессов контейнеризации (Docker, Kubernetes) и автоматизации CI/CD — Понимание принципов сетевой безопасности, опыт работы с криптографическими протоколами и системами управления секретами — Знание принципов и практический интерес к внедрению стандартов безопасности ISO 27001 Условия: — Официальное оформление в соответствии с регламентом МФЦА (AIFC) — График работы 5/2, гибкий гибридный формат (сочетание офиса в Алматы и удаленки) с гибким началом дня — Стабильная заработная плата — Интересные и динамичные digital-проекты (включая AI-интеграции и масштабные веб-платформы) — Сильная техническая команда, минимум бюрократии и открытость к вашим технологическим инициативам

Location: Hong Kong, Hong Kong SAR Who We Are At OKX, we believe that the future will be reshaped by crypto, and ultimately contribute to every individual's freedom. OKX is a leading crypto exchange, and the developer of OKX Wallet, giving millions access to crypto trading and decentralized crypto applications (dApps). OKX is also a trusted brand by hundreds of large institutions seeking access to crypto markets. We are safe and reliable, backed by our Proof of Reserves. Across our multiple offices globally, we are united by our core principles: We Before Me , Do the Right Thing , and Get Things Done . These shared values drive our culture, shape our processes, and foster a friendly, rewarding, and diverse environment for every OK-er. About the Opportunity We are looking for a Security Operations Engineer who combines hands-on engineering skills with security operations expertise. You will be deeply involved in the operations and troubleshooting of both server-side and client-side components within our Zero Trust architecture, drive security risk governance initiatives, and leverage AI tools to continuously improve system stability and compliance. Key Responsibilities K8s Operations & Vendor Engagement: Develop deep expertise in K3s / Kubernetes, including version management and disaster recovery. Independently identify and reproduce system issues, proactively engage with vendors to drive root cause analysis and resolution — not just workarounds. Zero Trust Network Access Governance: Work closely on Zero Trust initiatives, participate in cluster network configuration and troubleshooting, identify device compliance risks, drive remediation of non-compliant devices, and continuously optimize access control policies. Monitoring & Observability: Build and continuously improve log monitoring systems; proactively surface system risks through alert rules and trend analysis. AI Agent Implementation: Lead the adoption of AI Agents in security operations — design and deploy AI Agent workflows for log analysis, alert triage, and automated incident remediation (e.g., Multi-step Agents using Claude / GPT with tool-calling), reducing manual intervention and improving response efficiency. Requirements Must Have Solid understanding of Kubernetes / K3s core concepts; able to independently diagnose cluster-level issues. Foundational knowledge of security principles and Zero Trust model; strong networking fundamentals with the ability to independently troubleshoot and analyze network connectivity issues. Hands-on experience with AI tools (e.g., Claude, Codex, or equivalents) for day-to-day tasks including log analysis, scripting, fault diagnosis, and documentation. Bachelor's degree or above in Computer Science, Information Security, Network Engineering, or a related field; 3–5 years of relevant experience. Nice to Have Experience with DACS / NAC or similar device access control system operations or risk governance. Familiarity with monitoring and logging platforms such as Prometheus + Grafana, ELK, or Loki. Hands-on experience building AI Agents or implementing tool-calling workflows. Proven track record of collaborating with external vendors to drive issue resolution. Who You Are AI-Forward: You actively explore and integrate AI tools into your daily workflow to boost efficiency. Owner Mindset: You take genuine ownership of system health — you don't just close tickets. Strong Communicator & Driver: You can clearly articulate technical issues and effectively push cross-functional teams and vendors toward resolution. Self-Starter: You don't wait to be told — you proactively spot problems and drive them to closure. Perks & Benefits Competitive total compensation package L&D programs and Education subsidy for employees' growth and development Various team building programs and company events Wellness and meal allowances Comprehensive healthcare schemes for employees and dependants More that we love to tell you along the process! Please note that Hong Kong is a group-level service hub, and OKX does not carry on a business of operating a virtual asset trading platform in Hong Kong. Notice: All official OKX vacancies are published on this website. While roles may appear on selected third-party platforms from time to time, information on other sites may be inaccurate or outdated. If in doubt, please apply directly through our official careers website. Information collected and processed as part of the recruitment process of any job application you choose to submit is subject to OKX 's Candidate Privacy Notice .