Location: Riyadh, KSA
Workplace: onsite
We're looking for an Information Security Specialist (GRC) to join Tabby! The successful candidate will independently execute governance, risk, and compliance activities across the Tabby's information security programme.
Key Responsibilities
Information Security Governance
Maintain and update the information security governance framework documentation, policy library, and associated standards and procedures.
Draft and revise information security policies, standards, and baselines, ensuring alignment with applicable regulatory requirements and business objectives.
Monitor and track changes in legal, regulatory, and contractual requirements affecting information security (SAMA CSF, PDPL, NCA ECC, PCI-DSS), updating the compliance register accordingly.
Maintain and update role and responsibility matrices (RACI), information security governance committee documentation, and reporting packs.
Coordinate security governance committee meetings — preparing agendas, minutes, and action tracking.
Produce internal and external communication materials related to information security governance, policies, and programme updates.
Information Risk Management
Execute information security risk assessments independently, applying the organization's risk assessment methodology and producing complete risk registers with identified threats, vulnerabilities, likelihood, impact, and treatment plans.
Maintain and update the information asset register — tracking asset owners, classifications, and associated risk profiles.
Lead business impact assessment (BIA) data collection activities, coordinating with asset owners and business units to capture accurate recovery objectives and criticality ratings.
Conduct control effectiveness evaluations for key information security controls, documenting findings and escalating gaps to the Lead for treatment.
Coordinate third-party information security risk assessments — preparing assessment questionnaires, reviewing vendor responses, and producing risk summaries.
Integrate risk and vulnerability data into procurement reviews, project onboarding, and change management processes.
Prepare periodic risk reports for senior review, highlighting emerging risks, significant changes in the risk profile, and the status of risk treatment actions.
Compliance & Programme Development
Monitor the organization's compliance posture against SAMA CSF, NCA ECC, PDPL, ISO 27001, and PCI-DSS — tracking control status, identifying gaps, and coordinating remediation.
Coordinate internal and external audit activities — gathering evidence packages, liaising with auditors, tracking findings, and monitoring remediation progress.
Support the preparation of regulatory submissions, self-assessments, and compliance attestations required by SAMA, NCA, and PCI Council.
Maintain and enhance the security awareness programme — developing training materials, scheduling communications, and tracking completion metrics.
Monitor KPIs and KRIs for the information security programme, preparing accurate and timely dashboards for senior management review.
Support the integration of information security requirements into procurement, project management, and change control processes.
Cross-Functional & General GRC Support
Maintain the information security policy, standard, and procedure library — managing version control, review cycles, and distribution.
Support information security initiatives across business and technology teams, providing GRC subject matter expertise on projects and change programmes.
Conduct information classification reviews and document security requirements for key business and IT projects.
Deliver information security awareness sessions and materials to targeted staff groups.
Provide analytical support for GRC team reporting, data gathering, and programme tracking activities.
Skills, Knowledge and Expertise
Bachelor's degree in Information Technology, Computer Science, Software Engineering, Cybersecurity, Risk Management, or a related field.
1–3 years of professional experience in information security governance, risk management, compliance, or a closely related field. Hands-on experience with risk assessment execution, policy development, or compliance monitoring is required. Prior exposure to SAMA CSF, ISO 27001, PDPL, or NCA ECC requirements is a strong advantage. Experience in a regulated Fintech or banking environment is preferred.
ISO 27001 Foundation or Lead Implementer (preferred). CompTIA Security+ or equivalent.
Working toward CRISC (Certified in Risk and Information Systems Control) or CISM.
Benefits
We are an international team of inspired professionals located all over the globe.
We have an inclusive company culture, embracing diversity, integrity and transparency. We strive for work-life balance and cherish the moments you spend with your loved ones, off-work. In the same spirit as for our product, we are caring and nurturing for our employees.
Our people are granted 100% trust and freedom to apply their own vision and come up with their ideas from day 1 at Tabby. You are the one who takes responsibility for your area of work. We encourage everyone to think and make decisions like Tabby was their own business, well because it is. Our employee stock options programme is available for everyone.
You will have an opportunity to learn and grow in one of the fastest growing fin tech companies in the region
We offer you relocation support as well as we guide you through all the process.
We’ll set you up with the devices required for your work.
ОфисWe offer you relocation support as well as we guide you through all the process
Location: Israel - Office - Tel Aviv
Who is Tenable?
Tenable® is the Exposure Management company. Over 40,000 organizations around the globe rely on Tenable to understand and reduce cyber risk. Our global employees support 65 percent of the Fortune 500, 50 percent of the Global 2000, and large government agencies. Come be part of our journey!
What makes Tenable such a great place to work?
Ask a member of our team and they’ll answer, “Our people!” We work together to build and innovate best-in-class cybersecurity solutions for our customers; all while creating a culture of belonging, respect, and excellence where we can be our best selves. When you’re part of our #OneTenable team, you can expect to partner with some of the most talented and passionate people in the industry, and have the support and resources you need to do work that truly matters. We deliver results that exceed expectations and we win together!
Your Opportunity:
Tenable Research is seeking a Senior Security Researcher - Cloud Security to join our highly technical product research team working at the core of our cloud security platform.
This is a rare opportunity to join an elite research team and do work that directly shapes our product. In this role, you will define how vulnerabilities in cloud assets are understood, enriched, and remediated. As AI floods production with vulnerabilities, you design the model and system that keeps teams ahead of it.
You will define the foundation for how cloud vulnerabilities are treated across the platform, from reachability and exploitability to effective resolution. Your work will directly shape product direction and set the standard for what handling vulns at scale actually means.
We are looking for an exceptional researcher who can bridge cloud security, application security, and vulnerability management. You are curious, comfortable with ambiguity, and driven to deeply understand how vulnerabilities manifest and how they are fixed across cloud environments and code.
Your Role:
Own Vulnerability Management Across Tenable's Cloud Security Platform: Define cloud vulnerability management by grounding findings in how exposure is actually created and what resolving it means for organizations. Collaborate with engineering and product teams to introduce the signals and data that validate exploitability and drive remediation. Establish the standard for what separates an actionable finding from a theoretical one.
Research Exploitability and Risk Context: Research how the security context around a finding affects its real-world risk and what resolving it looks like. Define how these factors shape prioritization and remediation across the platform.
Lead Remediation Research: Define how vulnerabilities across cloud and code map to the fixes that resolve them, and drive AI innovation in how remediation is understood and delivered at scale. Work with engineering and product to build the capabilities that close the loop from detection to resolution.
Publish and Present: Share research through technical blogs, reports, and leading industry conferences.
What You'll Need:
5+ years of hands-on experience in security research
Familiarity with real-world vulnerability management: triage, prioritization, remediation, and the gap between CVSS and actual impact
Strong technical background in cloud platforms (AWS, Azure, GCP), including how vulnerabilities manifest across workloads, services, and code
Familiarity with application security tooling
Highly curious, self-driven, and comfortable working in ambiguous, fast-evolving problem spaces
Strong communication skills, both written and verbal, with the ability to clearly articulate complex technical findings
And Ideally:
Experience with exploit research, full-chain attack analysis, or CVE-to-fix resolution across complex dependency chains
Experience leveraging AI and agentic workflows for security research and analysis
Background in application security, secure code review, or supply chain security
Hands-on experience with SBOM tooling, container scanning, or software composition analysis pipelines
Track record of published research, conference talks, or technical blog posts
Experience working with product teams and delivering value to customers through the product
We’re committed to promoting Equal Employment Opportunity (EEO) at Tenable - through all equal employment opportunity laws and regulations at the international, federal, state and local levels. If you need a reasonable accommodation due to a disability during the application or recruiting process, please contact
Recruiting@Tenable.com
for further assistance.
Tenable Data Consent Statement
Tenable is committed to protecting the privacy and security of your personal data. Depending on your location, one or more of the following notices may apply to you:
General Applicant Privacy Notice
California Applicant Privacy Notice
EU/EEA/UK Applicant Privacy Notice
Location: Remote - US
Founded in 2012, Bugcrowd is the preemptive security platform that unifies exposure discovery and assessment, offensive testing, and intelligence shaped by AI and human insight to help organizations avoid, discover, and validate real-world risk. Bugcrowd helps security teams move faster by identifying the exposures that matter most so they can act first and stay ahead of attackers. By combining the power of humans and AI, teams can preempt attack paths and prevent breaches. Based in San Francisco and New Hampshire, Bugcrowd is supported by General Catalyst, Rally Ventures, Costanoa Ventures, and others. Visit
www.bugcrowd.com
.
Job Summary
The Bugcrowd RL and Reasoning Team focuses on pushing the boundaries of autonomous cybersecurity by building authentic, verifiable reinforcement learning environments for world-leading foundational AI companies. As a Reinforcement Learning Engineer specializing in Reinforcement Learning from Verifiable Rewards (RLVR), you will design and scale automated verification pipelines that transform real-world software vulnerabilities into deterministic reward functions. In this role, you will bridge the gap between low-level security analysis and modern LLM reasoning models, engineering environments where AI agents learn to discover, exploit, and remediate software vulnerabilities with mathematical certainty. Instead of relying on subjective human feedback, your work directly powers the rigorous, verifiable reward signals that teach next-generation frontier AI models how to master complex cybersecurity domain logic. You will work at the intersection of fuzzing, dynamic program analysis, system exploitation, and scalable ML infrastructure to shape the safety and offensive/defensive capabilities of future artificial intelligence.
Essential Duties and Responsibilities
Design, build, and deploy high-throughput RLVR (Reinforcement Learning from Verifiable Rewards) environments that evaluate LLM action sequences against deterministic execution outcomes.
Develop automated test harnesses, sandboxes, and verification engines that convert complex vulnerability research (e.g., memory corruption, web security, logic bugs) into binary pass/fail reward signals.
Integrate Bugcrowd’s Mayhem automated analysis platform and real-world vulnerability feeds into continuous, scalable RL environment generation pipelines.
Architect safe, isolated, and highly reproducible execution environments (using Docker, BuildKit, or Nix) capable of running thousands of simultaneous agent-driven exploitation and patching trajectories.
Collaborate directly with researchers at frontier AI labs including Anthropic, OpenAI, and Cohere to define standard benchmark formats, observation spaces, and verifiable evaluation metrics for cybersecurity tasks.
Implement precise telemetry, ground-truth verification algorithms, and trajectory logging to analyze agent reasoning paths and prevent reward hacking or false positives.
Build low-level instrumentation and debugging tools to monitor memory states, process executions, and network behaviors during agent interaction cycles.
Optimize infrastructure performance and environment reset latency to support massive-scale parallel sampling and distributed RL training workflows.
Benchmark and evaluate frontier AI model performance across diverse offensive and defensive security challenges, such as automated fuzzing, exploit payload generation, and patch validation.
Education, Experience, Knowledge, Skills, and Abilities
Understanding of RL training workflows used by modern LLM systems, specifically execution-based feedback or Reinforcement Learning from Verifiable Rewards (RLVR).
Proficiency developing applications in Python and low-level systems programming in C, with Rust experience being a strong plus.
Solid understanding of software vulnerabilities, binary exploitation, fuzzing methodologies, or program analysis.
Experience with DevOps pipelines (e.g., GitHub Actions), reproducible builds (Docker, BuildKit, Nix), and comfort working with Linux systems and low-level debugging.
Experience working with or building benchmark environments (e.g., CTFs, SWE-bench, security challenges, or execution sandboxes).
Preferred Experience
Experience designing custom reward functions, ground-truth verifiers, or automated grading engines for AI safety and reasoning models.
Background in low-level program analysis tools, sanitizers (e.g., ASan/MSan), compiler instrumentation, or automated exploit generation tools.
Proven track record of participating in or developing competitive cybersecurity benchmarks, CTFs, or open-source AI evaluation frameworks.
Working Conditions and Physical Requirements
The ideal candidate must be able to complete all physical requirements of the job with or without reasonable accommodation.
Sitting and / or standing - Must be able to remain in a stationary position 50% of the time
Carrying and / or lifting - Must be able to carry / move laptop as needed throughout the work day.
Environment - remote, work-from-home 100% of the time.
Pay Range Disclosure
At Bugcrowd, we strive for fairness, equality and to create an environment that allows our people to perform at their very best. Our compensation philosophy is to foster a collaborative community that rewards, attracts and retains the best possible talent. The provided salary details are based on US national averages and we retain the flexibility to tailor to the needs of the business.
The national estimate for the current base range for the position of $176,400 - $242,550.
This position may also be eligible to participate in a discretionary bonus program or commission plan, subject to the rules governing the program, whereby an award, if any, depends on various factors, including, without limitation, individual and organizational performance.
Culture
At Bugcrowd, we understand that diversity in the workplace is vital to a company’s success and growth. We strive to make sure that people are included and have a sense of being part of making Bugcrowd not only a great product but a great place to work.
We regularly hear from both customers and researchers that Bugcrowd feels like a family, and we strive to maintain that internally as well.
Our team consists of a broad range of people: musicians, adventure sports junkies, nature lovers, parents, cereal enthusiasts, night owls, cyclists, artists—you get the point.
At Bugcrowd, we are solving security threats and vulnerabilities that are relevant to everyone, therefore we believe solving these problems takes all kinds of backgrounds. We value the perspectives and experiences people from underrepresented backgrounds bring.
Disclaimer
This position has access to highly confidential, sensitive information relating to the technologies of Bugcrowd. It is essential that the applicant possess the requisite integrity to maintain the information in the strictest confidence.
The company is authorized to obtain background checks for employment purposes under state and federal law. Background checks will be conducted for positions that involve access to confidential or proprietary information (including trade secrets).
Background checks may include Social Security verification, prior employment verification, personal and professional references, educational verification, and criminal history. Applicants with conviction histories will not be excluded from consideration to the extent required by
law.
Any personal data you submit in connection with your application will be processed in compliance with Bugcrowd's Privacy Policy, which you may review here:
https://www.bugcrowd.com/privacy
.
Equal Employment Opportunity:
Bugcrowd is EOE, Disability/Age Employer.
Individuals seeking employment at Bugcrowd are considered without regards to race, color, religion, national origin, age, sex, marital status, ancestry, physical or mental disability, veteran status, gender identity, or sexual orientation.
Bugcrowd is committed to the full inclusion of all qualified individuals. In keeping with our commitment, Bugcrowd will take the steps to assure that people with disabilities are provided reasonable accommodations. Accordingly, if reasonable accommodation is required to fully participate in the job application or interview process, to perform the essential functions of the position, and/or to receive all other benefits and privileges of employment, please contact HR at ADA at bugcrowd.com.
Apply at:
https://www.bugcrowd.com/about/careers/
Location: Remote; Portugal; Armenia; Serbia; Poland
Workplace: Remote
We are looking for a hands-on DevSecOps Engineer to join a fast-growing software development company delivering fintech and iGaming products. In this role, you will take ownership of security across cloud infrastructure, CI/CD pipelines, and development processes, helping build secure and scalable products.
Responsibilities:
- Drive the evolution of the company’s DevSecOps function by defining security initiatives, long-term priorities, and promoting a security-first engineering mindset
- Partner with the DevOps team to improve the security and resilience of Kubernetes (EKS), Istio, Service Mesh, and related cloud-native infrastructure
- Support engineering teams during service transitions by embedding security best practices into operational processes and ensuring effective knowledge sharing
- Develop and maintain policy-as-code frameworks and infrastructure validation mechanisms using technologies such as OPA and other compliance automation tools
- Improve the security of infrastructure provisioning and deployment workflows across Terraform, Ansible, and other Infrastructure-as-Code solutions
- Integrate, maintain, and optimise security testing and scanning capabilities throughout the software development and release lifecycle
- Build automation around security monitoring, compliance checks, and operational controls to increase efficiency and reduce manual effort
Requirements:
- Strong practical understanding of modern DevOps principles and secure CI/CD pipeline design
- Hands-on experience with Kubernetes or other enterprise-grade container orchestration platforms
- Proven experience working with Infrastructure-as-Code and configuration management technologies such as Terraform, Ansible, Chef, or equivalent tools
- Solid background in administering production infrastructure, including web servers, databases, and supporting services
- Good understanding of networking concepts, including TCP/IP, routing principles, and the OSI model
- Experience securing distributed systems and microservices-based architectures
- Proficiency with Git or other source code version control platforms
- Practical experience securing cloud environments, preferably AWS, though experience with GCP or other major cloud providers is also valuable
- Ability to assess infrastructure security posture, identify vulnerabilities, and implement appropriate remediation measures
- Experience implementing identity and access management controls together with security automation practices
- Hands-on knowledge of secrets management platforms (such as Vault) and Privileged Access Management (PAM) solutions
- Experience integrating SAST, DAST, dependency scanning, container scanning, or similar security tooling into CI/CD workflows
- Good understanding of Secure Software Development Lifecycle (SSDLC) principles and familiarity with security maturity frameworks such as OWASP SAMM v2
- English level: Upper-intermediate or higher
What’s in it for you:
- Fully remote working format
- Competitive salary based on experience
- Paid annual leave and sick leave
- Opportunities for professional and career growth
- Supportive environment focused on continuous development and long-term growth
Location: London, United Kingdom
Senior Business Development Associate
In a Nutshell
Senior Business Development Associates bring ideas, initiatives, and activities that help grow our business day in and day out. They join, support, and collaborate with teams focused on specific opportunities, ensuring that the pursuit of new business is rigorous, disciplined, and ethical. They collaborate closely to craft strategies and plans and set the standard for creative excellence in business development.
About IDEO London
We're a global design consultancy where curiosity, empathy, and solving complex challenges drive us. For over 40 years, we've partnered with clients to innovate in healthcare, mobility, education, retail, and beyond. Here, every challenge is a chance to grow, connect, and create impact.
Why is this role important for IDEO's work?
Business Development is at the heart of connecting IDEO's creative capabilities with the people and organisations who need them. It's about more than winning new work. It's about understanding our clients' challenges, building trusted relationships, and helping shape opportunities where human-centred design can make a meaningful difference.
Once Here You Will
BUSINESS DEVELOPMENT PROCESS
Prioritize your time to collaborate and support the London Studio in landing project work - with new and returning clients.
Run pipeline meetings.
Act as an IDEO ambassador and be the first touch point for new potential clients, ensuring a positive initial experience with IDEO.
Lead and manage opportunity qualification, owning continuity of the BD process.
Involve internal leadership and designers as needed for boosts and to help determine strategic fit, frame opportunities, scope programs and articulate next steps.
Pull in director-level support as needed for advocating for client needs and negotiation support.
Finalize pitch decks, learn the industries of our client leads by conducting research and editing proposal decks, and brainstorm client deliverable options and consulting solutions.
Conduct client due diligence to help BD teams get smart and prepare for calls, creating intelligent discussion guides that help us start to build a relationship with potential clients from Day One.
Monitor and communicate market trends and themes to teams on a monthly basis that can be used to help shape our thinking and offer.
REPORTING
Track quarterly goals pertaining to recognized revenue, monthly profit and yield marks, time to close, conversion rate, qualification rate, and win rate KPIs within the London Hub. Report back in the pipeline meetings, looking for ways to engage the team in the information and how they need to apply it.
Be familiar with metrics that point towards the health of the business and be able to assist with ad-hoc reporting needs as assigned.
Prepare a monthly summary of insights and thought leadership (from IDEO and beyond), including how it applies to day-to-day business, to share with key clients as a value add.
DATA INTEGRITY
Work with the Director/Enterprise team to ensure the CRM system is kept up to date, including our pipeline and pre-pipeline in Hubspot.
Ensure that relevant documents related to BD are being stored and filed accordingly in the BD section of Google Drive (not on personal drives or Slack!).
Appropriately loop in Legal, Marketing, Finance, and other functions as needed to progress an ongoing BD process.
Build and maintain lists in Hubspot and LinkedIn Sales Navigator: who are our key clients, our lapsed clients, our warm contacts, the cold contacts we want to reach? Who’s engaging with our newsletters, with our LinkedIn, etc? Provide recommendations on how we might reach out to these folks.
PROGRAM MANAGEMENT
Exercise project management tactical skills by effectively steering the BD process for new and existing work.
Proactively identify and take action on the business development process and client needs based on what we’re hearing and seeing in the pipeline meetings.
Coordinate meetings with potential leads, ensure prompt and adequate follow-ups, manage legal agreement workflows, coordinate proposal research across teams, and ensure continual progress to meet client deadlines.
Help the team balance meeting the needs of existing clientele with prioritizing time for proactive outreach to land new clients.
Own and project manage lead generation activities, such as BD-specific mailers to LON Hub mailing lists.
Support account planning activities to drive a proactive, consistent approach to client investment and development.
Support the deployment of the right expertise and experience from within the hub team towards client pursuits
COMMUNICATION
Demonstrate persuasive and effective communication and presentation skills along with the confidence to command a room for the client and network-building meetings or events.
Contribute to providing excellent team and client communication and collaboration that shows an understanding of leading with empathy, openness, and curiosity.
Empower other team members to consistently gather and share inspiration, work, and learnings with teams and clients. This should come through leading by example as well as having a knowledge management system where folks can exchange and store content.
Strengthen existing assets and develop new ones in collaboration with subject matter experts.
Work with LON Hub Marketing to stay abreast of competitors and any impact that industry and economic changes and movements might have on our go to market positioning and offer.
NETWORK BUILDING
Demonstrate knowledge of the different approaches across each of our three offer sets, and understand the different areas of expertise of our design disciplines to confidently speak to our capabilities in the market.
Build cross-discipline relationships across IDEO in order to effectively help generate and capture written, verbal and visual input from IDEO leadership and design teams to potential client leads.
Cultivate your internal networks as well as you professional networks virtually on social media channels and live at education and industry-related associations.
Support top-of-funnel growth activity including working with the Executive Director of Growth, Marketing and portfolio teams to translate targeting priorities into actionable prospect audiences and lists for campaigns, events, roadshows and other market-facing activity.
EXPLORE
Strengthen your foundational BD skills and capabilities, using your learning budget intentionally to build on growth opportunities identified with your business lead.
Gain an understanding of GenAI and how it can support and improve the BD process, from generating client intelligence to scoring our RFP responses.
Support special projects as needed and provide support on other processes and projects outside the immediate area of responsibilities as required.
Assist with internal programs and initiatives to improve organizational BD efforts, as required.
Be an active member of the London community, coming into the office as needed, playing a role in our core rituals, such as Tuesday Morning Meetings, participating in SASU, and attending Hub gatherings.
We're looking for someone with
SKILLS
Minimum of 3-5 years of relevant experience in client relationship management and business development, preferably within a creative environment and/or design consultancy.
Project management skills with proven ability to prioritize tasks, keep momentum and develop timelines, involve and engage stakeholders, and maintain empathy for both internal and client teams.
The ability to create and deliver presentations, proposals, and other assets.
Data literacy: fluent in G-suite (slides, docs, and sheets), Workday, CRM, and translating quantitative outputs into actionable qualitative insights for the business.
Exceptional writing and communication skills to effectively and efficiently bridge between IDEO and its clients.
Strong presentation and writing skills
Ability to conduct and synthesize research
Attention to Detail: Demonstrates concern for the details and their impact on the larger picture.
Familiarity with a wide range of market analysis tools, data sets, and benchmarks.
Comfort determining next steps in ambiguous situations with limited direction.
Ready to pitch in on tasks, big or small. Volunteer and helper mindset.
Desire to collaborate across various design disciplines
Take chances without being afraid to fail and learn along the way
Insatiable curiosity to learn more about businesses, industries, markets, and what drives them
MINDSET
Ground in Self-Awareness: Reflect on your biases and lenses to be more inclusive.
Show Curiosity: Question accepted norms to make room to learn from more diverse voices.
Lean into Vulnerability: Build trust by being open.
Ask for and give consistent and timely feedback on personal performance.
Be optimistic
Collaborate
Embrace ambiguity
Talk Less, Do more
Learn from failure
Make others successful
Take ownership
What does IDEO offer you?
Innovation and creativity:
Dive into a variety of projects from creating breakthrough digital products and experiences, to designing new customer interactions, to building innovation capabilities – working alongside talented individuals across disciplines.
Learning and growth:
Whether it’s strengthening your project leadership, deepening your interaction design craft or exploring new technologies, we’re here to support your journey.
Community and well-being:
Collaboration and community are central to what we do. We foster moments for creativity, connection, and reflection, respecting the need for work-life balance.
Projects with purpose:
We partner with clients to use design as a means of realising their purpose and making a positive impact. We work 'upstream,' from defining the problem, designing possible solutions, and exploring what, why and how they might be brought to life.
Compensation
£55,000 - 60,000 GBP, depending on experience
Location
London, UK
Some Previous Projects To Check Out
To get a flavour of the work we do in London, take a look at these case studies:
Climate action for SMBs
– Designing a strategy and experience to help Sage’s SMB customers transition to net zero.
Redefining retail with FEMSA
– Designing Spin Premia, a digital loyalty experience connecting everyday shopping at OXXO with rewards and services.
Sustainable packaging system
– Helping H&M increase their sustainability and growth, by designing and scaling a universal packaging system for all of their brands.
Commitment to Diversity
At IDEO, we are committed to the work of advancing diversity, equity, and inclusion within our organisation and in the world. Our purpose of having disproportionate, world-changing impact through design is directly connected to our ability to bring many different perspectives to the table. This applies to our candidates, the people we hire, the clients and customers we serve, and the communities we learn from in our research.
As a human-centred organisation, we are committed to working with and designing for people of every race, ethnicity, gender identity, sexual orientation, age, socio-economic status, physical ability or attribute, religion, national origin, or political belief. We recognize that this commitment requires ongoing work and sustained attention, as well as adaptation to new insights and best practices
Application Requirements And Instructions
If you identify with our values, are excited about great design, and would like to contribute to our community, we would love to see your CV, a cover letter and examples of your work.
Location: San Francisco Bay Area, USA
Workplace: Hybrid
Why work at Higgsfield AI?
Higgsfield AI is the fastest-scaling generative AI company in history, hitting $1B in annual revenue run rate, 30M+ users worldwide, 6M+ generations per day, and powering 390 of Fortune 500 brands.
We're building at the absolute frontier of AI-powered video creation and next-generation creative tools. Joining Higgsfield means becoming part of a high-impact team shaping the future of AI-native experiences, at a company that isn't just moving fast, but rewriting what fast looks like.
About the role:
Higgsfield AI is looking for a hands-on Member of Technical Staff, Product Security to identify and eliminate security vulnerabilities across our rapidly evolving AI products and platforms.
As we build agentic systems, code-generating agents, generative AI models, and enterprise applications, you'll play a critical role in securing new features before they reach production.
Working closely with Product and Engineering, you'll conduct offensive security testing, identify architectural weaknesses, and drive fixes to their root cause. You'll also turn recurring vulnerabilities into scalable security standards and automated controls.
We're looking for someone with a proven track record of finding real vulnerabilities in production systems, strong technical judgment, and the ability to work directly with engineers to build more secure products.
WHAT YOU'LL DO
OFFENSIVE SECURITY & VULNERABILITY RESEARCH
- Conduct hands-on penetration testing of new products and features, including web applications, APIs, and administrative interfaces.
- Identify security risks across agentic systems, MCP servers, code-generating agents, and AI-powered applications.
- Independently map attack surfaces and uncover authorization, authentication, and multi-tenant isolation vulnerabilities.
- Develop proof-of-concept exploits, validate findings, and retest remediation efforts.
SECURE DESIGN & APPLICATION SECURITY
- Partner with Engineering early in product development to identify and prevent security flaws before release.
- Conduct threat modeling, architecture reviews, and security-focused code reviews.
- Analyze complex codebases to trace vulnerabilities to their root cause and recommend effective fixes.
- Assess security risks across generative AI products, user-deployed applications, and enterprise features such as SSO and role-based access controls.
SECURITY ENGINEERING & AUTOMATION
- Translate recurring vulnerabilities into secure development standards, reusable controls, and automated security checks.
- Build security tooling and integrate preventive controls into development and CI/CD workflows.
- Identify systemic weaknesses and implement solutions that prevent entire classes of vulnerabilities.
- Apply cloud, container, and infrastructure security knowledge to investigate vulnerabilities across the application stack.
TECHNICAL OWNERSHIP & COLLABORATION
- Own security findings from discovery through remediation, working directly with engineers to implement lasting fixes.
- Prioritize vulnerabilities based on exploitability, business impact, and real-world risk.
- Establish practical security standards that enable rapid product development without compromising security.
- Help define security practices for emerging AI technologies and new product architectures.
WHAT WE'RE LOOKING FOR
- 5+ years of hands-on experience in product security, application security, penetration testing, or vulnerability research.
- Proven track record of independently discovering and exploiting real vulnerabilities through application security work, bug bounty programs, or security research.
- Deep understanding of web application and API security, including authentication, authorization, and multi-tenant isolation.
- Strong ability to read and analyze modern codebases, identify root causes, and collaborate with engineers on remediation.
- Experience conducting threat modeling, secure design reviews, and hands-on penetration testing.
- Proficiency in scripting or programming languages such as Python, JavaScript, TypeScript, or Go.
- Familiarity with cloud infrastructure, containers, and modern application architectures.
- Ability to translate security findings into scalable engineering controls and automated checks.
- Strong technical judgment, independent problem-solving skills, and a proactive approach to identifying security risks.
Compensation & Benefits
- We offer a competitive and thoughtfully structured compensation package designed to align with impact, experience, and long-term growth.
- Base Salary: The anticipated salary range for this role is $200,000 - $300,000, depending on experience, skills, scope, and location.
• Bonus: This role is Bonus eligible and may participate in the Company's discretionary annual bonus program.
- Equity: In addition to cash compensation, employees are eligible to participate in the company’s stock option program and share in Higgsfield’s long-term growth.
- Benefits: We offer a comprehensive benefits package designed to support employees professionally and personally, including medical, dental, and vision insurance, a competitive 401(k) retirement plan with company matching, and additional benefits and perks.
- The opportunity to work on ambitious AI products alongside a highly experienced, fast-moving, and international team.
- Significant ownership, direct impact, and opportunities for professional growth as the company scales.
This is a hybrid role based in the San Francisco Bay Area. Team members are expected to work from our San Francisco office three full days per week, with the remaining days worked remotely and are expected to be available during agreed working hours and to maintain sufficient overlap with the relevant team’s time zone. We value in-person collaboration, active communication, responsiveness, and close partnership across teams.
Higgsfield AI is an equal opportunity employer. We are committed to building a diverse and inclusive team and do not discriminate on the basis of race, color, religion, sex, gender identity or expression, sexual orientation, national origin, age, disability, veteran status, or any other protected characteristic.
Location: Remote - US
About Backblaze
Backblaze is the object storage leader in the open cloud movement, fueling customer success with cloud storage built purposefully to unlock budgets, unburden administrators, and unleash innovators. Together with our partners, we’re helping customers break free from the restrictive, overpriced legacy solutions that hold them back, and blaze forward with the full power of the open cloud in their hands.
We’re seeking a
Senior Manager, Site Reliability Engineer
to join our team and help ensure the stability, scalability, and reliability of Backblaze production systems.
About the Role
We are seeking an experienced Senior Manager to lead within our Site Reliability Engineering (SRE) organization. The ideal candidate brings deep experience developing engineering strategies, leading high-performing technical teams, and translating reliability priorities into measurable outcomes.
As a leader at Backblaze, you will work across the organization to help achieve our reliability and operational goals, including partnering with engineering leaders, executives, customers, and other key stakeholders. This role will focus on unlocking the potential of our engineers through observability, automation, operational excellence, and continuous improvement.
What You'll Do
Hire, lead, mentor, and develop a high-performing team of Site Reliability Engineers, including coaching, career development, and performance management.
Manage other engineering managers as required and help develop leadership capability within the organization.
Establish team goals, objectives, and reliability priorities, ensuring commitments are delivered or expectations are proactively reset when circumstances change.
Collaborate with engineering leaders across Backblaze to define strategic priorities and execution plans.
Develop and improve automation that accelerates the deployment of new storage vaults, core servers, and supporting infrastructure.
Own and improve vulnerability management and patching schedules to ensure contractual, operational, and security requirements are met.
Drive complex reliability initiatives from problem discovery through implementation and resolution.
Partner with engineering teams to improve observability, monitoring, and alerting and provide meaningful insight into the health and performance of Backblaze infrastructure.
Lead analysis of SLA and reliability performance, identify areas of risk, and drive corrective actions.
Participate in leadership on-call rotations, major incident response, and post-incident reviews to continuously improve service reliability.
Provide leadership during incidents and ensure root cause analyses, corrective actions, and follow-up work are completed effectively.
Apply established ITIL and operational processes across incident, change, problem, and capacity management.
Partner with Engineering, Customer Success, Product, and Operations teams to support resilient system design and reliable production operations.
Engage with customers to understand their reliability needs and ensure stability priorities reflect customer experiences and business requirements.
Work with vendors and service providers to troubleshoot service issues and monitor SLA performance.
Lead cross-functional initiatives to identify gaps in observability, operational processes, reliability, and infrastructure management.
Identify recurring operational issues and develop long-term strategies and action plans to address them.
Document systems, share learnings, and promote a reliability-focused engineering culture across Backblaze.
The Right Fit
10+ years of experience in site reliability engineering, systems engineering, infrastructure, or production operations, including significant engineering leadership experience.
Demonstrated experience building, managing, mentoring, and developing high-performing technical teams.
Experience leading reliability or infrastructure organizations operating large-scale, production-grade systems.
Strong understanding of deploying and managing large fleets of Linux hosts, with a strong emphasis on automation.
Strong knowledge of observability and monitoring technologies such as VictoriaMetrics, Prometheus, Grafana, OpenSearch, or comparable platforms.
Experience establishing operational procedures, runbooks, incident processes, and reliability practices at scale.
Strong understanding of storage systems, including storage performance, sharding, distributed architectures, and storage algorithms.
Understanding of load-balancing technologies and services, including IPVS or comparable technologies.
Experience managing security-focused infrastructure operations, including patching, hardening, vulnerability identification, and remediation.
Demonstrated ability to lead major incidents and post-incident processes, including root cause analysis and corrective action planning.
Experience using automation and AI-assisted technologies to improve engineering productivity, system performance, operational efficiency, or scalability.
Ability to independently take ownership of complex problems and drive initiatives from discovery through resolution.
Strong communication and collaboration skills, with the ability to work effectively with engineers, executives, customers, vendors, and cross-functional stakeholders.
Bachelor's degree in Computer Science, Engineering, or a related field, or equivalent practical experience.
Bonus Points For
Experience operating infrastructure at hyperscale or within a hyperscaler environment.
Experience in SaaS, cloud infrastructure, service provider, storage, or large-scale distributed systems environments.
Experience with object storage or other large-scale storage platforms.
Familiarity with ITIL or OSS operational practices.
Experience defining, managing, and improving SLOs and SLAs.
Experience with AWS, Google Cloud Platform, Microsoft Azure, or other major cloud platforms.
Experience leading teams through significant infrastructure scaling, reliability, or operational transformation initiatives.
Backblaze Perks
Equity grants for eligible full-time employees.
Annual company bonus program.
Medical, dental, and vision benefits for eligible employees and family members.
401(k) program.
Employee Stock Purchase Plan.
Flexible vacation policy.
Parental leave benefits.
MacBook Pro and workstation support.
Childcare support.
Fertility treatment and family-building support.
Learning and development opportunities.
Commuter benefits where applicable.
A culture that supports a healthy work-life balance.
To provide greater transparency to candidates, Backblaze shares base pay ranges for U.S.-based positions. Compensation ranges are established based on factors including function, level, and location. Final offers may vary based on candidate location, relevant experience, skills, and applicable licenses or credentials.
The expected salary range for this role is $178,000 - $210,000.
At Backblaze, we value being fair and good to our customers, partners, and employees. That’s why diversity, equity, and inclusion are at the core of our values. We are committed to fostering a workforce where all employees feel a sense of belonging regardless of race, ethnicity, nationality, gender, sexual orientation, age, religion, socio-economic status, ability, veteran status, and education. We believe that our dedication to cultivating a diverse workspace not only allows us to better serve our customers in over 175 countries, but further reinforces our commitment to doing the right thing. We are proud to be an Equal Opportunity Employer.
To understand more about the data we collect and process as part of your application, please view our
Backblaze Employee Privacy Notice.
• Формирование и развитие программы проактивного выявления угроз и Threat Hunting в Компании, включая методологию, приоритизацию исследований, hunting backlog и критерии оценки результатов;
Location: Armenia; Georgia; Poland; Estonia; Azerbaijan; Romania
Intetics Inc.
, a global technology company providing custom software application development, distributed professional teams, software product quality assessment, and “all-things-digital” solutions, is seeking a highly skilled and experienced
Senior PHP Engineer
to join our dynamic team.
The client is a leading company specializing in advanced cybersecurity solutions. They provide comprehensive security measures designed to protect sensitive data and systems from cyber threats. Their offerings include vulnerability management, threat intelligence, incident response, and compliance management. With cutting-edge technology and a team of experts, they ensure robust protection for organizations across various industries, helping clients stay ahead of evolving cyber threats and maintain a secure digital environment.
Responsibilities
Take end-to-end ownership of QA for a new .NET-based product as the sole QA engineer.
Define and implement the testing strategy, test plans, quality standards, and release readiness criteria.
Select appropriate automation tools and build a maintainable test automation framework from scratch.
Design, implement, and maintain automated tests covering critical functionality, integrations, and end-to-end workflows.
Perform manual and exploratory testing to validate new features and identify issues beyond automated coverage.
Integrate automated tests into CI/CD pipelines and ensure reliable, actionable test results.
Collaborate with developers and product stakeholders to clarify requirements, identify edge cases, and improve testability early in development.
Investigate defects, document reproducible findings, and verify fixes.
Drive release quality by assessing test coverage, communicating risks, and providing clear release readiness recommendations.
Requirements
Proven experience in a Senior QA or QA Automation role, with the ability to independently own the full QA lifecycle.
Experience establishing QA processes and building test automation frameworks from scratch.
Strong hands-on programming skills in at least one language used for test automation; no specific language is required.
Solid understanding of test design techniques, risk-based testing, and selecting appropriate levels of test coverage.
Experience testing APIs, backend services, and integrations.
Ability to combine automated, manual, and exploratory testing effectively.
Experience integrating automated testing into CI/CD pipelines and working with Git.
Strong troubleshooting skills, including working with logs, test data, and databases.
Ability to select tools pragmatically, prioritize testing activities, and work independently in a new project with evolving requirements.
Clear communication skills and the ability to explain quality risks to technical and non-technical stakeholders.
Nice to Have
Experience testing .NET-based applications or programming in C#.
Previous experience as the sole QA engineer on a product.
Experience with performance, load, or security testing.
Experience with containerized test environments and Docker.
Location: Brazil
About the Role
Join Alvys, an early-stage company transforming the $800B US freight industry. As a DevSecOps Engineer, you'll help protect our platform and the customer data it holds. You'll close cloud security gaps, build security checks into how we ship software, run our penetration testing program, and stand up the infrastructure behind our internal security, IT, and AI tools. This role combines hands-on infrastructure work with coordination across DevOps, engineering teams, IT & Security, and outside security vendors.
Industry Insight
Freight companies run their business on Alvys: loads, drivers, carriers, payments, and financial records. As more of the industry moves to modern software, customers expect that data to be protected like any other business-critical system. Security is part of how we earn and keep their trust.
About Alvys
Alvys is building a multi-tenant SaaS platform that powers modern transportation operations. We combine deep industry knowledge with strong technical execution to bring clarity, automation, and reliability to one of the world's most essential industries. Security is a shared responsibility at Alvys, and this role helps every team meet that bar.
Our Principles
Engineering Principles
Build for Real-World Impact.
Our users rely on Alvys to solve real problems, not abstract ones. Every security fix should reduce real risk to our platform and the people moving freight every day, not just clear a scanner finding.
Extreme Ownership and Empowerment.
Ownership extends beyond building. It means being accountable for quality, reliability, and customer impact. If it's in production, it's yours: bugs, uptime, and results.
Technology Debt is Strategic, Not Accidental.
Technical debt is a strategic choice, not an oversight. We incur it deliberately when it unlocks speed, learning, or market advantage. Our architecture remains clean, maintainable, and scalable as we grow.
Simplicity Scales; Complexity Costs.
Logistics is inherently complex, but our technology shouldn't be. We prioritize simplicity in our architecture, leveraging modularity and well-defined service boundaries to reduce cognitive load.
Radical Transparency.
We democratize data and make it accessible across all functions to drive alignment and decision-making. Transparency also means feedback. We systematize constructive feedback loops to ensure growth.
Engineering Culture
Move Fast, Learn Fast.
Speed is our advantage, but we move fast intentionally. We bias for action, assume positive intent, and treat every mistake as a learning opportunity.
Own the Outcome.
Every engineer owns outcomes, not tickets. We take responsibility end-to-end, identifying problems, delivering solutions, and ensuring they last.
Partner, Don't Gatekeep.
Security works best when it's built with the teams who own the systems. We share context with DevOps and engineering teams, explain the risk behind each ask, and make the secure path the easy one.
Pragmatism Over Purism.
Perfect security doesn't exist, but reduced risk does. We choose fixes that scale, are maintainable, and address real threats, not theoretical ones.
People Over Heroics.
We don't reward burnout or always-on behavior. Sustainability is a feature, not a luxury. If someone needs to slow down, unplug, or take care of life outside work, that's expected.
Responsibilities
Cloud security architecture
Design and deliver infrastructure changes that strengthen our cloud security posture, including network isolation and identity-based access.
Make these changes through infrastructure as code, plan rollouts that avoid customer downtime, and work with service owners to update the applications that depend on them.
Build secure defaults into our infrastructure modules so new resources start out compliant.
Vulnerability management and pipeline security
Help run our vulnerability management program, driving remediation within defined SLAs.
Extend our existing security scanning with AI-assisted security testing, such as automated security code review and AI-driven penetration testing.
Tune and improve the automation we already use to process security findings.
Penetration testing
Manage our third-party penetration tests from start to finish: scoping and targeting, test environments and accounts, vendor coordination, findings intake, and retesting.
Help mature our internal, AI-assisted penetration testing tool into a dependable part of the security program, including deployment and scheduled runs.
Infrastructure for security, IT, and AI tooling
Deploy and operate internal applications in Azure, with identity, secrets, networking, and backups set up correctly from day one.
Build telemetry pipelines (OpenTelemetry into Azure Monitor) for our AI and internal tools, with dashboards and alerts that surface anomalous activity.
Working with others
Partner with DevOps, engineering teams, and IT & Security to plan and prioritize work.
Write clear runbooks and documentation, and produce evidence for our SOC 2 program.
Tech Stack
Cloud: Azure (AKS, App Service, Azure Functions, Storage, Key Vault, Cosmos DB, VNets, Microsoft Entra ID)
Infrastructure as code: Terraform
CI/CD: GitHub Actions and Azure DevOps pipelines
Containers: Docker, Kubernetes, Azure Container Registry
Observability: Azure Monitor, App Insights, Log Analytics, OpenTelemetry, Grafana
Security: Aikido, Cloudflare
AI tooling: Cursor, Claude, Claude Platform (managed agents), Grokbot
Application code: .NET/C#, TypeScript, Angular, React
Minimum Qualifications
Fluent in English, spoken and written.
3+ years of professional experience in DevOps, cloud infrastructure, platform engineering, or security engineering.
Hands-on experience with at least one major cloud provider (Azure, AWS, or GCP), including networking, identity and access management, and secrets management.
Production experience with infrastructure as code, preferably Terraform.
Experience building and maintaining CI/CD pipelines.
Working knowledge of containers and Kubernetes.
Scripting skills in Python, PowerShell, or Bash.
Understanding of common security risks in cloud and web applications, and how to fix them.
Ability to explain technical risk clearly to engineers and non-engineers.
Preferred Qualifications
Experience with Azure specifically, including private endpoints, VNet integration, and Entra ID managed identities.
Experience with application security testing (SCA, SAST, DAST), and interest in applying AI to security testing.
Experience coordinating penetration tests or working with external security firms.
Experience with OpenTelemetry, Azure Monitor, or similar observability tools, including writing alert queries (KQL is a plus).
Familiarity with SOC 2, ISO 27001, or CIS Benchmarks.
Interest in AI tooling and how to deploy and monitor it safely.
Security certifications such as AZ-500, Security+, or similar are a plus.
Background in logistics or transportation is a bonus.
Location: Mexico
About the Role
Join Alvys, an early-stage company transforming the $800B US freight industry. As a DevSecOps Engineer, you'll help protect our platform and the customer data it holds. You'll close cloud security gaps, build security checks into how we ship software, run our penetration testing program, and stand up the infrastructure behind our internal security, IT, and AI tools. This role combines hands-on infrastructure work with coordination across DevOps, engineering teams, IT & Security, and outside security vendors.
Industry Insight
Freight companies run their business on Alvys: loads, drivers, carriers, payments, and financial records. As more of the industry moves to modern software, customers expect that data to be protected like any other business-critical system. Security is part of how we earn and keep their trust.
About Alvys
Alvys is building a multi-tenant SaaS platform that powers modern transportation operations. We combine deep industry knowledge with strong technical execution to bring clarity, automation, and reliability to one of the world's most essential industries. Security is a shared responsibility at Alvys, and this role helps every team meet that bar.
Our Principles
Engineering Principles
Build for Real-World Impact.
Our users rely on Alvys to solve real problems, not abstract ones. Every security fix should reduce real risk to our platform and the people moving freight every day, not just clear a scanner finding.
Extreme Ownership and Empowerment.
Ownership extends beyond building. It means being accountable for quality, reliability, and customer impact. If it's in production, it's yours: bugs, uptime, and results.
Technology Debt is Strategic, Not Accidental.
Technical debt is a strategic choice, not an oversight. We incur it deliberately when it unlocks speed, learning, or market advantage. Our architecture remains clean, maintainable, and scalable as we grow.
Simplicity Scales; Complexity Costs.
Logistics is inherently complex, but our technology shouldn't be. We prioritize simplicity in our architecture, leveraging modularity and well-defined service boundaries to reduce cognitive load.
Radical Transparency.
We democratize data and make it accessible across all functions to drive alignment and decision-making. Transparency also means feedback. We systematize constructive feedback loops to ensure growth.
Engineering Culture
Move Fast, Learn Fast.
Speed is our advantage, but we move fast intentionally. We bias for action, assume positive intent, and treat every mistake as a learning opportunity.
Own the Outcome.
Every engineer owns outcomes, not tickets. We take responsibility end-to-end, identifying problems, delivering solutions, and ensuring they last.
Partner, Don't Gatekeep.
Security works best when it's built with the teams who own the systems. We share context with DevOps and engineering teams, explain the risk behind each ask, and make the secure path the easy one.
Pragmatism Over Purism.
Perfect security doesn't exist, but reduced risk does. We choose fixes that scale, are maintainable, and address real threats, not theoretical ones.
People Over Heroics.
We don't reward burnout or always-on behavior. Sustainability is a feature, not a luxury. If someone needs to slow down, unplug, or take care of life outside work, that's expected.
Responsibilities
Cloud security architecture
Design and deliver infrastructure changes that strengthen our cloud security posture, including network isolation and identity-based access.
Make these changes through infrastructure as code, plan rollouts that avoid customer downtime, and work with service owners to update the applications that depend on them.
Build secure defaults into our infrastructure modules so new resources start out compliant.
Vulnerability management and pipeline security
Help run our vulnerability management program, driving remediation within defined SLAs.
Extend our existing security scanning with AI-assisted security testing, such as automated security code review and AI-driven penetration testing.
Tune and improve the automation we already use to process security findings.
Penetration testing
Manage our third-party penetration tests from start to finish: scoping and targeting, test environments and accounts, vendor coordination, findings intake, and retesting.
Help mature our internal, AI-assisted penetration testing tool into a dependable part of the security program, including deployment and scheduled runs.
Infrastructure for security, IT, and AI tooling
Deploy and operate internal applications in Azure, with identity, secrets, networking, and backups set up correctly from day one.
Build telemetry pipelines (OpenTelemetry into Azure Monitor) for our AI and internal tools, with dashboards and alerts that surface anomalous activity.
Working with others
Partner with DevOps, engineering teams, and IT & Security to plan and prioritize work.
Write clear runbooks and documentation, and produce evidence for our SOC 2 program.
Tech Stack
Cloud: Azure (AKS, App Service, Azure Functions, Storage, Key Vault, Cosmos DB, VNets, Microsoft Entra ID)
Infrastructure as code: Terraform
CI/CD: GitHub Actions and Azure DevOps pipelines
Containers: Docker, Kubernetes, Azure Container Registry
Observability: Azure Monitor, App Insights, Log Analytics, OpenTelemetry, Grafana
Security: Aikido, Cloudflare
AI tooling: Cursor, Claude, Claude Platform (managed agents), Grokbot
Application code: .NET/C#, TypeScript, Angular, React
Minimum Qualifications
Fluent in English, spoken and written.
3+ years of professional experience in DevOps, cloud infrastructure, platform engineering, or security engineering.
Hands-on experience with at least one major cloud provider (Azure, AWS, or GCP), including networking, identity and access management, and secrets management.
Production experience with infrastructure as code, preferably Terraform.
Experience building and maintaining CI/CD pipelines.
Working knowledge of containers and Kubernetes.
Scripting skills in Python, PowerShell, or Bash.
Understanding of common security risks in cloud and web applications, and how to fix them.
Ability to explain technical risk clearly to engineers and non-engineers.
Preferred Qualifications
Experience with Azure specifically, including private endpoints, VNet integration, and Entra ID managed identities.
Experience with application security testing (SCA, SAST, DAST), and interest in applying AI to security testing.
Experience coordinating penetration tests or working with external security firms.
Experience with OpenTelemetry, Azure Monitor, or similar observability tools, including writing alert queries (KQL is a plus).
Familiarity with SOC 2, ISO 27001, or CIS Benchmarks.
Interest in AI tooling and how to deploy and monitor it safely.
Security certifications such as AZ-500, Security+, or similar are a plus.
Background in logistics or transportation is a bonus.
Location: United States
About the Role
Join Alvys, an early-stage company transforming the $800B US freight industry. As a DevSecOps Engineer, you'll help protect our platform and the customer data it holds. You'll close cloud security gaps, build security checks into how we ship software, run our penetration testing program, and stand up the infrastructure behind our internal security, IT, and AI tools. This role combines hands-on infrastructure work with coordination across DevOps, engineering teams, IT & Security, and outside security vendors.
Industry Insight
Freight companies run their business on Alvys: loads, drivers, carriers, payments, and financial records. As more of the industry moves to modern software, customers expect that data to be protected like any other business-critical system. Security is part of how we earn and keep their trust.
About Alvys
Alvys is building a multi-tenant SaaS platform that powers modern transportation operations. We combine deep industry knowledge with strong technical execution to bring clarity, automation, and reliability to one of the world's most essential industries. Security is a shared responsibility at Alvys, and this role helps every team meet that bar.
Our Principles
Engineering Principles
Build for Real-World Impact.
Our users rely on Alvys to solve real problems, not abstract ones. Every security fix should reduce real risk to our platform and the people moving freight every day, not just clear a scanner finding.
Extreme Ownership and Empowerment.
Ownership extends beyond building. It means being accountable for quality, reliability, and customer impact. If it's in production, it's yours: bugs, uptime, and results.
Technology Debt is Strategic, Not Accidental.
Technical debt is a strategic choice, not an oversight. We incur it deliberately when it unlocks speed, learning, or market advantage. Our architecture remains clean, maintainable, and scalable as we grow.
Simplicity Scales; Complexity Costs.
Logistics is inherently complex, but our technology shouldn't be. We prioritize simplicity in our architecture, leveraging modularity and well-defined service boundaries to reduce cognitive load.
Radical Transparency.
We democratize data and make it accessible across all functions to drive alignment and decision-making. Transparency also means feedback. We systematize constructive feedback loops to ensure growth.
Engineering Culture
Move Fast, Learn Fast.
Speed is our advantage, but we move fast intentionally. We bias for action, assume positive intent, and treat every mistake as a learning opportunity.
Own the Outcome.
Every engineer owns outcomes, not tickets. We take responsibility end-to-end, identifying problems, delivering solutions, and ensuring they last.
Partner, Don't Gatekeep.
Security works best when it's built with the teams who own the systems. We share context with DevOps and engineering teams, explain the risk behind each ask, and make the secure path the easy one.
Pragmatism Over Purism.
Perfect security doesn't exist, but reduced risk does. We choose fixes that scale, are maintainable, and address real threats, not theoretical ones.
People Over Heroics.
We don't reward burnout or always-on behavior. Sustainability is a feature, not a luxury. If someone needs to slow down, unplug, or take care of life outside work, that's expected.
Responsibilities
Cloud security architecture
Design and deliver infrastructure changes that strengthen our cloud security posture, including network isolation and identity-based access.
Make these changes through infrastructure as code, plan rollouts that avoid customer downtime, and work with service owners to update the applications that depend on them.
Build secure defaults into our infrastructure modules so new resources start out compliant.
Vulnerability management and pipeline security
Help run our vulnerability management program, driving remediation within defined SLAs.
Extend our existing security scanning with AI-assisted security testing, such as automated security code review and AI-driven penetration testing.
Tune and improve the automation we already use to process security findings.
Penetration testing
Manage our third-party penetration tests from start to finish: scoping and targeting, test environments and accounts, vendor coordination, findings intake, and retesting.
Help mature our internal, AI-assisted penetration testing tool into a dependable part of the security program, including deployment and scheduled runs.
Infrastructure for security, IT, and AI tooling
Deploy and operate internal applications in Azure, with identity, secrets, networking, and backups set up correctly from day one.
Build telemetry pipelines (OpenTelemetry into Azure Monitor) for our AI and internal tools, with dashboards and alerts that surface anomalous activity.
Working with others
Partner with DevOps, engineering teams, and IT & Security to plan and prioritize work.
Write clear runbooks and documentation, and produce evidence for our SOC 2 program.
Tech Stack
Cloud: Azure (AKS, App Service, Azure Functions, Storage, Key Vault, Cosmos DB, VNets, Microsoft Entra ID)
Infrastructure as code: Terraform
CI/CD: GitHub Actions and Azure DevOps pipelines
Containers: Docker, Kubernetes, Azure Container Registry
Observability: Azure Monitor, App Insights, Log Analytics, OpenTelemetry, Grafana
Security: Aikido, Cloudflare
AI tooling: Cursor, Claude, Claude Platform (managed agents), Grokbot
Application code: .NET/C#, TypeScript, Angular, React
Minimum Qualifications
Fluent in English, spoken and written.
3+ years of professional experience in DevOps, cloud infrastructure, platform engineering, or security engineering.
Hands-on experience with at least one major cloud provider (Azure, AWS, or GCP), including networking, identity and access management, and secrets management.
Production experience with infrastructure as code, preferably Terraform.
Experience building and maintaining CI/CD pipelines.
Working knowledge of containers and Kubernetes.
Scripting skills in Python, PowerShell, or Bash.
Understanding of common security risks in cloud and web applications, and how to fix them.
Ability to explain technical risk clearly to engineers and non-engineers.
Preferred Qualifications
Experience with Azure specifically, including private endpoints, VNet integration, and Entra ID managed identities.
Experience with application security testing (SCA, SAST, DAST), and interest in applying AI to security testing.
Experience coordinating penetration tests or working with external security firms.
Experience with OpenTelemetry, Azure Monitor, or similar observability tools, including writing alert queries (KQL is a plus).
Familiarity with SOC 2, ISO 27001, or CIS Benchmarks.
Interest in AI tooling and how to deploy and monitor it safely.
Security certifications such as AZ-500, Security+, or similar are a plus.
Background in logistics or transportation is a bonus.
Equal Employment Opportunity
Alvys is an equal opportunity employer and as such, we do not discriminate on the basis of race, color, religion, sex, sexual orientation, gender identity, national origin, age, disability, or any other characteristic protected by applicable laws.
We are dedicated to growing a diverse team of highly talented people. We’re dedicated to building a workplace where we give each other the strategies, support, and space we each need to thrive—believing in and bringing out the best of everyone.
If you require any accommodations during the recruitment process, whether it be alternate forms of material, accessible meeting rooms, etc., please let us know and we will work with you to meet your needs.
For information about Alvys's privacy practices, see our
Privacy Policy
.
Location: San Francisco, CA; San Jose, CA; Seattle, WA
Workplace: Remote
ABOUT DOCKER
Docker has been one of the most loved brands in developer tooling, trusted by more than 20 million monthly users and over 20 billion container image pulls. From solo founders to the world's largest companies, developers rely on Docker to build, share, and run their applications across our suite of products including Docker Desktop, Docker Hub, and Docker Scout.
We are a globally distributed, remote-first team building the tools that define how software gets built and delivered. As AI agents redefine software development, Docker is at the center of that shift, providing the sandboxed environments, verified images, and secure infrastructure that make autonomous workflows trustworthy by default.
_______________________________________________________________________
Docker Forward Deployed Engineers (FDE) embed directly with our most strategic customers to solve important, complex technical problems and turn ambitious ideas into production outcomes. FDEs take on the most challenging technical challenges using existing Docker products and patterns when possible, and work across customer, Docker Product and Engineering teams to realize new approaches when required.
As a Docker FDE, you will work side-by-side with customer engineering teams to deeply understand their goals, problems, constraints, and technical landscape; identify the highest-leverage opportunities; and design, build, and ship solutions with them. You own the technical journey from discovery and architecture through prototyping, implementation and production rollout.
The solutions you build may use existing Docker products, extend Docker into new environments, integrate deeply with customer and third-party systems, or reveal capabilities that Docker should build next. You work closely with Docker Solutions Architects to evolve existing patterns, and Docker Product and Engineering to turn new learnings into reusable patterns and product capabilities.
RESPONSIBILITIES
Build in Production with Customers
- Embed with customer engineering teams to design, build, and ship solutions from first prototype through stable production rollout. Use existing Docker products and patterns when possible, invent, prototype and validate innovative solutions when necessary.
- Deliver working technical artifacts to customers: custom MCP servers with tightly integrated Docker Sandbox environments for coding agents and containerized agents; Docker Compose definitions for multi-agent harnesses and model-backed applications; Hardened Image standardization and migration; New tools that unblock customer progress.
- Integrate Docker's AI platform with the customer's existing stack, including identity providers (OIDC/SAML/SSO), secrets management, private and air-gapped registries, Kubernetes, CI/CD pipelines, and observability tooling.
- Own technical delivery on your engagements: scope the work, sequence it, make trade-offs between speed and quality, remove blockers early, and contribute directly to code whenever progress depends on it.
Make AI Adoption Safe and Governable
- Translate customer security, compliance, and platform requirements into concrete plans and see those plans through from ideation to production.
- Help customers define controls to enable them to adopt agentic AI to solve their unique business problems without compromising security, compliance, data sovereignty or end-user experience.
- Establish quality and performance standards for customers and work closely with Docker Product and Engineering to quickly address issues that fall outside of established thresholds
- Partner with customer security and platform teams to get agentic workloads through architecture review, threat modeling, and change control.
Partner with Solutions Architecture and the Field
- Work closely with Solutions Architects to enable off-the-self solutions when possible and provide technical experience and leadership when a bespoke solution is necessary.
- Feed implementation learnings back into reference architectures, SOW templates, and success patterns so that FDE innovations become standard features and implementation patterns.
- Support the field with technical depth during proofs of concept, escalations, and expansion conversations when a working build is the fastest path to a customer adoption.
Close the Loop with Product and Engineering
- As part of Docker Engineering FDEs work closely with Product and Engineering teams to fold FDE innovations, learnings, and design patterns into existing or new products and services.
- Work with Customers, Product and Engineering to establish quality and performance thresholds, ensuring customer environments meet them consistently, and responding quickly and decisively when they don’t.
- Be the voice of the customer. Deliver data-driven and actionable feedback to Product and Engineering: what works well; what does not; what customers are asking for; and what blocks their adoption and forward progress. FDE experience directly influences the roadmap.
Shape the Practice
- Define the FDE engagement model, delivery standards, and quality bar, and codify them so that engagements are consistent across customers, regions, and delivery partners.
- Mentor and lead other Forward Deployed Engineers, and participate in hiring loops to grow the team.
- Act as the senior technical escalation point on the hardest problems impacting your customers. Every incident is an opportunity to improve Docker products and services.
- Maintain deep, current knowledge of the agentic AI stack: LLMs, APIs, MCP, coding agents, model and harness evaluation approaches, performance and quality thresholds, deployment patterns.
- This role may require participation in an on-call rotation to provide support outside of standard business hours, including evenings, weekends, and holidays, as needed.
QUALIFICATIONS
Required
- 10+ years of software engineering experience, including 4+ years in a customer-facing technical role such as Forward Deployed Engineer, Solutions Engineer, Professional Services Engineer, or Software Engineer with consulting or technical founder experience.
- Technical leadership across multiple engagements, teams, or domains, with a proven ability to set delivery standards, define repeatable patterns, and influence product direction through field evidence.
- Expert production coding skills in Go, Python, or TypeScript, with a track record of shipping and operating software that other people depend on and of leading technical design reviews.
- Deep, hands-on Docker expertise: Dockerfiles and multi-stage builds, Docker Compose, image and registry operations, container networking and storage, and container security fundamentals.
- Hands-on experience building with LLMs and agents in production, including tool use and function calling, the Model Context Protocol (MCP server and client implementation), prompt and context engineering, and evaluation of agent behavior.
- Working knowledge of software supply chain security: SBOMs, image signing and attestation, vulnerability management, minimal and hardened base images, and secure CI/CD.
- Experience integrating with enterprise systems: identity providers (Okta, Entra ID, LDAP/Active Directory), federated identity protocols (OIDC, SAML), secrets managers, Kubernetes, and at least one major cloud platform (AWS, Azure, GCP).
- Ability to scope and deliver complex work in ambiguous, fast-moving customer environments, making sound trade-offs between scope, speed, and quality.
- Excellent communication skills with engineers, security and platform teams, and executive stakeholders, with a low-ego, collaborative approach and the ability to lead through influence rather than authority.
- Proven track record of technical mentorship and of raising the bar for the engineers around you.
- High agency and comfort operating autonomously in distributed, remote-first teams.
- Bachelor's degree in Computer Science, Engineering, or a related field, or equivalent practical experience.
- Travel to customer sites to build in person with customer teams, estimated at up to 50%.
Bonus
- Experience with Docker Hardened Images, Docker Scout, MCP Gateway, MCP Toolkit, Docker Sandboxes, or Docker Model Runner.
- Experience deploying and operating coding agents (Claude Code, Codex, Gemini CLI, Cursor, or similar) in team or enterprise settings.
- Experience with air-gapped, regulated, or compliance-driven environments in financial services, healthcare, government, or similar sectors.
- Contributions to open source projects in the container, Kubernetes, or MCP ecosystems.
- Prior experience founding or scaling a Forward Deployed Engineering or Professional Services practice.
Docker considers visa sponsorship on a case-by-case basis based on business needs.
Compensation & Equity
United States: $198K – $319K + equity
______________________________________________________________________
POSTING INFORMATION
- Open vacancy: This posting is for an existing open role.
- AI in hiring: Docker may use AI-assisted tools during our recruiting process.
- Interview recordings: Candidates will be invited to opt in to interview recordings to support interviewer calibration and consistent evaluations. Recordings are optional and require explicit consent.
______________________________________________________________________
PERKS & BENEFITS
- Remote-first by design – Work from your home, with offices in Seattle and Paris for connection and collaboration.
- Flexibility that fits your life – We trust you to manage your schedule while delivering great work.
- Time to recharge – Generous PTO, designated quarterly Whaleness Days, and a designated end-of-year Whaleness break.
- Home office support – Set up your workspace for comfort and success.
- Technology stipend – Equivalent to US$100 net per month to help support your work.
- Learning & development – Annual stipend for conferences, courses, certifications, and continued learning.
- Parental leave – 16 weeks of paid parental leave after six months of employment.
- Equity for all full-time employees – Share in Docker's long-term success as we continue to grow.
- Comprehensive benefits – Medical, retirement, and paid holidays vary by country.
- Docker swag – Because representing the whale never gets old.
Docker is proud to be an equal opportunity employer. We are committed to building a team that reflects a broad range of backgrounds, experiences, and perspectives. We believe diverse teams build better products, make better decisions, and better serve our global community.
#LI-REMOTE
seniorГеография найма не уточнена
УдалённоRemote - US
Не хотите искать каждый день?
Настройте подбор один раз, и подходящие вакансии будут сами приходить в Telegram.
Настройте подбор, и подходящие вакансии будут приходить в Telegram.
ГибридSan Francisco Bay Area, USA; Team members are expected to work from our San Francisco office three full days per week, with the remaining days worked remotely and are expected to be available during agreed working hours and to maintain sufficient overlap with the relevant team’s time zone
УдалённоseniorRemote - US
United States - Remote
География найма не уточнена
География найма не уточнена
География найма не уточнена
УдалённоseniorArmenia; Georgia; Poland; Estonia; Azerbaijan; Romania
Brazil
Mexico
United States
УдалённоSan Francisco, CA; San Jose, CA; Seattle, WA
Все вакансии в одном месте - страница 3 · Job Hunters
