Вакансии

Location: Home based - Worldwide This global leadership role in cyber security is to manage the Security Operations (SecOps) team responsible for design, implementation and evolution of Canonical security practices, techniques, tools, systems and policies. The team is the primary owner of strategy and practices that determine how Canonical secures its data, internal infrastructure and build processes. They are responsible for assuring the security and integrity of our own infrastructure and product deployments. They design and implement technical security controls that ensure security threats are automatically identified, contained and remediated. The team will also contribute ideas and requirements for Canonical product security, improving the resilience and robustness of all Ubuntu customers and users subject to cyber attack. As a leader on cyber security in the company, the SecOps team manager will collaborate with our Organisational Learning and Development team to develop playbooks and facilitate SecOps training across Canonical. They will operate in a wider security organisation, run a high performing security team and improve Canonical's security posture. They will lead initiatives to integrate the team's insights into Canonical's broader software development process. While this is a management position, we expect managers to be expert practitioners, able to lead by example, contribute at the highest level, and assess work based on their own professional experience and skill. Candidates should have deep, hands-on expertise with a range of open source and proprietary security tooling and practices, which they can integrate into a holistic next generation security solution across the breadth of Canonical's interests. The SecOps team's mission is not only to secure Canonical, but also to contribute to the security of the wider open source ecosystem. They might share knowledge through public presentations and industry events, and share threat intelligence with the wider community or represent Canonical in sector-specific governance bodies. This role reports to the CISO. What you will do in this role: Hire and mentor a team of outstanding technical security professionals Define Canonical's SecOps security standards and playbooks Own and drive the architecture and design of the SOC Analyse and improve Canonical's security architecture Evaluate, select and implement new security tools and practices Identify, contain and guide the remediation of security threats and cyber attacks Grow the presence and thought leadership of Canonical SecOps practice Contribute to open source threat intelligence initiatives Drive threat modelling, table top exercises and other SecOps practices across Engineering, IS and Canonical Develop Canonical SecOps learning and development materials Publish blog posts, whitepapers and conference presentations Identify, implement and track SecOps KPIs Plan and deliver SecOps work in the framework of Canonical's agile engineering practice Work with Security leadership to present information and influence change What we are looking for Proven track record of mitigating with advanced threat actors and nation state threats Expert technical understanding of SOCs from the ground up In depth knowledge of SOC architecture and design including strategies for logging, firewalls, network segmentation, honeypots etc Someone who understands how the SOC works not just how to use it Expert in Linux security Ability to define, implement, automate and measure effective incident response playbooks Knowledge of security architecture and market-leading security tools Experience contributing to, and consuming, threat intelligence feeds Experience in security risk management frameworks such as NIST CSF An exceptional academic track record from both high school and university Undergraduate degree in Computer Science or STEM, or a compelling narrative about your alternative path Drive and a track record of going above-and-beyond expectations Deep personal motivation to be at the forefront of technology security Leadership and management ability Excellent business English writing and presentation skills Confidence to report security performance metrics with accountability for accuracy and completeness Optional things we value Experience in offensive or defensive security teams with hands-on ability Experience with open source security tools Experience with security standards such as ISO 27001 Experience with security posture management of corporate endpoitns

Location: Lightning Labs Workplace: Remote Lightning Labs is seeking to hire a Security Engineer for the ongoing scaling of our growing engineering organization. This is a hands-on role that consists of devising and implementing policies and procedures around best practices in systems security.  The ideal candidate has experience in securing web, Bitcoin, and other public-facing network services, penetration testing, and both automated and manual source code security reviews. Due to the domain in which we work, experience with Bitcoin and the Lightning Network is extremely desirable as is knowledge of the cryptographic aspects involved in this area.  As we are an international organization, experience and comfort working with highly distributed teams is a must.  In addition, the ideal candidate should have a passion for our mission of bringing financial freedom to the world, as well as for Bitcoin as a whole. Although a part of the engineering organization, candidates in this position will work across functional team boundaries to ensure all aspects of the business are appropriately considered and covered by security best practices.   Responsibilities may include but are not limited to: - Designing and deploying active fuzzing, black+white box testing and penetration testing infrastructure for open source and production systems  - Performing security audits and review of both internal production systems as well as open source software which interacts with Bitcoin+Lightning in a security critical manner  - Provide mentorship and guidance to level up your teammates - Creating global security policy, standards, guidelines, and procedures to ensure ongoing maintenance of security - Overseeing security aspects of software release processes and infrastructure - Determining security team requirements for future growth - Developing and ensuring responsiveness of security incident management processes - Performing risk management assessments   Preferred experience:  - At least 5 years prior experience in in systems security - An ability to work with a high impact, fast-moving startup team - Extensive knowledge of operating system and computer architecture internals  - Strong understanding of cryptography, protocol design and adversarial analysis  - Experience in reverse engineering and exploiting of cryptographic protocol (cryptocurrencies like Bitcoin) systems - Extensive expertise with professional software development experience in Go, Rust, C/C++, and/or Java - Experience in security incident response  - Experience in security code review and vulnerability triaging  - Prior experience running an open source facing bug bounty program  - 2+ years management experience or experience as a senior decision maker - Experience working with remote teams - Experience working with Kubernetes and AWS infrastructure - Working knowledge of fundamental Bitcoin and Lightning design principles - Candidates with additional experience are welcome to apply as we are open to adjusting the role accordingly

Location: Home based - Worldwide This is a unique opportunity to use your software engineering and cryptography skills to build and maintain the security foundation that enables Ubuntu and its users to operate securely and remain compliant to international information security standards such as FIPS 140-3 and Common Criteria.  You will use your applied cryptography, Linux Security, and coding skills to enhance the Ubuntu distribution and work with organizations such as DISA and CIS to draft and implement security hardening benchmarks for Ubuntu. As a member of the Security Hardening team you will work with and develop automation tooling to audit deployed systems for DISA-STIG and CIS benchmark compliance. You will interact with internal and external stakeholders to identify gaps in our frameworks, and develop new solutions to address these challenges. In this role you will have the opportunity to influence team and security culture, facilitate technical delivery, and help drive team direction and execution. You’ll collaborate closely with Canonical’s kernel team as well as the wider engineering organization to drive features impacting all Ubuntu users. Day-to-day responsibilities Collaborate with other engineers in the Security Hardening team to achieve and retain various Security certifications Extend and enhance Linux cryptographic components (OpenSSL, Libgcrypt, GnuTLS, and others) with the features and functionality required for FIPS and CC certification Collaborate with external security consultants to test and validate kernel and crypto module components Work with external partners to develop security hardening benchmarks and  audit + remediation automation for Ubuntu Contribute to Ubuntu mainline and upstream projects to land solutions and benefit the community Communication and collaboration within and outside Canonical to identify opportunities to improve our security posture, rapidly resolve issues, and deliver high-quality solutions on schedule What we are looking for in you Hands-on experience with low-level Linux cryptography APIs and debugging Excellent software engineering fundamentals, including prior experience with C development, and the ability to demonstrate such Hands-on experience with Linux system administration and shell scripting Demonstrated knowledge of security and cryptography fundamentals + direct experience writing secure code and implementing best practices Significant development experience working with open source libraries Excellent verbal and written communications to enable efficient collaboration with internal and external partners in a remote-first environment Additional skills that you might also bring Prior experience working on FIPS/Common Criteria certified products and in-depth knowledge of the underlying standards Prior experience working directly with DISA-STIG or CIS benchmarks, including related audit + remediation tooling (e.g. Compliance as Code) Experience working directly with Linux Kernel Prior experience with Python, OVAL (Open Vulnerability Assessment Language), and Ansible History of contributions to open source projects What we offer you We consider geographical location, experience, and performance in shaping compensation worldwide. We revisit compensation annually (and more often for graduates and associates) to ensure we recognise outstanding performance. In addition to base pay, we offer a performance-driven annual bonus. We provide all team members with additional benefits, which reflect our values and ideals. We balance our programs to meet local needs and ensure fairness globally. Distributed work environment with twice-yearly team sprints in person - we’ve been working remotely since 2004! Personal learning and development budget of USD 2,000 per year Annual compensation review Recognition rewards Annual holiday leave Maternity and paternity leave Employee Assistance Programme Opportunity to travel to new locations to meet colleagues from your team and others Priority Pass for travel and travel upgrades for long haul company events About Canonical Canonical is a pioneering tech firm that is at the forefront of the global move to open source. As the company that publishes Ubuntu, one of the most important open source projects and the platform for AI, IoT and the cloud, we are changing the world on a daily basis. We recruit on a global basis and set a very high standard for people joining the company. We expect excellence - in order to succeed, we need to be the best at what we do. Canonical has been a remote-first company since its inception in 2004.​ Work at Canonical is a step into the future, and will challenge you to think differently, work smarter, learn new skills, and raise your game. Canonical provides a unique window into the world of 21st-century digital business. Canonical is an equal opportunity employer We are proud to foster a workplace free from discrimination. Diversity of experience, perspectives, and background create a better work environment and better products. Whatever your identity, we will give your application fair consideration. #LI-Remote

Location: New York, NY / Seattle, WA / San Francisco Bay Area, CA / Remote Workplace: remote About CertiK One of the fastest-growing and most trusted companies in blockchain security, CertiK is a true market leader. To date, CertiK has worked with over 3,200 Enterprise clients, secured over $310 billion worth of digital assets, and has detected over 60,000 vulnerabilities in blockchain code. Our clients include leading projects such as Aave, Polygon, Yearn, and Chiliz.  Investors = Insight Partners, Sequoia, Tiger Global, Coatue Management, Lightspeed, Advent International, SoftBank, Hillhouse Capital, Goldman Sachs, Shunwei Capital, IDG Capital, Wing, Legend Star, Danhua Capital and other investors.  About the role We are seeking security research interns to join a top-notch security research team. We are working on a wide range of security research topics, including malware analysis, vulnerability detection, network anomaly detection, mobile app analysis, reverse engineering, and fraud detections. Multiple research tasks are ready to be explored. Responsibilities Develop analysis tools to facilitate security discovery and design mitigation techniques to deter security threats. Review system implementation of sandbox, VM, network modules, and critical distributed system. Perform vulnerability discovery and develop PoC exploits to large distributed system implementations. Publish research findings in related academic and industry venues. Requirements Pursuing Masters or PhD in Computer Science or Cybersecurity related field. Experiences in vulnerability discovery and exploitation on web applications or system software. Preferred Experiences in WASM or Rust/Go development is a plus. CTF experiences are a plus as well. Compensation $3000 - $8000/month (Full Time). The exact compensation at which this internship is filled will be determined by the skills and experience of qualified candidates. #blockchain #startups #hiring CertiK accepts applications on an ongoing basis for this position until it is filled. The approximate date of closing will be April 30, 2024. CertiK is proud to offer medical, vision, and dental insurance, 401(k) plan with company matching, life and accidental death and dismemberment insurance, HSA (with high deductible plan), FSA, and other benefits to all full-time employees, along with flexible paid time off and holidays. CertiK also offers a variable commission program for business development sales roles.   In compliance with federal law, all persons hired will be required to verify identity and eligibility to work in the United States and to complete the required employment eligibility verification form upon hire.   CertiK is proud to be an equal opportunity employer. We will not discriminate against any applicant or employee on the basis of age, race, color, creed, religion, sex, sexual orientation, gender, gender identity or expression, medical condition, national origin, ancestry, citizenship, marital status or civil partnership/union status, physical or mental disability, pregnancy, childbirth, genetic information, military and veteran status, or any other basis prohibited by applicable federal, state or local law.   CertiK will consider for employment qualified applicants with criminal histories in a manner consistent with local and federal requirements. https://www.eeoc.gov/sites/default/files/migrated_files/employers/poster_screen_reader_optimized.pdf   All CertiK employees are expected to actively support diversity on their teams, and in the Company.

Location: US / Remote Workplace: remote Why Us? CertiK is a pioneer in blockchain security, leveraging best-in-class AI technology to protect and monitor blockchain protocols and smart contracts. Founded in 2018 by professors from Yale University and Columbia University, CertiK’s mission is to secure the web3 world. CertiK applies cutting-edge innovations from academia to enterprise, enabling mission-critical applications to scale with safety and correctness. About the Role The primary responsibility of this role is for CertiK’s security-related services. Intersecting cybersecurity and blockchain, CertiK’s security offerings include security consulting, security reviews, security auditing of smart contracts and blockchains, verification of smart contracts, penetration testing, and more. We are looking to hire someone with a passion for application security and penetration testing. This is a fun and challenging full-time position. If you are excited about hacking, threat modeling, scanning, auditing, designing, and enhancing the security of applications across the board then you will thrive in this role. While you work with clients, we will also provide you with plenty of opportunities to get involved with research and development efforts to help us raise the standards of blockchain security. Responsibilities Perform security assessments on web, mobile, thick client applications, and browser extensions Conduct external and internal network penetration tests Perform security source code reviews Perform cloud security reviews Develop comprehensive pentest reports for both technical and non-technical audiences Research and develop innovative techniques, tools, and methodologies for pentesting applications in the blockchain space Contribute to the community by developing tools, presentations, and blog posts Requirements Passionate about cryptocurrency, DeFi, and blockchain, with a willingness to learn Web3 technologies such as smart contracts Minimum of 4 years of experience in application security and penetration testing Experienced in source code review for different languages, with a strong understanding of JavaScript and TypeScript Experienced in mobile application penetration testing Familiar with cloud platforms and their security risks, such as AWS, Azure, and GCP Experience in programming with scripting languages such as Python and Bash Solid understanding of cryptography BS/MS/PhD in Computer Science or Information Security Strong spoken and written communication skills Bonus Points Experienced in pentesting Web3 applications such as crypto exchanges, wallets, Dapps, and key custodian solutions Experienced in smart contract security audits Familiar with browser extension architecture and security risks Actively participate in the blockchain security community OSCP, OSWE, OSCE, GWAPT, or comparable certification Participated in bug bounty programs and audit contests Published security-related blog posts and spoken at security conferences and/or local meetups About the Company One of the fastest-growing and most trusted companies in blockchain security, CertiK is a true market leader. To date, CertiK has worked with over 3,200 Enterprise clients, secured over $310 billion worth of digital assets, and has detected over 60,000 vulnerabilities in blockchain code. Our clients include leading projects such as Aave, Polygon, Binance Smart Chain, Terra, Yearn, and Chiliz. Investors = Insight Partners, Sequoia, Tiger Global, Coatue Management, Lightspeed, Advent International, SoftBank, Hillhouse Capital, Goldman Sachs, Coinbase Ventures, Binance, Shunwei Capital, IDG Capital, Wing, Legend Star, Danhua Capital and other investors. Compensation Target annual base salary for this role performed in the US is $100,000 - $180,000. The exact compensation at which this job is filled will be determined by the skills and experience of qualified candidates. #LI-Remote #blockchain #startups #hiring CertiK is proud to offer medical, vision, and dental insurance, 401(k) plan with company matching, life and accidental death and dismemberment insurance, HSA (with high deductible plan), FSA, and other benefits to all full-time employees, along with flexible paid time off and holidays. CertiK also offers a variable commission program for business development sales roles.   In compliance with federal law, all persons hired will be required to verify identity and eligibility to work in the United States and to complete the required employment eligibility verification form upon hire.   CertiK is proud to be an equal opportunity employer. We will not discriminate against any applicant or employee on the basis of age, race, color, creed, religion, sex, sexual orientation, gender, gender identity or expression, medical condition, national origin, ancestry, citizenship, marital status or civil partnership/union status, physical or mental disability, pregnancy, childbirth, genetic information, military and veteran status, or any other basis prohibited by applicable federal, state or local law.   CertiK will consider for employment qualified applicants with criminal histories in a manner consistent with local and federal requirements. https://www.eeoc.gov/sites/default/files/migrated_files/employers/poster_screen_reader_optimized.pdf   All CertiK employees are expected to actively support diversity on their teams, and in the Company.

Location: Home based - Worldwide Canonical is a leading provider of open source software and operating systems to the global enterprise and technology markets. Our platform, Ubuntu, is very widely used in breakthrough enterprise initiatives such as public cloud, data science, AI, engineering innovation, and IoT. Our customers include the world's leading public cloud and silicon providers, and industry leaders in many sectors. The company is a pioneer of global distributed collaboration, with 1200+ colleagues in 75+ countries and very few office-based roles. Teams meet two to four times yearly in person, in interesting locations around the world, to align on strategy and execution. The company is founder-led, profitable, and growing. Canonical is building a team dedicated to providing security coverage across a wide range of ecosystems and environments, working to make the world a better, safer place. We are hiring an Ubuntu Security Engineer to join an industry-leading security engineering team and help protect the open source community and Ubuntu users from emerging threats. We are looking for candidates across all levels of experience, from Graduate to Senior. As part of the Ubuntu Security Team, you will work with some of the best and brightest people in technology to monitor, triage, respond to, and document new and existing vulnerabilities in open source software. You will collaborate with internal teams and external partners to identify issues, prioritize them, and coordinate remediation. This is an engineering-focused role that may also involve activities such as producing security assessments, building features, conducting code reviews, developing internal tools, engaging with the open source community, and participating in industry initiatives and events. This role requires international travel at least twice a year, usually for one week. It also requires the ability to be productive in a globally distributed team through self-discipline and self-motivation. Location: Worldwide, this is a globally remote role The role entails Analyzing, fixing, and testing vulnerabilities in open source packages Keeping track of vulnerabilities in the Ubuntu ecosystem as they are discovered, researched, and fixed, leveraging internal tools Collaborating with other teams in the Ubuntu community and upstream developers, as needed, to exchange or develop vulnerability patches and ensure that Ubuntu includes the most robust security features Auditing source code for vulnerabilities Building features and tools to help teams strengthen the security of their products and contribute to the overall security of Ubuntu What we are looking for in you You have a thorough understanding of the common categories of security vulnerabilities and techniques for fixing them You are familiar with coordinated disclosure practices You are familiar with open source development tools and methodologies You are skilled in one or more of C, Python, Go, Rust, Java, Ruby, PHP or JavaScript/TypeScript You have excellent logic, problem-solving, troubleshooting, and decision-making skills You can clearly and effectively communicate with the team and Ubuntu community members Experience with Linux (Debian or Ubuntu preferred) Excellent interpersonal skills, curiosity, flexibility, and accountability Appreciative of diversity, polite, and effective in a multi-cultural, multi-national organization Thoughtfulness and self-motivation Result-oriented, with a personal drive to meet commitments What we offer colleagues We consider geographical location, experience, and performance in shaping compensation worldwide. We revisit compensation annually (and more often for graduates and associates) to ensure we recognize outstanding performance. In addition to base pay, we offer a performance-driven annual bonus or commission. We provide all team members with additional benefits which reflect our values and ideals. We balance our programs to meet local needs and ensure fairness globally. Distributed work environment with twice-yearly team sprints in person Personal learning and development budget of USD 2,000 per year Annual compensation review Recognition rewards Annual holiday leave Maternity and paternity leave Team Member Assistance Program & Wellness Platform Opportunity to travel to new locations to meet colleagues Priority Pass and travel upgrades for long-haul company events About Canonical Canonical is a pioneering tech firm at the forefront of the global move to open source. As the company that publishes Ubuntu, one of the most important open-source projects and the platform for AI, IoT, and the cloud, we are changing the world of software. We recruit on a global basis and set a very high standard for people joining the company. We expect excellence; in order to succeed, we need to be the best at what we do. Most colleagues at Canonical have worked from home since our inception in 2004.​ Working here is a step into the future and will challenge you to think differently, work smarter, learn new skills, and raise your game. Canonical is an equal opportunity employer We are proud to foster a workplace free from discrimination. Diversity of experience, perspectives, and background create a better work environment and better products. Whatever your identity, we will give your application fair consideration. #LI-remote

Location: US / Remote Workplace: remote About the Role: We are seeking a Senior Blockchain Security Engineer with a strong security mindset and deep technical expertise across smart contracts, blockchain nodes, and decentralized infrastructure. You will play a critical role in safeguarding Web3 projects by auditing code, building security tools, and driving research. If you have hands-on experience in Web3 and are passionate about advancing the security of decentralized technologies, we’d love to hear from you. Responsibilities Audit and review codebases for smart contracts, blockchain protocols, and decentralized applications (dApps) to identify and remediate vulnerabilities. Work closely with external blockchain teams to enhance the security of their products by providing expert security consultation and implementing remediation strategies. Conduct independent security research, explore new attack vectors, and deliver actionable insights. Design, develop, and maintain internal security tools and frameworks to strengthen our security services. Continuously improve internal processes, methodologies, and service offerings while ensuring high client satisfaction and long-term partnerships. Requirements Bachelor’s, Master’s, or PhD in Mathematics, Computer Science, or Information Security. Minimum 3 years of professional experience as a Software Engineer, Security Engineer, or in a related role. At least 2 years of hands-on experience with blockchain technologies, including: Smart contracts (EVM chains, Solana, Move, etc.), Blockchain protocols (nodes, SDKs, Cosmos, etc.) Strong expertise in threat modeling, risk assessment, and security analysis. Proficiency in one or more programming languages: Rust, Go, Solidity, Python, etc. Passion for Cryptocurrency, DeFi, and Blockchain technologies. Preferred Qualifications Solid academic or practical background in Mathematics, Cryptography, or Cybersecurity. Demonstrated experience conducting audits and collaborating with leading Web3 protocols. Recognized achievements such as published CVEs, or strong placements in Attackathons, Bug Bounties, or Audit Contests. About the Company CertiK is the largest blockchain security auditor and provides a comprehensive suite of tools to secure the industry at scale. To date, CertiK has worked with over 4,900 Enterprise clients, secured over $557 billion worth of digital assets, and has detected over 18,000 vulnerabilities in blockchain code. Our clients include leading projects such as OKX, Tether, Ripple, and Pancakeswap. Our investors include top VCs like Tiger Global, Coatue Management, Shunwei Capital and Hillhouse Capital as well as industry leaders like Coinbase Ventures and Binance. Investors = Insight Partners, Sequoia, Tiger Global, Coatue Management, Lightspeed, Advent International, SoftBank, Hillhouse Capital, Goldman Sachs, Shunwei Capital, IDG Capital, Wing, Legend Star, Danhua Capital and other investors. About You You’re a self-starter. You believe in tackling the most important problems, even if they are the most difficult problems. You’re comfortable with the unknown and understand that startup life means that you’re going to be wearing multiple hats. And that’s what motivates you. You’re accountable and obsessed with improvement, both in yourself and in others. You’re up to the challenge of building a world-class company that aims to be the infrastructure for more secure software for all. Compensation Target annual salary for this role performed in the US is $102,000 - $180,000. The exact compensation at which this job is filled will be determined by the skills and experience of qualified candidates. CertiK is proud to offer medical, vision, and dental insurance, 401(k) plan with company matching, life and accidental death and dismemberment insurance, HSA (with high deductible plan), FSA, and other benefits to all full-time employees, along with flexible paid time off and holidays. CertiK also offers a variable commission program for business development sales roles.   In compliance with federal law, all persons hired will be required to verify identity and eligibility to work in the United States and to complete the required employment eligibility verification form upon hire.   CertiK is proud to be an equal opportunity employer. We will not discriminate against any applicant or employee on the basis of age, race, color, creed, religion, sex, sexual orientation, gender, gender identity or expression, medical condition, national origin, ancestry, citizenship, marital status or civil partnership/union status, physical or mental disability, pregnancy, childbirth, genetic information, military and veteran status, or any other basis prohibited by applicable federal, state or local law.   CertiK will consider for employment qualified applicants with criminal histories in a manner consistent with local and federal requirements. https://www.eeoc.gov/sites/default/files/migrated_files/employers/poster_screen_reader_optimized.pdf   All CertiK employees are expected to actively support diversity on their teams, and in the Company.

Location: Remote - Worldwide About us OpenZeppelin is the security standard onchain finance is built on. Founded in 2015, our mission is to accelerate the world's transition to an open financial system, built on open standards and secured by rigorous research. Our open-source Contract Libraries have facilitated over $35 trillion in onchain value and are used by 10 of the top 10 tokenized money market funds and 9 of the top 10 stablecoins by market cap. We combine AI-native security tooling with deep research and a decade of audit expertise to support leading institutions and crypto-native teams shaping the next generation of digital assets like DTCC, Fidelity, Coinbase, Uniswap, Aave, the Ethereum Foundation, and many more across the full secure development lifecycle. Please note: Always refer to OpenZeppelin's official job page for the most accurate information about our open roles, as we have seen multiple third party job sites posting inaccurate information. The Security Services Team OpenZeppelin's Security Services team is responsible for the security of the world's leading web3 protocols and top financial institutions building onchain. Our researchers partner with client teams across the full lifecycle of a protocol: working on architecture and design before any code is written, co-creating novel mechanisms and primitives with engineering teams, conducting deep audits of pre-launch codebases, and providing continuous coverage as production systems evolve. Our clients range from emerging projects shipping their first contracts to global financial institutions running production onchain systems at scale. What you'll be doing Review smart contracts for top decentralized applications, blockchain infrastructure and financial institutions before they launch. Find vulnerabilities, prioritize them, and present findings to the client. Drive audits independently from start to finish, with AI as your primary collaborator. When useful, partner with another researcher to attack the code together and pressure-test findings. Partner with client teams during the design phase of new protocols, analyzing architecture, trust assumptions, and operational constraints before any code is written (Design Reviews, Applied Research engagements). Use AI efficiently throughout the audit process, and build skills, agents, and workflows that compound across the team. Conduct open-ended research into cutting-edge blockchain technologies, vulnerability classes, and emerging attack vectors, and contribute findings back to OpenZeppelin's internal knowledge base and to the broader ecosystem. You have Hands-on and practical experience in one or more of the following: software development, cybersecurity, applied mathematics, distributed systems, cryptography, cryptoeconomics or game theory, or DeFi mechanisms. Experience designing and developing smart contracts, not only auditing them. Strong working knowledge of Solidity and the broader Ethereum / EVM ecosystem (common libraries, frameworks, smart contract patterns). Modern AI tooling is central to how you work, not a novelty. You use it daily to expand audit coverage, reason about complex systems, and produce high-quality outputs faster. You evaluate AI-generated code with a critical eye. Comfort building and extending your own tooling (skills, agents, prompts, scripts, or full workflows) that the rest of the team can adopt and build on. An advanced English level and strong communication skills (oral and written). Nice to have Experience with non-EVM ecosystems and languages, such as Canton, Move (Sui, Aptos), Golang (Cosmos SDK), Cairo (Starknet), Rust-based blockchains (Solana, Stellar), or ZK circuits and cryptography-heavy systems. Experience with risk assessment work in the crypto industry (smart contract risk assessment, threat modeling). Working hand-in-hand with protocol teams on co-creative engagements, helping design, specify, and implement smart contracts alongside the research. Web2 security expertise (penetration testing, web application security, infrastructure security, or appsec). Experience with formal verification, invariant testing, or advanced fuzzing tools (Echidna, Foundry, Halmos, Certora). A track record in audit contests (Code4rena, Sherlock, Cantina) or bug bounty platforms (Immunefi, HackerOne). Public security research output, such as published findings, blog posts, conference talks, or contributions to open-source security tooling. Logistics Our interview process takes place on Google Meet and tends to consist of the following stages: Recruiter call (30 minutes) Manager interview (60 minutes) Technical interview (60 minutes) Paid work trial (paid code review assessment) Reference checks Please let us know if you require any accommodations for the interview process, and we’ll do our best to provide assistance. Benefits Meet your teammates at company gatherings around the world 😎 Enjoy the flexibility of fully remote work 🌎 Take the time you need with flexible time off 🏝 Grow your family with 8 weeks of paid leave for primary caregivers, 4 weeks for secondary caregivers, and a one-time $3,600 baby bonus 💙 Build your ideal home office with up to $500 in equipment support 🪑 Stay covered with medical insurance 🏥 Keep growing with learning and development opportunities 🧠 Get a monthly stipend for your preferred co-working space 💻 At OpenZeppelin , we are an equal opportunity employer and we value different perspectives. We are committed to building a diverse workforce. This includes but is not limited to gender, race, sexual orientation, religion, national origin and other characteristics that make each one of us unique. In this uniqueness, we find the most value. Come join us! Use of AI as part of the recruiting process As part of OpenZeppelin’s recruitment process, we may use automated tools, including artificial intelligence, to assist in reviewing applications and assessing candidate qualifications. These tools are used to support our People team by identifying relevant skills and experience, and are not used to make decisions solely by automated means. All hiring decisions involve human review. Any personal data provided as part of your application will be processed in accordance with OpenZeppelin’s Data Privacy Notice . If you have questions about this recruitment process or would like to request human review of your application, please contact us at talent@openzeppelin.com.

Location: Remote - EMEA Who We Are: Alpaca is a US-headquartered, global leader in agent-first brokerage infrastructure for stocks, ETFs, options, crypto, fixed income, 24/5 trading, and more. Amongst our subsidiaries, Alpaca is a licensed financial services company, serving hundreds of financial institutions across 40 countries with our institutional-grade APIs. This includes broker-dealers, investment advisors, wealth managers, hedge funds, and crypto exchanges, totalling over 10 million brokerage accounts. Our global team is a diverse group of experienced engineers, traders, and brokerage professionals who are working to achieve our mission of opening financial services to everyone on the planet. We're deeply committed to open-source contributions and fostering a vibrant community, continuously enhancing our award-winning, developer-friendly API and the robust infrastructure behind it. Alpaca is proudly backed by $400 million in funding from top-tier global investors including Portage Ventures, Spark Capital, Tribe Capital, Social Leverage, Horizons Ventures, Opera Tech Ventures, SBI Group, Derayah Financial, Unbound, Peak XV, Elefund, and Y Combinator. Our Team Members: We're a dynamic team of 400+ globally distributed members who thrive working from our favorite places around the world, with teammates spanning the USA, Canada, Japan, Hungary, Nigeria, Brazil, the UK, and beyond! We're searching for passionate individuals eager to contribute to Alpaca's rapid growth. If you align with our core values—Stay Curious, Have Empathy, and Be Accountable—and are ready to make a significant impact, we encourage you to apply. About the Role As a Senior Software Engineer on the Reference Data team, you will build services that form the data backbone of Alpaca’s brokerage infrastructure. Almost every service at Alpaca needs information about the assets it operates on. Our team provides that information and supports the events that affect those assets throughout their lifecycle. The team owns two core areas: Security Master , the central source of information about tradable assets, their characteristics and whether, when, and how they can be traded; and corporate actions , which involves ingesting third-party information about dividends, stock splits, mergers and other events, then calculating the changes and transactions needed to reflect them in customer and partner holdings. You will work across both areas, helping Alpaca enter new markets, expand its portfolio of products and improve the reliability, performance and operability of existing systems. This is a hands-on backend engineering role focused on distributed systems, data modelling and correctness across interconnected services. You will take open-ended problems from scoping and design through implementation, rollout and production support, working closely with the teams that depend on reference data. Things You Get To Do Design, build and maintain distributed backend services, APIs and data models for Security Master and corporate actions. Extend reference data systems to support new instruments, asset classes and market-specific requirements, including futures and prediction markets. Build reliable workflows for ingesting, validating and processing third-party instrument and corporate action information. Develop internal tools and automation that reduce manual work and improve the reliability of reference data operations. Help redesign how foundational asset information is structured and shared across Alpaca, contributing to architectural decisions with company-wide impact. Work closely with engineering and business teams that consume reference data, coordinating changes across services. Own complex features and technical decisions from design through production, including testing, troubleshooting and continuous improvement. Who You Are (Must-Haves) Strong experience building and operating event-driven, distributed backend systems. Strong database and data-modelling skills, with an understanding of eventual consistency and data replication. Excellent system design fundamentals, including designing and evolving APIs. Proficiency in a strongly typed programming language and willingness to work in Go. Experience taking complex or ambiguous problems from initial requirements through delivery and production operation. Ability to explain technical decisions and trade-offs clearly, collaborate across teams and reason through cross-system dependencies. Senior-level engineering judgement and ownership; we assess capability and impact rather than applying a fixed years-of-experience threshold. Who You Might Be (Nice-to-Haves) Experience in trading, brokerage, capital markets, crypto infrastructure or related financial technology. Experience with reference data, Security Master, instrument or asset data, or corporate action processing. Understanding of financial instruments, particularly options, futures and other derivatives. Experience with third-party data ingestion, internal tooling and workflow automation. Experience guiding other engineers and working across interconnected services and teams. How We Take Care of You: Competitive Salary & Stock Options Health Benefits New Hire Home-Office Setup: One-time USD $500 Monthly Stipend: USD $150 per month via a Brex Card Alpaca is proud to be an equal opportunity workplace dedicated to pursuing and hiring a diverse workforce. Recruitment Privacy Policy

Location: Bangalore, India GitLab is the intelligent orchestration platform for DevSecOps. GitLab enables organizations to increase developer productivity, improve operational efficiency, reduce security and compliance risk, and accelerate digital transformation. More than 50 million registered users and more than 50% of the Fortune 100* trust GitLab to ship better, more secure software faster. The same principles built into our products are reflected in how our team works: we embrace AI as a core productivity multiplier, with all team members expected to incorporate AI into their daily workflows to drive efficiency, innovation, and impact. GitLab is where careers accelerate, innovation flourishes, and every voice is valued. Our high-performance culture is driven by our values and continuous knowledge exchange, enabling our team members to reach their full potential while collaborating with industry leaders to solve complex problems. Co-create the future with us as we build technology that transforms how the world develops software. * Fortune 500® is a registered trademark of Fortune Media IP Limited, used under license. Claim based on GitLab data. Fortune 100 refers to the top 20% ranked companies in the 2025 Fortune 500 list, published in June 2025. Fortune and Fortune Media IP Limited are not affiliated with, and do not endorse products or services of GitLab. An overview of this role As a Staff Software Engineer on GitLab's Authentication team, you'll be the technical lead for how every user, application, token, and automated agent proves who it is on GitLab.com, Self-Managed, and Dedicated. We're an OAuth 2.0 and OpenID Connect (OIDC) provider for millions of users. We also accept identity from enterprise identity providers through Security Assertion Markup Language (SAML) and Lightweight Directory Access Protocol (LDAP). Behind that sit more than ten token types and several session methods that grew inside the Ruby on Rails monolith. You'll help us move this work onto GATE, GitLab's new authentication and authorization platform. GATE exchanges external credentials for short-lived tokens at the edge through a Secure Token Service written in Go.You'll set our technical direction, lead the hardest protocol and migration work yourself, and help senior engineers own the rest. Our projects include: OAuth across Cells: Making OAuth clients, grants, and tokens work when users and organizations live in different cells Global identities: One user identity that works across organizations and cells Token consolidation: Reducing the number of token types and moving token issuance and validation out of the monolith Identity for artificial intelligence (AI) agents and workloads: OAuth for Model Context Protocol (MCP) clients, workload identity federation, and service identities with narrow scopes What you'll do Own the technical direction for authentication protocols at GitLab, including OAuth 2.0, OIDC, SAML, and token exchange, across the Rails monolith and GATE services. Write and drive design documents and architecture decision records (ADRs) for multi-quarter work, then break that work into increments that ship behind feature flags. Lead migrations that must not break existing customers: token formats, client and grant state, and session behavior on GitLab.com, Self-Managed, and Dedicated. Be hands-on in the most complex parts of the code, in Ruby on Rails and Go, and review the designs and merge requests of other engineers. Agree interface contracts with the GATE Core, GATE Infra, Authorization, and Tenant Scale (Cells and Organizations) teams, and keep them current as the architecture changes. Treat authentication as a security and availability boundary: threat-model new flows, add rate limits and abuse controls, and lead the technical response to authentication incidents. Mentor senior and intermediate engineers on the team and raise the protocol and security knowledge of the whole group. Work asynchronously with engineers in India, Europe, and the Americas, with most decisions made in writing. Take part in on-call or operational support where your team’s ownership model requires it. What you'll bring Significant experience building and running production authentication or identity systems at scale, with technical leadership across teams that moves unclear problems to written decisions and shipped code. Deep, hands-on knowledge of OAuth 2.0 and OIDC: authorization code with Proof Key for Code Exchange (PKCE), refresh token rotation, token exchange, client registration, scopes, and JSON Web Tokens (JWTs) with signing keys and key rotation. Working knowledge of SAML 2.0 single sign-on and enterprise identity integration (LDAP, System for Cross-domain Identity Management (SCIM), or similar). Strong production experience in Ruby on Rails or Go, willingness to work in both, and experience with careful refactors, feature-flagged rollouts, and backward-compatible migrations in large, long-lived codebases. A security mindset. You think about token theft, replay, revocation, and blast radius before you think about elegance. Experience with multi-tenant software as a service (SaaS) systems, including data isolation and performance under high request volume. Clear, concise written English and comfort working in an all-remote, asynchronous company. Optional experience: authentication libraries (Doorkeeper, Devise, or OmniAuth), passkeys or multi-factor authentication, workload identity, gateways or policy engines, AI agent authentication, or multi-region architectures. Contributions to identity standards or open source identity projects are also welcome. About the team The Authentication group is part of the Security Platform stage, alongside Authorization, GATE Core, GATE Infra, Secrets Manager, and other security teams. We own sign-in, single sign-on, OAuth, and personal and service tokens. Our work touches every GitLab customer, and much of it is on the critical path for Cells and for GitLab's AI agent platform. How GitLab Supports Full-Time Employees Benefits to support your health, finances, and well-being Flexible Paid Time Off Team Member Resource Groups Equity Compensation & Employee Stock Purchase Plan Growth and Development Fund Parental Leave Please note that we welcome interest from candidates with varying levels of experience; many successful candidates do not meet every single requirement. Additionally, studies have shown that people from underrepresented groups are less likely to apply to a job unless they meet every single qualification. If you're excited about this role, please apply and allow our recruiters to assess your application. Country Hiring Guidelines: GitLab hires new team members in countries around the world. All of our roles are remote, however some roles may carry specific location-based eligibility requirements. Our Talent Acquisition team can help answer any questions about location after starting the recruiting process. Privacy Policy: Please review our Recruitment Privacy Policy. Your privacy is important to us. GitLab is proud to be an equal opportunity workplace and is an affirmative action employer. GitLab’s policies and practices relating to recruitment, employment, career development and advancement, promotion, and retirement are based solely on merit, regardless of race, color, religion, ancestry, sex (including pregnancy, lactation, sexual orientation, gender identity, or gender expression), national origin, age, citizenship, marital status, mental or physical disability, genetic information (including family medical history), discharge status from the military, protected veteran status (which includes disabled veterans, recently separated veterans, active duty wartime or campaign badge veterans, and Armed Forces service medal veterans), or any other basis protected by law. GitLab will not tolerate discrimination or harassment based on any of these characteristics. See also GitLab’s EEO Policy and EEO is the Law . If you have a disability or special need that requires accommodation , please let us know during the recruiting process .

Location: New York City, NY | Seattle, WA; San Francisco, CA | New York City, NY About Anthropic Anthropic’s mission is to create reliable, interpretable, and steerable AI systems. We want AI to be safe and beneficial for our users and for society as a whole. Our team is a quickly growing group of committed researchers, engineers, policy experts, and business leaders working together to build beneficial AI systems. About Anthropic Anthropic's mission is to create reliable, interpretable, and steerable AI systems. We want AI to be safe and beneficial for our users and for society as a whole. Our team is a growing group of committed researchers, engineers, policy experts, and business leaders working together to build beneficial AI systems. About the role Agent Security's mission is to safely increase how much of the world's work agents can do, starting inside Anthropic. Claude now writes and ships code, runs experiments and acts on people's behalf, for hours at a time. How much more it can take on depends on how safely it can operate. If, in the worst case, an agent misbehaves, Anthropic and the public may bear the consequences. Our mandate is to mitigate this risk, and Anthropic’s mission depends on it. The Partnerships team pairs security engineers with the teams at Anthropic that build Claude, build agents and rely on agents. Those teams are our partners. When a team wants its agents to do more, we threat model the plan with them and build the controls together. Most of this has no playbook, so we have often created new controls from first principles. The ones that work become part of our toolbox, spread to other teams, and in some cases ship in our products. We're hiring an Engineering Manager to lead this team of security engineers. This is first and foremost a people leadership role. Few have secured agents at scale, especially at a frontier lab, so we don't expect you to have done it. We do expect you to have led security engineering teams, and we care most about how you lead people and reason about security. This role operates at the frontier. Each model generation, and each new harness, brings new challenges. The number of teams building on agents keeps growing, and partner teams won't always agree with your calls. In return, you will have the chance to directly contribute to making transformative AI go well, which is the heart of our mission. Key responsibilities Hire, mentor and grow senior and staff security engineers, and raise the bar as the team scales Set the team's investment strategy, deciding which teams get embedded engineers, and for how long, as demand outgrows the team Support the team through high-stakes safety and security calls made under uncertainty and on tight timelines Balance long-term investment in shared controls against partner teams’ immediate asks Deliver large security migrations across all of Anthropic Work through difficult tradeoffs with partner teams in ways that build trust and understanding Representative Projects In the past, the team has: Invented a new kind of classifier-based control for agents partnering with an internal team to develop and roll it out Co-built a sandbox with a product team, choosing what to enforce first so that adoption stuck Defined the security standards for running agents across the company and partnered with many different teams on how to hit these standards Minimum qualifications Excellent people management skills. You've hired, developed and managed senior and staff engineers, grown engineers into staff or lead roles, and kept a team delivering through changing priorities. Deep security management experience. You've managed security engineering teams and answered to executives for risk and tradeoffs. Strong written and oral communication skills. You've explained hard tradeoffs to executives and to engineers in plain words. Resilience, emotional awareness, low ego and high empathy Experience leading large migrations and highly cross-functional work A willingness to dive into the details to tie-break complex trade-offs without any clear answer, and the ability to stand by these decisions Preferred qualifications Experience embedding security engineers with product, infrastructure or research teams, or running a security partnerships team Agent security or AI/ML security experience Familiarity with AI safety concepts and research Leading in hypergrowth The annual compensation range for this role is listed below. For sales roles, the range provided is the role’s On Target Earnings ("OTE") range, meaning that the range includes both the sales commissions/sales bonuses target and annual base salary for the role. Annual Salary: $405,000 — $485,000 USD Logistics Minimum education: Bachelor’s degree or an equivalent combination of education, training, and/or experience Required field of study: A field relevant to the role as demonstrated through coursework, training, or professional experience Minimum years of experience: Years of experience required will correlate with the internal job level requirements for the position Location-based hybrid policy: Currently, we expect all staff to be in one of our offices at least 25% of the time. However, some roles may require more time in our offices. Visa sponsorship: We do sponsor visas! However, we aren't able to successfully sponsor visas for every role and every candidate. But if we make you an offer, we will make every reasonable effort to get you a visa, and we retain an immigration lawyer to help with this. For roles performing work in California: We will consider for employment all qualified applicants, including those with arrest or conviction records or criminal histories, in a manner consistent with the requirements of applicable state and local laws, including the San Francisco Fair Chance Ordinance, the City of Los Angeles’ Fair Chance Initiative for Hiring Ordinance, the Los Angeles County Fair Chance Ordinance for Employers, and the California Fair Chance Act. We encourage you to apply even if you do not believe you meet every single qualification. Not all strong candidates will meet every single qualification as listed.  Research shows that people who identify as being from underrepresented groups are more prone to experiencing imposter syndrome and doubting the strength of their candidacy, so we urge you not to exclude yourself prematurely and to submit an application if you're interested in this work. We think AI systems like the ones we're building have enormous social and ethical implications. We think this makes representation even more important, and we strive to include a range of diverse perspectives on our team. Your safety matters to us. To protect yourself from potential scams, remember that Anthropic recruiters only contact you from @anthropic.com email addresses. In some cases, we may partner with vetted recruiting agencies who will identify themselves as working on behalf of Anthropic. Be cautious of emails from other domains. Legitimate Anthropic recruiters will never ask for money, fees, or banking information before your first day. If you're ever unsure about a communication, don't click any links—visit anthropic.com/careers directly for confirmed position openings. How we're different We believe that the highest-impact AI research will be big science. At Anthropic we work as a single cohesive team on just a few large-scale research efforts. And we value impact — advancing our long-term goals of steerable, trustworthy AI — rather than work on smaller and more specific puzzles. We view AI research as an empirical science, which has as much in common with physics and biology as with traditional efforts in computer science. We're an extremely collaborative group, and we host frequent research discussions to ensure that we are pursuing the highest-impact work at any given time. As such, we greatly value communication skills. The easiest way to understand our research directions is to read our recent research. This research continues many of the directions our team worked on prior to Anthropic, including: GPT-3, Circuit-Based Interpretability, Multimodal Neurons, Scaling Laws, AI & Compute, Concrete Problems in AI Safety, and Learning from Human Preferences. Come work with us! Anthropic is a public benefit corporation headquartered in San Francisco. We offer competitive compensation and benefits, optional equity donation matching, generous vacation and parental leave, flexible working hours, and a lovely office space in which to collaborate with colleagues. Guidance on Candidates' AI Usage: Learn about our policy for using AI in our application process.

Location: Remote Dexis is a dynamic professional services firm dedicated to partnering with government and community leaders both in the U.S. and internationally to achieve critical social outcomes in a rapidly changing world. At Dexis, you will experience a corporate culture of inclusiveness, respect, fairness, and trust. You will be given the means and mentorship needed to succeed, and your creativity will be rewarded. About the Project This project will provide a broad range of assessment, monitoring, and evaluation (AM&E) support to DSCA. Project tasks will include desk and field research, analysis, data collection and visualization, strategy development, policy writing and coordination, and AM&E capacity building. Responsibilities AM&E Analysts II will support the design, coordination, conduct, and reporting of Security Cooperation analyses. They will work with key stakeholders to ensure efforts stay up to date with emerging AM&E techniques, tools, and approaches in specific subject matter. Key responsibilities include: Supporting the leadership team in identifying priorities and solutions to problems Providing qualitative and quantitative analysis of security cooperation programs Assisting with the development of indicators and metrics that enable evaluation of security cooperation programs Drafting reports, presentations, and other deliverables for senior leadership review Supporting the design and development of visual graphics (e.g., illustrations, layouts, designs) that distills key information in a clear, concise manner Supporting the development and maintenance of project processes and plans Travel up to 25-50% domestically and internationally as determined by client and portfolio requirements and demands on regional team, while adhering to approved budget, cost reasonableness requirements, and all applicable corporate and federal travel regulations Qualifications Bachelor’s degree Four (4) years of AM&E experience, including analyzing and summarizing disparate information in a clear and concise manner, drafting data collection methodologies, creating organizational work plans based on higher-level goals, leading and coordinating multiple offices through multiple step processes without being a direct supervisor, and supporting staff with a variety of levels of knowledge and capabilities Strong oral and written communication skills to deal effectively with mid and high-level partner contacts, the host government, and local communities Ability to apply government agency regulations and procedures related to controlled unclassified information and foreign disclosure to daily work requirements Excellent computer skills, including word processing, spreadsheet programs and data base management Seven (7) years of AM&E or capability-based-assessment (CBA) or other types of experience in one or more of the following subject matters: counterterrorism operations; Counter-weapons of mass destruction operations; counter-illicit drug trafficking operations and counter-transnational organized crime operations; maritime and border security operations; military intelligence operations and Operations or activities that contribute to an international coalition operation that is determined by the Secretary to be in the national interest of the United States; air domain awareness operations; cyberspace security and defensive cyberspace operations; humanitarian assistance and demining; small-scale construction associated with any of the above mission areas; Security Sector Governance (both across each of the above program areas as well as through distinct programs focused solely on Security-related institutions that span these broad program areas) DoD Secret clearance Preferred Qualifications Two (2) years of experience assessing, developing, mapping, and improving business processes Five (5) years of experience and knowledge of public policy and operations Five (5) years of experience planning, designing and implementing assessment, monitoring, and evaluation programs or projects in the security sector for a national organization, an NGO/IGO, the UN, or private industry Master’s degree (or higher) and formal training or education in the field of assessment, monitoring, and evaluation One to three (1-3) years of experience planning, executing, or overseeing policy of guidance for SC activities implemented under sections 332, 333, 1263, 342, 345, 401, or 2561 of Title 10, Chapter 16 Currently located in Hawaii or in the National Capital Region (NCR) Below is the pay range aligned with this position. When developing a range, Dexis evaluates compensation holistically, triangulating between external market research , our budget for the position, and internal equity to arrive at a figure that is fair and competitive. Offers within this range will be based on an individual candidate's qualification, relevant education and experience, skills, performance, and organizational needs. Dexis pay range for this role: $100,000 — $124,000 USD Benefits Dexis offers benefits to support employees’ health, financial security, and well-being. The benefits outlined below are for full-time, US-based positions only. These benefits include: Medical and prescription drug coverage: A choice of three UnitedHealthcare medical plans, with coverage options for employees and eligible dependents. Dental insurance: Dental coverage for employees and eligible dependents, including preventive, basic, major, and orthodontic services, subject to plan limits. Company-paid vision insurance: Vision coverage for employees and eligible dependents, with premiums paid in full by Dexis. Employer-funded health reimbursement arrangement (HRA): Employees who enroll in the Silver HRA medical plan receive an employer-funded HRA to help pay eligible in-network deductible expenses. Company-paid life and disability insurance: Basic life and accidental death and dismemberment (AD&D) insurance, plus short-term and long-term disability coverage. Optional supplemental insurance: Voluntary supplemental life and AD&D insurance options, including life insurance options for eligible dependents. Employee Assistance Program (EAP): Company-paid access to confidential counseling and legal and financial support resources for employees and their families. Health and wellness resources: Virtual care, behavioral health resources, and wellness programs available through the medical plan. Benefits assistance: Personalized support with benefit enrollment, coverage questions, claims, and finding providers through the Employee Care Center. Participation, coverage, and employee contributions are subject to applicable benefit plan terms and eligibility requirements. Dexis is on a mission to help solve today’s most pressing global political, social, and economic challenges and create a world where all people are safe and prosperous. As a Dexis employee, you will be challenged, empowered, and mentored. Our motto is “find a way or make a way” — that’s how Dexis goes “all in.” How will you? If you are passionate about this opportunity, apply now! Only those applicants who meet the above criteria will be contacted for interview. Dexis is an Equal Opportunity Employer, and does not discriminate on the basis of race, color, sex, national origin, religion, pregnancy, disability, age, genetic information, military service, veteran status, ethnicity, citizenship, sexual orientation, gender identity, marital status, childbirth and related medical conditions, including lactation, or any other protected class under applicable law.

Location: Tel Aviv, Israel About Nebius: Nebius is leading a new era in cloud infrastructure for the global AI economy. We are building a full-stack AI cloud platform that supports developers and enterprises from data and model training through to production deployment, without the cost and complexity of building large in-house AI/ML infrastructure. Built by engineers, for engineers. From large-scale GPU orchestration to inference optimization, we own the hard problems across compute, storage, networking and applied AI. Listed on Nasdaq (NBIS) and headquartered in Amsterdam, we have a global footprint with R&D hubs across Europe, the UK, North America and Israel. Our team of 1,500+ includes hundreds of engineers with deep expertise across hardware, software and AI R&D. The role The Legal Counsel provides senior, practical, risk-based legal counsel at the intersection of cybersecurity, Artificial Intelligence, cloud compute and services, physical security, supply chain and technology oriented regulatory compliance. The counsel will work closely with Security teams to support their efforts to address the needs of t he c ompany 's various business units , and enable the attainment of the company's business and product objectives while protecting the company from obligations that are unclear, disproportionate, operationally unachievable, or inconsistent with the company’s security posture. The role is expected to lead cross-functional initiatives, not only respond to individual legal requests. Your responsibilities will include Security terms in c ustomer contracts Review, draft, and negotiate cybersecurity, physical security compliance , , supply chain and resilience provisions in customer documents , including MSAs, DPAs, security addenda, order forms, and related schedules. Advise on security-control commitments, audit and assessment rights, incident-notification obligations . penetration testing, business continuity, data retention and deletion, subcontractors, cloud services, and allocation of liability. Translate technical controls and architecture into clear, supportable contractual language without overstating capabilities or creating unbounded obligations. Advise Product and Engineering on customer-driven requirements and translate recurring negotiations into scalable product, policy, and commercial positions. Support Sales and Customer Success with timely, commercially pragmatic guidance during strategic and high-value transactions. Certifications, audits, and external assurance Provide legal support for security certifications, attestations, and assurance programs, such as ISO 27001, SOC 2, PCI DSS, or other frameworks relevant to the company. Review certification scope, statements, evidence-sharing terms, management representations, auditor engagement terms, confidentiality obligations, and external communications. Help ensure that customer-facing descriptions of certifications and controls are accurate, current, and do not imply broader coverage than the underlying assessment supports. Partner with Security and Compliance on remediation plans, audit findings, regulator or customer inquiries, and the controlled disclosure of reports and evidence. Security governance, regulatory advice, and risk Managing DORA, NIS2, CRA frameworks, serving as principal point of contact with authorit ies in this respect. Monitor and interpret cybersecurity, operational resilience digital-services, and technology requirements applicable to the company’s products, services, customers, and geographic footprint. Assist in supporting physical security units A ssist the company GRC to a dvise on security policies, standards, risk acceptance, third-party risk, cloud governance, secure development practices, vulnerability disclosure, and responsible use of emerging technologies, including AI where applicable. Participate in security and product governance forums and provide legal input to material risk decisions, secure development practices, control exceptions, product launches, vendor onboarding, and significant architecture or service changes. Incident readiness and response Support preparation and maintenance of cyber-incident response plans, notification matrices, decision logs, tabletop exercises, and external communication protocols. Operations and enablement Assessment and adoption of  reference to specific legislation and regimes. Develop playbooks, clause libraries, decision trees, intake forms, templates, and training that enable consistent handling of security-related legal work. Define service levels and prioritization rules with Legal and Security; track volume, cycle time, recurring negotiation themes, exceptions, and material commitments. Deliver practical training to Security, Sales, Product, Engineering, Procurement, and Customer Success teams. Recommend process and tooling improvements that reduce manual work while maintaining appropriate legal and security review. We expect you to have Law degree and admission to practice, or equivalent professional legal qualification in a relevant jurisdiction. 5+ years of relevant legal experience, including significant in-house responsibility for technology, cybersecurity, cloud services, product counseling, commercial contracts, or regulated products. Demonstrated progression into a senior counsel, legal director, or comparable leadership role with ownership of complex, business-critical matters. Demonstrated experience negotiating customer security and data-protection terms and advising Security, Product, Engineering, and executive stakeholders. Working knowledge of common security and assurance frameworks and the ability to understand technical concepts sufficiently to assess legal and contractual implications. Strong judgment, concise drafting, executive communication, strategic project management, and the ability to prioritize multiple time-sensitive matters in a commercial environment. High integrity and discretion when handling privileged, confidential, security-sensitive, or incident-related information. It will be an added bonus if you have: Senior in-house experience with a SaaS, cloud, cybersecurity, enterprise technology, or other business-to-business technology company. Experience supporting security certifications, external audits, trust centers, public-sector customers, or highly regulated customers. Experience with global cybersecurity and resilience regimes and with coordinating advice across multiple jurisdictions. Experience building scalable legal intake, contract playbooks, knowledge bases, workflow automation, or legal-operations programs. Prior work involving cyber affairs, government, defense, international or regional legal matters, or other high-stakes regulated environments. An advanced degree or formal specialization in international law, technology law, cybersecurity, privacy, or a related discipline. Benefits & Perks: Competitive compensation Career growth and learning opportunities Flexibility and ownership Collaborative and innovative culture Opportunity to work on impactful AI projects International environment and talented teams What's it like to work at Nebius: Fast moving - Bold thinking - Constant growth - Meaningful impact - Trust and real ownership - Opportunity to shape the future of AI Equal Opportunity Statement: Nebius is an equal opportunity employer. We are committed to fostering an inclusive and diverse workplace and to providing equal employment opportunities in all aspects of employment. We do not discriminate on the basis of race, color, religion, sex (including pregnancy), national origin, ancestry, age, disability, genetic information, marital status, veteran status, sexual orientation, gender identity or expression, or any other characteristic protected by applicable law. Applicants must be authorized to work in the country in which they apply and will be required to provide proof of employment eligibility as a condition of hire. If you need accommodations during the application process, please let us know.

Location: Limassol Workplace: onsite About Unlimit Unlimit is the global financial infrastructure for the borderless agentic economy. Designed to bridge the gap between fragmented local markets and the future of autonomous commerce, Unlimit provides the programmable operating layer for the world’s most ambitious businesses. Through an integrated technology stack, the platform unifies global payment acceptance, programmable financial accounts, and digital asset rails into a singular financial layer. By mapping hyper-local payment ecosystems directly into its architecture, Unlimit enables businesses to move value and settle transactions instantly across continents. Built on decades of hard-won regulatory depth and an extensive global license portfolio, the platform provides direct access to a massive global infrastructure. With major hubs in London, San Francisco, Singapore, São Paulo, and Mexico City, Unlimit is building the infrastructure that makes global expansion a matter of code, not geography. Summary: The Head of Securities owns Unlimit's securities business end to end: trading, custody, clearing and settlement, and the controls around them. The role reports to the CEO of the investment firm entity (or COO), leads the securities operations team, and is the senior point of contact for brokers, custodians, exchanges and the regulator on securities matters. Key responsibilities: Strategy and business Set and deliver the securities business strategy, product scope and annual budget. Build and manage relationships with executing brokers, custodians, CSDs, exchanges and liquidity providers. Evaluate new instruments, markets and venues, and lead their onboarding. Operations Oversee the full trade lifecycle: order handling, execution, confirmation, clearing and settlement. Run daily reconciliations of positions, cash and securities across custodians and internal books. Manage corporate actions, settlement fails, breaks and exceptions to resolution. Ensure safeguarding of client financial instruments and funds Risk, compliance and regulation Ensure the securities business complies with MiFID II/MiFIR, CySEC rules, MAR, CSDR and EMIR as applicable. Own best-execution policy and monitoring, and transaction reporting (RTS 22) accuracy. Work with Compliance, Risk and AML on market abuse surveillance, client categorisation and suitability/appropriateness. Define and maintain operational controls, KPIs, procedures and the securities risk register. Act as key contact for internal and external audits and regulatory inspections. Technology and change Own requirements for OMS, back-office and reconciliation systems; drive automation and STP. Lead integration projects with new counterparties and venues. People Lead, hire and develop the securities team; set objectives and run performance reviews. Report to senior management and the Board on performance, incidents and risk. Requirements: 10+ years in securities operations, brokerage or custody, with 4+ years leading a team. Hands-on knowledge of the trade lifecycle across equities, fixed income and ETFs; derivatives a plus. Strong working knowledge of MiFID II/MiFIR, CySEC regulation, CSDR and client asset safeguarding. Experience with custodians, prime brokers and settlement systems (e.g. Euroclear, Clearstream, DTC, SWIFT ISO 15022/20022). Track record of building controls, reconciliations and procedures that pass audit and regulatory review. Degree in finance, economics, accounting or a related field. Fluent English; Greek or Russian an advantage. Able to meet CySEC fit-and-proper requirements; holder of the CySEC Advanced Certificate, or willing to obtain it. Experience with tokenized securities Join Unlimit Team now!   Unlimit is an equal opportunity employer. We believe passionately that employing a diverse workforce is central to our success. We make recruiting decisions based on your experience and skills. We welcome applications from all members of society irrespective of age, sex, disability, sexual orientation, race, religion or belief.

Location: Limassol; Nicosia; Athens; Thessaloniki Workplace: hybrid The Role:    We are looking for an experienced, passionate and self-motivated professional to join our fast-growing Information Security team. As part of our Information Security Audit Program, you will have the opportunity to assess and improve security controls across a dynamic and fast-paced environment. You will work with cutting-edge technologies and talented professionals, gaining hands-on experience in security assessments, compliance audits, and risk management. The main responsibilities of the position include: Perform hands-on complex security audits in IT infrastructure, applications, technologies and third parties Assess internal controls, processes and policies related to Information Technology and Security identifying deficiencies, and developing remediation strategies Prepare comprehensive audit reports summarizing the audit scope, results of test work, findings and recommend corrective actions Identify information security risks and make recommendations which are appropriate, practical and cost-effective Manage and monitor the progress of remediation steps on audit findings Ensure the organization meets all information security requirements of applicable laws and regulations Liaise with external auditors and internal stakeholders in successful execution of all compliance audits Provide regular reports and metrics on the security posture to the relevant stakeholders Main requirements: BSc/MSc in Information Security or any other related field Minimum 2 years working experience in an Information Security related field Experience in IT Systems and Security audit, vulnerability assessments and security risk management Demonstrated experience in auditing large scale infrastructures, information systems, IT processes and advanced security controls Good knowledge of information and security technologies such as Windows and Active Directory, Linux, virtualization, host and application security, networking, firewalls, security architecture etc Hands-on experience in auditing cloud infrastructures (AWS, Azure, GCP etc) will be considered an advantage Good understanding of security regulations and frameworks such as ISO 27001, NIST CSF and 800-53, GDPR, DORA etc Strong project and time management skills with the ability to work independently under minimal supervision and as part of a team Meticulous attention to detail with an analytical mind and outstanding problem-solving skills Excellent communication skills with the ability to explain technical concepts to a non-technical audience Audit-related and other information security certifications such as CISA, ISO 27001 Lead Auditor, CISSP, CCSP etc will be considered an advantage Benefit from: Attractive remuneration package plus performance related reward Private health insurance Corporate pension fund Intellectually stimulating work environment Continuous personal development and international training opportunities The Hiring Experience: What Awaits You Let’s Connect – Intro Chat with Talent Acquisition Deep Dive – First Interview with Your Future Team Final Connection – Final Interview All applications will be treated with strict confidentiality!   By submitting this application, I confirm that I have read and agree to the terms of the Privacy and Data Protection Notice and the Confidentiality Undertaking.

Location: APAC Please confirm the content below matches the template that SH&I provides and review the benefits at the bottom: [Make a Copy] OKX Job Description Who We Are At OKX, we believe that the future will be reshaped by crypto, and ultimately contribute to every individual's freedom. OKX is a leading crypto exchange, and the developer of OKX Wallet, giving millions access to crypto trading and decentralized crypto applications (dApps). OKX is also a trusted brand by hundreds of large institutions seeking access to crypto markets. We are safe and reliable, backed by our Proof of Reserves. Across our multiple offices globally, we are united by our core principles: We Before Me , Do the Right Thing , and Get Things Done . These shared values drive our culture, shape our processes, and foster a friendly, rewarding, and diverse environment for every OK-er. OKX is part of OKG, a group that brings the value of Blockchain to users around the world, through our leading products OKX, OKX Wallet, OKLink and more. About the Opportunity We are seeking an experienced Product Manager with expertise in blockchain risk control, anti-money laundering (AML), and security protection to build a secure and compliant Web3 product ecosystem. You will conduct in-depth analysis of on-chain transaction risks, design risk management strategies, and collaborate with security, compliance, and engineering teams to develop highly secure Web3 wallets and DApp interaction products, ensuring the safety of user assets. What You’ll Be Doing Risk Control & Security Product Planning Design risk control, AML, and security protection frameworks for Web3 products, and formulate risk management strategies. Research on-chain fraud patterns (e.g., phishing attacks, authorization hijacking, money laundering transactions) to optimize risk identification and interception mechanisms. Design and implement transaction security features, such as risk transaction alerts, malicious address blocking, and token contract security detection. Compliance & Anti-Money Laundering (AML) Monitor global blockchain compliance policies to ensure Web3 products meet regulatory requirements. Optimize AML risk control rules to improve suspicious transaction identification and interception capabilities, reducing compliance risks. Collaborate with legal and compliance teams to establish user AML processes and refine risk control review mechanisms. Security Product Design Research security risks such as smart contract vulnerabilities, wallet security, and private key management, and propose security solutions. Design security features to prevent phishing and authorization abuse, enhancing asset protection for users. Work with the security team to optimize on-chain transaction monitoring systems and improve abnormal transaction detection rates. Data Analysis & Strategy Optimization Analyze on-chain transaction data to identify potential risk patterns and continuously refine risk control models. Monitor industry security incidents (e.g., hacking attacks, fraud techniques) and rapidly iterate risk control strategies. What We Look For In You Essential Qualifications 5+ years of product management experience, with at least 3 years in blockchain/Web3, and familiarity with DeFi, smart contracts, and wallet security. Strong understanding of blockchain risk control, AML, and security mechanisms, with knowledge of common fraud methods (e.g., MEV attacks, phishing scams, money laundering). Solid data analysis skills, capable of identifying risks through on-chain data (e.g., transaction graphs, address behavior). Familiarity with mainstream risk control technologies (e.g., rule engines, machine learning models), with prior product design experience preferred. Strong stress tolerance and ability to handle sustained high-intensity workloads. Excellent cross-team collaboration skills to work effectively with security, engineering, and compliance teams Nice to Haves Prior experience in risk control or security products at exchanges, wallet providers, or security firms is a plus. Knowledge of blockchain and exchange compliance policies is preferred. Understanding of smart contract auditing, zero-knowledge proofs (ZKP), and other security technologies is a plus. Perks & Benefits Competitive total compensation package L&D programs and Education subsidy for employees' growth and development Various team building programs and company events Wellness and meal allowances Comprehensive healthcare schemes for employees and dependants More that we love to tell you along the process! Notice: All official OKX vacancies are published on this website. While roles may appear on selected third-party platforms from time to time, information on other sites may be inaccurate or outdated. If in doubt, please apply directly through our official careers website. Information collected and processed as part of the recruitment process of any job application you choose to submit is subject to OKX 's Candidate Privacy Notice .

Location: Bangalore, India GitLab is the intelligent orchestration platform for DevSecOps. GitLab enables organizations to increase developer productivity, improve operational efficiency, reduce security and compliance risk, and accelerate digital transformation. More than 50 million registered users and more than 50% of the Fortune 100* trust GitLab to ship better, more secure software faster. The same principles built into our products are reflected in how our team works: we embrace AI as a core productivity multiplier, with all team members expected to incorporate AI into their daily workflows to drive efficiency, innovation, and impact. GitLab is where careers accelerate, innovation flourishes, and every voice is valued. Our high-performance culture is driven by our values and continuous knowledge exchange, enabling our team members to reach their full potential while collaborating with industry leaders to solve complex problems. Co-create the future with us as we build technology that transforms how the world develops software. * Fortune 500® is a registered trademark of Fortune Media IP Limited, used under license. Claim based on GitLab data. Fortune 100 refers to the top 20% ranked companies in the 2025 Fortune 500 list, published in June 2025. Fortune and Fortune Media IP Limited are not affiliated with, and do not endorse products or services of GitLab. An overview of this role As an Engineering Manager on GitLab's Authentication team, you'll build and lead a team of engineers in Bangalore who own how users, applications, tokens, and artificial intelligence (AI) agents sign in to GitLab. At GitLab, we see our team as our product. You'll need to be technically credible in authentication protocols such as OAuth 2.0, OpenID Connect (OIDC), and Security Assertion Markup Language (SAML). Your main focus will be hiring well, growing your engineers, and helping the team deliver on commitments that other parts of GitLab depend on. You'll guide your team's work on OAuth across Cells, global identities, token consolidation, and moving authentication out of the Ruby on Rails monolith onto GATE, GitLab's new authentication and authorization platform. You'll manage these multi-quarter programs with fixed deadlines and many dependent teams. What you'll do Hire, onboard, and grow a team of senior and intermediate engineers in Bangalore, working with talent acquisition during a high-volume hiring period. Own delivery for your team's part of the authentication roadmap: plan in milestones, track risks early, and communicate clearly when a date is at risk and what would change it. Work with your Staff Engineer and Product Manager to turn architecture decisions into shippable, feature-flagged increments. Protect your team's focus. Manage requests from other teams through one intake path, and make trade-offs visible to leadership. Coordinate with the GATE Core, GATE Infra, Authorization, and Tenant Scale (Cells and Organizations) teams across India, Europe, and the Americas. Make sure the team runs what it builds, including on-call coverage, incident response for authentication issues, rate limits, and production readiness for new services. Build a team culture where security comes first, decisions are written down, and code review is thorough and kind. Give clear, regular feedback, run career conversations, and handle performance issues early. Take part in on-call or operational support where your team’s ownership model requires it. What you'll bring Significant experience as an engineering manager of backend or platform teams, including hiring and growing senior engineers. A background as an engineer in identity, authentication, or security systems, with enough depth in OAuth 2.0, OIDC, SAML, and JSON Web Tokens to review designs and ask probing questions. Experience delivering complex, multi-team programs against fixed dates, including migrations that must not disrupt existing customers. Experience running production services, including on-call coverage, incident response, and reliability work. Working knowledge of Ruby on Rails or Go. Experience building a new team or growing one quickly while keeping the hiring bar high. Clear, concise written English and comfort leading a team in an all-remote, asynchronous company across time zones. About the team We're part of the Security Platform stage, alongside Authorization, GATE Core, GATE Infra, Secrets Manager, and other security teams. You'll partner closely with our existing Authentication engineers in Europe and the Americas. How GitLab Supports Full-Time Employees Benefits to support your health, finances, and well-being Flexible Paid Time Off Team Member Resource Groups Equity Compensation & Employee Stock Purchase Plan Growth and Development Fund Parental Leave Please note that we welcome interest from candidates with varying levels of experience; many successful candidates do not meet every single requirement. Additionally, studies have shown that people from underrepresented groups are less likely to apply to a job unless they meet every single qualification. If you're excited about this role, please apply and allow our recruiters to assess your application. Country Hiring Guidelines: GitLab hires new team members in countries around the world. All of our roles are remote, however some roles may carry specific location-based eligibility requirements. Our Talent Acquisition team can help answer any questions about location after starting the recruiting process. Privacy Policy: Please review our Recruitment Privacy Policy. Your privacy is important to us. GitLab is proud to be an equal opportunity workplace and is an affirmative action employer. GitLab’s policies and practices relating to recruitment, employment, career development and advancement, promotion, and retirement are based solely on merit, regardless of race, color, religion, ancestry, sex (including pregnancy, lactation, sexual orientation, gender identity, or gender expression), national origin, age, citizenship, marital status, mental or physical disability, genetic information (including family medical history), discharge status from the military, protected veteran status (which includes disabled veterans, recently separated veterans, active duty wartime or campaign badge veterans, and Armed Forces service medal veterans), or any other basis protected by law. GitLab will not tolerate discrimination or harassment based on any of these characteristics. See also GitLab’s EEO Policy and EEO is the Law . If you have a disability or special need that requires accommodation , please let us know during the recruiting process .

Location: Foster City, CA Workplace: Hybrid Replit is the agentic software creation platform that enables anyone to build applications using natural language. With millions of users worldwide, Replit is democratizing software development by removing traditional barriers to application creation. About the role: We are looking for an Engineering Manager, Security to lead the teams that secure our cloud, our infrastructure, and the code we ship. You will manage two closely linked groups: - Cloud & Infrastructure Security: engineers who own cloud security posture, configuration hardening, and infrastructure vulnerability management across GCP, AWS, and Azure, plus containers, Kubernetes, and SaaS platforms. - Application Security & Secure SDLC: engineers who run our SCA, SAST, and IaC scanning programs, drive remediation with engineering teams, and deliver secure development training. The core responsibility of this role is getting vulnerabilities fixed on time. You will partner with engineering teams across the company to drive remediation of cloud, infrastructure, and code findings within SLA, so that we consistently meet our compliance commitments (SOC 2, ISO 27001, PCI DSS, FedRAMP, and customer contracts). You will hire and grow a high-performing team, set the strategy and roadmap for vulnerability management from code to cloud, and make secure-by-default the easiest path for every developer. You will not run incident response yourself, but you need to understand it well enough to support the incident response team with context, prioritization, and follow-up fixes.   What You'll Do: TEAM LEADERSHIP & STRATEGY - Build, lead, and mentor a team of cloud security, infrastructure vulnerability management, and application security engineers; own hiring, career development, and performance management. - Define the multi-year roadmap and quarterly OKRs for cloud security, vulnerability management, and Secure SDLC, balancing risk reduction against developer velocity. - Set clear ownership, operating rhythms, and on-call/escalation processes across the team. - Report on security posture, risk trends, and program metrics to engineering and executive leadership. REMEDIATION & COMPLIANCE DELIVERY - Own remediation SLAs by severity across cloud, infrastructure, container, and code findings, and make sure they map to our compliance obligations (SOC 2, ISO 27001, PCI DSS, FedRAMP, customer contracts). - Partner with engineering managers and tech leads to plan, prioritize, and land fixes within SLA without stalling roadmaps. - Run a regular remediation review with engineering leadership: open findings, SLA burn-down, upcoming SLA breaches, and owners. - Manage the exception and risk-acceptance process: documented justification, compensating controls, expiry dates, and approvals. - Build automated workflows that route findings to the right owning team, track them to closure, and escalate before SLAs are breached. - Work with Compliance/GRC to produce audit-ready evidence of remediation timeliness, and lead the security side of external audits for vulnerability management controls. - Track and report metrics such as SLA attainment, mean time to remediate, backlog age, and exceptions, by team and severity. CLOUD & INFRASTRUCTURE SECURITY - Lead infrastructure vulnerability management across cloud workloads, containers, registries, data stores, and platform services, from scanning and contextual risk triage to remediation workflows. - Oversee configuration hardening and secure baselines across GCP (primary) and supporting AWS and Azure environments. - Own the strategy for Cloud, Kubernetes, and Data Security Posture Management (CSPM, KSPM, DSPM) tooling; make sure findings are accurate, prioritized, and actionable. - Secure critical SaaS platforms with sound configurations, access controls, and integrations. - Partner with Platform and ML Infrastructure teams to secure multi-tenant and AI infrastructure. APPLICATION SECURITY & CODE SCANNING - Own the SCA, SAST, and IaC scanning programs end to end: tool selection, CI/CD integration, rule tuning, noise reduction, and developer experience. - Drive software supply chain security, including dependency management, SBOMs, artifact signing, and progress through SLSA levels. - Feed code-scanning findings into the central remediation workflow so they reach the owning team automatically and are tracked against SLA. - Shift IaC security left so misconfigurations are caught in pull requests, before they reach production. SECURE SDLC & DEVELOPER ENABLEMENT - Define and run the Secure SDLC program: security requirements, threat modeling, secure design reviews, and release gates proportionate to risk. - Build and deliver security training, including onboarding, role-based secure coding training, and targeted sessions driven by real vulnerability trends. - Develop paved roads, secure defaults, and guardrails that make the secure path the easiest path for engineers. - Grow a Security Champions network across engineering teams. INCIDENT RESPONSE PARTNERSHIP & COLLABORATION - Understand the incident response lifecycle well enough to support the IR team: supply asset, exposure, and vulnerability context, and help assess blast radius. - Own follow-up remediation from incidents and postmortems that touch cloud, infrastructure, or code, and track it to closure. - Feed incident learnings back into scanning rules, secure baselines, and developer training. - Collaborate with Security Monitoring/Detection, Incident Response, Offensive Security, PSIRT, Architecture, DevOps, and Platform Engineering. - Help communicate security advisories, best practices, and updates to customers. - Tune into threat intelligence alerts to promptly manage patching of critical, exploitable vulnerabilities.   Required Skills & Experience: - 8+ years in security engineering, cloud security, or DevSecOps, including 2+ years managing security engineers (or 3+ years as a tech lead with formal people-leadership responsibility). - Deep, hands-on knowledge of cloud security in GCP plus working knowledge of AWS and/or Azure: IAM, networking, logging, org policies, and security services. - Proven track record running vulnerability management programs at scale and driving remediation across many engineering teams to meet SLAs, across cloud infrastructure, containers, and application code. - Hands-on experience with CSPM/CNAPP platforms (e.g., Wiz, Orca, Prisma Cloud, Lacework, GCP Security Command Center). - Hands-on experience with SCA, SAST, and IaC scanning tools (e.g., Snyk, Semgrep, CodeQL, Checkmarx, Socket, Dependabot, Checkov, tfsec) and integrating them into CI/CD. - Strong understanding of Kubernetes and container security, and Infrastructure-as-Code (Terraform or similar). - Proven track record of building or maturing a Secure SDLC program, including developer security training. - Ability to write and review code or automation (Python, Go, TypeScript, or similar). - Strong understanding of how remediation SLAs and security controls map to compliance frameworks (SOC 2, ISO 27001, PCI DSS, FedRAMP, CIS, NIST), and experience producing audit evidence. - Working understanding of security incident response in cloud-native environments, enough to partner effectively with IR and detection teams. - Excellent communication skills, with the ability to influence engineering leaders and explain risk in business terms. Bonus Qualifications: - Experience securing developer platforms, multi-tenant SaaS, or AI/ML infrastructure. - Experience with software supply chain frameworks (SLSA, Sigstore, SBOM standards). - Experience building a Security Champions program or developer-facing security tooling. - Experience leading the security side of external audits (SOC 2 Type II, ISO 27001, PCI DSS, or FedRAMP). - Relevant certifications (e.g., CCSP, GCP Professional Cloud Security Engineer, OSCP, CSSLP), though not required. Full-Time Employee Benefits Include: 💰 Competitive Salary & Equity 💹 401(k) Program with a 4% match (US Only) ⚕️ Health, Dental, Vision and Life Insurance 🩼 Short Term and Long Term Disability 🚼 Paid Parental, Medical, Caregiver Leave 🏝 Flexible Time Off (FTO) + Holidays 🚗 Commuter Benefits (In-Office & US Only) 📱 Monthly Wellness Stipend 🧑‍💻 Autonomous Work Environment 🖥 In Office Set-Up Reimbursement (In-Office Only) 🚀 Quarterly Team Gatherings ☕ In Office Amenities (In-Office Only) Want to learn more about what we are up to? - Self-driving Company https://replit.com/blog/self-driving-company - Replit Agent at Scale https://replit.com/blog/evaluating-and-improving-agent-at-scale - AI Adoption https://replit.com/blog/ai-adoption - Build Open-Source Apps https://replit.com/build/open-source-app-builder   Interviewing + Culture at Replit - Operating Principles https://blog.replit.com/operating-principles - Reasons not to work at Replit https://blog.replit.com/reasons-not-to-join-replit To achieve our mission of making programming more accessible around the world, we need our team to be representative of the world. We welcome your unique perspective and experiences in shaping this product. We encourage people from all kinds of backgrounds to apply, including and especially candidates from underrepresented and non-traditional backgrounds.