Location: Remote-Friendly (Travel Required) | San Francisco, CA
About Anthropic
Anthropic’s mission is to create reliable, interpretable, and steerable AI systems. We want AI to be safe and beneficial for our users and for society as a whole. Our team is a quickly growing group of committed researchers, engineers, policy experts, and business leaders working together to build beneficial AI systems.
About the role
Claude is trained and served on hardware in data centers Anthropic operates and in sites partners build and run for us. DCSE secures that footprint: the sites, the hardware moving through them, and the people and vendors who touch it. You'll be the engineer for one or more security domains end to end: design the controls, build the systems that enforce and verify them, and set the technical standard the rest of the team and our partners build to.
The engineering is in the controls and the tooling that proves them. The goal is security that runs itself: requirements kept as code and checked automatically, evidence, chain of custody and access continuously verified, and tools and agents in place of manual reviews. We favor simple, standard controls and tools that can be verified over elaborate ones. We use Claude throughout our engineering workflow and expect you to as well.
This is a foundational role: you'll shape how our security engineering is built and scaled. The team's physical security systems engineers design and test the site security systems themselves; this role engineers the controls around them and across the domains beyond the facility itself: hardware custody, media, personnel and vendors. You'll work with the rest of DCSE, Anthropic's compute, data center operations, legal, compliance and procurement teams, and directly with data center operators, hardware vendors and logistics providers.
The role involves regular travel to data center sites, which are critical infrastructure, and may include on-call for security events at them.
Key responsibilities
Security domains, end to end:
own one or more of physical security at partner-operated and Anthropic-operated sites, hardware supply chain and chain of custody, media protection and sanitization, personnel security and site access, third-party and vendor security assessment, and maintenance and contingency controls
Tools, automation and AI agents:
build the internal tools, automation and agents the team runs on: evidence collection, access reviews, asset and custody tracking, partner intake. When a process keeps costing people time, you build the tool that retires it
Security review for new sites, leases and vendors:
find the gaps in the design, the contract and the operator's procedures, write the security terms and exhibits, and verify the fixes after signing
Requirements and procedures as code:
write requirements and procedures that a partner can build to and an assessor can test, kept as code in a version-controlled repository
Site and supplier assessment:
assess sites and suppliers against those requirements, on site and from evidence; document deviations and engineer the compensating control where a requirement can't be met as written
Continuous compliance evidence:
tie controls to the compliance frameworks we and our partners are assessed against, with evidence always current so an assessment pulls from it directly
Security event response:
respond to security events at sites (intrusion alarms, custody breaks, access violations) with operations teams and site operators; write up what happened and fix the control that allowed it
Minimum qualifications
Have engineered a security control domain end to end: designed the controls, built or integrated the systems that enforce them, and verified they work
Read and review code, design the data systems behind security tooling, and build automation (often with AI coding agents) using Git and code review
Have done security work hands-on for data centers, critical infrastructure or a large hardware fleet, in at least one of the domains under Key responsibilities
Have applied a control framework such as NIST SP 800-53, ISO 27001 or SOC 2 to real systems and produced the evidence for it
Write requirements a third party can build to and an assessor can test: each states what must be true, how it is verified and what evidence shows it
Preferred qualifications
Experience across several of the domains above rather than one
Experience at sites you did not fully control: cloud, colocation or GPU cloud operators
Experience with federal assessment regimes based on NIST SP 800-53, including supply chain (NIST SP 800-161) and media sanitization (NIST SP 800-88) guidance; have produced evidence an assessor accepted
Have built governance, risk and compliance (GRC) or evidence automation: automated control checks, asset or custody tracking, questionnaire and assessment pipelines, docs-as-code workflows
Have run incident response at physical sites: alarms, investigations, after-action fixes
Have worked in live data halls and on active construction sites, and can follow a method of procedure
Experience redlining contract security language with legal and procurement counterparts
Experience with international sites: per-country personnel screening and staffing restrictions, data residency, and export controls on hardware
Have built AI agents or automation that replaced recurring manual security work
The annual compensation range for this role is listed below.
For sales roles, the range provided is the role’s On Target Earnings ("OTE") range, meaning that the range includes both the sales commissions/sales bonuses target and annual base salary for the role.
Annual Salary:
$320,000
—
$405,000 USD
Logistics
Minimum education:
Bachelor’s degree or an equivalent combination of education, training, and/or experience
Required field of study:
A field relevant to the role as demonstrated through coursework, training, or professional experience
Minimum years of experience:
Years of experience required will correlate with the internal job level requirements for the position
Location-based hybrid policy:
Currently, we expect all staff to be in one of our offices at least 25% of the time. However, some roles may require more time in our offices.
Visa sponsorship:
We do sponsor visas! However, we aren't able to successfully sponsor visas for every role and every candidate. But if we make you an offer, we will make every reasonable effort to get you a visa, and we retain an immigration lawyer to help with this.
For roles performing work in California:
We will consider for employment all qualified applicants, including those with arrest or conviction records or criminal histories, in a manner consistent with the requirements of applicable state and local laws, including the San Francisco Fair Chance Ordinance, the City of Los Angeles’ Fair Chance Initiative for Hiring Ordinance, the Los Angeles County Fair Chance Ordinance for Employers, and the California Fair Chance Act.
We encourage you to apply even if you do not believe you meet every single qualification.
Not all strong candidates will meet every single qualification as listed. Research shows that people who identify as being from underrepresented groups are more prone to experiencing imposter syndrome and doubting the strength of their candidacy, so we urge you not to exclude yourself prematurely and to submit an application if you're interested in this work. We think AI systems like the ones we're building have enormous social and ethical implications. We think this makes representation even more important, and we strive to include a range of diverse perspectives on our team.
Your safety matters to us.
To protect yourself from potential scams, remember that Anthropic recruiters only contact you from @anthropic.com email addresses. In some cases, we may partner with vetted recruiting agencies who will identify themselves as working on behalf of Anthropic. Be cautious of emails from other domains. Legitimate Anthropic recruiters will never ask for money, fees, or banking information before your first day. If you're ever unsure about a communication, don't click any links—visit
anthropic.com/careers
directly for confirmed position openings.
How we're different
We believe that the highest-impact AI research will be big science. At Anthropic we work as a single cohesive team on just a few large-scale research efforts. And we value impact — advancing our long-term goals of steerable, trustworthy AI — rather than work on smaller and more specific puzzles. We view AI research as an empirical science, which has as much in common with physics and biology as with traditional efforts in computer science. We're an extremely collaborative group, and we host frequent research discussions to ensure that we are pursuing the highest-impact work at any given time. As such, we greatly value communication skills.
The easiest way to understand our research directions is to read our recent research. This research continues many of the directions our team worked on prior to Anthropic, including: GPT-3, Circuit-Based Interpretability, Multimodal Neurons, Scaling Laws, AI & Compute, Concrete Problems in AI Safety, and Learning from Human Preferences.
Come work with us!
Anthropic is a public benefit corporation headquartered in San Francisco. We offer competitive compensation and benefits, optional equity donation matching, generous vacation and parental leave, flexible working hours, and a lovely office space in which to collaborate with colleagues.
Guidance on Candidates' AI Usage:
Learn about
our policy
for using AI in our application process.
Location: Remote - United States
Reddit is a community of communities. It’s built on shared interests, passion, and trust, and is home to the most open and authentic conversations on the internet. Every day, Reddit users submit, vote, and comment on the topics they care most about. With 100,000+ active communities and approximately 130 million daily active unique visitors, Reddit is one of the internet’s largest sources of information. For more information, visit
www.redditinc.com
.
The Infrastructure Engineering team
enables Reddit to deliver Reliability, Performance, and Efficiency, with a single opinionated technology stack. We empower Reddit developers by delivering a reliable, scalable, and automated foundation - unifying compute, seamless deployments, robust storage, and high-performance messaging to maximize developer velocity and system resilience.
This centralized role hires across several high-impact teams, including:
Messaging:
Delivers a reliable, performant, and efficient platform to support asynchronous communication across all products and services at Reddit.
Compute:
Provides a resilient, high-performance, and cost-effective abstraction layer that streamlines application deployment and execution management across systems.
Build & Deployment:
Builds platforms and developer tooling that enable engineers to build, test, and safely deploy software across Reddit’s infrastructure.
Consumer IAM:
Authentication, authorization, and account infrastructure services.
Core Systems & Libraries:
Builds the foundational services that power Reddit.
Security:
Builds software that improves the security and reliability of Reddit’s infrastructure.
GRC (Governance, Risk & Compliance):
Builds software and automation that help Reddit manage risk, monitor controls, and scale security and compliance programs.
What You’ll Do
Cross-Functional Product Architecture:
Partner closely with Product Management, Product Design, Data Science, and Client Engineers (iOS/Android/Web) to translate business and user needs into reliable, low-latency technical solutions.
End-to-End Delivery:
Own the full software lifecycle for major product initiatives from technical design docs and API contracts to development, testing, rollout, and observability.
Metrics & Experimentation-Led Engineering:
Design, build, and evaluate A/B experiments. Work with tools like BigQuery, HEX, or Firebase to analyze user behavior, conversion funnels, and retention loops to make data-backed engineering decisions.
API & System Performance:
Build and maintain scalable APIs (GraphQL, REST, gRPC) and distributed backend services optimized for client consumption and consumer UI performance.
Technical Rigor & Modern Tooling:
Establish engineering best practices, improve developer workflows, mentor teammates, and use modern, AI-integrated tools to ship high-quality products efficiently.
In your day-to-day, you will:
Steer: Work with the team to select, scope, and drive high leverage projects that align with Reddit’s goals.
Build: Execute on a strategy and create a more performant, more scalable, higher quality architecture around authentication, authorization and identity.
Amplify: Mentor, coach, and collaborate with other technical contributors
Collaborate: Work together with a variety of cross functional teams across Reddit Engineering.
Evolve: Learn and improve your own technical and non-technical abilities
Who you might be:
5+ years of experience building internet-scale software, preferably with a focus on machine learning storage infrastructure.
Software development experience in one or more general purpose programming languages; Golang, Python, C++, Java
Experience with essential cloud infrastructure (Kubernetes, IC/CD, AWS, GCP)
Hands-on experience implementing features, optimizations, and bug fixes to distributed messaging systems.
Excellent communication skills to collaborate with stakeholders in engineering, data science, machine learning, and product.
Degree in Computer Science or equivalent technical field.
Benefits:
Comprehensive Healthcare Benefits and Income Replacement Programs
401k with Employer Match
Global Benefit programs that fit your lifestyle, from workspace to professional development to caregiving support
Family Planning Support
Gender-Affirming Care
Mental Health & Coaching Benefits
Flexible Vacation & Paid Volunteer Time Off
Generous Paid Parental Leave
Pay Transparency:
This job posting may span more than one career level.
In addition to base salary, this job is eligible to receive equity in the form of restricted stock units, and depending on the position offered, it may also be eligible to receive a commission. Additionally, Reddit offers a wide range of benefits to U.S.-based employees, including medical, dental, and vision insurance, 401(k) program with employer match, generous time off for vacation, and parental leave. To learn more, please visit
https://www.redditinc.com/careers/
.
To provide greater transparency to candidates, we share base salary ranges for all US-based job postings regardless of state. We set standard base pay ranges for all roles based on function, level, and country location, benchmarked against similar stage growth companies. Final offer amounts are determined by multiple factors including, skills, depth of work experience and relevant licenses/credentials, and may vary from the amounts listed below.
The base salary range for this position is:
$190,000
—
$267,000 USD
In select roles and locations, the interviews will be recorded, transcribed and summarized by artificial intelligence (AI). You will have the opportunity to opt out of recording, transcription and summarization prior to any scheduled interviews.
During the interview, we will collect the following categories of personal information: Identifiers, Professional and Employment-Related Information, Sensory Information (audio/video recording), and any other categories of personal information you choose to share with us. We will use this information to evaluate your application for employment or an independent contractor role, as applicable. We will not sell your personal information or disclose it to any third party for their marketing purposes. We will delete any recording of your interview promptly after making a hiring decision. For more information about how we will handle your personal information, including our retention of it, please refer to our
Candidate Privacy Policy for Potential Employees and Contractors
.
Reddit is proud to be an equal opportunity employer, and is committed to building a workforce representative of the diverse communities we serve. Reddit is committed to providing reasonable accommodations for qualified individuals with disabilities and disabled veterans in our job application procedures. If, due to a disability, you need an accommodation during the interview process, please let your recruiter know.
Location: Cairo, Egypt
Workplace: onsite
About Us:
Tabby is on a mission to give people power over their money. For too long, financial systems have worked for the institutions that built them, not the people using them. Runaway interest, fine print and limited access have left many behind, feeling shut out of a system that wasn't setting them up for success.
We're building a different kind of system—in a complete money app to send, spend and save. One that's clear, flexible and puts people and businesses in control. Founded in 2019, we serve customers and businesses across Saudi Arabia, the United Arab Emirates and Kuwait. Millions of customers and 65,000 global brands, government services and small businesses rely on us today.
What began as a better way to pay at checkout has grown into a financial system working the way it should have all along.
About the Role:
The role supports the Enterprise Risk Management (ERM) function by keeping its core processes running to a reliable cycle — risk and incident records, policy administration, new product approval coordination and the reporting calendar — so that the risk information reaching senior management and committees is complete, accurate and on time. The role works closely with the ERM Manager and first-line stakeholders across the business.
Key Responsibilities
Support the quarterly risk reporting cycle, including collection and validation of metrics, pack production and committee materials.
Maintain risk registers, incident records and action trackers, ensuring entries are complete, current and supported by evidence.
Administer the policy programme — tracking review and approval status, formatting, version control and the governance calendar.
Support the risk and control self-assessment cycle — scheduling checks, chasing evidence, and populating workpapers and trackers.
Support the maintenance of the risk appetite framework and key risk indicators, including data sourcing and validation with metric owners.
Support ERM training and awareness activity, including delivery logistics, materials and completion records.
Work closely with first-line stakeholders to collect, chase and quality-check risk information, escalating gaps and delays promptly.
Support internal audit and regulatory requests by preparing documentation and audit-ready evidence.
Support ERM governance and tooling, including use and administration of GRC tools and maintenance of documentation.
Skills, Knowledge & Expertise
2–4 years' experience in risk, GRC, compliance, audit support or a related operational role within Financial Services, FinTech, Payments or another regulated environment.
Working knowledge of risk registers, risk reporting and control documentation, with the ability to apply concepts pragmatically.
Strong organisational skills and attention to detail, with the ability to run several recurring cycles in parallel and keep each to deadline.
Confident coordinating across functions and seniority levels, including remotely, and comfortable chasing stakeholders for information.
Excellent written and verbal communication skills in English, including experience preparing clear risk reports and presentations.
Proficiency in Excel and PowerPoint; hands-on experience using or supporting GRC tools a strong advantage.
Job Benefits
2–4 years' experience in business continuity, operational resilience, operational risk or a related role within Financial Services, FinTech, Payments or another regulated environment.
Practical working knowledge of business continuity and resilience concepts — business impact analysis, recovery objectives, continuity planning and testing — with the ability to apply them pragmatically.
Awareness of regulatory expectations for operational resilience; familiarity with CBUAE requirements or an equivalent regime is an advantage.
Strong stakeholder engagement skills, with the confidence to run workshops and interviews with department heads and to challenge the answers constructively.
Excellent written and verbal communication skills, including experience preparing clear plans, reports and presentations.
Location: Dubai, UAE
Workplace: onsite
About Us:
Tabby is on a mission to give people power over their money. For too long, financial systems have worked for the institutions that built them, not the people using them. Runaway interest, fine print and limited access have left many behind, feeling shut out of a system that wasn't setting them up for success.
We're building a different kind of system—in a complete money app to send, spend and save. One that's clear, flexible and puts people and businesses in control. Founded in 2019, we serve customers and businesses across Saudi Arabia, the United Arab Emirates and Kuwait. Millions of customers and 65,000 global brands, government services and small businesses rely on us today.
What began as a better way to pay at checkout has grown into a financial system working the way it should have all along.
About the Role:
The role supports and independently delivers key elements of the business continuity and operational resilience programme across Tabby's UAE entities, helping the business understand which services must keep running, how long they can be disrupted before customers are harmed, and whether the firm could recover within that time. The role works closely with first-line owners across the business and supports the firm's response to regulatory expectations on operational resilience.
Key Responsibilities
Support the delivery of the business continuity and operational resilience programme across both UAE entities, in line with Central Bank of the UAE (CBUAE) expectations and the Group risk framework.
Run the business impact analysis cycle with departments — gathering, challenging and consolidating what each team does, what breaks if it stops, and how quickly.
Support the identification of critical operations and the setting of impact tolerances, working with first-line owners and senior management.
Develop and maintain business continuity and recovery plans, dependency mapping and crisis playbooks, keeping them current, practical and usable.
Coordinate and support the exercise and testing programme, including tabletop exercises, and document outcomes, lessons learned and follow-up actions.
Support the maintenance and continuous improvement of business continuity and operational resilience policies, standards and methodologies.
Contribute to resilience reporting for senior management, risk committees and the regulator, including maturity and self-assessment positions.
Support third-party and technology dependency work where it affects the resilience of critical operations.
Provide practical support to first-line owners on business impact analyses, recovery objectives, continuity planning and remediation actions.
Act as a point of contact for internal audit and support regulatory or external reviews relating to business continuity and operational resilience.
Support ERM governance and tooling, including use and administration of GRC tools, maintenance of documentation, committee materials, action trackers and audit-ready evidence.
Skills, Knowledge & Expertise
2–4 years' experience in business continuity, operational resilience, operational risk or a related role within Financial Services, FinTech, Payments or another regulated environment.
Practical working knowledge of business continuity and resilience concepts — business impact analysis, recovery objectives, continuity planning and testing — with the ability to apply them pragmatically.
Awareness of regulatory expectations for operational resilience; familiarity with CBUAE requirements or an equivalent regime is an advantage.
Strong stakeholder engagement skills, with the confidence to run workshops and interviews with department heads and to challenge the answers constructively.
Excellent written and verbal communication skills, including experience preparing clear plans, reports and presentations.
Job Benefits
A working environment that gives you autonomy and responsibility from day one.
You should be comfortable with the idea that the quality of your work will influence the shape of your career.
Participation in the company’s employee stock options program.
Health Insurance
Flexi Perks: A monetary benefit that gives you the freedom to use it as you choose—whether for health and well-being, education and professional development or travel needs!
Location: Riyadh, KSA
Workplace: onsite
We're looking for an Information Security Specialist (GRC) to join Tabby! The successful candidate will independently execute governance, risk, and compliance activities across the Tabby's information security programme.
Key Responsibilities
Information Security Governance
Maintain and update the information security governance framework documentation, policy library, and associated standards and procedures.
Draft and revise information security policies, standards, and baselines, ensuring alignment with applicable regulatory requirements and business objectives.
Monitor and track changes in legal, regulatory, and contractual requirements affecting information security (SAMA CSF, PDPL, NCA ECC, PCI-DSS), updating the compliance register accordingly.
Maintain and update role and responsibility matrices (RACI), information security governance committee documentation, and reporting packs.
Coordinate security governance committee meetings — preparing agendas, minutes, and action tracking.
Produce internal and external communication materials related to information security governance, policies, and programme updates.
Information Risk Management
Execute information security risk assessments independently, applying the organization's risk assessment methodology and producing complete risk registers with identified threats, vulnerabilities, likelihood, impact, and treatment plans.
Maintain and update the information asset register — tracking asset owners, classifications, and associated risk profiles.
Lead business impact assessment (BIA) data collection activities, coordinating with asset owners and business units to capture accurate recovery objectives and criticality ratings.
Conduct control effectiveness evaluations for key information security controls, documenting findings and escalating gaps to the Lead for treatment.
Coordinate third-party information security risk assessments — preparing assessment questionnaires, reviewing vendor responses, and producing risk summaries.
Integrate risk and vulnerability data into procurement reviews, project onboarding, and change management processes.
Prepare periodic risk reports for senior review, highlighting emerging risks, significant changes in the risk profile, and the status of risk treatment actions.
Compliance & Programme Development
Monitor the organization's compliance posture against SAMA CSF, NCA ECC, PDPL, ISO 27001, and PCI-DSS — tracking control status, identifying gaps, and coordinating remediation.
Coordinate internal and external audit activities — gathering evidence packages, liaising with auditors, tracking findings, and monitoring remediation progress.
Support the preparation of regulatory submissions, self-assessments, and compliance attestations required by SAMA, NCA, and PCI Council.
Maintain and enhance the security awareness programme — developing training materials, scheduling communications, and tracking completion metrics.
Monitor KPIs and KRIs for the information security programme, preparing accurate and timely dashboards for senior management review.
Support the integration of information security requirements into procurement, project management, and change control processes.
Cross-Functional & General GRC Support
Maintain the information security policy, standard, and procedure library — managing version control, review cycles, and distribution.
Support information security initiatives across business and technology teams, providing GRC subject matter expertise on projects and change programmes.
Conduct information classification reviews and document security requirements for key business and IT projects.
Deliver information security awareness sessions and materials to targeted staff groups.
Provide analytical support for GRC team reporting, data gathering, and programme tracking activities.
Skills, Knowledge and Expertise
Bachelor's degree in Information Technology, Computer Science, Software Engineering, Cybersecurity, Risk Management, or a related field.
1–3 years of professional experience in information security governance, risk management, compliance, or a closely related field. Hands-on experience with risk assessment execution, policy development, or compliance monitoring is required. Prior exposure to SAMA CSF, ISO 27001, PDPL, or NCA ECC requirements is a strong advantage. Experience in a regulated Fintech or banking environment is preferred.
ISO 27001 Foundation or Lead Implementer (preferred). CompTIA Security+ or equivalent.
Working toward CRISC (Certified in Risk and Information Systems Control) or CISM.
Benefits
We are an international team of inspired professionals located all over the globe.
We have an inclusive company culture, embracing diversity, integrity and transparency. We strive for work-life balance and cherish the moments you spend with your loved ones, off-work. In the same spirit as for our product, we are caring and nurturing for our employees.
Our people are granted 100% trust and freedom to apply their own vision and come up with their ideas from day 1 at Tabby. You are the one who takes responsibility for your area of work. We encourage everyone to think and make decisions like Tabby was their own business, well because it is. Our employee stock options programme is available for everyone.
You will have an opportunity to learn and grow in one of the fastest growing fin tech companies in the region
We offer you relocation support as well as we guide you through all the process.
We’ll set you up with the devices required for your work.
Location: Riyadh, KSA
Workplace: onsite
BNPL businesses don't run on a single core system — they run on a chain of vendors: KYC providers doing identity
checks in milliseconds, bureau data feeding underwriting decisions, processors moving money at checkout, and
collections agencies chasing missed payments on our behalf. When any link in that chain fails, it isn't an internal
inconvenience — it's a customer who can't check out, a credit decision made on bad data, or a regulator asking why
a critical service went down with no warning.
As Vendor Risk Manager, you will own our third-party risk program end to end, from the first due diligence
questionnaire to the day a vendor is offboarded. You will be the person who can tell leadership, in plain terms,
which vendors carry the most risk and why, and you will make sure vendor failures never become customer failures.
Key Responsibilities
Due Diligence & Onboarding
Run due diligence on new vendors before contracts are signed, including financial health checks, SOC 2 / ISO 27001 review, breach history, and subprocessor mapping.
Issue a clear risk rating for every prospective vendor, with conditions attached rather than a simple pass or
fail, covering KYC, identity verification, fraud detection, credit bureau, payment processing, card issuing,
banking, and collections partners.
Sit inside the contracting process with Legal and Procurement to secure the terms that matter: audit rights,
breach notification windows, data localization commitments, exit assistance clauses, and SLAs tied to real penalties.
Risk Assessment & Ongoing Monitoring
Own vendor risk assessments across our active third-party portfolio, prioritizing critical and high-risk vendors for annual deep-dive reviews.
Build and run tiered monitoring cadences — quarterly for critical vendors such as KYC, payment processing, and banking partners, annual for the rest — tracking control drift, subprocessor changes, and
adverse media.
Maintain the concentration risk and critical-vendor register, and be ready to explain single points of failure, such as one bureau covering the majority of underwriting volume, and what the contingency plan actually
is.
Cross-Functional Partnership
Work with Product before new vendor integrations go live — you're in the room when a new checkout partner or fraud model vendor is being evaluated, not brought in after the contract is signed.
• Prepare vendor risk reporting for the Risk Committee and Board, translating control gaps and incident
trends into decisions leadership can act on.
Offboarding & Exit Management
Manage the offboarding process for exited vendors, confirming data deletion, access revocation, and transition continuity for anything customer-facing.
Ensure regulatory and contractual exit obligations are met and documented, particularly for vendors
classified as critical or important.
Skills, Knowledge & Expertise
3–4 years in third-party risk management, vendor risk, or operational risk, ideally at a payments company, lender, bank, or fintech where vendor failure has direct customer or regulatory consequences.
Working knowledge of NIST CSF, ISO 27001, SOC 2, and standardized assessment tools like SIG or
CAIQ — you know how to read a SOC 2 report and spot what's missing, not just file it away.
Familiarity with the regulatory landscape vendors sit inside: consumer credit rules, data privacy obligations
(GDPR/CCPA depending on footprint), PCI-DSS for anything touching card data, and
outsourcing/operational resilience expectations for critical third parties.
Comfort negotiating directly with vendors — you've pushed back on a processor's standard MSA, gotten a
fraud vendor to commit to a real SLA, and know when “our legal team will follow up” means the deal
needs to walk.
Ability to translate risk findings for people who don't think in risk terms, including explaining to a
commercial lead why a cheaper KYC vendor isn't worth the onboarding delay it will cause six months later.
Strong analytical skills with the ability to interpret vendor performance and control data to support
operational decisions.
Excellent communication and interpersonal skills, with the ability to interact effectively across all levels of
the organization.
Full professional proficiency in English required; Arabic is a plus.
Nice to have:
Direct BNPL or consumer credit experience — you've worked with bureau data, alternative credit scoring
vendors, or collections agencies specifically.
Hands-on experience with a GRC platform such as OneTrust, ProcessUnity, or Archer for assessment
workflows and vendor inventory.
CTPRP, CRISC, CISA, or CISM certification.
Location: Remote Canada
At Affirm, we exist for the moments that matter—giving people a clear, predictable way to pay over time, with no hidden fees, no surprises, and no tradeoffs on what matters most.
At Affirm, we exist for the moments that matter—giving people a clear, predictable way to pay over time, with no hidden fees, no surprises, and no tradeoffs on what matters most.
About the team
Affirm values security as being critical to the company's continued success. Our mission is to cultivate a culture of security at Affirm, enabling the company to succeed in building honest financial products. The Security Risk Management team is evolving beyond traditional governance, risk, and compliance; we are building an engineering driven program that designs, automates, and scales the controls, workflows, and tooling that protect Affirm and our customers.
The ideal candidate will design, develop, configure, and implement solutions to complex technical and business problems across the Security Third Party Program and the broader Security Risk Management program, with a focus on the third parties Affirm takes on when it enters new markets and acquires companies. They are equally comfortable shaping policy and shipping automation using modern tooling (Python, Cursor, Claude, and other agentic coding platforms) to replace manual GRC work with scalable, code-defined workflows. They will operate as a subject matter expert, interface with business, legal, corporate development, and engineering stakeholders, and play a key role in transforming Security Risk Management from a compliance oriented function into a security engineering discipline.
What You'll Do:
Lead and mature Affirm's Security Third Party Program, including the design, implementation, and continuous improvement of processes, controls, and operational workflows
Own pre-launch security due diligence for the third parties that support Affirm's entry into new international markets, such as local payment processors, banking and lending partners, credit bureaus, identity verification and KYC providers, collections agencies, and in-region hosting providers. Adapt Affirm's third party assessment standards to new markets, account for data residency, cross-border data transfer, and local regulatory requirements
Support Finance - Strategy & Development, Legal, and Security leadership on M&A security due diligence: assess an acquisition target's security program, control environment, incident history, data handling, and third party dependencies, and turn findings into risk ratings and deal recommendations
Lead post-close integration of an acquired company's vendor portfolio into Affirm's third party program, including inventory, risk tiering, reassessment, and tracking remediation and transition service dependencies to closure
Design and operate workflow orchestration and integrations across systems like ticketing, GRC platforms, vendor management tools, identity providers, and cloud control planes
Partner closely with Procurement, Legal, Engineering, IT, Compliance, Privacy, Corporate Development, international launch teams, and business stakeholders to assess and manage security risk across third party relationships
Translate ambiguous business and security requirements into practical, scalable program solutions and decision frameworks
Identify opportunities to automate manual processes across the program and prototype solutions yourself rather than waiting on an engineering backlog
Drive program operational excellence by establishing repeatable processes, service-level expectations, metrics, and reporting for third party security risk management
Evaluate third party security controls, cloud architectures (AWS/GCP), integration patterns, and risk posture, and provide clear recommendations to stakeholders and leadership
Conduct threat modeling assessments on high risk integrations and partner with Security SMEs for deeper diligence
Manage and prioritize a portfolio of complex security risk reviews and initiatives simultaneously, including confidential deal work on compressed timelines, balancing business enablement with risk reduction
Partner with technical teams to implement or optimize systems and tools that support program automation and workflow orchestration
Develop dashboards, reporting mechanisms, and program insights (SQL, BI tools, or custom tooling) that improve visibility into risk trends, bottlenecks, and program performance
Act as a trusted advisor and SME on third party security risk management, helping stakeholders make informed, risk based decisions
Contribute to the broader Security Risk Management strategy by identifying opportunities to scale, simplify, and strengthen security governance processes through engineering
What We Look For:
5+ years of experience in Information Security, Risk Management, Engineering and/or relevant roles
Experience performing security due diligence on M&A targets, or running third party risk assessments across multiple countries or regulatory regimes
Hands-on experience using agentic coding tools (Cursor, Claude Code, Copilot, etc.) and a working knowledge of Python; you don't need to be a software engineer, but you should be fluent enough to read, modify, and run scripts, build automations, and ship small tools end-to-end
Familiarity with cloud environments (AWS, GCP, or Azure): IAM, logging, common services, and the security risks/controls that apply to cloud-deployed third parties and integrations
Excellent written and verbal communications skills
Experience engineering solutions via Python, Claude, Cursor or other agentic coding tooling
Experience with industry based information security & control frameworks (NIST Cybersecurity Framework, ISO 2700x, SOC 1 & 2 (SSAE 18), ISAE 3402, PCI DSS, NIST 800-53, CIS Critical Security Controls, etc.)
BA or BS degree in Information Security, Cyber Security, Computer Science or related field or commensurate experience
Attention to detail and experience with security practices and security tooling
Demonstrated ability to drive projects towards completion
Ability to understand and communicate technical issues to non-technical teams and leadership
Sound judgment and discretion handling confidential, deal-sensitive information
Familiarity with international data protection and third party or operational resilience requirements (e.g., GDPR, EU DORA, etc.) is a plus
Professional certification in Information Security or Risk Management (such as CISSP, CISM, CISA, CRISC, etc.) is a plus
Base Pay Grade
- L
Equity Grade
- 5
Employees new to Affirm typically come in at the start of the pay range. Affirm focuses on providing a simple and transparent pay structure which is based on a variety of factors, including location, experience and job-related skills.
Base pay is part of a total compensation package that may include monthly stipends for health, wellness and tech spending, and benefits (including 100% subsidized medical coverage, dental and vision for you and your dependents). In addition, the employees may be eligible for equity rewards offered by Affirm Holdings, Inc. (parent company).
CAN base pay range per year:
CAD $128,000 - $188,000
Remote-first with flexibility built in
Affirm is proud to be a remote-first company. Most roles can be done from almost anywhere within the country of employment. Some positions may occasionally require in-person work at an Affirm office, and a few are office-based due to the nature of the work. All new hires will be invited to attend an in-person onboarding experience.
Benefits designed for you
Our benefits reflect our commitment to care, transparency, and flexibility. Here are a few highlights:
Health coverage at no cost: We cover 100% of premiums for employees and their dependents.
Spending stipends: Monthly stipends support your tech setup, and the ability to choose health and wellness options that are right for you.
Time off to recharge: Flexible time off and generous holiday calendars help you rest when you need to.
Own a piece of what you build: Our employee stock purchase plan (ESPP) lets you buy Affirm stock at a discount.
Location - Remote Canada
This remote role is open only to candidates residing in Alberta, British Columbia, Manitoba, New Brunswick, Newfoundland and Labrador, Nova Scotia, Ontario, Prince Edward Island, or Saskatchewan.
#LI-Remote
Remote-first with flexibility built in
Affirm is proud to be a remote-first company. Most roles can be done from almost anywhere within the country of employment. Some positions may occasionally require in-person work at an Affirm office, and a few are office-based due to the nature of the work. All new hires will be invited to attend an in-person onboarding experience.
Benefits designed for you
Our benefits reflect our commitment to care, transparency, and flexibility. Here are a few highlights:
Health coverage at no cost: We cover 100% of premiums for employees and their dependents.
Spending stipends: Monthly stipends support your tech setup, and the ability to choose health and wellness options that are right for you.
Time off to recharge: Flexible time off and generous holiday calendars help you rest when you need to.
Own a piece of what you build: Our employee stock purchase plan (ESPP) lets you buy Affirm stock at a discount.
We’re committed to providing an inclusive interview process, including accommodations for candidates with disabilities. If you need support, we’re happy to help.
For positions based in San Francisco or Los Angeles: Affirm considers qualified applicants with arrest and conviction records, as required by law.
By clicking "Submit Application," you acknowledge that you have read Affirm's
Global Candidate Privacy Notice
and consent to the use of your personal information as described.
Location: San Francisco; Washington D.C.; New York City
Workplace: Hybrid
We're hiring a Legal Response Specialist on Perplexity's Support team to handle legal and other sensitive tickets. You'll help Legal answer routine requests for information and support Governance, Risk & Compliance, or GRC, on privacy and security requests.
You'll review cases, write responses, and follow up until the work is done. Support Engineering owns the routing and safeguards that keep these tickets from being missed, answered by AI, or automatically closed.
RESPONSIBILITIES
- Monitor designated Support and Legal channels, assess urgency, and route requests for human review. Promptly escalate government, court, law enforcement, and legal-threat requests according to approved procedures.
- Respond to routine requests using Legal-approved templates and guidance. Escalate matters requiring legal interpretation or disclosure of user information.
- Answer routine requests for information under Legal's guidance. Gather account history and draft responses for matters that need review.
- Help GRC process data subject requests and meet deadlines. Follow approved identity-verification and data-handling procedures.
- Coordinate security questionnaires and data protection agreements, with Legal and GRC responsible for substantive review and approval.
- Track each case through completion, including after handoffs. Record decisions, follow up on deadlines, and confirm the work is done before closing.
- Work with Support Engineering to test routing, AI bypass rules, auto-close protections, and alerts. Investigate missed cases and verify fixes.
- Keep approved replies and handoff instructions current with Legal and GRC. Arrange backup coverage so cases keep moving when you're out.
- Handle other sensitive support escalations. Report backlog, response times, overdue cases, and recurring problems to Support, Legal, and GRC.
REQUIREMENTS
- 5+ years in support, trust and safety, legal or privacy operations, or compliance, ideally at a technology company.
- Experience handling legal, privacy, or law enforcement requests.
- Working knowledge of GDPR, CCPA, and data subject requests.
- Judgment about when to involve Legal or GRC, and care with confidential and privileged information.
- Clear writing, including in sensitive customer conversations.
- Ability to manage competing deadlines and follow through without reminders.
- Experience improving support processes with technical teams, including automation and AI safeguards.
NICE TO HAVE
- Experience with Intercom, Decagon, Linear, or Kodex.
- Paralegal, privacy, or compliance experience or certification.
- Experience with security questionnaires, SOC 2, ISO 27001, or HIPAA.
- Familiarity with AI products or data tools for case reviews.
Location: Boston, MA
Workplace: OnSite
At WHOOP, we're on a mission to unlock and inspire performance for life. WHOOP empowers members to perform at a higher level through a deeper understanding of their bodies and daily lives.
WHOOP is seeking a Security Detection Engineer to join our growing Information Security team, reporting directly to the Information Security Manager. In this hands-on technical role, you'll be responsible for designing, building, and continuously improving scalable, high-fidelity detection capabilities that safeguard the sensitive biometric and health data of millions of WHOOP members.
You'll play a critical role in strengthening our detection capabilities across cloud, identity, endpoint, and application environments, with a focus on identifying emerging threats, improving detection accuracy, and reducing security risk. This is an opportunity to take meaningful ownership of our detection engineering program, influence its technical direction, and help shape the future of security at WHOOP as we continue to scale.
RESPONSIBILITIES
- Design, build, and scale high-signal detections across cloud, identity, endpoint, network, and application layers using Detection-as-Code principles.
- Develop and maintain detection logic aligned to real-world attacker behavior and frameworks such as MITRE ATT&CK across modern security platforms.
- Translate threat intelligence into actionable detections and validate effectiveness through adversary emulation and testing.
- Build behavioral detections to protect against threats such as account takeover, credential abuse, API misuse, automation attacks, privilege escalation, and data exfiltration.
- Continuously improve detection quality by tuning alerts, reducing false positives, and implementing automated enrichment and triage.
- Define and track detection KPIs (e.g., precision, recall, false positive rate, MTTD) and implement processes to measure and improve detection health.
- Support and lead incident investigations, including containment, root cause analysis, and post-incident detection improvements.
- Contribute to the on-call rotation while proactively reducing operational overhead through automation.
- Partner with Engineering, IT, Infrastructure, Product, and GRC to ensure systems launch with strong monitoring and detection coverage.
- Map detections to threat models, identify visibility gaps, and continuously improve coverage as the environment scales.
- Explore and apply advanced analytics and machine learning techniques to improve detection fidelity, reduce noise, and enhance triage and investigation workflows.
- Stay ahead of evolving threats by researching emerging attack techniques and incorporating learnings into detection strategy.
QUALIFICATIONS
- 4+ years of hands-on experience in Information Security, with a focus on detection engineering, threat detection, or security operations.
- Demonstrated experience writing and tuning detections across cloud, identity, endpoint, or application environments.
- Familiarity with detection frameworks and tooling such as YARA, SIGMA, Suricata, or similar rule-based detection methodologies.
- Strong understanding of attacker techniques across identity compromise, cloud abuse, lateral movement, and data exfiltration.
- Expertise analyzing and building detections on cloud and SaaS telemetry, including authentication events, API activity, and system logs.
- Strong scripting skills in a scripting language such as Python, Go, or PowerShell for automation and tool development.
- Ability to operate effectively in a fast-paced, high-growth environment.
- Strong analytical mindset with a systems-thinking approach to reducing noise and increasing signal fidelity.
- Experience supporting incident response investigations and participating in on-call rotations.
- Experience building detective controls for consumer-facing platforms or detecting authentication and API abuse at scale is a strong plus.
- Effective communicator who can collaborate with engineers and explain detection strategy clearly to both technical and non-technical stakeholders.
- Familiarity with applying data analysis or machine learning techniques to security detection or alert triage is a plus.
- Bachelor’s degree in Computer Science, Information Security, or a related technical field, and/or relevant security certifications are a plus.
Interested in the role, but don’t meet every qualification? We encourage you to still apply! At WHOOP, we believe there is much more to a candidate than what is written on paper, and we value character as much as experience. As we continue to build a diverse and inclusive environment, we encourage anyone who is interested in this role to apply.
WHOOP is an Equal Opportunity Employer and participates in E-verify to determine employment eligibility. It is unlawful in Massachusetts to require or administer a lie detector test as a condition of employment or continued employment. An employer who violates this law shall be subject to criminal penalties and civil liability.
The WHOOP compensation philosophy is designed to attract, motivate, and retain exceptional talent by offering competitive base salaries, meaningful equity, and consistent pay practices that reflect our mission and core values.
At WHOOP, we view total compensation as the combination of base salary, equity, and benefits, with equity serving as a key differentiator that aligns our employees with the long-term success of the company and allows every member of our corporate team to own part of WHOOP and share in the company’s long-term growth and success.
The U.S. base salary range for this full-time position is $130,000 - $170,000. Salary ranges are determined by role, level, and location. Within each range, individual pay is based on factors such as job-related skills, experience, performance, and relevant education or training.
In addition to the base salary, the successful candidate will also receive benefits and a generous equity package.
These ranges may be modified in the future to reflect evolving market conditions and organizational needs. While most offers will typically fall toward the starting point of the range, total compensation will depend on the candidate’s specific qualifications, expertise, and alignment with the role’s requirements.
Location: San Francisco, CA
About Anthropic
Anthropic’s mission is to create reliable, interpretable, and steerable AI systems. We want AI to be safe and beneficial for our users and for society as a whole. Our team is a quickly growing group of committed researchers, engineers, policy experts, and business leaders working together to build beneficial AI systems.
About the Role
You will run the external audit calendar for our SOX 404 program as we scale toward an IPO. That means coordinating with our external auditors across the year, aligning testing windows with control owners, educating our control owners, and keeping requests and deliverables on schedule. You will also own SOX scoping and risk assessment cycles, deficiency tracking, and status reporting, and help roll out our GRC platform so the program runs from one system of record instead of spreadsheets. You will scale the program through AI-enabled workflows that reduce manual effort and speed up our SOX program.
This role reports to the Head of Business Controls and works closely with everyone on the SOX and Internal Audit team. This is an individual contributor role for someone who keeps a complex program on schedule, writes clearly, and makes the program simpler each cycle.
Key responsibilities
Own the annual SOX audit calendar, including interim and year-end testing windows, walkthrough schedules, and key deliverable dates agreed with external auditors.
Serve as the day-to-day point of contact for external auditor requests. Triage, route, and track each request to closure, including PBC (provided-by-client) lists and evidence deliveries.
Coordinate auditor walkthroughs and fieldwork with process owners, control owners, and the SOX Testing team, so each control owner is asked for the same evidence once.
Track auditor findings, management responses, and deficiency follow-ups, and report status to Internal Audit leadership.
Prepare control owners and process owners for auditor sessions, and get evidence delivered on time without direct authority over them.
Lead the annual SOX scoping and risk assessment, including quarterly refreshes, and support the annual Fraud Risk Assessment, so the program has appropriate scope and coverage under COSO.
Monitor BP and IT SOX testing and report status to leadership and share status with external auditors
Lead work with the business to improve control documentation, including education of templates and SOX guidance.
Find optimization and automation opportunities across the SOX lifecycle through the use of AI.
Support the rollout of the GRC tool for SOX, including control libraries, workflows, evidence requests, and testing templates.
Define the data and reporting requirements the platform must meet, and test that it produces what the program needs.
Run the quarterly sub-certification process and report results to leadership
Own SOX program status reporting: dashboards and metrics for leadership, audit calendar progress, and deficiency and remediation status.
Own status reporting for the full SOX lifecycle: scoping and risk assessment, testing, deficiencies and remediation, segregation of duties (SOD), SOC 1 report reviews, the fraud risk assessment, and audit calendar progress.
Minimum qualifications
Big 4 audit firm experience on SOX 404 or ICFR engagements, including managing audit calendars, PBC requests, and fieldwork with external audit teams.
Experience working directly with external auditor teams on requests, testing schedules, and findings, from the company side.
Several years of hands-on SOX 404 experience, including scoping, risk assessment, control documentation, testing, and deficiency evaluation.
Working knowledge of the COSO framework, ICFR, and PCAOB standards.
Experience developing or maintaining Risk and Control Matrices and process documentation or flowcharts.
Experience implementing or administering a GRC systems
Experience reporting program status, metrics, and issues to senior leadership.
Ability to get control owners to deliver on time without authority over them.
Clear writing and calm coordination under deadline pressure.
A Bachelor's degree in a related field or equivalent experience.
Preferred qualifications
In-house SOX experience at a pre-IPO or newly public company.
Experience running a fraud risk assessment.
CPA, CISA, or similar certification.
Comfort with SQL or data tools for reporting, and experience building lightweight automations, including with Claude.
The annual compensation range for this role is listed below.
For sales roles, the range provided is the role’s On Target Earnings ("OTE") range, meaning that the range includes both the sales commissions/sales bonuses target and annual base salary for the role.
Annual Salary:
$230,000
—
$300,000 USD
Logistics
Minimum education:
Bachelor’s degree or an equivalent combination of education, training, and/or experience
Required field of study:
A field relevant to the role as demonstrated through coursework, training, or professional experience
Minimum years of experience:
Years of experience required will correlate with the internal job level requirements for the position
Location-based hybrid policy:
Currently, we expect all staff to be in one of our offices at least 25% of the time. However, some roles may require more time in our offices.
Visa sponsorship:
We do sponsor visas! However, we aren't able to successfully sponsor visas for every role and every candidate. But if we make you an offer, we will make every reasonable effort to get you a visa, and we retain an immigration lawyer to help with this.
For roles performing work in California:
We will consider for employment all qualified applicants, including those with arrest or conviction records or criminal histories, in a manner consistent with the requirements of applicable state and local laws, including the San Francisco Fair Chance Ordinance, the City of Los Angeles’ Fair Chance Initiative for Hiring Ordinance, the Los Angeles County Fair Chance Ordinance for Employers, and the California Fair Chance Act.
We encourage you to apply even if you do not believe you meet every single qualification.
Not all strong candidates will meet every single qualification as listed. Research shows that people who identify as being from underrepresented groups are more prone to experiencing imposter syndrome and doubting the strength of their candidacy, so we urge you not to exclude yourself prematurely and to submit an application if you're interested in this work. We think AI systems like the ones we're building have enormous social and ethical implications. We think this makes representation even more important, and we strive to include a range of diverse perspectives on our team.
Your safety matters to us.
To protect yourself from potential scams, remember that Anthropic recruiters only contact you from @anthropic.com email addresses. In some cases, we may partner with vetted recruiting agencies who will identify themselves as working on behalf of Anthropic. Be cautious of emails from other domains. Legitimate Anthropic recruiters will never ask for money, fees, or banking information before your first day. If you're ever unsure about a communication, don't click any links—visit
anthropic.com/careers
directly for confirmed position openings.
How we're different
We believe that the highest-impact AI research will be big science. At Anthropic we work as a single cohesive team on just a few large-scale research efforts. And we value impact — advancing our long-term goals of steerable, trustworthy AI — rather than work on smaller and more specific puzzles. We view AI research as an empirical science, which has as much in common with physics and biology as with traditional efforts in computer science. We're an extremely collaborative group, and we host frequent research discussions to ensure that we are pursuing the highest-impact work at any given time. As such, we greatly value communication skills.
The easiest way to understand our research directions is to read our recent research. This research continues many of the directions our team worked on prior to Anthropic, including: GPT-3, Circuit-Based Interpretability, Multimodal Neurons, Scaling Laws, AI & Compute, Concrete Problems in AI Safety, and Learning from Human Preferences.
Come work with us!
Anthropic is a public benefit corporation headquartered in San Francisco. We offer competitive compensation and benefits, optional equity donation matching, generous vacation and parental leave, flexible working hours, and a lovely office space in which to collaborate with colleagues.
Guidance on Candidates' AI Usage:
Learn about
our policy
for using AI in our application process.
Location: Remote
Workplace: Remote
ABOUT BASETEN
Baseten powers mission-critical inference for the world's most dynamic AI companies, like Cursor, Notion, OpenEvidence, Abridge, Clay, Gamma, and Writer. By uniting applied AI research, flexible infrastructure, and seamless developer tooling, we enable companies operating at the frontier of AI to bring cutting-edge models into production. We're growing quickly and recently raised our $1.5B Series F https://www.baseten.co/blog/announcing-our-series-f/, led by Altimeter Capital, Conviction Partners, and Spark Capital. Join us and help build the platform engineers turn to ship AI products.
THE ROLE
We’re looking for an IT Engineer to design the systems behind how people at Baseten get access, stay secure, and move through their time here. This role builds the controls and automation that our IT Operations team runs every day across identity, client platforms, SaaS, and cloud access.
The goal is a corporate environment that’s secure by default and easy to use: access that’s right from day one, removed when it should be, and provable at any time.
RESPONSIBILITIES
- Strengthen our identity platform with strong authentication, clean access models, and least privilege as the default.
- Automate the workforce lifecycle so that joining, changing roles, and leaving Baseten are fast, consistent, and need little manual work.
- Build reliable pipelines for OS updates, patching, and software deployment that keep the fleet current without disrupting people’s work.
- Connect device health to access decisions, so a compliant device is what earns access to sensitive systems.
- Recommend identity and security standards for our SaaS and AI tools, and make the secure configuration the easy path for teams adopting new ones.
- Bring governance to non-human identities (service accounts, API keys, AI agents) and replace long-lived credentials with better options wherever possible.
- Manage configuration as code across identity and endpoints to reduce drift, so audit readiness comes from the systems themselves instead of a separate workstream.
- Give IT Operations well-designed tools and guardrails, so they can handle more requests on their own, safely.
REQUIREMENTS
- 5+ years in IT engineering or corporate security engineering, ideally at a cloud-native company.
- Strong grounding in identity: SSO, MFA, provisioning, and the protocols behind them.
- Hands-on experience engineering macOS fleets at scale: MDM, configuration profiles, app packaging and deployment, and endpoint visibility and EDR tooling.
- Experience automating real workflows in code (Python, Bash, or similar), and comfort with infrastructure-as-code.
- A working understanding of SaaS and cloud access risks, and how to reduce them without blocking the business.
- Good judgment about when to build, when to buy, and when to leave something alone.
- Clear writing, and a track record of working across IT, People, Engineering, Legal, GRC and Security.
BENEFITS
- Competitive compensation, including meaningful equity
- (U.S. only) 100% coverage of medical, dental, and vision insurance for employee and dependents
- Flexible PTO policy including company wide Winter Break (our offices are closed from Christmas Eve to New Year's Day!)
- Paid parental leave
- Fertility and family-building stipend through Carrot
- (U.S. only) Company-facilitated 401(k)
- Exposure to a variety of ML startups, offering unparalleled learning and networking opportunities.
Apply now to embark on a rewarding journey in shaping the future of AI! If you are a motivated individual with a passion for machine learning and a desire to be part of a collaborative and forward-thinking team, we would love to hear from you.
At Baseten, we are committed to fostering a diverse and inclusive workplace. We provide equal employment opportunities to all employees and applicants without regard to race, color, religion, gender, sexual orientation, gender identity or expression, national origin, age, genetic information, disability, or veteran status.
We are an Equal Opportunity Employer and will consider qualified applicants with criminal histories in a manner consistent with applicable law (by example, the requirements of the San Francisco Fair Chance Ordinance, where applicable).
Location: US - Headquarters - Maryland - Columbia
Who is Tenable?
Tenable® is the Exposure Management company. Over 40,000 organizations around the globe rely on Tenable to understand and reduce cyber risk. Our global employees support 65 percent of the Fortune 500, 50 percent of the Global 2000, and large government agencies. Come be part of our journey!
What makes Tenable such a great place to work?
Ask a member of our team and they’ll answer, “Our people!” We work together to build and innovate best-in-class cybersecurity solutions for our customers; all while creating a culture of belonging, respect, and excellence where we can be our best selves. When you’re part of our #OneTenable team, you can expect to partner with some of the most talented and passionate people in the industry, and have the support and resources you need to do work that truly matters. We deliver results that exceed expectations and we win together!
Your Role:
Join our InfoSec team at Tenable as a hands-on Mid Risk and Compliance Analyst. Drive compliance and assurance efforts for our products and cloud services while assisting with external risk assessments, security assessments, and audits. Make a real impact on our organization's security and customer trust and come join us at Tenable!
Your Opportunity:
Serve as a company representative with prospects, customers, and partners for security questionnaires, assessments, and audits
Collaborate with Sales, Engineering, Information Security, IT, and Product Development teams to communicate compliance obligations and requirements
Complete Third-Party Risk Assessments (TPRM Program) for new and potential vendors
Educate stakeholders on their responsibilities
Coordinate and participate in internal and external audit walkthroughs
Help guide and perform remediation of issues identified during third-party assurance or internal reviews
Support special projects as needed, which may include:
Assisting in the development and execution of the internal compliance program, involving preparation for audits, certifications, and risk assessments.
Assisting in the development, administration, and continuous monitoring of internal security controls.
What You'll Need:
Able to work hybrid/onsite location at HQ in Columbia MD. This position is US-based only
4+ years of experience performing information security and vendor risk assessments based upon industry accepted standards
4+ years of experience in responding to security assessments, SAQs, compliance requirements, etc
4+ years of experience with implementation, monitoring, and reporting of control processes, documentation, and remediation items
Experience working with the Federal Risk and Authorization Management Program (FedRAMP)
Be self-driven with the ability to work independently and comprehend all requirements
Strong communication skills and ability to collaborate effectively with all levels
Analytical mindset with a rational, pragmatic, and realistic approach to security, risk, and compliance
Ability to adopt and utilize technology, with advanced proficiency in Excel, PowerPoint, and Vizio.
And Ideally:
Knowledge of governance, risk and compliance frameworks (GRC)
Experience performing or undergoing internal and external audits
Relevant security certifications (SSCP, Sec+, CISA, etc)
Experience in a Big 4 or similar security consulting or risk assurance role
Experience with conducting audits, privacy, BC & DR Program Management
BS, BA in Information Technology, Computer Science, Information Security, or other related field
#LI-Hybrid #LI-MM1
This is the base pay range for this position. Compensation for the role will depend on a number of factors, including the candidate's qualifications, skills, competencies, location and experience, and may fall outside of the range shown. Employees are also eligible for variable compensation in addition to base pay (commission for sales roles, bonus for non-sales roles), depending on company and individual performance. Tenable also offers a variety of comprehensive and competitive benefits which include: medical, dental, vision, disability and life insurance; 401(k) retirement savings with company match; an employee stock purchase plan; an employee referral program; flexible spending accounts; an Employee Assistance Program (EAP); education assistance; parental leave; paid time off (PTO); company-paid holidays; health and wellness events; and community programs.
US Pay Range
$80,500
—
$107,166.67 USD
We’re committed to promoting Equal Employment Opportunity (EEO) at Tenable - through all equal employment opportunity laws and regulations at the international, federal, state and local levels. If you need a reasonable accommodation due to a disability during the application or recruiting process, please contact
Recruiting@Tenable.com
for further assistance.
Tenable Data Consent Statement
Tenable is committed to protecting the privacy and security of your personal data. Depending on your location, one or more of the following notices may apply to you:
General Applicant Privacy Notice
California Applicant Privacy Notice
EU/EEA/UK Applicant Privacy Notice
Location: Sweden (Remote)
Grafana Labs is the company behind Grafana Cloud, the fully managed observability platform trusted by more than 10,000 organizations to ensure reliability, resolve incidents faster, and optimize telemetry at scale. Built on open source and open standards and designed for interoperability across any stack, Grafana Cloud brings AI to observability and observability to AI, giving teams (and their agents) unified visibility so they can see, understand, and act on all their disparate data, wherever it lives, and move at the speed of their ambitions. Customers, including Anthropic, Bloomberg, NVIDIA, Microsoft, and Salesforce, rely on Grafana Labs. We are a 100% remote company with team members across 40+ countries, backed by leading investors including Lightspeed Venture Partners, Sequoia Capital, GIC, Coatue, J.P. Morgan, CapitalG, and Lead Edge Capital. Learn more at
grafana.com
and follow us on
LinkedIn
and
X
.
We’re scaling fast and staying true to what makes us different: an open-source legacy, a global collaborative culture, and a passion for meaningful work. Our team thrives in an innovation-driven environment where transparency, autonomy, and trust fuel everything we do.
You may not meet every requirement, and that’s okay. If this role excites you, we’d love you to raise your hand for what could be a truly career-defining opportunity.
This is a remote position. We are looking for candidates in the UK, Ireland, Spain, Germany or Sweden.
Senior Software Engineer - Security Assurances
We are looking for a Senior Software Engineer, Security Assurance to join our GRC engineering team. We are building a security system that’s automated at scale, rigorously data-driven, and built from the ground up with defense-in-depth and self-healing in mind. We support a highly autonomous, remote-first, cloud-native organization. We are a technical team that can build any tool we need, while knowing when to buy to improve velocity.
To support our growth and ambitious vision, we embrace agile principles and values, share openly, apply context-driven security mechanisms, default to action, and have an OSS-first mindset. We are a 100% remote company. We believe in high-velocity but sustainable expectations and timeframes, giving people the room to do great work.
The Opportunity:
You will work to build out our security observability, compliance, and control management systems and tools. You will develop services and tools to proactively defend our systems, provide visibility to our security state, and give engineers and stakeholders guardrails and paved roads to behave securely. You will collaborate across your team, the security department, and wider Grafana to write and deploy security policies across all of our SDLC, applications, and infrastructure.
This is a very technical, hands-on keyboard software engineering, so development experience is critical. You will ideally have some experience building, implementing and improving the maturity of security programs in Cloud-based SaaS organizations. Knowledge of security standards and frameworks (ISO, FedRAMP, PCI-DSS, GDPR, etc) is useful, but the disposition to quickly learn new things is more important than rote knowledge. You will work alongside other security engineers, full-stack developers, and customer-facing teams. Experience guiding and negotiating with peers, stakeholders, customers, and auditors is a plus.
What You’ll Be Doing:
Be a technical contributor on our GRC team covering a range of areas, including certifications, application, build, cloud, and supply chain security, and internal security tooling development
Develop, implement, and maintain highly automated security assurance programs to ensure compliance with organizational and regulatory requirements (e.g., ISO 27001, SOC 2, GDPR, NIST, PCI-DSS, TISAX, whatever else our customers eventually throw at us)
Develop systems, automations, and methods of security observability to push the GRC engineering organization beyond just meeting certification requirements
Deploy security and compliance checks in an employee-enabling way (guardrails and paved roads) in their daily workflows and build pipelines
Collaborate with cross-functional teams to integrate security controls into the software development lifecycle and operational processes.
Respond to customer security issues, security alerts, and potential incidents
What Makes You a Great Fit:
Experience developing in a production environment with at least one programming language. We primarily use Go, TypeScript, and Python but most languages translate well. You will take a code screen and be expected to discuss programming principles such as algorithms, data structures, and optimization
Knowledge of using and securing containerized, cloud-native applications, ideally with Kubernetes. Experience with multiple cloud providers is a strong plus
Experience in automating security and compliance processes using tools, scripts, and frameworks while enabling developer and employee workflows
Strong interpersonal skills, as this position will require communication with peers, stakeholders, auditors, and customers
Understanding of industry-recognized security frameworks, standards, and certifications, such as ISO 27001, SOC 2, PCI DSS, NIST, or GDPR, and how to apply them without added operational burden. You can gain this by reading the standards documents and audit guidance
A degree in Computer Science, Information Security, or related field (or equivalent experience)
Bonus Points For:
Working knowledge of Grafana Labs OSS projects and products. Experience in using observability tooling to solve security problems.
Experience working with OSS communities
Experience in using technical automations to prove infrastructure compliance
Experience securing large-scale distributed systems running in public clouds
In Sweden, the base compensation range for this role is SEK
775,444 - SEK 930,533
.
Actual compensation may vary based on level, experience, and skillset as assessed throughout the interview process. All of our roles include Restricted Stock Units (RSUs), giving every team member ownership in Grafana Labs' success. We believe in shared outcomes—RSUs help us stay aligned and invested as we scale globally.
*Compensation ranges are country specific. If you are applying for this role from a different location than listed above, your recruiter will discuss your specific market’s defined pay range & benefits at the beginning of the process.
Why You’ll Thrive at Grafana Labs:
100% Remote, Global Culture -
As a remote-only company, we bring together talent from around the world, united by a culture of collaboration and shared purpose.
Scaling Organization
– Tackle meaningful work in a high-growth, ever-evolving environment.
Transparent Communication
– Expect open decision-making and regular company-wide updates.
Innovation-Driven
– Autonomy and support to ship great work and try new things.
Open Source Roots
– Built on community-driven values that shape how we work.
Empowered Teams
– High trust, low ego culture that values outcomes over optics.
Career Growth Pathways
– Defined opportunities to grow and develop your career.
Approachable Leadership
– Transparent execs who are involved, visible, and human.
Passionate People
– Join a team of smart, supportive folks who care deeply about what they do.
In-Person onboarding
- We want you to thrive from day 1 with your fellow new ‘Grafanistas’ to learn all about what we do and how we do it.
Balance is Key
- We operate a global annual leave policy of 30 days per annum. 3 days of your annual leave entitlement are reserved for Grafana Shutdown Days to allow the team to really disconnect.
*We will comply with local legislation where applicable.
Equal Opportunity Employer:
Grafana Labs is an equal opportunities employer. We welcome applications from everyone regardless of race, colour, nationality, origin, caste, sex, gender reassignment identity or expression, sexual orientation, age, religion or belief, disability, veteran status, genetic information, pregnancy, maternity, marital, family or carer status, or any other characteristic which is protected by local law. We believe that equality and diversity build a strong organisation, and we work hard to ensure that is the foundation of our organisation as we grow.
Grafana Labs may utilize AI tools in its recruitment process to assist in matching information provided in CVs to job postings. The recruitment team will continue to review inbound CVs manually to identify alignment with current openings.
#LI-Remote
For information about how your personal data is used once you’ve applied to a job, check out our
privacy policy
.
Location: Germany (Remote)
Grafana Labs is the company behind Grafana Cloud, the fully managed observability platform trusted by more than 10,000 organizations to ensure reliability, resolve incidents faster, and optimize telemetry at scale. Built on open source and open standards and designed for interoperability across any stack, Grafana Cloud brings AI to observability and observability to AI, giving teams (and their agents) unified visibility so they can see, understand, and act on all their disparate data, wherever it lives, and move at the speed of their ambitions. Customers, including Anthropic, Bloomberg, NVIDIA, Microsoft, and Salesforce, rely on Grafana Labs. We are a 100% remote company with team members across 40+ countries, backed by leading investors including Lightspeed Venture Partners, Sequoia Capital, GIC, Coatue, J.P. Morgan, CapitalG, and Lead Edge Capital. Learn more at
grafana.com
and follow us on
LinkedIn
and
X
.
We’re scaling fast and staying true to what makes us different: an open-source legacy, a global collaborative culture, and a passion for meaningful work. Our team thrives in an innovation-driven environment where transparency, autonomy, and trust fuel everything we do.
You may not meet every requirement, and that’s okay. If this role excites you, we’d love you to raise your hand for what could be a truly career-defining opportunity.
This is a remote position. We are looking for candidates in the UK, Ireland, Spain, Germany or Sweden.
Senior Software Engineer - Security Assurances
We are looking for a Senior Software Engineer, Security Assurance to join our GRC engineering team. We are building a security system that’s automated at scale, rigorously data-driven, and built from the ground up with defense-in-depth and self-healing in mind. We support a highly autonomous, remote-first, cloud-native organization. We are a technical team that can build any tool we need, while knowing when to buy to improve velocity.
To support our growth and ambitious vision, we embrace agile principles and values, share openly, apply context-driven security mechanisms, default to action, and have an OSS-first mindset. We are a 100% remote company. We believe in high-velocity but sustainable expectations and timeframes, giving people the room to do great work.
The Opportunity:
You will work to build out our security observability, compliance, and control management systems and tools. You will develop services and tools to proactively defend our systems, provide visibility to our security state, and give engineers and stakeholders guardrails and paved roads to behave securely. You will collaborate across your team, the security department, and wider Grafana to write and deploy security policies across all of our SDLC, applications, and infrastructure.
This is a very technical, hands-on keyboard software engineering, so development experience is critical. You will ideally have some experience building, implementing and improving the maturity of security programs in Cloud-based SaaS organizations. Knowledge of security standards and frameworks (ISO, FedRAMP, PCI-DSS, GDPR, etc) is useful, but the disposition to quickly learn new things is more important than rote knowledge. You will work alongside other security engineers, full-stack developers, and customer-facing teams. Experience guiding and negotiating with peers, stakeholders, customers, and auditors is a plus.
What You’ll Be Doing:
Be a technical contributor on our GRC team covering a range of areas, including certifications, application, build, cloud, and supply chain security, and internal security tooling development
Develop, implement, and maintain highly automated security assurance programs to ensure compliance with organizational and regulatory requirements (e.g., ISO 27001, SOC 2, GDPR, NIST, PCI-DSS, TISAX, whatever else our customers eventually throw at us)
Develop systems, automations, and methods of security observability to push the GRC engineering organization beyond just meeting certification requirements
Deploy security and compliance checks in an employee-enabling way (guardrails and paved roads) in their daily workflows and build pipelines
Collaborate with cross-functional teams to integrate security controls into the software development lifecycle and operational processes.
Respond to customer security issues, security alerts, and potential incidents
What Makes You a Great Fit:
Experience developing in a production environment with at least one programming language. We primarily use Go, TypeScript, and Python but most languages translate well. You will take a code screen and be expected to discuss programming principles such as algorithms, data structures, and optimization
Knowledge of using and securing containerized, cloud-native applications, ideally with Kubernetes. Experience with multiple cloud providers is a strong plus
Experience in automating security and compliance processes using tools, scripts, and frameworks while enabling developer and employee workflows
Strong interpersonal skills, as this position will require communication with peers, stakeholders, auditors, and customers
Understanding of industry-recognized security frameworks, standards, and certifications, such as ISO 27001, SOC 2, PCI DSS, NIST, or GDPR, and how to apply them without added operational burden. You can gain this by reading the standards documents and audit guidance
A degree in Computer Science, Information Security, or related field (or equivalent experience)
Bonus Points For:
Working knowledge of Grafana Labs OSS projects and products. Experience in using observability tooling to solve security problems.
Experience working with OSS communities
Experience in using technical automations to prove infrastructure compliance
Experience securing large-scale distributed systems running in public clouds
In Germany, the base compensation range for this role is €
97,034 - €116,441
.
Actual compensation may vary based on level, experience, and skillset as assessed throughout the interview process. All of our roles include Restricted Stock Units (RSUs), giving every team member ownership in Grafana Labs' success. We believe in shared outcomes—RSUs help us stay aligned and invested as we scale globally.
*Compensation ranges are country specific. If you are applying for this role from a different location than listed above, your recruiter will discuss your specific market’s defined pay range & benefits at the beginning of the process.
Why You’ll Thrive at Grafana Labs:
100% Remote, Global Culture -
As a remote-only company, we bring together talent from around the world, united by a culture of collaboration and shared purpose.
Scaling Organization
– Tackle meaningful work in a high-growth, ever-evolving environment.
Transparent Communication
– Expect open decision-making and regular company-wide updates.
Innovation-Driven
– Autonomy and support to ship great work and try new things.
Open Source Roots
– Built on community-driven values that shape how we work.
Empowered Teams
– High trust, low ego culture that values outcomes over optics.
Career Growth Pathways
– Defined opportunities to grow and develop your career.
Approachable Leadership
– Transparent execs who are involved, visible, and human.
Passionate People
– Join a team of smart, supportive folks who care deeply about what they do.
In-Person onboarding
- We want you to thrive from day 1 with your fellow new ‘Grafanistas’ to learn all about what we do and how we do it.
Balance is Key
- We operate a global annual leave policy of 30 days per annum. 3 days of your annual leave entitlement are reserved for Grafana Shutdown Days to allow the team to really disconnect.
*We will comply with local legislation where applicable.
Equal Opportunity Employer:
Grafana Labs is an equal opportunities employer. We welcome applications from everyone regardless of race, colour, nationality, origin, caste, sex, gender reassignment identity or expression, sexual orientation, age, religion or belief, disability, veteran status, genetic information, pregnancy, maternity, marital, family or carer status, or any other characteristic which is protected by local law. We believe that equality and diversity build a strong organisation, and we work hard to ensure that is the foundation of our organisation as we grow.
Grafana Labs may utilize AI tools in its recruitment process to assist in matching information provided in CVs to job postings. The recruitment team will continue to review inbound CVs manually to identify alignment with current openings.
#LI-Remote
For information about how your personal data is used once you’ve applied to a job, check out our
privacy policy
.
United States - Remote
УдалённоseniorГеография найма не уточнена
Не хотите искать каждый день?
Настройте подбор один раз, и подходящие вакансии будут сами приходить в Telegram.
Настройте подбор, и подходящие вакансии будут приходить в Telegram.
United States - Remote; You are comfortable working in an international environment: a distributed team across the US, UK, and Europe, customers and auditors across time zones, and UK and EU regimes alongside US ones
ОфисseniorCairo, Egypt
ОфисseniorDubai, UAE
ОфисRiyadh, KSA; We offer you relocation support as well as we guide you through all the process
ОфисseniorRiyadh, KSA
УдалённоleadRemote Canada
ГибридSan Francisco; Washington D.C.; New York City
ОфисBoston, MA
leadSan Francisco, CA
УдалённоГеография найма не уточнена
География найма не уточнена
seniorSweden (Remote); We are looking for candidates in the UK, Ireland, Spain, Germany or Sweden
seniorGermany (Remote); We are looking for candidates in the UK, Ireland, Spain, Germany or Sweden
Автоотклики