Вакансии

Location: London 500M+ downloads. 80M+ monthly users. A decade of building – and we’re still accelerating. Flo is the world’s #1 health & fitness app worldwide on a mission to build a better future for female health. Backed by a $200M investment led by General Atlantic, we became the first product of our kind to reach a $1B valuation in 2024 – and we’re not slowing down. With 7M paid subscribers and the highest-rated experience in the App Store’s health category, we’ve spent 10 years earning trust at scale. Now, we’re building the next generation of digital health – AI-powered, privacy-first, clinically backed – to help our users know their body better. The job Millions of people trust Flo with their most personal health data. As our Security Architect, you’ll make sure we deserve that trust. This is a hands-on individual contributor role. You’ll work side by side with engineering, product and platform teams to shape secure architectures and build the guardrails that let both humans and AI coding agents ship quickly and safely. The role combines security architecture, product and application security engineering and security risk expertise: you will set secure patterns and standards, lead threat modelling and design reviews, embed security into the SDLC and CI/CD, and translate security risk into clear, pragmatic decisions. What you’ll do Shape secure architecture from day one. Partner with teams early in design, lead security design reviews for new services and major changes, and record key decisions and risk trade-offs. Build security harnesses for human and AI-agent development. Design guardrails, sandboxing, least-privilege access for agents and tools, secrets handling, policy-as-code and automated checks that run inside developer and agent workflows. Lead on AI and agentic security. Define secure patterns for LLM integrations, MCP servers and tool use, and tackle risks like prompt injection, data leakage, excessive agency and supply-chain compromise. Create paved roads. Publish reusable patterns, reference architectures and standards that teams adopt because they’re the easiest option. Scale threat modelling. Build tools and skills that let engineers run threat models themselves, and carry out internal security assessments. Remove whole classes of vulnerabilities. Automate vulnerability triage and investigation, find systemic root causes, and feed the fixes back into patterns and guardrails. Turn risk into clear decisions. Explain security risk in pragmatic terms so the business can prioritise based on risk and value. Advise and enable. Be a trusted partner to engineering, product and leadership, coach engineers, and help evaluate third-party and AI tools so they can be adopted securely. Support ISO 27001/27701 so that controls are built into how we engineer, not bolted on afterwards. What you’ll bring 7+ years in security engineering, application/product security or security architecture, including hands-on work securing cloud-native systems Deep knowledge of Secure SDLC: threat modelling, security testing, app security review and CI/CD security Hands-on experience with AWS and Cloudflare (or equivalents) and Terraform or similar IaC A strong grasp of the OWASP Top 10 and the ability to assess exploitability and impact Solid coding skills (e.g. Python, Go, Scala) and experience building security tooling or automation Practical understanding of the risks in AI-assisted and agentic development and LLM applications (e.g. OWASP Top 10 for LLMs) Experience with security risk analysis and risk management methods The ability to explain trade-offs clearly to engineers and senior stakeholders, and to win people over Nice to have Experience building guardrails, sandboxes or policy-as-code (e.g. OPA) for developer platforms or AI coding agents iOS or Android security experience Experience with ISO 27001, ISO 27701 or SOC 2 audits A background in health tech, femtech or another regulated, privacy-sensitive industry Certifications or degrees such as CISSP, CCSP, OSCP or an MSc in Information Security Why Flo You’ll protect data that matters deeply to millions of people. You’ll also help set the standard for how a company adopts agentic engineering safely, and you’ll have real ownership: you design and build the first version, then hand it off to the teams who will run it. Annual Salary Range (ranges may vary based on skills and experience) £100,000 — £130,000 GBP How we work We’re a mission-led, product-driven team. We move fast, stay focused and take ownership – from brief to build to impact. Debate is encouraged. Decisions are shared. We care about craft, ship with purpose, and always raise the bar. You’ll be working with people who take their work seriously, not themselves. It takes commitment, resilience, and the drive to keep going when things get tough. Because better health outcomes are worth it. What you'll get We support impact with meaningful reward. Here’s what that looks like: Competitive salary and annual reviews Opportunity to participate in Flo’s performance incentive scheme Paid holiday, sick leave, and female health leave Enhanced parental leave and pay for maternity, paternity, same-sex and adoptive parents Accelerated professional growth through world-changing work and learning support In-person collaboration and work in a hybrid model, with 3 days per week spent in the office 5-week fully paid sabbatical at 5-year Floversary Flo Premium for friends & family, plus more health, pension and wellbeing perks Diversity, equity and inclusion Our strength is in our differences. At Flo, hiring is based on merit, skill and what you bring to the role – nothing else. We’re proud to be an equal opportunity employer, and we welcome applicants from all backgrounds, communities and identities. Read our privacy notice for job applicants .

🎯 For security engineers with hands-on threat modelling experience.

Location: Remote Canada At Affirm, we exist for the moments that matter—giving people a clear, predictable way to pay over time, with no hidden fees, no surprises, and no tradeoffs on what matters most. About the InfoSec team The InfoSec team protects Affirm’s systems and data from evolving threats. We manage security risk, monitor vulnerabilities, and enforce protective controls across the company. The team leads incident response, compliance, identity and access management, and employee training. Our goal is to ensure that security is built into every system and decision at Affirm. We maintain a secure, trustworthy environment so the business can operate and grow with confidence. About the role In this role, you'll help mature Affirm's insider threat program. You'll build out the controls, detection use cases, and investigative practices that make it work day to day, support insider risk investigations, and partner with Legal, HR, Privacy, and Compliance to keep the program effective, proportionate, and trusted by Affirmers. What you’ll do Lead the build-out of key insider threat workstreams, from initial design through to day-to-day operation Build out the program's operating mechanics, including investigative standards, playbooks, and the metrics and reporting that show whether the program is working Support insider risk investigations alongside SIRT, bringing insider threat expertise, telemetry and evidence analysis, and written findings and risk recommendations Partner with Legal, HR/Employee Relations, Privacy, and Compliance on case handling and escalation criteria, helping ensure the program respects employee privacy and meets legal and regulatory obligations Threat model Affirm's highest-risk data and systems for insider risk, and partner with detection engineers to turn the results into production detections Own and improve the controls that reduce insider risk, including data loss prevention, endpoint monitoring, secure browser and contractor access controls, SaaS posture management, and access governance, working with system owners to close gap Automate the program's operational load with workflow automation platforms and Python, covering evidence collection, case routing, and reporting Build and expand agentic automations that assist with insider risk triage and investigation, and define which decisions stay with a human What we look for Deep expertise in security engineering, security operations, insider risk, or digital forensics Track record of standing up new security capabilities where little existed before Experience running investigations end to end, including evidence handling, log and endpoint forensics, timeline reconstruction, and written findings suitable for Legal and HR audiences Ability to write and evaluate detection logic against endpoint, identity, cloud, and SaaS telemetry in a SIEM (Splunk, Elastic, Panther, Chronicle, or similar) Hands-on experience with insider risk tooling such as DLP, UEBA, endpoint detection and response, CASB, and access governance, with a practical sense of their strengths and limits Working knowledge of Python for security tooling and automation Experience building and maintaining production workflows in automation platforms such as Tines, Torq, or similar Experience building and running agentic automations in production that assist with alert triage and investigation, such as LLM-driven enrichment, summarization, or first-pass analysis, with a clear view of where human review stays in the loop Discretion and sound judgment handling sensitive investigations, and comfort navigating the privacy, legal, and employee-relations considerations that insider work carries Clear written and verbal communication skills, with the ability to work across Security, Engineering, Legal, HR, Privacy, and Compliance Experience in regulated or financial services environments (SOC 2, PCI DSS, GLBA) is a plus Base Pay Grade - N Equity Grade - Canada 6 Employees new to Affirm typically come in at the start of the pay range. Affirm focuses on providing a simple and transparent pay structure which is based on a variety of factors, including location, experience and job-related skills. Base pay is part of a total compensation package that may include monthly stipends for health, wellness and tech spending, and benefits (including 100% subsidized medical coverage, dental and vision for you and your dependents). In addition, the employees may be eligible for equity rewards offered by Affirm Holdings, Inc. (parent company). CAN base pay range per year: $153,000 - $213,000 $CAD. This remote role is open only to candidates residing in Alberta, British Columbia, Manitoba, New Brunswick, Newfoundland and Labrador, Nova Scotia, Ontario, Prince Edward Island, or Saskatchewan. #LI-Remote Remote-first with flexibility built in Affirm is proud to be a remote-first company. Most roles can be done from almost anywhere within the country of employment. Some positions may occasionally require in-person work at an Affirm office, and a few are office-based due to the nature of the work. All new hires will be invited to attend an in-person onboarding experience. Benefits designed for you Our benefits reflect our commitment to care, transparency, and flexibility. Here are a few highlights: Health coverage at no cost: We cover 100% of premiums for employees and their dependents. Spending stipends: Monthly stipends support your tech setup, and the ability to choose health and wellness options that are right for you. Time off to recharge: Flexible time off and generous holiday calendars help you rest when you need to. Own a piece of what you build: Our employee stock purchase plan (ESPP) lets you buy Affirm stock at a discount. We’re committed to providing an inclusive interview process, including accommodations for candidates with disabilities. If you need support, we’re happy to help. For positions based in San Francisco or Los Angeles: Affirm considers qualified applicants with arrest and conviction records, as required by law. By clicking "Submit Application," you acknowledge that you have read Affirm's Global Candidate Privacy Notice and consent to the use of your personal information as described.

- Проводить анализ защищённости приложений, сервисов и смарт-контрактов. - Выполнять Security Code Review, Security Design Review и моделирование угроз.

Задачи: — Проведение инструктажей, тренингов и развитие программы Security Awareness. — Подготовка обучающих материалов (презентации, тесты, методички). — Регулярная поддержка и консультация сотрудников по вопросам информационной безопасности. — Коммуникация с внутренними заказчиками и защита позиции информационной безопасности. — Расследование и разбор инцидентов информационной безопасности, подготовка рекомендаций. — Сопровождение и развитие программы Bug Bounty, обработка отчетов об уязвимостях. — Организация пентестов, контроль устранения уязвимостей по их результатам. — Участие в процессе PCI DSS и подготовке к аудитам, поддержание соответствия требованиям. — Проведение Security Research новых сервисов и решений. — Проведение Security Review ADR и процессов передачи чувствительных данных. — Анализ контрагентов и оценка рисков. — Работа с SIEM-системами и настройка правил безопасности. — Настройка систем алертов, мониторинга безопасности, сопровождение инструментов анализа кода и уязвимостей. — Поддержка и развитие процессов DevSecOps. Требования: — Практический опыт в информационной безопасности от 3 лет. — Знание угроз, уязвимостей ПО и методов их устранения. — Опыт самостоятельной организации и проведения внутренних фишинговых тестов. — Опыт работы со сканерами безопасности и интерпретации отчетов о найденных уязвимостях. — Уверенный опыт администрирования ОС Windows, MacOS, Linux. — Понимание принципов работы микросервисов, CI/CD и сетевых технологий. — Уровень английского, позволяющий уверенно читать техническую документацию.

Vultr is looking for a Physical Security Evaluator to evaluate data-center security, document vulnerabilities, support mitigation, and report on physical security posture.

Location: New York; San Francisco Workplace: Hybrid ABOUT ALCHEMY Alchemy is the Web3 infrastructure and developer platform that powers millions of users and the world’s most innovative blockchain applications. From enabling $1+ trillion in financial transactions worldwide to scaling L2s and enabling DeFi, Alchemy provides the infrastructure and tools developers need to build reliable, scalable, and accessible experiences. Trusted by companies like JPMorgan, Stripe, Visa, Franklin Templeton, Nike, and backed by a16z, Coatue, Silver Lake, Lightspeed, and Stanford University, Alchemy is building the foundational layer for a decentralized and AI-enabled Web3 ecosystem. For more information, visit alchemy.com http://alchemy.com.   THE ROLE We're looking for a Security Operations Engineer to improve how Alchemy detects threats, investigates incidents, and reduces operational security risk. This is a hands-on individual-contributor role with no people-management responsibilities. You'll investigate suspicious activity and build the systems that make the next investigation faster and more reliable. AI-assisted engineering and investigation should be part of your daily work: connecting evidence, developing detections, building response workflows, and checking the results against source data. You'll also help the team get better at this work. Through shared tooling, code review, pairing, and practical documentation, you'll give teammates capabilities they can use independently.   WHAT YOU WILL DO - Detect and investigate threats. Triage alerts, hunt for suspicious activity, and investigate across cloud infrastructure, corporate systems, identity, endpoints, and production environments. Establish what happened from evidence and communicate uncertainty clearly. - Engineer detection coverage. Build and tune detections, onboard useful telemetry, and maintain reliable log pipelines. Test rules against representative attacks and benign activity; address missing coverage and noisy alerts. - Respond to incidents. Participate in the security on-call rotation and incident response, including scoping, containment, recovery, and post-incident improvements. Preserve evidence and coordinate changes with system owners. - Build AI-assisted security workflows. Automate evidence collection, alert enrichment, investigation timelines, and response preparation. Connect agents to approved tools and data sources so they can complete bounded tasks with traceable results. - Verify before trusting. Evaluate AI-assisted workflows against known cases and adversarial inputs. Require evidence for conclusions, test false-positive and missed-threat behavior, and keep human approval for disruptive containment actions. - Reduce operational exposure. Partner with Infrastructure and IT on vulnerability remediation, cloud and host hardening, identity controls, and attack-surface monitoring. Prioritize findings by exposure and impact, then verify remediation. - Help secure agent operations. Work with platform and product-security partners on operational controls for agent identities, credentials, tool access, and audit logging. Investigate misuse and build detections for suspicious agent behavior. - Improve how the team works. Share reusable code, investigation skills, runbooks, and evaluation cases. Pair with teammates, review automation, and teach approaches they can apply to their own investigations. - Measure defensive outcomes. Track detection coverage, alert quality, investigation effort, response time, and remediation progress. Use those measures to decide what to improve next.   WHAT WE ARE LOOKING FOR - Hands-on security operations experience spanning detection engineering, threat hunting, and incident response. - Strong scripting and software-building ability, especially Python; experience with APIs, version control, tests, and operating automation in production. - Experience with a SIEM such as Panther, Splunk, or an equivalent platform, including detection logic and log analysis. - Working knowledge of cloud security, identity, endpoint telemetry, networking, and Linux systems. Ability to investigate across system boundaries. - Evidence of building and using AI-assisted tools in security or adjacent engineering work. You can show how you validate outputs, handle failures, and protect sensitive information. - Sound incident judgment: you can separate a hypothesis from a finding, preserve evidence, and choose when to escalate or contain. - A record of making teammates more effective through tools, mentoring, code review, or documentation, without needing management authority. - Clear written communication and the willingness to own both urgent investigations and the follow-through that prevents repeat incidents.   HELPFUL EXPERIENCE - AWS, Kubernetes, bare-metal infrastructure, detection-as-code, or SOAR workflows. - Digital forensics, threat intelligence, or testing detections through attack simulation. - Securing AI agents and tool integrations, including prompt injection, credential misuse, and data-exfiltration risks. - Blockchain infrastructure or other environments with sensitive keys and high-impact production systems.   WHAT SUCCESS LOOKS LIKE - Investigations reach evidence-backed conclusions faster. Detection coverage improves, repeat noise declines, and remediation is verified. The team adopts tools and workflows you've built, with clear limits on what agents may do and a tested path for handling failures.   BENEFITS & PERKS 🏥 Private Health Insurance 💪 Gym Reimbursement 🚅 Commuter Benefits 🌴 Flexible Time Off 🥙 In-Office Group Meals 🧠 Learning & Development Stipend 🌎 Company Sponsored Conferences & Events 🎧 Books & Audiobook subscription with Bookster https://landing.bookster.ro/

As Kubernetes and Container Platform Security Specialist you own the security of Verda's Kubernetes offering: multi-node and single-node clusters, the container registry, and the credentials that reach it.

Fluidstack is looking for a Security Systems Technician to maintain, troubleshoot, repair, and commission physical security and supporting infrastructure at data center sites.

Location: US - Headquarters - Maryland - Columbia Who is Tenable? Tenable® is the Exposure Management company. Over 40,000 organizations around the globe rely on Tenable to understand and reduce cyber risk. Our global employees support 65 percent of the Fortune 500, 50 percent of the Global 2000, and large government agencies. Come be part of our journey! What makes Tenable such a great place to work? Ask a member of our team and they’ll answer, “Our people!” We work together to build and innovate best-in-class cybersecurity solutions for our customers; all while creating a culture of belonging, respect, and excellence where we can be our best selves. When you’re part of our #OneTenable team, you can expect to partner with some of the most talented and passionate people in the industry, and have the support and resources you need to do work that truly matters. We deliver results that exceed expectations and we win together! Applicants must be authorized to work for any employer in the U.S. without sponsorship. We are unable to provide sponsorship for work visas of any kind at the time of hire, or at any point during employment. This includes, but is not limited to: F1-OPT, F1-CPT, H-1B, TN, J-1, etc Your Role: In this role, you’ll help evaluate, implement and maintain Tenable’s cybersecurity systems. You’ll work alongside Security Engineers, Analysts and the Digital Solutions Department to protect the confidentiality, integrity and availability of Tenable’s assets. Your Opportunity: Help evaluate, deploy and improve security solutions across on-premise, cloud and SaaS environments Identify opportunities to improve the resiliency and quality of security systems and applications Support maintenance of security tooling and appliances Assist in identifying and remediating threats and risks reported by Security Analysts, assessments or third parties Participate in security reviews of SaaS, on-premise, and AI-enabled products (including LLM integrations, MCP servers and agentic tools), with guidance from senior engineers Help apply baseline AI security controls: least-privilege access, no static credentials, scoped tokens, logging/auditing of agent activity, and data handling guardrails Support detection and monitoring use cases for AI and agentic workloads Document projects and write Standard Operating Procedures Build strong working relationships across the team and with partner groups Manage your time and responsibilities, set accurate expectations and meet deadlines Provide infrequent, as-needed off-hours support Other duties as assigned What You’ll Need: Working knowledge of securing Windows, Linux, mobile devices and cloud (IaaS) environments Familiarity with security architecture and review methodologies (e.g., threat modeling, STRIDE) Foundational understanding of network security (IDS/IPS, web proxies, traffic analysis) and the TCP/IP stack and common protocols (DNS, SMTP, DHCP) Familiarity with authentication and access concepts: SSH, LDAP, SSO/OAuth/OIDC, RBAC, MFA Understanding of Zero Trust and cloud security principles Hands-on experience with 2 or more of: EDR/antivirus, SIEM/log correlation, CASB, web proxies, PAM, MDM, DLP, email security/DMARC Basic understanding of AI/LLM security risks (prompt injection, data leakage, excessive agent permissions, supply chain risk) and curiosity about MCP and agentic architectures Scripting or automation ability (Python, Bash or PowerShell) is a plus BA/BS in Computer Science, IT or a related field, SANS training, or equivalent experience 3-5 years of Information Security experience; some cloud experience preferred Security+, GIAC, AWS security or similar certifications are a plus Self-motivated, with a passion for cybersecurity and a willingness to innovate Able to work effectively in an agile environment, with growing independence Hybrid/on-site at our Columbia, MD headquarters #LI-Hybrid #LI-MS1 This is the base pay range for this position. Compensation for the role will depend on a number of factors, including the candidate's qualifications, skills, competencies, location and experience, and may fall outside of the range shown. Employees are also eligible for variable compensation in addition to base pay (commission for sales roles, bonus for non-sales roles), depending on company and individual performance. Tenable also offers a variety of comprehensive and competitive benefits which include: medical, dental, vision, disability and life insurance; 401(k) retirement savings with company match; an employee stock purchase plan; an employee referral program; flexible spending accounts; an Employee Assistance Program (EAP); education assistance; parental leave; paid time off (PTO); company-paid holidays; health and wellness events; and community programs. US Pay Range $102,500 — $136,500 USD We’re committed to promoting Equal Employment Opportunity (EEO) at Tenable - through all equal employment opportunity laws and regulations at the international, federal, state and local levels.  If you need a reasonable accommodation due to a disability during the application or recruiting process, please contact Recruiting@Tenable.com for further assistance. Tenable Data Consent Statement Tenable is committed to protecting the privacy and security of your personal data. Depending on your location, one or more of the following notices may apply to you: General Applicant Privacy Notice California Applicant Privacy Notice EU/EEA/UK Applicant Privacy Notice

Location: Denmark - Remote Who is Tenable? Tenable® is the Exposure Management company. Over 40,000 organizations around the globe rely on Tenable to understand and reduce cyber risk. Our global employees support 65 percent of the Fortune 500, 50 percent of the Global 2000, and large government agencies. Come be part of our journey! What makes Tenable such a great place to work? Ask a member of our team and they’ll answer, “Our people!” We work together to build and innovate best-in-class cybersecurity solutions for our customers; all while creating a culture of belonging, respect, and excellence where we can be our best selves. When you’re part of our #OneTenable team, you can expect to partner with some of the most talented and passionate people in the industry, and have the support and resources you need to do work that truly matters. We deliver results that exceed expectations and we win together! Your Role: At Tenable, we seek a passionate and skilled Presales Security Engineer covering Denmark and Norway to join our team. In this role, you’ll be crucial in driving sales success and enhancing our customers' experience through your technical expertise. You'll work alongside Sales Representatives and a talented team to set Tenable apart from the competition, build lasting customer relationships, and create enthusiastic advocates for our solutions. You must speak Fluent/Native Danish and English. What You'll Do: Deliver Technical Excellence: Present technical demonstrations of Tenable’s platform products, showcasing their value and differentiation to potential customers. Manage Evaluations: Oversee enterprise software trials and "Proof of Value" evaluations, ensuring they align with customer goals. Solve Real Problems: Address customer challenges and business needs with consultative security and compliance expertise. Engage and Educate: Answer technical questions and provide insights, occasionally presenting at local events and conferences. Support Sales Efforts: Work closely with sales representatives to achieve or exceed revenue targets, support local partners in enterprise deals, and respond to RFIs and RFPs. What We’re Looking For: Technical Expertise: Experience with Nessus or other network scanning technologies and solid foundational knowledge of TCP/IP and network security concepts. Cyber Security & Cloud Knowledge: Familiarity with the Cyber Security ecosystem both on-prem and in the Cloud, including CMDB, Ticketing, Patch Management, PAM, etc. Compliance Awareness: Understanding of international & local compliance standards (e.g., NIS2, DORA, PCI, FISMA, SOX, NERC, CIS, DIS STIG). Effective Communicator: Excellent communication and presentation skills, with the ability to adapt based on the audience and effectively frame problems and solutions. Strong teamwork skills are essential, as collaboration is at the heart of this role’s success. Flexibility: Willingness to travel as needed within your territory (up to 25%). Relationship: Build a good relationship with customers, partners and your peers. Drive Activities: Demo’s, Workshop’s, Technical Meetings for customers & partners, Events and Webinars, Capture the Flag activities. Bonus Points For: Experience: 5-7 years of direct Pre-Sales Engineer experience. Certifications: Cloud certifications in AWS, GCP &/or Azure. CISSP or equivalent. Network Knowledge: Understanding of TCP/IP and network security concepts. System Experience: Experience with enterprise-class operating systems at the security admin level. Embracing AI: Experience and Creative in using AI capabilities. DevOps Skills: Proficiency in Docker, DevOps, API scripting, and Python SDK. Proactive Attitude: A self-starter who stays up to date with current technologies. Interview Process Recruiter Interview  – 1st Stage - Virtual Hiring Manager Interview  – 2nd Stage – Virtual Tech Assessment - 3rd Stage - Virtual Job Skills Interview - 4th Stage - Face to Face Senior Stakeholder Panel Interview – Final Stage - Virtual Apply Today! If you’ve read this far and are still unsure if you should apply, we encourage you to go for it! At Tenable, we believe there’s no such thing as a perfect candidate. Whether you meet all the listed qualifications or just a few, we welcome your application. We value diverse perspectives and backgrounds and are excited to see what you can bring to our team. Join us at Tenable, where your passion and expertise can make a real difference every day. #LI-JG1 #LI-Remote This is the expected salary range for this position in the primary job location, depending on experience and qualifications. Compensation for the role will depend on a number of factors, including the candidate's qualifications, skills, competencies, location and experience, and may fall outside of the range shown. Employees are also eligible for variable compensation in addition to base pay (commission for sales roles, bonus for non-sales roles), depending on company and individual performance. Tenable also offers a variety of Competitive wellness and financial benefits. EU Pay Range 725.000 kr. — 965.000 kr. DKK We’re committed to promoting Equal Employment Opportunity (EEO) at Tenable - through all equal employment opportunity laws and regulations at the international, federal, state and local levels.  If you need a reasonable accommodation due to a disability during the application or recruiting process, please contact Recruiting@Tenable.com for further assistance. Tenable Data Consent Statement Tenable is committed to protecting the privacy and security of your personal data. Depending on your location, one or more of the following notices may apply to you: General Applicant Privacy Notice California Applicant Privacy Notice EU/EEA/UK Applicant Privacy Notice

Location: Remote, United States GitLab is the intelligent orchestration platform for DevSecOps. GitLab enables organizations to increase developer productivity, improve operational efficiency, reduce security and compliance risk, and accelerate digital transformation. More than 50 million registered users and more than 50% of the Fortune 100* trust GitLab to ship better, more secure software faster. The same principles built into our products are reflected in how our team works: we embrace AI as a core productivity multiplier, with all team members expected to incorporate AI into their daily workflows to drive efficiency, innovation, and impact. GitLab is where careers accelerate, innovation flourishes, and every voice is valued. Our high-performance culture is driven by our values and continuous knowledge exchange, enabling our team members to reach their full potential while collaborating with industry leaders to solve complex problems. Co-create the future with us as we build technology that transforms how the world develops software. * Fortune 500® is a registered trademark of Fortune Media IP Limited, used under license. Claim based on GitLab data. Fortune 100 refers to the top 20% ranked companies in the 2025 Fortune 500 list, published in June 2025. Fortune and Fortune Media IP Limited are not affiliated with, and do not endorse products or services of GitLab. An overview of the role GitLab is seeking an experienced Principal Security GRC Manager, Legal Assurance to tackle complex customer security challenges at the intersection of technical architecture and business requirements. In this role, you'll apply deep security expertise to answer technical questions, assess contract requirements, and enable GitLab’s Sales and field organizations to address security problems for enterprise customers. You'll work directly with customers and internal teams to provide technical guidance, create security content, and help customers understand how GitLab's security controls meet their compliance and risk management needs. What you'll do: Contract & Legal Review Perform comprehensive contract reviews for both customer agreements and vendor relationships Analyze security and compliance clauses in legal documents Provide risk-based recommendations and remediation guidance for contractual security requirements Partner with Legal, Sales, Product, and Procurement teams to negotiate security-related contract terms. Manage escalations, collaborate across other teams, and develop solutions to enable team and business partners to close deals Document and track contract-related security obligations Customer Engagement & Assurance Join customer and prospect meetings to provide expert guidance on GitLab’s security practices and controls in order to address security, privacy, and compliance requirements Build and maintain templates, playbooks, fallback positions, and training that simplify and accelerate negotiations Facilitate customer assurance activities through our Customer Assurance Activities Service Desk Provide escalation support for complex security questionnaires, RFPs, and risk assessments Serve as security point of contact for enterprise customer questions, requests, and concerns Security Evangelism & Thought Leadership Act as a trusted technical thought leader, developing internal and external security content such as blog posts, whitepapers, technical standards, and field sales enablement training materials Keep abreast of the rapidly evolving regulatory landscape affecting our agreements. Identify, track, and facilitate solutions for security related customer trends and improvement areas Build and strengthen GitLab's security brand within the industry Strategic Initiatives Maintain and enhance GitLab's Trust Center and self-service security resources Provide strategic recommendations based on customer security concerns in support of revenue growth Participate in Quarterly Business Reviews to inform product and security roadmap decisions Mentor and provide guidance to Security Assurance team members Drive continuous improvement of Field Security processes and documentation Design and implement solutions to enable Sales facing teams to successfully discuss security problems and topics with customers What you'll bring: Expertise in law and regulation such as (GDPR, CCPA, DORA, EU AI Act) Deep experience in information security, with at least 5 years in customer-facing security roles Deep experience in security frameworks and standards such as (SOC 2, ISO 27001/27017/27018/42001, FedRAMP, NIST CSF, etc.) Proven track record of contract negotiation and security/privacy agreement reviews Exceptional written and verbal communication skills with ability to translate complex technical concepts for diverse audiences Experience creating security content (blogs, whitepapers, presentations) Strong understanding of cloud security, SaaS security models, and DevSecOps practices Experience working cross-functionally with Sales, Legal, Product, and Engineering teams Ability to balance security risk with business objectives Experience speaking at conferences is a plus Preferred: One or more relevant certifications such as CISSP, CISA, CISM, CCSP, ISO 27001 Lead Implementer/Auditor, or CIPP/CIPM. Equivalent demonstrated experience is equally valued. Due to government requirements, you must be a United States Citizen (defined as any individual who is a citizen of the United States by law, birth, or naturalization) to fill this position. About the team The Security Assurance organization helps GitLab build and maintain trust by strengthening how we approach security, compliance, and risk. Security Governance sits within it and owns customer trust, security awareness, policies and standards, and other governance functions. Our counterparts are Security Compliance, Security Risk, and GRC Engineering. You will join a small team of four direct reports under the Director, where each person has broad scope and visible impact. We work remote-first and asynchronously, and we write things down and share them openly. The base salary range for this role’s listed level is currently for residents of the United States only. This range is intended to reflect the role's base salary rate in locations throughout the US. Grade level and salary ranges are determined through interviews and a review of education, experience, knowledge, skills, abilities of the applicant, equity with other team members, alignment with market data, and geographic location. The base salary range does not include any bonuses, equity, or benefits. See more information on our benefits and equity . Sales roles are also eligible for incentive pay targeted at up to 100% of the offered base salary. United States Salary Range $203,200 — $285,000 USD How GitLab Supports Full-Time Employees Benefits to support your health, finances, and well-being Flexible Paid Time Off Team Member Resource Groups Equity Compensation & Employee Stock Purchase Plan Growth and Development Fund Parental Leave Please note that we welcome interest from candidates with varying levels of experience; many successful candidates do not meet every single requirement. Additionally, studies have shown that people from underrepresented groups are less likely to apply to a job unless they meet every single qualification. If you're excited about this role, please apply and allow our recruiters to assess your application. Country Hiring Guidelines: GitLab hires new team members in countries around the world. All of our roles are remote, however some roles may carry specific location-based eligibility requirements. Our Talent Acquisition team can help answer any questions about location after starting the recruiting process. Privacy Policy: Please review our Recruitment Privacy Policy. Your privacy is important to us. GitLab is proud to be an equal opportunity workplace and is an affirmative action employer. GitLab’s policies and practices relating to recruitment, employment, career development and advancement, promotion, and retirement are based solely on merit, regardless of race, color, religion, ancestry, sex (including pregnancy, lactation, sexual orientation, gender identity, or gender expression), national origin, age, citizenship, marital status, mental or physical disability, genetic information (including family medical history), discharge status from the military, protected veteran status (which includes disabled veterans, recently separated veterans, active duty wartime or campaign badge veterans, and Armed Forces service medal veterans), or any other basis protected by law. GitLab will not tolerate discrimination or harassment based on any of these characteristics. See also GitLab’s EEO Policy and EEO is the Law . If you have a disability or special need that requires accommodation , please let us know during the recruiting process .

Проводить анализ безопасности архитектуры, выявлять угрозы и уязвимости, связанные с использованием AI-агентов/LLM/GenAI во внутренних и внешних продуктах компании. Разрабатывать требования безопасной разработки в сфере использования AI-агентов/LLM/GenAI.

Взаимодействовать с командами аналитики и разработки для анализа бизнес требований и их влияния на защищенность продукта; Моделировать угрозы безопасности приложений/сервисов и предлагать механизмы защиты;

Задачи: — Обрабатывать сложные и нестандартные сценарии JML — Устранять технические неполадки сервисов IAM (SSO, IdP, потоки предоставления доступа) — Настраивать и поддерживать инструмент IAM

Location: Remote Workplace: Remote About the Company Rain is the global stablecoin payments platform for enterprises, neobanks, platforms, developers, and AI agents. Our technology allows partners to move, store, and use stablecoins instantly and compliantly through global payment cards, rewards, on/offramps, wallets, and cross-border rails. As both a Visa and Mastercard Principal Member, Rain issues cards that work at more than 175 million merchant locations in over 220 countries and territories. Built natively for stablecoins and trusted by more than 100 organizations worldwide, Rain delivers secure, scalable infrastructure that makes money move freely and instantly around the world. You will have the opportunity to deliver massive impact at a hypergrowth company backed by some of the top investors in fintech, crypto, and SaaS. In January 2026, we closed a $250M Series C led by ICONIQ, valuing Rain at $1.95B, with Sapphire Ventures, Dragonfly, Bessemer Venture Partners, Galaxy Ventures, FirstMark, Lightspeed, Norwest, and Endeavor Catalyst also participating. If you're curious, bold, and excited to help shape a borderless financial future, we'd love to talk. Our Ethos We believe in an open and flat structure. You will be able to grow into the role that most aligns with your goals. Our team members at all levels have the freedom to explore ideas and impact the roadmap and vision of our company. About the team & role Security at Rain protects a platform where real money moves every second, across cloud infrastructure, identity, endpoints, partner integrations and smart contracts. The team is small, senior and cross-functional, and it builds most of what it runs. Our engineers use AI agents for alert triage, investigation and response, and they design, tune and supervise those agents. Together we build Rain’s central systems for detection, response, sensors and threat intelligence, working directly with engineering, compliance and leadership. You will secure the systems Rain builds next. The role spans the whole program: you will build security tooling and controls, harden our infrastructure and access, and take on the hardest problems as Rain expands into new products and chains. What you’ll do - Build central security systems and automation the whole company relies on - Secure cloud infrastructure, identity and access across Rain’s growing footprint - Assess new products, partners and vendors before launch, and guide the engineers building them - Build AI agents and tools that make security work faster and more accurate - Lead external security assessments and drive findings to verified fixes - Join the on-call rotation and support incident response WHAT WE’RE LOOKING FOR - 5+ years in security engineering, including building tools and controls that run in production - Strong coding skills in TypeScript, Go, Rust or Python - Experience securing cloud infrastructure, identity and access - Ability to find vulnerabilities, prove them, and drive the fix with the team that owns the code - Experience at a fintech, payments or crypto company Nice to have - Blockchain security: smart contract review, onchain monitoring, custody and multisig controls - AI security: securing LLM applications and agents, or building AI into security workflows - Experience running external audits or a bug bounty program Things that enable a fulfilling, healthy and happy experience at Rain: Unlimited time off 🌴Unlimited vacation can be daunting, so we require Rainmakers to take 10 days minimum for themselves. Flexible working ☕ We support a flexible workplace, if you feel comfortable at home please work from home. If you’d like to work with others in an office feel free to come in. We want everyone to be able to work in the environment in which they are their most confident and productive selves. New Rainmakers will have a stipend to create a comfortable atmosphere at home. Easy to access benefits 🧠For US Rainmakers, we offer comprehensive health, dental and vision plans for you and your dependents, as well as a 100% company subsidized life insurance plan. Retirement goals💡Plan for the future with confidence. We offer a 401(k) with a 4% company match. Equity plan 📦 We offer every Rainmakers an equity option plan so we can all can benefit from our success. Rain Cards 🌧️ We want Rainmakers to be knowledgeable about our core products and services. To support this mission, we issue a card for our team to utilize the card for testing. Health and Wellness 📚 High performance begins from within. Rainmakers are welcome to use their card for eligible health and wellness spending like gym memberships/fitness classes, massages, acupuncture - whatever recharges you! Team summits ✨ Summits play an important role at Rain! Time spent together helps us get to know each other, strengthen our relationships, and build a common destiny. Expect team and company offsites both domestically and internationally.

Location: Riyadh, KSA Workplace: onsite Tabby creates financial freedom in the way people shop, earn and save by reshaping their relationship with money. Over 25 million users choose Tabby to stay in control of their spending and make the most out of their money. The company’s flagship offering allows shoppers to split their payments online and in-store with no interest or fees. Over 70,000 global brands and small businesses, including Amazon, Noon, IKEA, and SHEIN use Tabby to accelerate growth and gain loyal customers by offering easy and flexible payments online and in stores. Tabby generates over $18 billion in annual transaction volume for its partner brands and is the highest-rated, most-reviewed, largest, and fastest-growing FinTech in the GCC region. Tabby launched in 2019 and has since raised +$1 billion in equity and debt funding from global and regional investors, and is now valued at $6,5 billion. As Information Security Engineer , you’ll play a key part in monitoring and defending our infrastructure, applications, and cloud environments from cyber threats. You’ll lead incident response efforts, develop and tune detection rules, investigate security events, and collaborate with cross-functional teams to strengthen our security posture. Key Responsibilities Security Monitoring & Detection Monitor and analyze logs and alerts from a wide range of sources including firewalls, intrusion detection/prevention systems (IDS/IPS), endpoints, servers, and cloud platforms. Perform correlation of events from multiple sources to identify advanced threats and unusual patterns of behavior. Fine-tune alert thresholds and detection logic to reduce false positives and improve signal-to-noise ratio. Maintain dashboards and reporting to provide real-time visibility into security posture. Incident Response & Investigation Serve as a frontline responder for security incidents, managing incidents through their lifecycle – detection, containment, eradication, recovery, and lessons learned. Coordinate with internal stakeholders and external vendors during high-severity incidents or data breaches. Perform root cause analysis and forensic investigations using endpoint and network-based artifacts. Maintain detailed incident documentation and contribute to post-mortem analysis and reports. Threat Intelligence & Detection Rule Development Research emerging threats and trends. Contribute to the creation and tuning of detection rules, threat-hunting queries, and use cases across multiple platforms including cloud environments. Maintaining CTI Platform along with the integration of the CTI feeds with the security controls to have active CTI driven detections. Collaboration and Communication Communicate effectively with cross-functional teams including IT, DevOps, Risk, and Compliance during incidents and investigations. Provide concise and clear updates during incident handling to stakeholders and management. Mentor junior analysts and assist in training efforts within the SOC team. Skills, Knowledge and Expertise 3–4 years of experience in a SOC or cybersecurity operations role, ideally in a fast-paced fintech or enterprise environment. Strong knowledge of security best practices, including incident handling, alert triage, log analysis, and threat modeling. Understanding of online technologies, REST APIs, microservices, and modern application architectures. Experience working in a culturally diverse and collaborative environment. Familiarity with DLP, AV, and anti-malware systems from an operational monitoring perspective. Experience with phishing detection, user behavior analytics, and security awareness campaigns. Security certifications such as Security+, CySA+, eCIR, eCTHPv2, GCIA, or GMON (preferred but not required). Strong communication skills, especially for coordinating incident response and writing clear incident reports. Experience with SIEM platforms , SOAR tools , EDR/XDR , and Threat Intelligence platforms . Familiarity with cloud environments and cloud-native logging and monitoring tools. Scripting experience (e.g., Python ) to automate tasks and improve SOC efficiency.

Location: Самара Workplace: В офисе О компании RED Security – открытая экосистема ИБ-решений и экспертизы для комплексной защиты бизнеса. RED Security SOC – центр мониторинга и реагирования на кибератаки. Обязанности расследовать нетиповые инциденты ИБ с различных источников; взаимодействовать с заказчиками по техническим вопросам; анализировать полноту и качество анализа инцидентов; проводить обучение и делиться опытом с другими аналитиками. Требования понимание векторов атак на корпоративные сети и способы противодействия; знание современных методов классификации тактик и техник атакующих (Mitre Attack, Kill Chain); опыт в расследовании инцидентов ИБ; умение анализировать журналы регистрации событий в различных системах (ОС, СЗИ, сетевое оборудование, прикладное ПО, access логи и др). Условия сменный режим работы в офисе г. Самара; собственную платформу MTS Ocean для получения ИТ-ресурсов, а это значит, что деплой, мониторинг, observability — не будут для тебя проблемой, ты сможешь сосредоточиться на фичах; профессиональные гильдии инженеров, где мы поддерживаем друг друга и помогаем стать лучше; внутреннюю площадку TechTalks для обмена опытом, дискуссий, развития навыков самопрезентации; участие во внешних IT конференциях. Наши эксперты выступают на ведущих профильных конференциях, таких как HighLoad++, DevOps Conf, Joker, AHA!, Матемаркетинг и другие. А еще мы организуем собственную масштабную конференцию True Tech Day и регулярно проводим митапы для разработчиков и инженеров. полезные курсы и вебинары в корпоративном университете и электронную библиотеку; ДМС с первого месяца работы, включая стоматологию; страхование от несчастных случаев с 1 месяца работы. Материальную помощь в сложных жизненных ситуациях; отпуск 28 календарных дней (+3 дополнительных дня за ненормированный рабочий день); прием врачей общей практики и массаж в офисе; мобильная связь за счет компании и льготные тарифы для близких; подписка на онлайн-кинотеатр KION, сервис МТС Музыка, книжный сервис Строки от МТС, безлимитные мессенджеры и соцсети.