Вакансии

Location: Remote (US) About Ondo Ondo Finance is building institutional-grade financial infrastructure for tokenized real-world assets. We operate at the intersection of traditional finance and on-chain systems, which means our product surface has to hold up against both the ordinary threats that hit any high-value fintech and the specific ones that follow value on-chain. About the Role We are hiring a Senior Security Engineer - Product Security to own how we ship secure products at Ondo. You will be a security partner for our product engineering teams, driving threat modeling, owning secure code reviews for new products or feature expansions, maintaining and tuning AppSec tooling, and improving the existing SSDLC. You can expect to take ownership of the bug bounty program, new feature to existing product reviews, and similar broad ownership of critical functions paired to a dedicated ProdSec lead. An AI-native approach is welcome, paired with AI-driven approaches should expect to be justified by describing how doing so enables risk outcomes. This is a hands-on IC role. You will read code, run threat models, review architecture proposals, own tooling, and push engineering teams to build products that are secure by default. You partner closely with adjacent security function like AppSec, Infrasec, and SecOps. What You’ll Do Drive threat modeling for new features, integrations, and architectural changes across the product surface. Push threat models past templates into decisions that engineering teams actually implement. Own secure code review for high-risk changes — authentication, session management, cryptographic paths, wallet and signing flows, RPC and third-party integrations, permission and consent surfaces. Expand the AppSec tooling stack and treat “reducing false positives” as a first-class deliverable. AI-native integrations are welcome. Design and evolve our secure SDLC: where security fits in the dev workflow, what triggers a review, what a lightweight security sign-off looks like versus a full one, and how do we validate controls. Run our responsible disclosure and bug bounty program. Set scope, triage inbound reports, decide payouts, and drive findings to closure with engineering. Support and own appropriate scope for the intake and closure of findings from external audits and pentests — coordinate with audit vendors (Coinspect, Cantina, NCC Group, and others), organize findings into our internal risk register, and drive remediation with engineering owners. Partner with engineering leads to align o secure-by-default patterns - libraries, templates, sensible defaults, and paved-road implementations of anything security-relevant. Threat model blockchain-integrated components like wallet flows, RPC integrations, signing infrastructure, on-chain admin actions triggered from off-chain systems in partnership with engineers who own the on-chain code. Contribute to hiring, mentoring, and pushing the technical bar on the Security team. What We’re Looking For 5+ years in Product Security or Application Security, including senior IC time at a fast-moving product company. Deep secure code review skills in at least one modern stack (TypeScript / JavaScript, Python, or Go). Ability to move across stacks at the level required to threat model. Strong threat modeling skills, appropriate to experience - you can drive a real threat model with an engineering team, not just fill in a template. In practice, we look for core understanding of industry-relevant TTPs and IoCs and strong intuitions on how to apply those lessons learned to our products. Practical experience owning or majorly contributing to an AppSec tooling program. You have shipped rules, tuned noise, and measured impact. Comfortable running or building a bug bounty / responsible disclosure program end-to-end assuming properly resourced to do so. Strong working knowledge of modern web and API security - session and auth flows, OAuth and OIDC, browser security model, common web/API vulnerability classes, and their less-common variants. Comfortable reading Terraform, cloud IAM policies, and CI/CD configuration well enough to reason about how a product vulnerability crosses into an infra risk. Strong engineering partnership skills - you engage constructively, understand the “why” before proposing risk controls, you know when to accept risk, and you write things down. Willing to grow into blockchain-adjacent product security on the job, including the specific attack surface introduced by wallet, signing, and on-chain-integration code. Blockchain Exposure Note This role firmly lives in Web2 prodsec. But, it also requires someone who understands what “Web2 vs Web3” terminology means. In other words, how our products interact with blockchains creates unique threat models that all product security teammates must grasp. At a minimum, by Day 1 you should have strong intuitions about how blockchains will make your prodsec experience unique, you should grasp the common terminologies, and you should be able to discuss with colleagues several incident post-mortems that demonstrate how Web2 compromises lead to Web3 funds losses. You do not need to be an expert in smart contract auditing, blockchain security architectures, or decentralized consensus-driven risk controls. Nice to Have Prior work at a crypto, fintech, or other company where products handle high-value or irreversible actions. Familiarity with wallet, signing, or key-management flows. Reading-level familiarity with Solidity or Rust, target: when ProdSec intersects with smart contracts or other on-chain applications, you can parse what the code is likely doing, and work with blockchain security subject matter experts from there. Bug bounty history - reports, CVEs, or published write-ups. Familiarity with browser-extension security, mobile app security, or account-abstraction wallet designs. Public output - talks, blog posts, open-source tools, CVEs. How We Work The Security team values a high trust team environment where respectful candor can thrive. We expect senior engineers to have an opinionated take on how to accomplish a task, accept feedback from the team and other external stakeholders and return it in kind, and to always assume positive intent. Professionalism, ethics, and enabling stakeholders towards common goals are important always.

Location: Remote; Serbia; Poland Workplace: Remote We are looking for a Senior Penetration Tester to strengthen the security of high-load products by identifying vulnerabilities across applications, infrastructure, cloud environments, and payment flows. In this role, you will work closely with engineering, product, fraud, and compliance teams to improve security posture through offensive security assessments and practical remediation. Responsibilities: - Plan and execute penetration testing activities across web applications, APIs, mobile applications, internal and external infrastructure, and AWS cloud environments - Perform offensive security exercises, including red team and assumed-breach scenarios covering privilege escalation, lateral movement, persistence, and data exfiltration - Assess the security of cloud-native services, Kubernetes environments, microservices, and CI/CD pipelines - Identify vulnerabilities affecting payment systems, wallets, KYC/AML processes, bonus mechanisms, affiliate tracking, and other business-critical workflows - Work with Product, Engineering, AppSec, Payments, and Fraud teams to prioritize findings and support remediation efforts - Develop custom scripts and internal tools to improve testing capabilities where standard solutions are insufficient - Contribute to threat modeling activities and support secure-by-design initiatives - Review penetration testing plans, reports, and provide technical guidance to junior and middle security specialists - Research emerging vulnerabilities, MITRE ATT&CK techniques, security advisories, and translate them into actionable improvements - Support security assessments for new products, releases, and market launches, including effort estimation and pre-certification activities - Act as a security advisor for technical and business stakeholders on offensive security matters Requirements: - 4+ years of hands-on experience in penetration testing or offensive security - Proven practical experience in at least three of the following areas: - Web applications / APIs - Internal networks - External infrastructure - Cloud environments (AWS/GCP) - Mobile applications (iOS/Android) - OSCP or an equivalent offensive security certification - Strong knowledge of SAST, SCA, DAST, AWS/GCP, MITRE ATT&CK, OWASP ASVS, OWASP WSTG, and PTES - Good understanding of application architecture, including MVC and data flow principles - Knowledge of supply chain attack techniques - Experience writing scripts in Python and Bash - Understanding of IAM models within at least one major cloud provider - Hands-on experience testing Kubernetes-based environments, cloud-native applications, CI/CD pipelines (GitLab, GitHub Actions, Jenkins) and Infrastructure as Code solutions (Terraform, Helm, CloudFormation) - Strong reporting, documentation, and communication skills - Ability to balance security priorities with business and release deadlines - Solid understanding of security frameworks and compliance standards, including PCI DSS, ISO 27001, NIST, and GDPR - At least Upper-Intermediate level of English Would be a plus: - Advanced offensive security certifications such as OSWE, OSEP, OSED, CRTO, BSCP, ARTE, or GRTE - Experience designing secure architectures for Kubernetes and AWS environments - Previous background in iGaming, fintech, or payment products - Public security research, CVEs, advisories, technical publications, or conference presentations - Completion of HTB Pro Labs or strong CTF achievements - Contributions to open-source offensive or defensive security projects What's in it for you: - Fully remote working format - Competitive salary based on experience - Paid annual leave and sick leave - Opportunities for professional and career growth - Supportive environment focused on continuous development and long-term growth

Location: Almaty, Kazakhstan Workplace: OnSite WHY WORK AT HIGGSFIELD AI? Higgsfield AI is the fastest-scaling generative AI company in history, hitting $500M in annual revenue run rate, 25M+ users worldwide, 6M+ generations per day, and powering 390 of Fortune 500 brands. We're building at the absolute frontier of AI-powered video creation and next-generation creative tools. Joining Higgsfield means becoming part of a high-impact team shaping the future of AI-native experiences, at a company that isn't just moving fast, but rewriting what fast looks like. ABOUT THE ROLE Break new features before they ship: agentic systems, MCP servers, code-generating agents, user-deployed apps, generative models for image, video, and voice, and enterprise features (SSO, org and team management, roles). It's new ground, and you'll help define how we secure it. You go first. What you'll do: - Pentest new features and products pre-release: web, APIs, admin surfaces. - Work out the attack surface of each new feature yourself. - Hunt authorization flaws across our multi-tenant APIs and retest fixes. - Join design and code reviews early, so flaws die before they're built. - Turn recurring findings into guardrails — paved-road standards and automated checks — so a bug class dies once instead of resurfacing every release. - Bring a working repro to the team that owns the code and see the fix through. Requirements - A track record of finding real vulnerabilities in real systems — appsec work, bug bounty, or research. - The ability to read modern codebases, trace a bug to root cause, and discuss the fix with the engineers who wrote it. - A threat-modeling instinct for spotting the weak spots in a design or architecture before a line is written. - Enough cloud and container fundamentals to follow a bug into the infrastructure it runs on. - High agency. - Working English. Nice to have - LLM/agent security research, public research or CVEs, OSWE/CWEE or equivalent hands-on certificates. WHAT WE OFFER: - Competitive base salary in USD - Equity: participation in the company’s stock option program, giving you the opportunity to share in the company’s long-term growth. - On-site role in our Almaty office (we will relocate you from anywhere).

Location: Remote-Friendly (Travel-Required) | San Francisco, CA | Seattle, WA | New York City, NY About Anthropic Anthropic’s mission is to create reliable, interpretable, and steerable AI systems. We want AI to be safe and beneficial for our users and for society as a whole. Our team is a quickly growing group of committed researchers, engineers, policy experts, and business leaders working together to build beneficial AI systems. About the role Anthropic's Application Security team secures the systems that build, serve, and increasingly are Claude — and as Anthropic's footprint grows, that mandate now extends to companies and codebases we bring in from outside. This role establishes that function. You'll own security due diligence and secure integration for Anthropic's acquisitions — assessing a target's security posture pre-close, writing the security risk readout for leadership, and after close, bringing acquired systems up to Anthropic's bar. Security has been part of every deal to date, but this is the first dedicated role for it: you'll formalize the playbook, the risk model, and the tooling, and make them repeatable. This is an AppSec role first. You'll be an active member of the Application Security team — same rituals, same on-run rotation, same tooling, working alongside engineers securing Anthropic's own agentic product surfaces. The expectation is the same too: we use Claude as our primary tool, and you're expected to automate the repeatable parts of diligence and integration as you go, so each acquisition is easier than the last. When deal flow is quiet, you'll pick up core AppSec project work; when it's active, M&A is your priority. We're upfront that the center of gravity here is M&A rather than core product security. It's burstier, more assessment-heavy, and operates on confidential, time-sensitive work. If you like parachuting into an unfamiliar codebase under time pressure and turning it into a clear risk picture for leadership, this is that job. Key responsibilities Lead pre-close security due diligence on prospective acquisitions — coordinate external penetration testing, threat-model the target's architecture, assess security controls, and deliver the security risk readout for leadership ahead of close and integration planning Drive post-close security integration — stand up static and dynamic analysis coverage on acquired codebases, track high- and critical-severity remediation to closure, fold acquired assets into bug bounty scope, and onboard repositories to Anthropic's automated vulnerability remediation and reporting systems Coordinate adjacent security engineering teams (supply chain, cloud, corporate security, detection & response) on their portions of each integration Work across a wide set of stakeholders on every deal — corporate development, legal, security leadership, and the engineering teams inheriting acquired systems internally; engineering and security counterparts at the target company externally — translating between them and keeping the security workstream legible to all of them Formalize and scale Anthropic's M&A security playbook — risk-scoring model, diligence runbook, integration checklist — and turn as much of it as possible into Claude-powered tooling rather than manual process Share the team's operational on-run rotation (bug bounty escalations, launch consults, incident response), swapping out during periods of active deal work Contribute to core AppSec projects between deals — secure design reviews, threat modeling for agentic systems, and the team's security automation roadmap Minimum qualifications Hands-on application and infrastructure security experience, including cloud and containerized environments Demonstrated ability to rapidly assess an unfamiliar codebase or architecture and produce a clear, prioritized risk assessment for a non-security audience Production-quality coding ability in at least one of Python, Go, Rust, or TypeScript Practical threat-modeling and vulnerability-identification skills — you've found and reasoned about real bugs in real systems Comfort operating with high autonomy, ambiguity, and tightly-held confidential context Clear written and verbal communication across varied audiences — executives, legal and corporate development partners, and engineering counterparts at an acquired company Preferred qualifications 7+ years in application security, security consulting, or security architecture Prior M&A security due diligence, third-party security assessment, or technical due diligence experience Experience standing up or scaling SAST/DAST, bug bounty, or vulnerability management coverage across multiple codebases Track record of building security automation or tooling rather than relying solely on manual review Familiarity with using LLMs as a core part of your security workflow Experience securing agentic, code-execution, or LLM-integrated systems Representative projects Point Anthropic's internal LLM-driven code analysis and AI-assisted scanning at an acquired repository nobody here has seen, and turn the output into a prioritized remediation plan in days rather than weeks Design the risk-scoring framework Anthropic uses to compare security posture across acquisitions of different shapes and sizes Build the automation that onboards an acquired codebase to Anthropic's vulnerability dashboard, dependency auto-patching, and bounty scope without a human running a checklist Write the security risk memo for a live deal and present it to corporate development and security leadership The annual compensation range for this role is listed below. For sales roles, the range provided is the role’s On Target Earnings ("OTE") range, meaning that the range includes both the sales commissions/sales bonuses target and annual base salary for the role. Annual Salary: $320,000 — $485,000 USD Logistics Minimum education: Bachelor’s degree or an equivalent combination of education, training, and/or experience Required field of study: A field relevant to the role as demonstrated through coursework, training, or professional experience Minimum years of experience: Years of experience required will correlate with the internal job level requirements for the position Location-based hybrid policy: Currently, we expect all staff to be in one of our offices at least 25% of the time. However, some roles may require more time in our offices. Visa sponsorship: We do sponsor visas! However, we aren't able to successfully sponsor visas for every role and every candidate. But if we make you an offer, we will make every reasonable effort to get you a visa, and we retain an immigration lawyer to help with this. We encourage you to apply even if you do not believe you meet every single qualification. Not all strong candidates will meet every single qualification as listed.  Research shows that people who identify as being from underrepresented groups are more prone to experiencing imposter syndrome and doubting the strength of their candidacy, so we urge you not to exclude yourself prematurely and to submit an application if you're interested in this work. We think AI systems like the ones we're building have enormous social and ethical implications. We think this makes representation even more important, and we strive to include a range of diverse perspectives on our team. Your safety matters to us. To protect yourself from potential scams, remember that Anthropic recruiters only contact you from @anthropic.com email addresses. In some cases, we may partner with vetted recruiting agencies who will identify themselves as working on behalf of Anthropic. Be cautious of emails from other domains. Legitimate Anthropic recruiters will never ask for money, fees, or banking information before your first day. If you're ever unsure about a communication, don't click any links—visit anthropic.com/careers directly for confirmed position openings. How we're different We believe that the highest-impact AI research will be big science. At Anthropic we work as a single cohesive team on just a few large-scale research efforts. And we value impact — advancing our long-term goals of steerable, trustworthy AI — rather than work on smaller and more specific puzzles. We view AI research as an empirical science, which has as much in common with physics and biology as with traditional efforts in computer science. We're an extremely collaborative group, and we host frequent research discussions to ensure that we are pursuing the highest-impact work at any given time. As such, we greatly value communication skills. The easiest way to understand our research directions is to read our recent research. This research continues many of the directions our team worked on prior to Anthropic, including: GPT-3, Circuit-Based Interpretability, Multimodal Neurons, Scaling Laws, AI & Compute, Concrete Problems in AI Safety, and Learning from Human Preferences. Come work with us! Anthropic is a public benefit corporation headquartered in San Francisco. We offer competitive compensation and benefits, optional equity donation matching, generous vacation and parental leave, flexible working hours, and a lovely office space in which to collaborate with colleagues. Guidance on Candidates' AI Usage: Learn about our policy for using AI in our application process.

Location: Baku Workplace: onsite ABOUT YOU Xsolla seeks a security engineer to join a new security team during a critical build-out phase. You work across application security and infrastructure security - reviewing code, hardening cloud environments, supporting incident response, and partnering with engineering teams to improve security posture across the company. This is a generalist role well-suited to an early-team hire. You are comfortable working across domains rather than specializing in one, and you grow into deeper expertise as the team and program mature. You collaborate closely with the security program manager and work directly with engineering teams on secure design, findings, and remediation. Our tech stack includes GCP, vSphere/ESX, Kubernetes and container workloads, MariaDB, CockroachDB, Go, PHP, and Python. You do not need expertise in all of these, but you are comfortable navigating a mixed environment and learning what you need. As always true in job descriptions, there is an intangible value that is hard to capture. We look for a diverse set of perspectives and skills. Even if you don't match every requirement, we encourage you to apply if you think you can be highly successful in this role.   ABOUT US   Xsolla is a global commerce company with robust tools and services to help developers solve the inherent challenges of the video game industry. From indie to AAA, companies partner with Xsolla to help them fund, distribute, market, and monetize their games. Grounded in the belief in the future of video games, Xsolla is resolute in the mission to bring opportunities together, and continually make new resources available to creators. Headquartered and incorporated in Los Angeles, California, Xsolla operates as the merchant of record and has helped over 1,500+ game developers to reach more players and grow their businesses around the world. With more paths to profits and ways to win, developers have all the things needed to enjoy the game. For more information, visit xsolla.com. Responsibilities Perform Application Security Reviews - Conduct code reviews, run SAST / DAST and dependency scanning tools, and work with engineering to resolve findings. Participate in Threat Modeling - Contribute to threat modeling sessions for new features and architecture changes, helping identify risks early in the design process. Help Harden Cloud and Container Infrastructure - Work on GCP, Kubernetes, and IAM configurations to strengthen the security of our cloud and container environments. Participate in Pen Test Remediation - Help triage penetration test findings and work with engineering teams to implement fixes, coordinating closely with the security program manager. Partner with Engineering on Secure Design - Review architectures, advise on secure implementation patterns, and help teams make informed security decisions. Identify and Track Security Findings - Document findings, assess severity, and track them through the remediation lifecycle to resolution. Support Incident Response - Help investigate and document security events, contribute to root-cause analysis, and support containment efforts. Write Async Security Guidance - Produce advisories, best-practice documentation, and practical guidance that helps engineering teams build securely across time zones. Support Product Security - Work with partners on the security posture of customer-facing services, contributing to reviews and assessments as needed. What You Bring Foundational AppSec Knowledge - Understands common vulnerability classes, secure coding patterns, and how to conduct a meaningful code review. Cloud Environment Exposure - Has worked with GCP or a similar cloud provider and is comfortable with IAM , networking, and container concepts. Code Literacy - Reads and reviews code in one or more of: Go, Python, PHP. Does not need to be a software engineer, but can follow logic and spot issues. Security Tooling Familiarity - Has used or is familiar with SAST , DAST , or dependency scanning tools and understands how they fit into a development workflow. Strong Written Communication - Writes clear, concise async documentation - findings, advisories, guidance - that works across time zones and audiences. Collaborative Mindset - Partners effectively with engineering teams. Focuses on helping teams build securely rather than just identifying problems. Self-Directed with Growth Mindset - Eager to learn, comfortable with ambiguity, and able to make progress with minimal direction in a new and evolving team. Nice to Have Threat modeling experience; Hands-on Kubernetes or container security experience; Infrastructure security background - Linux, networking, vSphere/ ESX; Familiarity with NIST CSF , PCI , SOC 2, or ISO 27001 from a technical perspective; Detection engineering or incident response experience; Experience building security automation or internal tooling; Relevant certifications ( OSCP , GWAPT , CKS , or similar hands-on certs). Xsolla operates across multiple time zones. Strong written communication is essential - you will need to document your work clearly so findings and context are not lost across handoffs. We value directness, intellectual honesty, and follow-through. If you do not know something, say so and find out. If you find something, explain it clearly and see it through to resolution.

Location: Baku Workplace: onsite ABOUT YOU We are looking for a junior application security specialist to join a growing security team at Xsolla. This is a hands-on role where you will work closely with senior specialists to identify, assess, and help remediate security vulnerabilities across our products and infrastructure. You will be involved in day-to-day AppSec work - code reviews, vulnerability triage, threat modeling, and security testing. You are curious, detail-oriented, and eager to develop deep expertise in application security. You do not need to have all the answers, but you ask the right questions and follow through. This is a strong learning environment. You will be exposed to real-world security challenges in a payment platform operating at scale, and supported by experienced security specialists who will help you grow.   ABOUT US   Xsolla is a global commerce company with robust tools and services to help developers solve the inherent challenges of the video game industry. From indie to AAA, companies partner with Xsolla to help them fund, distribute, market, and monetize their games. Grounded in the belief in the future of video games, Xsolla is resolute in the mission to bring opportunities together, and continually make new resources available to creators. Headquartered and incorporated in Los Angeles, California, Xsolla operates as the merchant of record and has helped over 1,500+ game developers to reach more players and grow their businesses around the world. With more paths to profits and ways to win, developers have all the things needed to enjoy the game. For more information, visit xsolla.com. Responsibilities Triage Security Findings - Assess incoming bug bounty reports and scanner findings. Evaluate validity, calculate real severity, and escalate appropriately with clear written summaries. Assist with Vulnerability Assessments - Participate in security assessments of web applications and APIs. Help identify and document risks in new features and existing systems. Write Clear Security Documentation - Document findings, reproduction steps, and remediation guidance in a way that engineering teams can act on. Support Threat Modeling - Participate in threat modeling sessions. Learn to identify trust boundaries, data flows, and attack surfaces in system designs. Monitor Security Tools - Help operate SAST , DAST , and dependency scanning tooling. Track findings, reduce noise, and support remediation workflows. Support Code Reviews - Review code for common vulnerability classes under guidance of senior specialists. Learn to identify security issues across PHP, Python, and Go codebases. Stay Current - Follow developments in the security community. Bring awareness of new vulnerability classes, CVEs, and attack techniques relevant to our stack. What You Bring Web Security Fundamentals - Solid understanding of common vulnerability classes: OWASP Top 10, CSRF , XSS , IDOR , SQL injection, open redirect, authentication and session management weaknesses. You understand root causes, not just names. Web and Browser Fundamentals - Solid understanding of how web applications work: HTTP request/response cycle, client-server model, REST APIs, how browsers handle same-origin policy, cookies and their attributes, and CORS . This is the foundation everything else builds on. Security Testing Tools - Hands-on experience with Burp Suite or similar web application security testing tools. You have used them to intercept, modify, and replay requests — not just run automated scans. Vulnerability Documentation - Able to reproduce a vulnerability and write it up clearly: reproduction steps, proof of concept, and impact statement. Findings that engineering teams cannot reproduce or understand do not get fixed. Secure Development Awareness - Familiarity with foundational secure coding concepts: input validation, output encoding, parameterized queries, and least privilege. Code Readability - Ability to read and follow code in at least one language relevant to web security - PHP, Python, JavaScript, or Go. You don't need to be a developer, but you need to follow logic and spot security-relevant patterns. Analytical Thinking - You reason through problems methodically. You can explain not just what a vulnerability is but why it exists, how it is exploited, and what fixing it actually requires. Clear Written Communication - You write findings and summaries that are precise, reproducible, and useful to the engineers who need to act on them. Curiosity and Initiative - You dig into problems rather than stopping at the surface. When something looks wrong, you investigate before concluding Nice to Have Participation in bug bounty programs or CTF competitions; Basic scripting ability for automation - Python or Bash; Familiarity with CI/CD pipelines and where security tooling fits; Exposure to cloud environments - GCP, AWS, or Azure; Relevant coursework or certifications - eWPT, CEH , PortSwigger Web Security Academy progress, or similar entry-level credentials. Xsolla operates across multiple time zones. Strong written communication is essential - you will need to document your work clearly so findings and context are not lost across handoffs. We value directness, intellectual honesty, and follow-through. If you do not know something, say so and find out. If you find something, explain it clearly and see it through to resolution.

Location: United States Workplace: Remote At ClickUp, we're building the future of work: the first truly converged AI workspace unifying tasks, docs, chat, calendar, and enterprise search, all supercharged by context-driven AI. We are an AI-native company. Every team member is expected to leverage AI daily, and we evaluate AI fluency as part of our hiring process. Join us and help redefine what's possible. 🚀 JOB SUMMARY   We are looking for a GTM DevOps Engineer to join our Business Systems team and own the reliability, automation, and delivery infrastructure behind our Go-To-Market (GTM) technology stack. This role sits at the intersection of platform reliability and CI/CD engineering, ensuring that our critical business systems — including Salesforce, NetSuite, MuleSoft, Workato, and an expanding portfolio of AI-powered workloads — are deployed consistently, operate resiliently, and scale with the business.   You will partner closely with Business Systems developers, architects, and business stakeholders to build and maintain the pipelines, monitoring frameworks, and operational standards that keep our GTM systems healthy and our release cycles fast and predictable. As our team builds and deploys AI agents across GCP Cloud Run and AWS Bedrock AgentCore, you will serve as the infrastructure and deployment owner for these workloads — bringing engineering discipline to an environment where AI-generated code is increasingly entering production. This is a hands-on engineering role for someone who thrives in complexity, takes ownership of platform uptime, and brings a software engineering mindset to business application operations — directly supporting GTMSOE's broader mission of operational excellence across the GTM org.   KEY RESPONSIBILITIES   CI/CD & RELEASE ENGINEERING   - Design, build, and maintain CI/CD pipelines for Salesforce (SFDX/Salesforce CLI), NetSuite (SuiteScript/SuiteBundler), MuleSoft (Anypoint Platform), and Workato; establish branching strategies, environment promotion standards, and release gating processes across all GTM platforms. - Extend CI/CD practices to cover AI agent workloads deployed on GCP Cloud Run and AWS Bedrock AgentCore — including containerized builds, deployment pipelines, and automated validation gates. - Implement safe rollout patterns — including feature toggles, phased launches, automated validation, smoke tests, and rollback procedures — to reduce deployment risk on business-critical changes.   PLATFORM RELIABILITY & OBSERVABILITY   - Own SLA/SLO definitions for core GTM systems; standardize monitoring, alerting, and runbook patterns across quote-to-cash and GTM integrations, with proactive health checks and synthetic monitoring for critical flows (e.g., Salesforce ↔ NetSuite, Workato). - Extend observability coverage to GCP Cloud Run workloads — Cloud Scheduler jobs, agent pipelines, and integration microservices — and AWS-hosted agent infrastructure. - Conduct root cause analysis (RCA) for platform incidents and drive post-incident reviews with actionable remediation plans.   CLOUD INFRASTRUCTURE & ENVIRONMENT MANAGEMENT   - Manage sandbox, staging, and production environment lifecycles across GTM platforms — including refresh cycles, data masking, environment segmentation, and promotion standards that balance speed with reliability. - Own cloud infrastructure for Business Systems-operated workloads on GCP (Cloud Run, Cloud Scheduler, Cloud Secret Manager, GCS, Artifact Registry) and AWS (Lambda, S3, EventBridge, Secrets Manager, Bedrock AgentCore); apply IaC practices to make provisioning repeatable and auditable. - Establish base image pinning, dependency vulnerability scanning, and supply chain security practices for containerized workloads — particularly AI-generated codebases deployed via tools like Cursor or Claude Code. - Define and enforce patch management and container runtime ownership for vibe-coded and agentic workloads entering production.   SECRETS, ACCESS & SECURITY POSTURE   - Establish and enforce a consistent secrets management standard across all Business Systems workloads — GCP Secret Manager, AWS Secrets Manager, and equivalent — eliminating credential exposure via environment variables, source code, or client-side contexts. - Define and maintain API key rotation policies in alignment with security standards (high-severity keys: quarterly; vendor keys: annually at minimum). - Partner with Security and IT on IAM scoping, least-privilege service accounts, VPC configuration, and public/private endpoint governance for Cloud Run and Bedrock deployments. - Maintain a centralized registry of deployed workloads — GitHub repos, deployment URLs, architecture docs, data classification, and observability dashboard links — accessible to AppSec and infrastructure teams.   AUTOMATION & TOOLING   - Build internal tooling, automation scripts, and automated testing frameworks (unit, integration, regression) to reduce toil and increase deployment confidence; continuously evaluate new tooling to improve developer experience. - Develop or enforce GitHub repository templates for Cloud Run deployments that cover security audits, deployment configuration, API integration, and MCP server patterns — serving as a reusable foundation for AI-assisted builds.   GOVERNANCE, STANDARDS & COLLABORATION   - Define where self-service deployment and administration are appropriate versus where stronger change control and operational guardrails are required; serve as the DevOps SME, enabling developers to operate with autonomy within those boundaries. - Document and maintain operational runbooks, architecture decision records (ADRs), and deployment standards as living artifacts. - Collaborate with IT, Data Engineering, Security, and business stakeholders on cross-functional initiatives that touch the GTM platform.   QUALIFICATIONS   EXPERIENCE   - 4+ years in a DevOps, Site Reliability Engineering (SRE), or Platform Engineering role - 2+ years of hands-on experience deploying and managing Salesforce environments (SFDX, Salesforce CLI, scratch orgs, sandboxes, change sets, or pipeline-based deployments) - Experience with at least one additional GTM/ERP platform, such as NetSuite, MuleSoft, or Workato, in an operational or deployment capacity - Demonstrated experience building and maintaining CI/CD pipelines using tools such as GitHub Actions, GitLab CI, Jenkins, or Copado - Hands-on experience with GCP services — Cloud Run, Cloud Scheduler, Cloud Secret Manager, Artifact Registry, GCS — in a deployment or operations context - Experience with AWS services in an integration or operations context — Lambda, S3, SQS, Secrets Manager, CloudWatch; familiarity with Bedrock AgentCore or similar managed agent hosting infrastructure is a strong plus - Experience managing containerized workloads, including image lifecycle, dependency scanning, and supply chain security practices - Experience with incident management, on-call processes, and writing post-incident reviews   SKILLS & COMPETENCIES   Technical   - Strong scripting skills in Python, Bash, or Node.js for automation and tooling - Proficiency with Git, branching strategies, and version control best practices - Understanding of API-based integration patterns (REST, SOAP, event-driven) as they apply to MuleSoft, Workato, or similar iPaaS tools - Hands-on familiarity with secrets management across GCP Secret Manager and AWS Secrets Manager; strong grasp of security best practices in CI/CD contexts (least-privilege IAM, no hardcoded credentials, key rotation) - Monitoring and observability tooling experience (Datadog, Splunk, Google Cloud Monitoring, CloudWatch, or similar) - Infrastructure-as-code proficiency — Terraform or CloudFormation; experience applying IaC to Cloud Run or Lambda-based workloads preferred - Familiarity with container security practices: base image pinning, vulnerability scanning (e.g., Artifact Registry, Trivy), and dependency management for AI-generated codebases   Operational & Mindset   - Ownership: Takes full accountability for platform uptime, deployment quality, and the operational health of GTM infrastructure end-to-end. - Velocity: Operates with a bias for action — ships iteratively, reduces toil systematically, and keeps release cycles fast and predictable. - AI & Automation mindset: Actively leverages AI-assisted tooling and automation to accelerate delivery, improve reliability, and reduce manual overhead across the GTM stack. - Collaboration: Fluent cross-functional partner to developers, architects, Security, IT, and business stakeholders — enables autonomy without becoming a bottleneck. - Growth: Continuously evaluates new tooling, patterns, and practices to raise the bar on platform engineering and developer experience.   WHAT YOU'LL WORK WITH   - Salesforce: Core GTM CRM platform; this role owns deployment pipelines, environment management, and release reliability across orgs. - NetSuite: ERP platform integrated into the quote-to-cash flow; managed via SuiteScript/SuiteBundler within CI/CD standards. - MuleSoft (Anypoint Platform): Integration middleware; this role maintains deployment pipelines and observability for MuleSoft-managed flows. - Workato: iPaaS automation platform; monitored and deployed within the broader GTM reliability framework. - GCP (Cloud Run, Cloud Scheduler, Secret Manager, Artifact Registry, GCS): Primary cloud platform for AI agent workloads and integration microservices. - AWS (Lambda, S3, EventBridge, Secrets Manager, Bedrock AgentCore): Secondary cloud environment for agent hosting and integration operations. - GitHub Actions / GitLab CI / Copado: CI/CD tooling used to build, validate, and promote changes across GTM platforms. - Terraform / CloudFormation: IaC tooling for repeatable, auditable infrastructure provisioning. - Datadog / Splunk / Google Cloud Monitoring / CloudWatch: Observability and alerting stack across GTM and cloud workloads. Equal Opportunity Employer ClickUp is an Equal Opportunity Employer, and qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, or national origin. Privacy Notice ClickUp collects and processes personal data in accordance with applicable data protection laws. You can find further details by viewing our Global Candidate Privacy Notice. https://clickup.com/careers-terms/candidate-privacy-notice If you are a Philippine Job Applicant, please also see our Philippine Data Privacy Notice https://t333.s.clickup-attachments-stg.com/t333/d9a53ce2-6d2c-48cd-84b1-ed4e525f9613/Philippine%20Data%20Privacy%20Notice_2024.pdf?view=open for further details. Visa Sponsorship Please note we are unable to sponsor or take over sponsorship of an employment visa for roles outside of engineering and product at this time. Sponsorship for engineering and product roles is not guaranteed, but is instead based on the business needs for that specific role at that time. Please reach out to the recruiter with any questions. Fraud Alert ClickUp Talent Acquisition will only initiate contact via an @clickup.com http://clickup.com email or through our official careers portal on clickup.com http://clickup.com. We will never request fees, payments, or sensitive personal information. Please disregard any offers received outside these channels and report them to support@clickup.com. AI Processing Notice ClickUp may use artificial intelligence and machine learning technologies to help review and screen candidates' employment applications against role-related criteria. These tools support, but do not replace, human decision‑making. If you have questions or need an accommodation in the recruitment process, please contact us at AskPeople@ClickUp.com.

Location: Baku Workplace: onsite ABOUT YOU We are looking for a senior application security specialist to join a growing security team at Xsolla. This is a hands-on role where you will own security initiatives end-to-end - identifying, assessing, and driving remediation of security vulnerabilities across our products and infrastructure. You will lead day-to-day AppSec work - deep code reviews, vulnerability triage, threat modeling, and security testing - and set the standards for how this work is done. You are rigorous, pragmatic, and able to balance security risk against business velocity in a payment platform operating at scale. You will also mentor junior specialists and help raise the security bar across engineering teams. ABOUT US   Xsolla is a global commerce company with robust tools and services to help developers solve the inherent challenges of the video game industry. From indie to AAA, companies partner with Xsolla to help them fund, distribute, market, and monetize their games. Grounded in the belief in the future of video games, Xsolla is resolute in the mission to bring opportunities together, and continually make new resources available to creators. Headquartered and incorporated in Los Angeles, California, Xsolla operates as the merchant of record and has helped over 1,500+ game developers to reach more players and grow their businesses around the world. With more paths to profits and ways to win, developers have all the things needed to enjoy the game. For more information, visit xsolla.com. Responsibilities Own Vulnerability Management - Lead triage of bug bounty reports and scanner findings. Set severity standards, drive escalation policy, and ensure remediation SLAs are met across teams. Lead Security Assessments - Plan and conduct in-depth security assessments and penetration tests of web applications, APIs, and services. Define assessment scope and methodology. Drive Threat Modeling - Facilitate threat modeling sessions with engineering teams. Identify trust boundaries, data flows, and attack surfaces early in the design phase, and embed the practice into the SDLC . Own AppSec Tooling Strategy - Select, operate, and tune SAST , DAST , SCA , and secrets-scanning tooling. Design noise-reduction and auto-triage workflows; integrate security gates into CI/CD. Lead Secure Code Reviews - Perform security-focused code reviews across PHP, Python, and Go codebases. Define secure coding guidelines and review checklists for engineering teams. Mentor and Educate - Coach junior security specialists, run internal security training, and champion security awareness among developers. Write Clear Security Documentation - Document findings, reproduction steps, and remediation guidance in a way engineering teams can act on. Set the documentation standard for the team. What You Bring 4+ years in application security or a closely related security engineering role, with demonstrable ownership of AppSec programs or major initiatives. Deep Web Security Expertise - Expert-level understanding of vulnerability classes ( OWASP Top 10 and well beyond: SSRF , deserialization, request smuggling, OAuth/ OIDC flaws, business logic abuse). You understand root causes, exploitation chains, and realistic impact in production systems. Offensive Testing Proficiency - Extensive hands-on experience with Burp Suite and manual testing methodology. You can find vulnerabilities that scanners miss and chain low-severity issues into meaningful impact. Code Fluency - Comfortable reading and auditing code in at least one of: PHP, Python, Go, JavaScript. Able to trace data flows across services and spot vulnerable patterns without runtime access. Secure SDLC Experience - Practical experience embedding security into development workflows: security requirements, design review, CI/CD security gates, and developer enablement. Risk Communication - You can calculate and defend real severity, push back on inflated findings, and explain risk to both engineers and leadership in their own language. Analytical Thinking - You reason through problems methodically and can explain not just what a vulnerability is, but why it exists, how it is exploited, and what fixing it actually requires. Ownership and Follow-Through - You drive findings to resolution across team boundaries without being asked. Nice to Have Track record in bug bounty programs (accepted reports on major platforms) or notable CTF results; Strong automation skills - Python or Go for building internal security tooling; Experience securing cloud-native environments - GCP preferred; Kubernetes security a plus; Advanced certifications - OSWE , OSCP , BSCP , or GWAPT; Experience in payments, fintech, or other regulated environments ( PCI DSS familiarity); CVE credits, public security research, or conference talks. Xsolla operates across multiple time zones. Strong written communication is essential - you will need to document your work clearly so findings and context are not lost across handoffs. We value directness, intellectual honesty, and follow-through. If you do not know something, say so and find out. If you find something, explain it clearly and see it through to resolution.

О ПРОЕКТЕ StarTribe — часть крупного международного холдинга с 10-летней историей. Мы разрабатываем высоконагруженные IT-продукты для мировых брендов. Сейчас мы усиливаем команду безопасности для тестирования внутренних и публичных приложений собственной разработки. ВАШИ КЛЮЧЕВЫЕ ЗАДАЧИ — Pentesting: Проведение глубоких тестов веб-приложений (White/Grey/Black box). — Remediation: Подготовка конкретных рекомендаций по устранению уязвимостей. — Collaboration: Тесное взаимодействие с разработчиками для внедрения Security Best Practices. — DevSecOps: Участие в разработке внутреннего инструментария и автоматизации проверок. — Mentoring: Помощь коллегам и развитие экспертизы внутри команды. ЧТО МЫ ЖДЕМ ОТ ВАС — Опыт: 4+ года в области AppSec и тестирования безопасности веб-приложений. — Инструментарий: Экспертное владение Burp Suite и другими средствами анализа (Manual & Auto). — Коммуникация: Умение аргументированно доносить риски до бизнеса и находить компромиссы с Dev-командами. — Стек: Понимание специфики безопасности Node.js и PHP (дополнительно .NET / Go). БУДЕТ ПЛЮСОМ — Сертификации уровня OSCP, OSWE или Burp Suite Certified Practitioner. — Активное участие в CTF, наличие рейтинга на HackTheBox. — Наличие подтвержденных Bug Bounty репортов. УСЛОВИЯ И БЕНЕФИТЫ — Оформление: Официальный контракт по ТК Кипра. — Релокация: Частичная компенсация аренды жилья и корпоративная мобильная связь. — Бонусы: Годовой бонус по результатам, 4 дополнительных Day Off в году. — Life Quality: Корпоративное питание, спорт, мероприятия для семей и активности для детей. — Развитие: Скидка 50% на SkyEng, поддержка образовательных инициатив.

Location: Remote-Friendly (Travel-Required) | San Francisco, CA | Seattle, WA | New York City, NY About Anthropic Anthropic’s mission is to create reliable, interpretable, and steerable AI systems. We want AI to be safe and beneficial for our users and for society as a whole. Our team is a quickly growing group of committed researchers, engineers, policy experts, and business leaders working together to build beneficial AI systems. About the role: Anthropic's Application Security team secures the systems that build, serve, and increasingly are Claude. The attack surface is unlike most AppSec work: multi-agent orchestration, sandboxed code execution, agents holding delegated credentials, untrusted tool output crossing trust boundaries — problems with little prior art and no off-the-shelf playbook. The way the team works is also different. We use Claude as our primary tool across every part of the job: it drives our static analysis, drafts and fixes vulnerabilities as pull requests, performs first-line bug bounty triage, and assists threat modeling for design reviews. The human work is the judgment layer — system-level reasoning, deciding what matters, and building the next thing the model can't do yet. This is a builder's role on a senior team. We hire engineers who ship production systems and clear a hands-on threat-modeling bar — people who can find the vulnerability but would rather build the system that finds them all. Every engineer owns a system end-to-end, and the team's work has shaped customer-facing product security — including Claude Code's security review tooling, its security guidance plugin, sandboxing, and auto mode. Key responsibilities: Design, build, and operate Claude-powered security systems — LLM-driven code analysis, automated vulnerability remediation, AI-assisted threat modeling — and own one or more of them end-to-end, including the cross-functional relationships that come with it Lead secure design reviews and threat modeling for novel AI systems, identifying risks that don't map to existing frameworks Evolve a public bug bounty program where automation handles routine triage and root-cause work, and engineers handle escalations and corner cases Partner with Product, Infrastructure, and Research teams as an embedded security owner — consulting on launches, shaping architecture, and influencing decisions where security is the constraint Share an operational on-run rotation with the rest of the team — bounty escalations, incident response, and launch consults on systems serving Claude in production Minimum qualifications: Hands-on application and infrastructure security experience, including cloud and containerized environments Production-quality coding ability in at least one of Python, Go, Rust, or TypeScript, with a track record of building durable systems rather than one-off scripts Practical threat-modeling and vulnerability-identification skills — you've found and reasoned about real bugs in real systems, even if breaking isn't your primary mode Demonstrated ability to operate with high autonomy and ambiguity — comfortable being handed a problem and a lot of latitude rather than a spec Clear technical communication with both engineers and leadership Preferred qualifications: 7+ years in application security, security engineering, or security-focused software engineering Already use LLMs as a core part of how you work, with opinions about where they help and where they don't Experience securing agentic, code-execution, or LLM-integrated systems specifically Prior ownership of a bug bounty program, vulnerability disclosure program, or vulnerability-management infrastructure at scale Background building security automation or developer-facing security tooling Offensive security or penetration testing experience Representative projects An increasingly autonomous vulnerability pipeline — LLM-driven code analysis finds the issue, scores it for real exploitability, and opens the fix PR, with humans as the review step rather than the author Bug bounty operations where Claude handles first-line triage and drafting, and engineers focus on the reports that actually need judgment AI-assisted threat modeling that generates intake questions, drafts the model, and recommends which design reviews need a human in the room Automated dependency vulnerability remediation across Anthropic's codebase The company-wide vulnerability dashboard and SLA enforcement layer every engineering team works against Threat models and security architecture for agentic product surfaces — code execution sandboxing, agent identity and delegated auth, tool-use boundaries The annual compensation range for this role is listed below. For sales roles, the range provided is the role’s On Target Earnings ("OTE") range, meaning that the range includes both the sales commissions/sales bonuses target and annual base salary for the role. Annual Salary: $320,000 — $485,000 USD Logistics Minimum education: Bachelor’s degree or an equivalent combination of education, training, and/or experience Required field of study: A field relevant to the role as demonstrated through coursework, training, or professional experience Minimum years of experience: Years of experience required will correlate with the internal job level requirements for the position Location-based hybrid policy: Currently, we expect all staff to be in one of our offices at least 25% of the time. However, some roles may require more time in our offices. Visa sponsorship: We do sponsor visas! However, we aren't able to successfully sponsor visas for every role and every candidate. But if we make you an offer, we will make every reasonable effort to get you a visa, and we retain an immigration lawyer to help with this. We encourage you to apply even if you do not believe you meet every single qualification. Not all strong candidates will meet every single qualification as listed.  Research shows that people who identify as being from underrepresented groups are more prone to experiencing imposter syndrome and doubting the strength of their candidacy, so we urge you not to exclude yourself prematurely and to submit an application if you're interested in this work. We think AI systems like the ones we're building have enormous social and ethical implications. We think this makes representation even more important, and we strive to include a range of diverse perspectives on our team. Your safety matters to us. To protect yourself from potential scams, remember that Anthropic recruiters only contact you from @anthropic.com email addresses. In some cases, we may partner with vetted recruiting agencies who will identify themselves as working on behalf of Anthropic. Be cautious of emails from other domains. Legitimate Anthropic recruiters will never ask for money, fees, or banking information before your first day. If you're ever unsure about a communication, don't click any links—visit anthropic.com/careers directly for confirmed position openings. How we're different We believe that the highest-impact AI research will be big science. At Anthropic we work as a single cohesive team on just a few large-scale research efforts. And we value impact — advancing our long-term goals of steerable, trustworthy AI — rather than work on smaller and more specific puzzles. We view AI research as an empirical science, which has as much in common with physics and biology as with traditional efforts in computer science. We're an extremely collaborative group, and we host frequent research discussions to ensure that we are pursuing the highest-impact work at any given time. As such, we greatly value communication skills. The easiest way to understand our research directions is to read our recent research. This research continues many of the directions our team worked on prior to Anthropic, including: GPT-3, Circuit-Based Interpretability, Multimodal Neurons, Scaling Laws, AI & Compute, Concrete Problems in AI Safety, and Learning from Human Preferences. Come work with us! Anthropic is a public benefit corporation headquartered in San Francisco. We offer competitive compensation and benefits, optional equity donation matching, generous vacation and parental leave, flexible working hours, and a lovely office space in which to collaborate with colleagues. Guidance on Candidates' AI Usage: Learn about our policy for using AI in our application process.

Location: Remote - Worldwide About us OpenZeppelin is the security standard onchain finance is built on. Founded in 2015, our mission is to accelerate the world's transition to an open financial system, built on open standards and secured by rigorous research. Our open-source Contract Libraries have facilitated over $35 trillion in onchain value and are used by 10 of the top 10 tokenized money market funds and 9 of the top 10 stablecoins by market cap. We combine AI-native security tooling with deep research and a decade of audit expertise to support leading institutions and crypto-native teams shaping the next generation of digital assets like DTCC, Fidelity, Coinbase, Uniswap, Aave, the Ethereum Foundation, and many more across the full secure development lifecycle. Please note: Always refer to OpenZeppelin's official job page for the most accurate information about our open roles, as we have seen multiple third party job sites posting inaccurate information. The Security Services Team OpenZeppelin's Security Services team is responsible for the security of the world's leading web3 protocols and top financial institutions building onchain. Our researchers partner with client teams across the full lifecycle of a protocol: working on architecture and design before any code is written, co-creating novel mechanisms and primitives with engineering teams, conducting deep audits of pre-launch codebases, and providing continuous coverage as production systems evolve. Our clients range from emerging projects shipping their first contracts to global financial institutions running production onchain systems at scale. What you'll be doing Review smart contracts for top decentralized applications, blockchain infrastructure and financial institutions before they launch. Find vulnerabilities, prioritize them, and present findings to the client. Drive audits independently from start to finish, with AI as your primary collaborator. When useful, partner with another researcher to attack the code together and pressure-test findings. Partner with client teams during the design phase of new protocols, analyzing architecture, trust assumptions, and operational constraints before any code is written (Design Reviews, Applied Research engagements). Use AI efficiently throughout the audit process, and build skills, agents, and workflows that compound across the team. Conduct open-ended research into cutting-edge blockchain technologies, vulnerability classes, and emerging attack vectors, and contribute findings back to OpenZeppelin's internal knowledge base and to the broader ecosystem. You have Hands-on and practical experience in one or more of the following: software development, cybersecurity, applied mathematics, distributed systems, cryptography, cryptoeconomics or game theory, or DeFi mechanisms. Experience designing and developing smart contracts, not only auditing them. Strong working knowledge of Solidity and the broader Ethereum / EVM ecosystem (common libraries, frameworks, smart contract patterns). Modern AI tooling is central to how you work, not a novelty. You use it daily to expand audit coverage, reason about complex systems, and produce high-quality outputs faster. You evaluate AI-generated code with a critical eye. Comfort building and extending your own tooling (skills, agents, prompts, scripts, or full workflows) that the rest of the team can adopt and build on. An advanced English level and strong communication skills (oral and written). Nice to have Experience with non-EVM ecosystems and languages, such as Canton, Move (Sui, Aptos), Golang (Cosmos SDK), Cairo (Starknet), Rust-based blockchains (Solana, Stellar), or ZK circuits and cryptography-heavy systems. Experience with risk assessment work in the crypto industry (smart contract risk assessment, threat modeling). Working hand-in-hand with protocol teams on co-creative engagements, helping design, specify, and implement smart contracts alongside the research. Web2 security expertise (penetration testing, web application security, infrastructure security, or appsec). Experience with formal verification, invariant testing, or advanced fuzzing tools (Echidna, Foundry, Halmos, Certora). A track record in audit contests (Code4rena, Sherlock, Cantina) or bug bounty platforms (Immunefi, HackerOne). Public security research output, such as published findings, blog posts, conference talks, or contributions to open-source security tooling. Logistics Our interview process takes place on Google Meet and tends to consist of the following stages: Recruiter call (30 minutes) Manager interview (60 minutes) Technical interview (60 minutes) Paid work trial (paid code review assessment) Reference checks Please let us know if you require any accommodations for the interview process, and we’ll do our best to provide assistance. Benefits Meet your teammates at company gatherings around the world 😎 Enjoy the flexibility of fully remote work 🌎 Take the time you need with flexible time off 🏝 Grow your family with 8 weeks of paid leave for primary caregivers, 4 weeks for secondary caregivers, and a one-time $3,600 baby bonus 💙 Build your ideal home office with up to $500 in equipment support 🪑 Stay covered with medical insurance 🏥 Keep growing with learning and development opportunities 🧠 Get a monthly stipend for your preferred co-working space 💻 At OpenZeppelin , we are an equal opportunity employer and we value different perspectives. We are committed to building a diverse workforce. This includes but is not limited to gender, race, sexual orientation, religion, national origin and other characteristics that make each one of us unique. In this uniqueness, we find the most value. Come join us! Use of AI as part of the recruiting process As part of OpenZeppelin’s recruitment process, we may use automated tools, including artificial intelligence, to assist in reviewing applications and assessing candidate qualifications. These tools are used to support our People team by identifying relevant skills and experience, and are not used to make decisions solely by automated means. All hiring decisions involve human review. Any personal data provided as part of your application will be processed in accordance with OpenZeppelin’s Data Privacy Notice . If you have questions about this recruitment process or would like to request human review of your application, please contact us at talent@openzeppelin.com.