Location: Marousi, Greece
Are you interested in a career in Information Security and fluent in English? We currently have a vacancy for a motivated professional to join our team.
What You'll Do:
Assist with conducting IT risk assessments, Data Protection Impact Assessments (DPIAs), and drafting security plans.
Support ISO/IEC 27001 activities, including ISMS maintenance, documentation, and preparation for internal audits.
Help develop, review, and track enterprise information security policies and GRC (Governance, Risk, and Compliance) elements.
Collaborate on third-party vendor risk evaluations, security audits, and gathering security requirements for IT projects.
Requirements
University degree (or higher) in IT, Cybersecurity, or a related field, alongside 1 to 3 years of foundational experience in IT or information security roles;
Exposure to common security frameworks (particularly ISO/IEC 27001), risk methodologies, and privacy assessments (DPIAs);
Exposure to enterprise IT systems and/or Cloud environments.
Strong capacity for writing and presenting technical documentation, with an excellent command of written and oral English;
Ability to cooperate well and integrate seamlessly within an international team environment;
Security/IT/Cloud certifications would be considered a plus.
Benefits
We believe in rewarding talent and dedication. Here's what you can expect as part of our team:
Competitive full-time salary;
Private Health Coverage on the Company’s group program;
Flexible Working Hours;
Top-of-the-Line Tools;
Professional Development: Benefit from language courses, specialized training, and continuous learning opportunities;
Career Growth: Work with some of the most innovative and exciting specialists in the industry;
Dynamic Work Environment: Thrive in a setting that offers challenging goals, autonomy, and mentoring, fostering both personal and company growth.
If you want an exciting challenge, work with some of the coolest technologies, and enjoy your time doing it, then join us! Submit your detailed CV in English, quoting reference: (
JISC/11/26
).
You may also consider all our other open vacancies by visiting the career section of our website (
www.eurodyn.com
) and follow us on Twitter (@EURODYN_Careers) and LinkedIn.
EUROPEAN DYNAMICS (ED)
(
www.eurodyn.com
) is a leading European Software, Information, and Communication Technologies company, operating internationally (Athens, Brussels, Luxembourg, Copenhagen, Berlin, Stockholm, London, Nicosia, Valetta, Vienna, Den Haag, Hong Kong, etc.) The company employs over 1100 engineers, IT experts, and consultants (around 3% PhD, 41% MSc, and 54% BSc). We design and develop software applications using integrated, state-of-the-art technology. Our current IT projects have a value exceeding 300 million EURO. EUROPEAN DYNAMICS is a renowned supplier of IT services to European Union Institutions, international organizations, European Agencies, and national government Administrations in 40 countries and 4 continents.
As part of our dedication to the diversity of our workforce, we are committed to Equal Employment Opportunity without regard for race, colour, national origin, ethnicity, gender, disability, sexual orientation, gender identity, or religion.
EUROPEAN DYNAMICS (ED)
adheres to the General Data Protection Regulation principles by applying its Privacy Policy as published at
www.eurodyn.com/privacy
. By submitting an application to this position and by sharing your personal data with ED, you acknowledge and accept its Policy and authorize ED to process your personal data for the purposes of the company's recruitment opportunities, in line with the Policy
Location: Remote
Who we are
Our mission is to bring clarity and control to the world's most complex codebases. AI is accelerating code creation, but the infrastructure to understand, oversee, and evolve that code hasn't kept pace. Sourcegraph gives engineering organizations full visibility across their systems, precise context for their agents, and the ability to execute coordinated code changes at scale. As agentic development becomes the dominant engineering paradigm, we provide the context layer teams need to take control of their codebase.
With Code Search, Deep Search, MCP, and Agentic Batch Changes, we deliver on that mission today - giving engineering teams and their AI tools the cross-repo context to navigate massive codebases with confidence, and the ability to make changes across hundreds of repositories at once.
Companies like Stripe, Reddit, and Leidos rely on Sourcegraph to ship faster and with higher quality. We're backed by a16z, Sequoia, and Redpoint, and proud to operate as a globally distributed team that values high agency, direct communication, and customer love.
If you want to build the infrastructure that lets every engineering team - and every agent they deploy - operate on their codebase with confidence, join us.
Hours & location
🌎 While we hire
almost anywhere
in the world, we have a preference for someone to reside in the following locations for this role. However, if you feel qualified, we welcome you to apply regardless of location. No matter what, working hours must overlap with GMT-3 for at least 20 hours/week.
Preferred locations:
USA
Why this job is exciting
As our Compliance Manager, you will own and drive Sourcegraph’s governance, risk, and compliance program, with a primary focus on compliance. This is a highly cross-functional role that works closely with Security, Engineering, IT, Legal, People, Sales, and other teams across the company.
You will be responsible for maintaining and evolving our compliance program, including owning certifications such as SOC 2 and ISO 27001 and preparing Sourcegraph for additional frameworks as the business grows. This is not a role where you will simply coordinate work across a large compliance organization. We are looking for someone who has personally owned audit and certification programs end to end: designing and tailoring controls, collecting evidence, training internal teams, working directly with auditors, managing remediation, and driving follow-up work through completion.
📅 Within one month, you will…
You will build strong working relationships across Security, Engineering, IT, Legal, People, Sales, and other key stakeholders.
You will develop a clear understanding of Sourcegraph’s existing governance, risk, and compliance program, including our ISMS, risk register, controls, certifications, audit processes, and current areas of focus.
You will understand how our SOC 2 and ISO 27001 programs operate today, including key owners, evidence requirements, open risks, and upcoming milestones.
You will begin participating directly in day-to-day compliance activities and identify opportunities to improve or simplify existing processes.
📅 Within three months, you will…
You will have taken ownership of Sourcegraph’s ongoing SOC 2 and ISO 27001 compliance programs.
You will independently manage key audit activities, including control testing, evidence collection, stakeholder coordination, auditor requests, findings, and remediation.
You will evaluate existing controls and tailor them to Sourcegraph’s environment rather than relying on overly prescriptive or generic auditor recommendations.
You will actively maintain Sourcegraph’s risk register, ISMS processes, policies, and compliance documentation.
You will help internal teams understand their compliance responsibilities and provide practical guidance that allows them to meet requirements without creating unnecessary process.
You will support customer-facing compliance activities, including security questionnaires and compliance-related questions from prospective and existing customers.
📅 Within six months, you will…
You will have successfully led Sourcegraph through an audit or major certification milestone.
You will own the operating rhythm of the GRC program, including ISMS meetings, risk management activities, control reviews, documentation updates, and audit preparation.
You will have established a forward-looking compliance roadmap covering renewals, upcoming audits, new frameworks, regulatory requirements, and opportunities to improve how the program operates.
You will be able to independently identify control gaps or deficiencies, assess their risk, recommend practical solutions, and drive remediation with both technical and non-technical stakeholders.
You will have introduced automation, AI, or other process improvements that reduce manual compliance work while maintaining or improving program quality.
About you
You have built or operated compliance programs in a fast-moving technology environment and have personally owned major compliance initiatives from beginning to end.
You are comfortable operating independently, getting into the details, and doing the work yourself while coordinating with stakeholders across the organization. You understand that frameworks such as SOC 2 and ISO 27001 define requirements but often leave significant flexibility in how an organization satisfies them, and you know how to translate those requirements into controls that fit the business.
You are also comfortable working with technical teams and modern cloud environments. You can understand enough about infrastructure, systems, access controls, software development, and security processes to ask the right questions and effectively translate between auditors and technical teams.
5+ years of experience in governance, risk, compliance, information security compliance, or a related role.
Demonstrated end-to-end ownership of SOC 2 and ISO 27001 programs, ideally within a SaaS, technology startup, or similarly fast-moving environment.
Experience personally managing external audits and certification processes, including audit preparation, evidence collection, control testing, stakeholder training, auditor interaction, remediation, and follow-up.
Strong understanding of risk management, control design, ISMS governance, and compliance program operations.
Experience adapting compliance controls to an organization's actual environment rather than applying generic or overly prescriptive requirements.
Familiarity with cloud-based technology environments and the security and compliance considerations associated with a distributed or remote workforce.
Strong project management and organizational skills with the ability to drive cross-functional initiatives from inception through completion.
Excellent written and verbal communication skills and the ability to explain compliance requirements clearly to both technical and non-technical audiences.
A hands-on mindset and willingness to personally execute the work required to keep the compliance program operating effectively.
Curiosity about AI, automation, and emerging technology, with an interest in using new tools to improve compliance workflows.
Nice-to-haves:
Experience with additional security, privacy, or compliance frameworks such as GDPR, HIPAA, HITRUST, FedRAMP, FISMA, PCI DSS, or related standards.
Experience supporting security questionnaires, customer assurance processes, or sales-related compliance activities.
Experience with GRC platforms, compliance automation tools, or building internal automation for evidence collection and control monitoring.
Relevant certifications such as CISA, CISSP, ISO 27001 Lead Implementer or Lead Auditor, CRISC, or similar credentials.
Level
📊 This job is an IC3. You can read more about
our job leveling philosophy
in our Handbook.
Compensation
We pay above-market salaries because we want to hire exceptional people who can focus on building great products, not worrying about paying bills. As an
open and transparent
company, our
compensation philosophy
and pay bands are visible to every Sourcegraph teammate, and we strive to make our approach equitable, explainable, and competitive.
Your base salary is determined by the IC3 pay band for your location zone (1-4). Our pay bands are informed by market data and designed to ensure competitive compensation wherever you live. During the recruiting process, we'll discuss the range applicable to you based on job level, relevant skills, experience, qualifications, and location zone.
The starting salary for the IC3 pay band in each zone is:
Zone 2:
$137,718 USD
Zone 3:
$102,899 USD
In addition to competitive cash compensation, we offer meaningful equity (because when Sourcegraph succeeds, we want you to succeed, too) and generous
perks & benefits
.
Interview process
Below is the interview process you can expect for this role (you can read more about
the types of interviews
in our Handbook). It may look like a lot of steps, but rest assured that we move quickly and the steps are designed to help you get the information needed to determine if we’re the right fit for you… Interviewing is a two-way street, after all!
We expect the interview process to take 5 hours in total.
👋 Introduction Stage
- we have initial conversations to get to know you better…
[30m]
Recruiter Screen
[30m]
Hiring Manager Screen
🧑💻 Team Interview Stage
- we then delve into your experience in more depth and introduce you to members of the team, including cross-functional partners…
[Async] Working assignment
[60m]
Assignment Walkthrough + Review
[60m]
Resume Deep Dive
[60m]
Technical Interview
🎉 Final Interview Stage
- we move you to our final round, where you gain a better understanding of our business and values holistically…
[30m]
Values
[30m]
Leadership
We check references and conduct your background check
Please note - you are welcome to request additional conversations with anyone you would like to meet, but didn’t get to meet during the interview process.
Learn more about us
You can learn more about what it is like to work at Sourcegraph by reading
our handbook
.
We are an ambitious team who are collectively working hard to build the most influential company in the world. You can read more about our
culture
,
competitive compensation
and
benefits
here.
Sourcegraph is an equal opportunity workplace; we welcome people from all backgrounds.
Sourcegraph participates in
E-Verify
for U.S. Employees.
Location: USA - Remote
Workplace: Remote
About Us
Since 2013, we’ve been building a CRM that gets out of your way and helps your team sell more, faster. Now we’re building AI into every part of it, so Close does the busywork and your team does the selling. No manual data entry, no 10-click workflows. Just communication-first, AI-powered sales software designed to help you succeed and scale.
We're bootstrapped and profitable which means we answer to our customers and play by our rules. We're proud of our 130-person, 100% remote team, focused on building Close so that no small, scaling business fails because it can't figure out sales.
ABOUT THE ROLE
Close is a CRM built around the communication tools sales teams use every day: email, calling, SMS, workflows, reporting, and AI. Underneath that product is a broad technical surface — Python services and a large application backend, a TypeScript and React frontend, public APIs, Docker and Kubernetes, AWS infrastructure, and integrations with providers that handle sensitive customer data.
Security work happens across it all today, but the ownership is spread across Engineering, Infrastructure, and Security & Trust. We’re hiring our first dedicated Product Security Engineer to make that work systematic. You’ll report to the Backend Platform team manager within EPD (Engineering, Product, and Design), while working across the entire product and infrastructure surface. You’ll find vulnerabilities, determine which findings matter most, and drive them through remediation. Often you’ll fix the problem yourself. Other times you’ll give the owning team a clear reproduction, a practical path forward, and enough context to prioritize correctly.
You’ll analyze code, build proof-of-concepts, test running applications, tune or replace noisy tools, and automate the repetitive parts of vulnerability management. This is not a role where you forward scanner alerts and call the queue managed. Product and application security will be your responsibility. You’ll partner closely with our Infrastructure team on cloud security, access, and secrets, and with our Security & Trust Lead on GRC Engineering https://grc.engineering/, compliance (SOC 2) goals, audits, and corporate security.
This role is a new one at Close. You’ll have significant room to decide where better tooling, clearer ownership, and a small amount of code can reduce the most risk.
OUR STACK
Our backend is primarily Python, with Flask and FastAPI services and TaskTiger https://github.com/closeio/tasktiger and Temporal handling much of our asynchronous work. We expose REST https://developer.close.com/ and GraphQL APIs and store data in MongoDB, PostgreSQL, Elasticsearch, and Redis.
Our frontend is a large single-page TypeScript application built primarily with React. We bundle with Vite, target modern browsers, and test with Vitest, React Testing Library, Playwright, and Chromatic. The product updates in near real time and uses technologies including WebSockets and WebRTC. Our mobile application is built with React Native.
We build and test Docker images in CI/CD and continuously deploy them to Kubernetes on AWS. Our infrastructure uses managed services including EKS, MSK, and ElastiCache, alongside services running on EC2. Terraform and Ansible automate much of the underlying infrastructure, and our containerized local development environment lets engineers run the full system on their own machines.
For this role, our stack extends beyond simply backend or frontend: browser behavior, frontend state, API authorization, asynchronous processing, data access, third-party integrations, containers, and cloud configuration can all be part of the same attack path.
We love open sourcing our code and ideas on our GitHub https://github.com/closeio and on The Making of Close https://making.close.com/, our behind-the-scenes Product & Engineering blog. Check out our open source projects like SocketShark https://github.com/closeio/socketshark, TaskTiger https://github.com/closeio/tasktiger, LimitLion https://github.com/closeio/limitlion and ciso8601 https://github.com/closeio/ciso8601.
AI is both how we build and what we ship, and that's reshaped what engineering looks like. This is a transformation we’re embracing and find deeply exciting.
YOU ARE
- An application security engineer who writes code. You can move from reading an unfamiliar code path, to reproducing an exploit, to proposing or shipping a production-quality fix. Strong Python or TypeScript experience would be especially useful; fluency across both backend and frontend systems is even better.
- Skilled at finding vulnerabilities conventional scanners may miss. You use modern AI-assisted review pipelines, guided by expert judgment, to uncover subtle flaws in web apps and APIs—from authentication, authorization, and tenant isolation to injection, SSRF, unsafe data flows, and business logic. You can threat-model designs, white-box review code, and test running systems.
- Offensive-minded and operationally responsible. You know how to test like an attacker without being careless with customer data or production systems. You can turn a finding into a safe reproduction, assess exploitability and business impact, and retest the eventual fix.
- An automation builder. You have worked with some mix of SAST, DAST, software composition analysis, container scanning, secrets scanning, or cloud posture tooling. More importantly, you know how to tune tools, connect them to engineering workflows, and remove noise.
- AI-native and accountable. You use coding agents and LLMs to accelerate investigation, code review, and repetitive engineering work, but you verify their output. You think carefully about what happens when agents clone untrusted code, install dependencies, or receive access to credentials.
- Able to separate severity from priority. A score is an input, not a foregone conclusion. You consider reachability, existing controls, customer impact, and attack chains, then explain the risk in language that is legible to an engineer or business owner.
- Comfortable working across the business. You’ll collaborate with product engineers, Site Reliability Engineers, Security & Trust Lead, auditors, and external researchers without confusing partnership for pass-off ownership. You will follow findings to closure even when another team is responsible for the fix.
- Self-directed in a remote environment. You can take an ambiguous surface (say, secret rotation or dependency remediation) and learn how it works across multiple systems then turn it into a practical plan with measurable progress.
You do not need to arrive as the deepest expert in every part of this scope. You do need to be able to investigate an unfamiliar system, determine what matters, and bring the right people with you.
YOU WILL
The work spans hands-on application security, security automation, vulnerability management, and infrastructure partnership. Depending on where you find the greatest risk and leverage, projects could include:
- Build a recurring product security review program. Threat model new features, audit high-risk areas, review code, and build safe proof-of-concepts in isolated development environments. Work across our backend, frontend, APIs, and customer-facing integrations.
- Improve application security testing. Combine static analysis, dependency and secrets scanning, dynamic testing in development, and carefully scoped production testing. Use existing tools where they fit and build focused automation where they don’t.
- Own vulnerability intake and remediation. Triage findings from HackerOne, scanners, penetration tests, audits, customers, and internal research. Reproduce issues, assess exploitability and impact, track remediation, and verify fixes. Serve as technical lead for our bug bounty program while contract and budget ownership remain elsewhere.
- Turn security alerts into useful engineering work. Verify scanner coverage and automate ingestion, deduplication, enrichment, prioritization, and routing—so teams spend less time interpreting alerts and more time fixing important issues.
- Make dependency remediation safer and less manual. Improve scanning across our Python and TypeScript codebases, then build workflows to assess upgrades, stage pull requests, run checks, and route work without exposing credentials to untrusted packages or build steps.
- Make secrets routinely rotatable. Partner with service owners and Infrastructure to inventory application secrets, add graceful rotation paths, document provider-specific runbooks, and automate rotation where the provider and risk justify it. Expand our use of Vault-backed dynamic credentials and reduce the number of rotations that require a coordinated fire drill.
- Strengthen AWS security with Infrastructure. Evaluate and improve automated detection of risky configuration across identity, networking, compute, storage, containers, and registries. Turn findings into secure defaults, just-in-time access patterns, infrastructure guardrails, and actionable remediation—not build a second Infrastructure team.
- Support audits and raising the security floor. Partner with Security & Trust on external assessments, provide technical context, and ensure findings are fixed rather than rediscovered. Along the way, create documentation, paved roads, and lightweight training that helps engineers make safer choices without waiting for a security review.
- Take a key technical role in security incident response. Partner with Engineering and Infrastructure to coordinate investigation, containment, and remediation. Contribute to root-cause analysis and follow-up improvements, translating lessons learned into stronger controls and reduced recurrence.
Tech you’ll touch: Python, TypeScript, React, Flask, FastAPI, GraphQL, Docker, Kubernetes, AWS, Vault, GitHub Actions, MongoDB, PostgreSQL, Redis, Kafka, Elasticsearch and the security tooling you help us choose.
BENEFITS
- Compensation: Competitive pay plus an organization-wide goal-based bonus
- Paid Time Off: ~5 weeks of PTO to start. Plus a 1-week all-company Winter Holiday Break and paid US holidays. You'll earn 2 extra days for every year you're with Close.
- 80% Work Option: Work with your manager to choose between a standard 5-day week or a 4-day week at 80% pay
- Parental Leave: Paid leave for primary and secondary caregivers
- Sabbatical: A 1-month paid sabbatical every 5 years with the team
- Healthcare (US residents): Best-in-class health coverage with the majority of employee and dependent premiums covered. Two medical plans, plus Dental, Vision, HSA, FSA, and company-paid Long-Term Disability.
- 401k (US residents): We match your contributions up to 6%, vested immediately
OUR VALUES
Build a house you want to live in - Examine long-term thinking and action
No BS - Practice transparency and honesty, especially when it’s hard
Invest in each other - Build successful relationships with your coworkers and customers
Discipline equals freedom - Keep your word to yourself and others
Strive for greatness - Constantly challenge yourself and others
LEARN MORE
Listen to our CEO and Founder, Steli Efti, tell the story of Close’s journey in the $0-30m Blueprint https://www.close.com/blueprint.
Watch our culture video https://www.youtube.com/watch?v=maXKi1GN2MI from our 2023 team retreat in Milan. Every year our entire team gathers in person to build connection, foster cross-functional collaboration, and have fun. In 2027, we're headed to Dusseldorf, Germany!
Explore our product. Check out a demo https://www.close.com/demo-site!
OUR HIRING PROCESS
We ask a few role-specific questions as part of our application process. These questions are designed to help us learn more about you from the start, so please answer each one thoughtfully. We see this as an opportunity to get to know you beyond your resume.
We use AI tools daily at Close and expect candidates to do the same. In evaluating your application, we aim to get a sense for you - the way you think, how you communicate, the work you've done. Applications that read as fully AI-generated will not be considered.
Regardless of fit, you can expect to hear back from our team with an update on the status of your candidacy.
If you progress to the interview process, you'll receive a full outline of the role-specific steps in your first touchpoint with us. We do our best to make the hiring process clear and human.
Задачи:
— Участие в разработке и развитии продуктов линейки Security Vision: IRP/SOAR, SGRC, TIP и др.;
— Проработка экспертизы и архитектуры продуктов;
— Реализация и настройка интеграций со смежными системами: SIEM, Антивирусы, Песочницы, NGFW, DLP и тд;
— Разработка playbook’ов и скриптов автоматизации в рамках продуктов Security Vision;
— Постоянное саморазвитие в части новых трендов, техник и тактик атак и средств защиты, процедур и стандартов по управлению и контролю ИБ.
Требования:
— Образование высшее (техническое, предпочтительно профильное - информационная безопасность);
— Практический опыт в области информационной безопасности от 1 года;
— Знание сетевых технологий и принципов организации локально-вычислительных сетей;
— Знание устройства современных веб-приложений;
— Английский (на уровне чтения профессиональной литературы/технической документации);
— Возможность работать полный день.
Будет плюсом, если есть:
— Опыт работы с современными реляционными базами данных;
— Знание скриптовых языков (PowerShell, Python, JavaScript и т.д.);
— Опыт работы с веб-серверами;
— Интерес к системам класса СУИБ, SOC, SOAR, GRC и горячее желание развиваться в этом направлении.
Условия:
— Высокий доход;
— Работа в аккредитованной ИТ-компании и ОПК;
— Увеличенный ежегодный отпуск - 31 день;
— Объемный пакет ДМС со стоматологией и госпитализацией плановой и экстренной с самого начала работы, полис выезжающим на отдых;
— Корпоративная библиотека для чтения электронных и аудиокниг;
— Скидки на множество товаров и услуг, включая фитнес и иностранные языки;
— Сильные и опытные руководители, лидеры рынка;
— Работа в молодом и любящем свое дело коллективе;
— Комфортабельный офис, чай, кофе, фрукты, сладости;
— Гибкий график начала работы с 9-11;
— Возможность профессионального и карьерного роста.
Location: San Francisco, CA | New York City, NY
About Anthropic
Anthropic’s mission is to create reliable, interpretable, and steerable AI systems. We want AI to be safe and beneficial for our users and for society as a whole. Our team is a quickly growing group of committed researchers, engineers, policy experts, and business leaders working together to build beneficial AI systems.
About the team
Anthropic's Security Governance, Risk, and Compliance (GRC) team is the connective tissue that holds the company accountable to its security commitments. We translate regulatory, customer, and voluntary obligations into controls that teams act on, and give leadership a bird's-eye view of how well we're meeting them. We're building toward a fundamentally different kind of GRC: one that directs Claude, with the right humans in the loop, to challenge and evidence the performance of controls continuously rather than through periodic audits.
Responsibilities:
Serve as the security policy partner for AI agent governance, authoring the policies and standards for how agents are built, deployed, operated
Define review and approval criteria when an agent may interact with sensitive or regulated data, and which actions require human approval as it relates to compliance frameworks
Serve as the GRC reviewer within existing engineering approval workflows
Define data governance requirements for agents, including least-privilege access, access reviews, and handling of regulated and sensitive data
Monitor agent behavior over time and adapt governance requirements in partnership with cross-functional security, research and engineering teams
Map agent security and data controls to AI governance frameworks (e.g., ISO 27001, ISO 42001, EU AI Act), strengthening Anthropic's certification efforts ensuring agent security is auditable
Assess and document agent-related security and compliance risks, driving them to resolution with engineering owners
Own the policy for agent-related risk acceptances and exceptions, including approval authority, duration and re-review
You may be a good fit if you:
Have 8+ years in security governance, risk, and compliance, including ownership of security policies and control standards at a technology company
Have owned or meaningfully supported efforts to compartmentalize sensitive data, PII, or intellectual property, and understand how identity and access mechanisms implement or undermine protection boundaries
Think about non-human identities as a distinct risk and control category, and can design least-privilege access and accountability controls for systems acting on a person's behalf
Can reason from a threat model to a control and explain the tradeoff to both an engineer and an auditor
Have defined risk-based review or approval criteria within engineering workflows and kept them effective under high change velocity
Deliver clear, precise written work for both technical and non-technical audiences
Thrive in ambiguous environments with no settled industry playbook, where you're expected to propose the standard rather than wait for one
Are energized by being the security and risk authority who educates and influences outcomes rather than only advises
Strong candidates may also:
Understand the security properties of LLM agents, whether from an AI, developer-platform, or agent-tooling company, or through comparable experience
Bring familiarity with AI governance frameworks alongside traditional security frameworks
Have adapted controls from regulated or highly sensitive environments to an open, high-trust engineering culture
Possess relevant certifications (CISSP, CISM, CRISC, CISA, CCSP, ISO 27001 or ISO 42001 Lead Implementer/Auditor)
Candidates need not have:
Done everything on this list before. Very few people have governed AI agents at scale — we care more about how you reason about access, accountability, and blast radius than about a prior title.
Deadline to apply: None. Applications will be received on a rolling basis.
The annual compensation range for this role is listed below.
For sales roles, the range provided is the role’s On Target Earnings ("OTE") range, meaning that the range includes both the sales commissions/sales bonuses target and annual base salary for the role.
Annual Salary:
$255,000
—
$345,000 USD
Logistics
Minimum education:
Bachelor’s degree or an equivalent combination of education, training, and/or experience
Required field of study:
A field relevant to the role as demonstrated through coursework, training, or professional experience
Minimum years of experience:
Years of experience required will correlate with the internal job level requirements for the position
Location-based hybrid policy:
Currently, we expect all staff to be in one of our offices at least 25% of the time. However, some roles may require more time in our offices.
Visa sponsorship:
We do sponsor visas! However, we aren't able to successfully sponsor visas for every role and every candidate. But if we make you an offer, we will make every reasonable effort to get you a visa, and we retain an immigration lawyer to help with this.
For roles performing work in California:
We will consider for employment all qualified applicants, including those with arrest or conviction records or criminal histories, in a manner consistent with the requirements of applicable state and local laws, including the San Francisco Fair Chance Ordinance, the City of Los Angeles’ Fair Chance Initiative for Hiring Ordinance, the Los Angeles County Fair Chance Ordinance for Employers, and the California Fair Chance Act.
We encourage you to apply even if you do not believe you meet every single qualification.
Not all strong candidates will meet every single qualification as listed. Research shows that people who identify as being from underrepresented groups are more prone to experiencing imposter syndrome and doubting the strength of their candidacy, so we urge you not to exclude yourself prematurely and to submit an application if you're interested in this work. We think AI systems like the ones we're building have enormous social and ethical implications. We think this makes representation even more important, and we strive to include a range of diverse perspectives on our team.
Your safety matters to us.
To protect yourself from potential scams, remember that Anthropic recruiters only contact you from @anthropic.com email addresses. In some cases, we may partner with vetted recruiting agencies who will identify themselves as working on behalf of Anthropic. Be cautious of emails from other domains. Legitimate Anthropic recruiters will never ask for money, fees, or banking information before your first day. If you're ever unsure about a communication, don't click any links—visit
anthropic.com/careers
directly for confirmed position openings.
How we're different
We believe that the highest-impact AI research will be big science. At Anthropic we work as a single cohesive team on just a few large-scale research efforts. And we value impact — advancing our long-term goals of steerable, trustworthy AI — rather than work on smaller and more specific puzzles. We view AI research as an empirical science, which has as much in common with physics and biology as with traditional efforts in computer science. We're an extremely collaborative group, and we host frequent research discussions to ensure that we are pursuing the highest-impact work at any given time. As such, we greatly value communication skills.
The easiest way to understand our research directions is to read our recent research. This research continues many of the directions our team worked on prior to Anthropic, including: GPT-3, Circuit-Based Interpretability, Multimodal Neurons, Scaling Laws, AI & Compute, Concrete Problems in AI Safety, and Learning from Human Preferences.
Come work with us!
Anthropic is a public benefit corporation headquartered in San Francisco. We offer competitive compensation and benefits, optional equity donation matching, generous vacation and parental leave, flexible working hours, and a lovely office space in which to collaborate with colleagues.
Guidance on Candidates' AI Usage:
Learn about
our policy
for using AI in our application process.
Location: Atlanta, Georgia; Toronto, Ontario; Athens, Georgia
Workplace: Hybrid
Artificial Intelligence. Actual Impact.
At Docebo, we’re using AI to change how people learn at work—and we mean actually change it. We’re an AI-powered learning platform that helps organizations create, deliver, and manage training all in one place. But our real mission goes deeper: we help teams move faster, work smarter, and focus on the work that truly matters. Our platform is built with intelligent, time-saving tools that personalize learning, eliminate busywork, and turn training from a checkbox into a superpower. The result? Better experiences for learners and real results for businesses.
We’re shaping the future of learning with a team that isn’t afraid to challenge the status quo. If you're excited by the idea of using AI to make work-life better for real people–you’ll feel right at home here. And it’s not just what we build, it’s how we show up. At Docebo, our values aren’t just posters on the wall—they guide how we work every day. We call it the Docebo Heart: trust by default, assume positive intent, and create space for different perspectives to thrive.
So… what are you waiting for? Join 900+ Docebians around the world and help us reinvent the way people learn, because learning never stops.
THE ADVENTURE AHEAD 🚀
As our Vice President, Information Security, you will step up as the de facto security leader owning Docebo’s global security strategy across product, cloud, GRC, and AI. This is not an advisory tower role; you will operate at executive altitude while staying close to real architecture, engineering decisions, threat modeling, and control execution. You will drive hard, measurable risk reduction while pioneering AI-first security practices that empower our business to move fast with complete confidence.
THE DAY-TO-DAY 🗓️
- Architect Global Strategy: Own and evolve Docebo’s enterprise security roadmap across product security, cloud hardening, GRC, privacy, and incident response to achieve measurable control maturity.
- Embed Security by Design: Partner deeply with Product and Engineering to integrate threat modeling, secure SDLC, CI/CD security, identity controls, and vulnerability remediation into core engineering workflows.
- Pioneer AI-First Security: Build robust governance and controls for AI products and internal tooling while harnessing AI to automate detection, vulnerability management, and threat response.
- Champion Customer Trust: Lead compliance programs (SOC 2, ISO 27001) backed by real controls, and represent Docebo with executive credibility in board updates, audits, and enterprise customer due diligence.
- Elevate Defense Operations: Strengthen security telemetry, threat intelligence, and detection across cloud and corporate environments to protect against emerging modern attack patterns.
- Empower High-Impact Teams: Lead and coach a talented security team, building a high-accountability culture focused on clear outcomes, rapid execution, and continuous learning.
YOUR SUPERPOWERS ⚡
- Proven Executive Leadership: Significant experience leading information security programs in a software, SaaS, or tech product environment with a track record of executive and board collaboration.
- Deep Technical Foundations: Hands-on mastery of application security, cloud security (AWS), infrastructure, identity systems, secure SDLC, and modern vulnerability management.
- Mandatory Certification: Active CISSP credential backed by a deep understanding of SOC 2, ISO 27001, privacy regulations, and enterprise SaaS security standards.
- Collaborative Business Driver: Exceptional ability to forge trusted partnerships across Product, Engineering, Legal, and Sales, acting as an enabler who balances security with business velocity.
- Outcome-Focused Execution: A clear track record of using metrics and business risk language to make decisive, risk-informed choices in complex, ambiguous environments.
BONUS POINTS 🎯
- AI Security Expertise: Hands-on experience securing AI-enabled products and LLMs, or utilizing AI tools to scale security operations and automated testing.
- Advanced Technical Certifications: Additional credentials such as CISM, CISA, CCSP, AWS Security Specialty, or GIAC, combined with offensive security or red teaming experience.
- Enterprise & Public Sector Reach: Proven experience navigating FedRAMP standards, public-sector requirements, and high-growth global SaaS expansion.
OUR HYBRID WORK PHILOSOPHY 🤝
Great work can happen anywhere but coming together helps us go further. Our team spends three days a week in the office (Tuesday-Thursday) to collaborate, solve problems, and learn from each other. With flexibility the rest of the week, it’s a balance designed to help everyone do their best work and keep growing.
OUR TOTAL REWARDS PHILOSOPHY 🎉
Our Total Rewards Philosophy centers around three core areas to reward and care for our People:
- Rewarding Impact: We lead with competitive pay to reward the impact, skills and traits that fuel our success.
- Fostering Holistic Wellbeing: We care deeply about and invest in the whole person with programs that support our people’s physical, mental, and financial well-being.
- Empowering Our Talent Culture: We build a culture of trust and empowerment by designing our rewards and benefits with transparency, equity, and flexibility, enabling our people to do their best work and stay for the long haul.
OUR PROMISE TO YOU 😍
- Financial Wellness: Own a piece of Docebo through our Employee Share Purchase Plan (ESPP) at a 15% discount, plus a competitive compensation package.
- Your Well-Being, Covered: You’ll get access to health benefits, so you can get the care you need when you need it.
- Rest, Relax, Repeat: Rest and recharge with paid vacation days, two company-wide Docebo Days, floating holidays for cultural celebrations, and your birthday off!
- Family First: We provide coverage offering you time with your little one(s) so you can soak up all those precious moments. Fun fact: we had 30 Docebian babies join the family in 2025!
- Connections That Count: Connect with global communities through our Employee Resource Groups (including PRIDE, DWA, BIDOC, and Green Ambassadors) and company-wide events that keep the fun rolling all year long.
ABOUT DOCEBO 💙
At Docebo, we create seamless, AI-powered learning experiences for over 3,000 customers worldwide. We have successfully achieved two IPOs (TSX: DCBO & NASDAQ: DCBO https://www.docebo.inc/home/default.aspx), been recognized as a top SaaS e-learning solution, and are growing exponentially in the process. We're a global company, with office across North America, EMEA, APAC, and beyond. Our team is guided by five core values—Grow Together Win Together, Build with Our Customer, Clear is Kind, Own Outcomes, Progress Over Perfection—that shape everything we do. If this resonates with you, now is the perfect time to join one of the fastest-growing learning technology companies in the world.
Docebo is an Equal Employment Opportunity employer https://www.eeoc.gov/sites/default/files/2022-10/EEOC_KnowYourRights_screen_reader_10_20.pdf. We are committed to diversity and inclusion in our workforce. All qualified applicants and employees will receive consideration for employment regardless of their race, colour, religion, sex (including pregnancy, gender identity, and sexual orientation), national origin, citizenship status, age, disability, genetic information, or any other category protected under applicable law.
As a federal contractor, Docebo is committed to the principles of affirmative action and equal employment opportunity for protected veterans and individuals with disabilities. Docebo does not discriminate because of protected veteran status or on the basis of disability, and Docebo takes affirmative action to employ and advance in employment qualified protected veterans and individuals with disabilities.
Any individuals requiring a reasonable accommodation or would like to voluntarily disclose a disability or protected veteran status to assist with their employment application should send an e-mail to their recruiter directly.
Location: IN - Jaipur
About the Role
iCapital is seeking an Assistant Vice President, Internal Controls Readiness, to support the Enterprise Risk Management program an to be based out of the Jaipur office. This individual will provide hands-on support to the audit team throughout the audit lifecycle, ensuring that evidence, testing, documentation and follow-up activities are completed accurately and on schedule. The individual will demonstrate the ability to independently apply the department’s audit methodology. They will participate in all phases of the audit from planning to reporting, including understanding business operations, scoping the audit, identifying risks and controls, designing and executing testing with minimal oversight and assisting with the writing of audit reports This position will collaborate with senior leadership and cross-functional teams to drive audit excellence and a strong control environment.
The Individual: The ideal candidate will excel in navigating a complex stakeholder landscape while managing concurrent tactical and strategic initiatives. They will possess the ability to perform assessments of IT General Controls and prepare appropriate working papers, including gathering information around understanding the IT environmental and requesting data to support these activities and assist in the Third-Party Vendor audit reports reviews. This individual will maintain a proactive and logical approach to information gathering and present complex ideas through clear communications.
Responsibilities
Control Library: Maintain a Control Library aligned with the Risk Register with relevant control attributes.
Control Design: Design and implement tests to assess the effectiveness of internal controls and compliance with regulatory standards.
Control Testing: Perform control testing across financial, operational, and IT domains, including walkthroughs, re-performance, inspection, and observation techniques.
Control Findings: Review and evaluate evidence to identify control deficiencies and recommend remediation strategies.
Control Management: Collaborate with cross-functional teams to address audit findings and implement corrective actions.
Third Party Review: Perform vendor risk assessments and review third-party control reports from an IT risk standpoint.
GRC Tool: Support the development and enhancement of reporting tools and dashboards
Issue Tracking: Develop and implement mechanisms for issue, complaint, and incident reporting to identify errors and remediate root causes.
Compliance: Ensure compliance with regulatory requirements and industry best practices related to audit.
Qualifications
Education: Bachelor’s degree in Information Technology, Computer Science, Accounting, Finance, Cybersecurity, Internal Audit or related discipline.
Experience
: 6+ years of experience
in IT audit, internal audit, IT risk, compliance or information security.
Presence: Strong work ethic, resourceful disposition, and solutions-oriented mindset with interpersonal skills that enhance partner capacity.
Attributes: Adaptable and entrepreneurial; a willingness to roll up sleeves and get stuff done.
Skill: Exceptional organizational, time management, and written and verbal communication skills. Proficiency in audit management software (e.g., ACL, IDEA) and Microsoft Office Suite
Knowledge: Strong understanding of audit and control frameworks, operational risk assessment methodologies, and industry regulatory compliance requirements.
Experience: Experience with IT General Controls with regards to Logical Access, Change Management, IT Operations testing.
We believe the best ideas and innovation happen when we are together. Employees in this role will work in the office four days, with the flexibility to work remotely one day (Friday).
Benefits
iCapital offers a comprehensive benefits package that includes a total compensation program consisting of competitive salary, annual performance bonus, and equity for all full-time employees; healthcare with 100% employer-paid health and dental insurance; and generous paid time off (PTO).
For additional information on iCapital Network, please visit
https://www.icapitalnetwork.com/about-us
Twitter: @icapitalnetwork | LinkedIn:
https://www.linkedin.com/company/icapital-network-inc
Location: Hong Kong, Hong Kong SAR
Who We Are
At OKX, we believe that the future will be reshaped by crypto, and ultimately contribute to every individual's freedom.
OKX is a leading crypto exchange, and the developer of OKX Wallet, giving millions access to crypto trading and decentralized crypto applications (dApps). OKX is also a trusted brand by hundreds of large institutions seeking access to crypto markets. We are safe and reliable, backed by our Proof of Reserves.
Across our multiple offices globally, we are united by our core principles:
We Before Me
,
Do the Right Thing
, and
Get Things Done
. These shared values drive our culture, shape our processes, and foster a friendly, rewarding, and diverse environment for every OK-er.
OKX is part of OKG, a group that brings the value of Blockchain to users around the world, through our leading products OKX, OKX Wallet, OKLink and more.
About the Opportunity
We are seeking a highly motivated Technology and Security Risk Manager within the Second Line of Defence (2LOD).
You will be responsible for continuously refining and scaling the Technology and Security oversight program, guiding first-line of defence (1LOD) execution, and providing independent risk challenge.
You will be a key member of OKX's Risk team, helping to shape and scale the firm’s 2LOD Security & Data Risk programs. You’ll work closely with stakeholders including Engineering, Product, Risk, Compliance and Internal Audit.
You will play a key role in developing and implementing a comprehensive Technology and Security Risk Management program. This includes 2LOD oversight of technology defects, issues, and incidents, Risk and Control Self-Assessments (RCSA), key risk indicators (KRIs) and reporting.
The ideal candidate has a strong understanding of Technology Risk (including Technology Resilience, Change Management, SDLC, CI/CD pipeline, and software quality assurance) and Cybersecurity (covering internal and external threat vectors, control weaknesses, and organisational cyber hygiene). We are looking for a candidate with a strong drive for improvement and career growth.
What You’ll Be Doing
Collaborate with internal stakeholders across the company to proactively identify, escalate, assess, and mitigate Technology and Security risks, ensuring adherence to the Technology Risk Policy.
Providing oversight of Technology and Security Risk incidents and issues, and partnering with 1LOD stakeholders to enhance related processes and ensure effective oversight
Lead the Technology Risk and Control Self-Assessment (RCSA) process from a 2LOD perspective, ensuring adherence to the ERM RCSA methodology, and providing effective challenge and oversight of 1LOD Security risks and controls.
Support the Security Key Risk Indicators (KRIs) definition, monitoring, and reporting.
Supporting the implementation and ongoing enhancement of Governance, Risk, and Compliance (GRC) systems to enable effective risk oversight
Advocate and support the implementation of Risk Management frameworks for technology stakeholders, serving as a trusted advisor for the first line.
Stay up to date on emerging trends and regulations in the digital asset space, proactively identifying and addressing new risk considerations.
What We Look For In You
8+ years in information security, with a strong security architecture or technical security background; fintech, crypto or cloud-native experience preferred.
Practical experience designing, implementing or reviewing cloud, IAM, cryptographic, network or application security controls.
Experience in risk oversight, or readiness to transition, with the technical judgement to challenge controls and recommend proportionate improvements.
Ability to threat-model systems and assess technical evidence, including architecture diagrams, IAM policies, logging configurations and dependencies.
Working knowledge of cloud resilience, multi-region/AZ failover, RTO/RPO and disaster recovery testing.
Familiarity with NIST CSF, ISO 27001, SOC 2 and relevant privacy requirements, including GDPR and PDPA, and their application to technical controls.
Ability to independently assess and test controls, evaluate incidents and drive remediation with engineering and security teams; GRC platform experience desirable.
Clear written and verbal communication, translating technical findings into prioritised actions for business stakeholders and governance committees.
Strong stakeholder management skills, providing constructive challenge and collaborating across functions and geographies.
A proactive, adaptable approach, with confidence taking ownership and improving practices in a fast-paced environment.
A relevant degree or equivalent practical experience; CISSP, CCSP, cloud security/architecture, CISA or CISM qualifications desirable.
Perks & Benefits
Competitive total compensation package
L&D programs and Education subsidy for employees' growth and development
Various team building programs and company events
Wellness and meal allowances
Comprehensive healthcare schemes for employees and dependants
More that we love to tell you along the process!
Please note that Hong Kong is a group-level service hub, and OKX does not carry on a business of operating a virtual asset trading platform in Hong Kong
.
Notice:
All official
OKX
vacancies are published on this website.
While roles may appear on selected third-party platforms from time to time, information on other sites may be inaccurate or outdated.
If in doubt, please apply directly through our official careers website.
Information collected and processed as part of the recruitment process of any job application you choose to submit is subject to
OKX
's
Candidate Privacy Notice
.
Location: Singapore, Singapore
Who We Are
At OKX, we believe that the future will be reshaped by crypto, and ultimately contribute to every individual's freedom.
OKX is a leading crypto exchange, and the developer of OKX Wallet, giving millions access to crypto trading and decentralized crypto applications (dApps). OKX is also a trusted brand by hundreds of large institutions seeking access to crypto markets. We are safe and reliable, backed by our Proof of Reserves.
Across our multiple offices globally, we are united by our core principles:
We Before Me
,
Do the Right Thing
, and
Get Things Done
. These shared values drive our culture, shape our processes, and foster a friendly, rewarding, and diverse environment for every OK-er.
OKX is part of OKG, a group that brings the value of Blockchain to users around the world, through our leading products OKX, OKX Wallet, OKLink and more.
About the Opportunity
We are seeking a highly motivated Technology and Security Risk Manager within the Second Line of Defence (2LOD).
You will be responsible for continuously refining and scaling the Technology and Security oversight program, guiding first-line of defence (1LOD) execution, and providing independent risk challenge.
You will be a key member of OKX's Risk team, helping to shape and scale the firm’s 2LOD Security & Data Risk programs. You’ll work closely with stakeholders including Engineering, Product, Risk, Compliance and Internal Audit.
You will play a key role in developing and implementing a comprehensive Technology and Security Risk Management program. This includes 2LOD oversight of technology defects, issues, and incidents, Risk and Control Self-Assessments (RCSA), key risk indicators (KRIs) and reporting.
The ideal candidate has a strong understanding of Technology Risk (including Technology Resilience, Change Management, SDLC, CI/CD pipeline, and software quality assurance) and Cybersecurity (covering internal and external threat vectors, control weaknesses, and organisational cyber hygiene). We are looking for a candidate with a strong drive for improvement and career growth.
What You’ll Be Doing
Collaborate with internal stakeholders across the company to proactively identify, escalate, assess, and mitigate Technology and Security risks, ensuring adherence to the Technology Risk Policy.
Providing oversight of Technology and Security Risk incidents and issues, and partnering with 1LOD stakeholders to enhance related processes and ensure effective oversight
Lead the Technology Risk and Control Self-Assessment (RCSA) process from a 2LOD perspective, ensuring adherence to the ERM RCSA methodology, and providing effective challenge and oversight of 1LOD Security risks and controls.
Support the Security Key Risk Indicators (KRIs) definition, monitoring, and reporting.
Supporting the implementation and ongoing enhancement of Governance, Risk, and Compliance (GRC) systems to enable effective risk oversight
Advocate and support the implementation of Risk Management frameworks for technology stakeholders, serving as a trusted advisor for the first line.
Stay up to date on emerging trends and regulations in the digital asset space, proactively identifying and addressing new risk considerations.
What We Look For In You
8+ years in information security, with a strong security architecture or technical security background; fintech, crypto or cloud-native experience preferred.
Practical experience designing, implementing or reviewing cloud, IAM, cryptographic, network or application security controls.
Experience in risk oversight, or readiness to transition, with the technical judgement to challenge controls and recommend proportionate improvements.
Ability to threat-model systems and assess technical evidence, including architecture diagrams, IAM policies, logging configurations and dependencies.
Working knowledge of cloud resilience, multi-region/AZ failover, RTO/RPO and disaster recovery testing.
Familiarity with NIST CSF, ISO 27001, SOC 2 and relevant privacy requirements, including GDPR and PDPA, and their application to technical controls.
Ability to independently assess and test controls, evaluate incidents and drive remediation with engineering and security teams; GRC platform experience desirable.
Clear written and verbal communication, translating technical findings into prioritised actions for business stakeholders and governance committees.
Strong stakeholder management skills, providing constructive challenge and collaborating across functions and geographies.
A proactive, adaptable approach, with confidence taking ownership and improving practices in a fast-paced environment.
A relevant degree or equivalent practical experience; CISSP, CCSP, cloud security/architecture, CISA or CISM qualifications desirable.
Perks & Benefits
Competitive total compensation package
L&D programs and Education subsidy for employees' growth and development
Various team building programs and company events
Wellness and meal allowances
Comprehensive healthcare schemes for employees and dependants
More that we love to tell you along the process!
Notice:
All official
OKX
vacancies are published on this website.
While roles may appear on selected third-party platforms from time to time, information on other sites may be inaccurate or outdated.
If in doubt, please apply directly through our official careers website.
Information collected and processed as part of the recruitment process of any job application you choose to submit is subject to
OKX
's
Candidate Privacy Notice
.
Location: Remote, United States
GitLab is the intelligent orchestration platform for DevSecOps. GitLab enables organizations to increase developer productivity, improve operational efficiency, reduce security and compliance risk, and accelerate digital transformation. More than 50 million registered users and more than 50% of the Fortune 100* trust GitLab to ship better, more secure software faster.
The same principles built into our products are reflected in how our team works: we embrace AI as a core productivity multiplier, with all team members expected to incorporate AI into their daily workflows to drive efficiency, innovation, and impact. GitLab is where careers accelerate, innovation flourishes, and every voice is valued. Our high-performance culture is driven by our values and continuous knowledge exchange, enabling our team members to reach their full potential while collaborating with industry leaders to solve complex problems.
Co-create the future with us
as we build technology that transforms how the world develops software.
*
Fortune 500® is a registered trademark of Fortune Media IP Limited, used under license. Claim based on GitLab data. Fortune 100 refers to the top 20% ranked companies in the 2025 Fortune 500 list, published in June 2025. Fortune and Fortune Media IP Limited are not affiliated with, and do not endorse products or services of GitLab.
An overview of this role
As a Staff Security Governance Engineer, you will be the individual contributor who owns how GitLab writes, maintains, communicates, and measures its security policies and standards. You will turn emerging regulations, including AI regulation, into clear requirements that engineering, product, and legal teams can act on, and you will use automation to keep governance lightweight and continuous rather than a point-in-time exercise. You will sit on the Security Governance team within Security Assurance and work closely with Security Compliance, Security Risk, and GRC Engineering. You will report to the Director, Customer Trust & Security Governance.
What you'll do
Policies and standards
Own the end-to-end lifecycle of GitLab's security policies, standards, procedures, and guidelines: drafting, stakeholder review, approval, publication, annual review, and retirement.
Define and run the exception management process, including risk-based approvals, expiry tracking, and trend reporting that shows where policies need to change.
Run policy attestation and investigate non-adherence.
Keep policies clear, practical, and aligned with how GitLab's engineering teams work in a DevSecOps environment.
Regulatory and framework alignment
Monitor emerging regulations and standards (e.g., EU AI Act, NIST AI RMF, ISO 42001, sector or regional requirements) and partner with Legal well ahead of compliance deadlines to assess impact and update policy.
Maintain mappings between our policies and frameworks such as SOC 2, ISO 27001, ISO 42001, FedRAMP, and NIST CSF, so requirements are written once and reused.
Measurement and assurance
Define KPIs for policy adherence and report trends to Security leadership.
Run targeted internal assessments of adherence and drive remediation to closure.
Support audit activities by coordinating evidence, testing, and remediation management.
Customer trust
Support customer questionnaires and customer meetings, and help turn recurring customer requests into better policies and self-service content.
Automation and AI
Identify and implement automation and AI-assisted workflows for policy management, evidence collection, control monitoring, and assessment work, in partnership with GRC Engineering.
Technical leadership
Act as a technical and program leader across Security, Product, Legal, and Engineering, influencing without direct authority.
Mentor other team members and help set the direction of the Security Governance roadmap.
What you'll bring
10+ years in security governance, GRC, or IT risk, with hands-on ownership of a policy and standards lifecycle and measurable outcomes, ideally at a global technology company.
Working knowledge of SOC 2, ISO 27001, ISO 42001, FedRAMP, and NIST CSF, including how to put them into practice, not only how to read them
Experience creating and maintaining an enterprise Information Security Management System (ISMS), ideally including hands on involvement in ISO 27001 certification or recertification.
Understanding of cloud, SaaS, and DevSecOps practices, and the ability to write policy that engineers will follow.
A risk-based mindset that balances compliance with real security risk.
Demonstrated use of automation or AI to reduce manual GRC work.
Strong written and verbal communication, including translating technical concepts for engineers, executives, auditors, and customers.
Experience collaborating with Security, Product, Legal, and Engineering.
Certifications such as CISSP, CISM, CISA, or similar are highly desirable.
What success looks like
First 30 days: Assessed the current policy library and exception process, built relationships with key stakeholders, and proposed a prioritized roadmap.
First 90 days: Uplift the existing security policy library to align with NIST CSF, ISO 27001/27017/27018/42001, and PCI-DSS.
First 120 days: A refreshed review cadence is in place, exception reporting is running, and can demonstrate a measurable improvement in policy adherence.
First six months: Develop Policy as Code and collaborate with Security, Product, Legal, and Engineering for implementation into existing workflows.
About the team
The Security Assurance organization helps GitLab build and maintain trust by strengthening how we approach security, compliance, and risk. Security Governance sits within it and owns customer trust, security awareness, policies and standards, and other governance functions. Our counterparts are Security Compliance, Security Risk, and GRC Engineering.
You will join a small team of four direct reports under the Director, where each person has broad scope and visible impact. We work remote-first and asynchronously, and we write things down and share them openly, so you'll draft and revise policies and standards in the open with input from Security, Legal, Product, and Engineering.
The base salary range for this role’s listed level is currently for residents of the United States only. This range is intended to reflect the role's base salary rate in locations throughout the US. Grade level and salary ranges are determined through interviews and a review of education, experience, knowledge, skills, abilities of the applicant, equity with other team members, alignment with market data, and geographic location. The base salary range does not include any bonuses, equity, or benefits. See more information on our
benefits
and
equity
. Sales roles are also eligible for incentive pay targeted at up to 100% of the offered base salary.
United States Salary Range
$168,000
—
$238,000 USD
How GitLab Supports Full-Time Employees
Benefits to support your health, finances, and well-being
Flexible Paid Time Off
Team Member Resource Groups
Equity Compensation & Employee Stock Purchase Plan
Growth and Development Fund
Parental Leave
Please note that we welcome interest from candidates with varying levels of experience; many successful candidates do not meet every single requirement. Additionally, studies have shown that people from
underrepresented groups
are less likely to apply to a job unless they meet every single qualification. If you're excited about this role, please apply and allow our recruiters to assess your application.
Country Hiring Guidelines:
GitLab hires new team members in countries around the world. All of our roles are remote, however some roles may carry specific location-based eligibility requirements. Our Talent Acquisition team can help answer any questions about location after starting the recruiting process.
Privacy Policy:
Please review our
Recruitment Privacy Policy.
Your privacy is important to us.
GitLab is proud to be an equal opportunity workplace and is an affirmative action employer. GitLab’s policies and practices relating to recruitment, employment, career development and advancement, promotion, and retirement are based solely on merit, regardless of race, color, religion, ancestry, sex (including pregnancy, lactation, sexual orientation, gender identity, or gender expression), national origin, age, citizenship, marital status, mental or physical disability, genetic information (including family medical history), discharge status from the military, protected veteran status (which includes disabled veterans, recently separated veterans, active duty wartime or campaign badge veterans, and Armed Forces service medal veterans), or any other basis protected by law. GitLab will not tolerate discrimination or harassment based on any of these characteristics. See also
GitLab’s EEO Policy
and
EEO is the Law
. If you have a disability or special need that requires
accommodation
, please let us know during the
recruiting process
.
Location: Brazil
Workplace: remote
About CertiK
Born from groundbreaking research at Columbia and Yale, CertiK has grown to become the largest Web3 security platform, combining proprietary models with comprehensive security solutions and end-to-end toolkits to support the full lifecycle of Web3 development. Founded in 2017 and headquartered in New York City, CertiK provides a wide range of services including smart contract audits, penetration testing, on-chain monitoring, incident response, and compliance solutions for some of the largest projects and institutions in the digital asset ecosystem.
Responsibilities
Build, deepen and manage relationships with banks, brokers, asset managers, payment institutions and fintechs entering digital assets in Brazil and LATAM
Map each institution's digital asset roadmap and regulatory obligations, and position CertiK's solutions accordingly. These include security assessments, custody and infrastructure audits, penetration testing, monitoring, and compliance tooling
Lead complex, multi-stakeholder sales cycles with CISOs, CTOs, compliance, risk, innovation and legal teams through to close
Represent CertiK at industry events, associations (e.g. Febraban, ABBC, ABFintechs, ABToken, ANBIMA) and executive forums; speak on panels when relevant
Navigate institutional politics: understand who decides, who influences and how procurement actually works
Work with CertiK's technical, advisory and product teams to shape proposals that fit institutional requirements
Share market intelligence to inform CertiK's regional strategy and product roadmap
Requirements
10+ years
in financial services, fintech, consulting, technology or infrastructure sales, serving financial institutions in Brazil
An
established, active network
at C-level and senior management in Brazilian banks and financial institutions. You can get a meeting in weeks, not months
A track record of closing and expanding
enterprise relationships
with long cycles and multiple stakeholders
Executive presence: comfortable in boardrooms, with regulators and on stage
Political acumen and the patience to build relationships over time
Solid understanding of the Brazilian regulatory landscape (BCB, CVM) and how institutions handle compliance
Fluent Portuguese and professional English; Spanish is a plus
Web3 or cybersecurity experience is not required.
Curiosity and willingness to learn are. We will give you the technical backing
Bonus Points
Experience selling to CISOs, risk or compliance functions (GRC, cybersecurity, audit, regtech, core banking, payments)
Background at a Big Four firm, bank, core banking/payments vendor, or regulatory consultancy
Network across other LATAM markets (Mexico, Chile, Colombia, Argentina)
Location: Remote, Canada; Remote, United States
GitLab is the intelligent orchestration platform for DevSecOps. GitLab enables organizations to increase developer productivity, improve operational efficiency, reduce security and compliance risk, and accelerate digital transformation. More than 50 million registered users and more than 50% of the Fortune 100* trust GitLab to ship better, more secure software faster.
The same principles built into our products are reflected in how our team works: we embrace AI as a core productivity multiplier, with all team members expected to incorporate AI into their daily workflows to drive efficiency, innovation, and impact. GitLab is where careers accelerate, innovation flourishes, and every voice is valued. Our high-performance culture is driven by our values and continuous knowledge exchange, enabling our team members to reach their full potential while collaborating with industry leaders to solve complex problems.
Co-create the future with us
as we build technology that transforms how the world develops software.
*
Fortune 500® is a registered trademark of Fortune Media IP Limited, used under license. Claim based on GitLab data. Fortune 100 refers to the top 20% ranked companies in the 2025 Fortune 500 list, published in June 2025. Fortune and Fortune Media IP Limited are not affiliated with, and do not endorse products or services of GitLab.
An overview of this role
GitLab's Security Risk function is responsible for reducing risk across the security division: third-party risk (TPRM), annual security risk assessments, quarterly risk reporting, and remediation of security findings. As a Senior Security Risk Engineer, you'll take ownership of risk identification, quantification, and remediation tracking across the business, and you'll be a driving force behind automating and modernizing how the team does this work using AI and scripting. Reporting to the Security Risk Manager, you will bring expertise on risk methodology, risk-based thinking, and AI-enablement.
In this role, you'll partner closely with Security, Legal, IT, Product, and Engineering to translate technical findings and vendor risk into business-relevant risk statements and risk treatments. You’ll help surface emerging risks, and report top risks to leadership.
Some examples of our projects:
Building and maintaining a risk register that translates technical vulnerabilities, control gaps, and third-party risk findings into quantified, business-relevant risk statements.
Driving cross-functional remediation of security findings and risk issues to closure, tracked against SLAs.
Driving automation and AI-enabled improvements for risk and GRC workflows so the team can spend less time on manual work and more time on high-value risk analysis and program maturity.
What you'll do
Own risk identification, analysis, and prioritization across third-party risk (TPRM), security risk assessments, and security findings, using an established risk framework (e.g., NIST RMF, ISO 31000, or NIST 800-39).
Translate technical vulnerabilities, control gaps, and risk findings into clear, quantified risk statements that non-security stakeholders and leadership can act on.
Drive remediation of findings and risk exceptions to closure, partnering with Engineering, IT, Product, and Legal, and escalating stalled or high-severity items.
Mature and maintain a risk register and quarterly reporting cadence that gives leadership clear visibility into open risk, remediation progress, and trends.
Own and mature AI risk management, including AI impact assessments, AI risk assessments, and risk treatments, to support ISO 42001 certification.
Design, develop, and implement key risk indicators and supporting metrics for top risks in the risk register.
Identify manual, repetitive steps in risk and TPRM workflows and personally build the automation, scripting, or AI-enabled tooling to remove them.
Contribute to the roadmap for the risk program, incorporating new frameworks, regulatory changes, and lessons learned from past assessments.
Monitor the internal and external risk landscape (new frameworks, threat trends, business changes) to identify and escalate emerging risks before they become findings.
What you'll bring
5+ years of experience in security risk management, working with security-centric risk management or compliance frameworks (e.g., NIST RMF, NIST 800-39, ISO 31000). Familiarity with AI governance frameworks (e.g., ISO 42001, NIST AI RMF) is a plus.
Experience designing and executing qualitative and quantitative risk analyses that translate technical risks into measurable business impact.
A track record of driving risk assessments, risk registers, and remediation efforts to closure across IT, Procurement, Internal Audit, Legal, Product, and Engineering, in a heavily regulated or multi-entity environment.
Experience interpreting technical control requirements and translating them for both technical and non-technical stakeholders.
Demonstrated bias toward automation: you've personally built scripts, workflows, or AI-enabled tooling that reduced manual risk or GRC work, not just evaluated tools conceptually.
Comfort operating with ambiguity, managing multiple concurrent assessments, and reprioritizing under tight deadlines.
Exceptional written and verbal communication skills with demonstrated ability to translate security risks into business risks.
Strong understanding of cloud security, SaaS security models, and DevSecOps practices.
Relevant certifications (e.g., CISSP, CISM, CISA, CRISC) are preferred but not required.
About the team
The
Security Assurance
organization helps GitLab build and maintain trust by strengthening how we approach security, compliance, and risk across the company. The Security Risk team sits within that group and owns third-party risk (TPRM), security risk assessments, and remediation of security findings. The Security Risk Team performs thorough, collaborative, and efficient risk assessments as well as drive risk reduction so that GitLab can achieve its goals while maintaining a high level of security. Security Risk counterparts are Security Compliance, Security Governance and Security Enablement functions.
The base salary range for this role’s listed level is currently for residents of the United States only. This range is intended to reflect the role's base salary rate in locations throughout the US. Grade level and salary ranges are determined through interviews and a review of education, experience, knowledge, skills, abilities of the applicant, equity with other team members, alignment with market data, and geographic location. The base salary range does not include any bonuses, equity, or benefits. See more information on our
benefits
and
equity
. Sales roles are also eligible for incentive pay targeted at up to 100% of the offered base salary.
United States Salary Range
$139,200
—
$189,000 USD
How GitLab Supports Full-Time Employees
Benefits to support your health, finances, and well-being
Flexible Paid Time Off
Team Member Resource Groups
Equity Compensation & Employee Stock Purchase Plan
Growth and Development Fund
Parental Leave
Please note that we welcome interest from candidates with varying levels of experience; many successful candidates do not meet every single requirement. Additionally, studies have shown that people from
underrepresented groups
are less likely to apply to a job unless they meet every single qualification. If you're excited about this role, please apply and allow our recruiters to assess your application.
Country Hiring Guidelines:
GitLab hires new team members in countries around the world. All of our roles are remote, however some roles may carry specific location-based eligibility requirements. Our Talent Acquisition team can help answer any questions about location after starting the recruiting process.
Privacy Policy:
Please review our
Recruitment Privacy Policy.
Your privacy is important to us.
GitLab is proud to be an equal opportunity workplace and is an affirmative action employer. GitLab’s policies and practices relating to recruitment, employment, career development and advancement, promotion, and retirement are based solely on merit, regardless of race, color, religion, ancestry, sex (including pregnancy, lactation, sexual orientation, gender identity, or gender expression), national origin, age, citizenship, marital status, mental or physical disability, genetic information (including family medical history), discharge status from the military, protected veteran status (which includes disabled veterans, recently separated veterans, active duty wartime or campaign badge veterans, and Armed Forces service medal veterans), or any other basis protected by law. GitLab will not tolerate discrimination or harassment based on any of these characteristics. See also
GitLab’s EEO Policy
and
EEO is the Law
. If you have a disability or special need that requires
accommodation
, please let us know during the
recruiting process
.
Задачи:
— Помогать проектировать, выполнять и постоянно улучшать взаимодействия с клиентами по модели масштабируемого Customer Success: новые клиенты/ввод в эксплуатацию, проверки состояния, продления, проактивные обращения
— Владеть конкретными процессами или программами в модели, от проектирования до исполнения и измерения
— Принимать решения по нестандартным ситуациям, отличая те, что подходят под сценарий, требуют творческого решения или эскалации
— Проектировать и вести массовые взаимодействия с клиентами: вебинары, цифровые кампании, масштабные коммуникации
— Выявлять закономерности в взаимодействиях с клиентами и переводить их в улучшения процессов
— Поддерживать техническую компетентность, уверенно говорить о сервисах Expel, операциях безопасности и типовых интеграциях
— Обучать и наставлять младших сотрудников по исполнению процессов и работе с клиентами
— Вносить вклад в проектирование операционной модели масштабирования: требования к системам, автоматизация, метрики
Требования:
— Опыт работы в Customer Success, управлении аккаунтами или взаимодействии с клиентами не менее 2 лет
— Минимум 2 года опыта в сфере безопасности (операции, продукты, консалтинг, GRC, реагирование на инциденты)
— Желателен опыт работы в масштабируемой или цифровой модели Customer Success
— Опыт проектирования или значительного улучшения клиентских процессов или сценариев
— Уверенность в работе с большим объемом задач и частой сменой контекста
— Отличные письменные коммуникативные навыки, адаптация под разные сегменты клиентов
— Умение принимать решения по применимости сценариев, творческим решениям и эскалации
— Глубокое понимание безопасности: MDR, EDR, SIEM, NDR, облачная безопасность и построение программ безопасности
— Знакомство с платформами Customer Success, системами тикетов и инструментами автоматизации, с мнением о том, что работает
Условия:
— Годовая зарплата от $93,900 до $136,200 плюс бонусы и акции
— Неограниченный оплачиваемый отпуск, гибкость в выборе места работы
— До 24 недель отпуска по уходу за ребенком
— Отличные медицинские льготы
— Требование иметь разрешение на работу в США
— Компания обеспечивает равные возможности и поддержку для людей с инвалидностью
Location: UNITED STATES - Remote, LATAM - Remote, EMEA - Remote
Please note that we are unable to consider applications from candidates based in France, Italy, or Germany for this role.
Money is moving onto the internet, and the shift has a name:
Open Money.
This is money that is open, portable, agentic, and owned by you. MetaMask spent the last ten years building it; with 100M+ downloads, users in ~190 countries, and trillions in cumulative transaction volume, it's the most trusted self-custodial financial platform on the internet. Now we're building the operating system for your money: one place to hold, move, grow, and use anything you own. Join a remote-first, global team rebuilding how money works: a problem that touches everyone, every day.
About the role
This role runs the internal posture engine — the risk register, critical control monitoring, evidence, audit operations and GRC tooling. It keeps risk state current so the Lead and the Risk Committee decide from accurate data in the Risk Dashboard and reporting. Drata is the register of record. Named owners close gaps; this role keeps the register, evidence and audit operations current.
Responsibilities
Planning
Operate the risk register from the Security Programme threat model: populate, track treatment, record acceptance decisions, follow up owners, and run the exceptions register.
Keep the ISMS and security policy library current as part of audit readiness. Draft security standards when commissioned by the Lead.
Run Drata as the control and evidence system — Statement of Applicability, framework crosswalk and automation.
Execution
Run critical control monitoring: health check-ins, drift flags and Drata automation. Route drift to the SOC. Maintain the evidence file for Lead assessments and independent internal audit.
Feed threat-assessment findings into the register and confidence ratings. Track which required assessments are current.
Lead audit coordination and preparation: ISO 27001 and SOC 2 logistics, ISMS readiness, team prep, management-review pack, and customer due-diligence questionnaires.
Coordinate the control register for external testing (red team, tabletop, pentest). Run security awareness and weekly alerts.
Tracking and evaluating performance
Track residual risk, exceptions and gap-closure against appetite. Exceptions expire and are reported; the underlying requirement stays in force.
Report register state and evidence health so the Lead and Risk Committee work from one view.
Achieving overall defined performance
Be accountable for a current, defensible posture engine — register, evidence and audit operations.
Ensure Drata collects evidence continuously, with automated evidence where coverage exists.
Qualifications
Hands-on experience running a risk register, control library and audit cycle (ISO 27001 and/or SOC 2).
Comfortable with GRC platforms (Drata or equivalent) and turning monitoring into evidence.
Proven ability to coordinate audits and customer questionnaires with named control owners.
Precise written work; register and Statement of Applicability quality matters.
Strong stakeholder management with control owners and auditors.
CISA, ISO 27001 Lead Implementer or Auditor, or equivalent professional certification.
Don't meet all the requirements? Don't sweat it. We’re passionate about building a diverse team of humans and as such, if you think you've got what it takes for our chaotic-but-fun, remote-friendly, start-up environment—apply anyway, detailing your relevant transferable skills in your cover letter. While we have a pretty good idea of what we need, we're ready for you to challenge our thinking on who needs to be in this role
.
The salary range listed for this role applies to US-based candidates only. Compensation for candidates based outside the US (including Canada, EMEA, and LATAM) will be determined based on location, experience, and skills during the interview process, and may differ from the listed US range.
US pay range (not including bonus, equity or other benefits)
$150,000
—
$206,000 USD
In the rapidly evolving Web3 space, we believe that everyone is a builder. This expansive paradigm requires a range of backgrounds, talents, skills, and experiences to influence and shape the future. At MetaMask, this diversity fuels our ability to shift control and redefine the realm of possibility. We are committed to ensuring that our technology empowers people and communities through decentralized technologies. We welcome the range of perspectives and differences and celebrate them. We're excited to see how your unique skills as a builder can contribute to our vision, drive innovation, and help us shape a more inclusive Web3.
MetaMask is an equal opportunity employer. All employment decisions are made without regard to race, color, national origin, ancestry, sex, gender, gender identity or expression, sexual orientation, age, genetic information, religion, disability, medical condition, pregnancy, marital status, family status, veteran status, or any other characteristic protected by law.
MetaMask is aware of fraudulent recruitment practices and we encourage all applicants to review our best practices to protect yourself, which can be found on our page.
MetaMask may use artificial intelligence (AI) tools to support parts of our recruitment process, such as reviewing applications, screening resumes, or conducting initial candidate assessments. These tools are designed to assist our recruiting team and improve efficiency — they do not replace human judgment. A human recruiter or hiring manager reviews every candidate, and all final hiring decisions are made by people, not AI.
It is a requirement of employment in this position that applicants may be required to submit to background and identity verification checks, including but not limited to employment, education, criminal record checks, and other such checks as determined necessary by the company.
Location: Remote
Workplace: Remote
We are building AI to simulate the world through merging art and science.
We believe that world models are at the frontier of progress in artificial intelligence. Language models alone won’t solve the world’s hardest problems – robotics, disease, scientific discovery. Real progress requires models that experience the world and learn from their mistakes, the same way that humans do. And this kind of trial and error can be massively accelerated when done in simulation, rather than in the real world.
World models offer the most clear path to general-purpose simulation, changing how stories are told, how scientific progress is made and how the next frontiers of humanity are reached.
Our team consists of creative, open minded, caring and ambitious people who are determined to change the world. We aspire to continuously build impossible things and our ability to do so relies on building an incredible team. If you are driven to do the same, we'd love to hear from you.
*Titles posted to our careers page are updated regularly to best advertise the role and expected seniority, but internally we have a flat titling system with two types of titles: one for individual contributors and one for people managers.
ABOUT THE ROLE
Open to hiring remote — we also have offices in New York, San Francisco, Seattle, London, Paris, and Tel Aviv.
Runway is hiring a Detection & Response Engineer to own how we find and stop attacks against our infrastructure, our research environment and our products.
Securing a company that trains and serves frontier video models is a different problem from securing a typical SaaS product. The environment includes research compute, large training datasets, a fast-moving build pipeline and engineers who work inside AI-assisted tooling every day. Each of those changes what an attack looks like and what you need to see to catch it.
You'll join the Security team and build our detection and response program the way an engineer would: detections as code, response as automation, evidence as something you can query. This is a role with real ownership: you'll own the detection program end to end, from what we log to how quickly we close an incident. You'll report to the head of security, partner with engineers across platform and research, and shape how this function grows from here.
WHAT YOU'LL DO
- Own detection and response end to end: what we log, what we alert on, how we triage and how we recover
- Write and tune detections as code across multiple cloud environments, Kubernetes, identity systems, endpoints and SaaS, and measure them on coverage and precision rather than alert volume
- Lead incident response from the first alert through containment and forensics, then write the post-incident review people actually read
- Build automation that takes toil out of triage, including enrichment, correlation, containment actions and evidence collection, and use LLM-based tooling where it holds up under audit
- Monitor AI agents and developer tooling operating inside our environment, and turn that into concrete telemetry and controls
- Partner with platform and research engineers so new systems ship with logging and response playbooks in place on day one
- Run threat hunts and tabletop exercises against the parts of the environment that worry you most, and fix what you find
- Turn incident and detection metrics into evidence for SOC 2, ISO 27001 and enterprise customer security reviews, working with our GRC team
- Participate in an on-call rotation for security incidents
WHAT YOU'LL NEED
- Hands-on incident response experience: you've triaged live alerts, led investigations and written up what happened afterward
- Experience building and tuning detections in a modern SIEM, ideally managed as code
- Working knowledge of how attackers move through cloud and Kubernetes environments (IAM abuse, container escape, credential theft, supply chain compromise) and what that leaves behind in logs
- Comfort writing Python, Typescript, Rust or another language to automate response work and connect security tools
- Familiarity with at least one major cloud platform and with Kubernetes at the level of audit logs, RBAC and workload identity
- Clear writing. Incident timelines, detection documentation and updates to leadership are all part of the job
- Judgment about what to alert on, what to automate and when to wake someone up
EVEN BETTER IF YOU HAVE
- Experience monitoring GPU or HPC-style infrastructure, or research environments with large datasets
- Experience building detections or guardrails for AI agents, LLM tooling or MCP servers
- Cloud forensics experience: disk and memory acquisition, cloud audit trail reconstruction, chain of custody
- Published open source detection content
Runway strives to recruit and retain exceptional talent from diverse backgrounds while ensuring pay equity for our team. Our salary ranges are based on competitive market rates for our size, stage and industry, and salary is just one part of the overall compensation package we provide.
There are many factors that go into salary determinations, including relevant experience, skill level and qualifications assessed during the interview process, and maintaining internal equity with peers on the team. The range shared below is a general expectation for the function as posted, but we are also open to considering candidates who may be more or less experienced than outlined in the job description. In this case, we will communicate any updates in the expected salary range.
Lastly, the provided range is the expected salary for candidates in the U.S. Outside of those regions, there may be a change in the range, which again, will be communicated to candidates.
WORKING AT RUNWAY
Great things come from great teams. https://www.youtube.com/watch?v=kwmj4ato2kw&ab_channel=Runway We’d love to hear from you.
We’re committed to creating a space where our employees can bring their full selves to work and have equal opportunity to succeed. So regardless of race, gender identity or expression, sexual orientation, religion, origin, ability, age, veteran status, if joining this mission speaks to you, we encourage you to apply.
More about Runway
- Universal World Simulator https://runwayml.com/world-simulator.html
- GWM-1 https://runwayml.com/research/introducing-runway-gwm-1
- Gen-4.5 https://runwayml.com/research/introducing-runway-gen-4.5
- General World Models https://runwayml.com/research/introducing-general-world-models
- Robotics SDK https://runwayml.com/research/introducing-runway-gwm-1#robotics-section
- Conversational Real-time Agents https://runwayml.com/research/introducing-runway-gwm-1#avatars-section
- Runway Studios https://runwayml.com/studios
We're excited to be recognized as a best place to work:
Crain's https://www.crainsnewyork.com/awards/best-places-work-2023 | InHerSight https://www.inhersight.com/companies/best/city/new-york-city-ny | BuiltIn NYC https://builtin.com/awards/new-york-city/2024/best-places-to-work | INC https://www.inc.com/best-workplaces/2024
Location: Toronto, Ontario
Workplace: Hybrid
Artificial Intelligence. Actual Impact.
At Docebo, we’re using AI to change how people learn at work—and we mean actually change it. We’re an AI-powered learning platform that helps organizations create, deliver, and manage training all in one place. But our real mission goes deeper: we help teams move faster, work smarter, and focus on the work that truly matters. Our platform is built with intelligent, time-saving tools that personalize learning, eliminate busywork, and turn training from a checkbox into a superpower. The result? Better experiences for learners and real results for businesses.
We’re shaping the future of learning with a team that isn’t afraid to challenge the status quo. If you're excited by the idea of using AI to make work-life better for real people–you’ll feel right at home here. And it’s not just what we build, it’s how we show up. At Docebo, our values aren’t just posters on the wall—they guide how we work every day. We call it the Docebo Heart: trust by default, assume positive intent, and create space for different perspectives to thrive.
So… what are you waiting for? Join 900+ Docebians around the world and help us reinvent the way people learn, because learning never stops.
🚀 THE ADVENTURE AHEAD
As our Cybersecurity Compliance Specialist, you will be the front-line champion and strategist safeguarding Docebo's security posture and driving customer trust. You will bridge the gap between technical rigor and client confidence, translating complex compliance frameworks (like NIS2, NIST, GDPR, ISO, SOC, and FedRAMP) into competitive advantages. In this role, your work directly accelerates deal cycles, empowers our sales and legal teams, and ensures our global SaaS ecosystem remains fortress-secure.
⚡ THE DAY-TO-DAY
- Champion Customer Trust: Respond to prospect and customer security requests, review RFIs/RFQs, and deliver flawless responses regarding Docebo's compliance and security posture.
- Drive Compliance & CAPs: Tackle customer security questionnaires head-on and collaborate internally to establish Corrective Action Plans (CAPs) for outstanding requirements.
- Power Legal Alignment: Partner with the Docebo legal team to review Customer Agreements, Terms & Conditions, and Data Processing Addendums, seamlessly mapping client requirements to standard processes.
- Spearhead Audit Readiness: Lead and support annual customer audits while partnering with the GRC team during SOC2, ISO (27001, 9001, 42001), and NIS2 assessments.
- Automate for Efficiency: Leverage AI tools and basic programming capabilities to automate internal processes and optimize compliance workflows.
- Publish & Curate Insights: Organize internal compliance documentation and publish up-to-date materials directly to Docebo’s "trust pages" using platforms like Vanta.
- Evaluate Vendor Risk: Support third-party vendor risk assessments, monitor security controls, and maintain management reporting dashboards to mitigate external supplier risks.
🦸 YOUR SUPERPOWERS
- Proven SaaS Expertise: 4+ years of hands-on experience supporting security activities, audits, and compliance in SaaS environments, backed by a Bachelor's degree in Computer Science or a related field.
- Cloud & Privacy Mastery: Solid working knowledge of cloud environments (AWS, Azure, GCloud) alongside data privacy regulations like GDPR, CCPA, and PIPEDA.
- Framework Fluent: Deep familiarity with security and compliance standards including ISO/IEC (27001, 27017, 27018, 27701, 9001, 42001), SOC 2, PCI, NIS2, and CFR21 Part 11.
- Technical Savvy & Automation Mindset: Basic coding skills and hands-on experience with modern security governance platforms like Vanta and 1UP.
- Articulate Communicator: Exceptional written and verbal English communication skills, with a knack for translating complex technical concepts into clear customer answers.
- Problem-Solver Extraordinaire: Proactive, adaptable, and deeply passionate about the intersection of technology, business, and enterprise learning.
🌟 BONUS POINTS
- Certified Specialist: Holding certifications such as CISA, CIPP (or CIPT), or CompTIA Security+.
- FedRAMP Familiarity: Basic understanding and exposure to the FedRAMP framework.
- Advanced Academic Background: Specialized degree focus in Information Security or Auditing.
🧭 OUR INTERVIEW PROCESS
Step 1: We’ll kick things off with a 30-minute video call with a member of our Talent team. We’ll get to know you, share more about the role and team, and make sure we’re aligned.
Step 2: A 60-minute video call with the hiring manager, where they’ll dig deeper into your experience, approach, and what excites you most about this opportunity.
Step 3: A 45-minute practical case study/technical discussion with key members of the Compliance & GRC team.
Step 4: A final 30-minute chat with our Security Leadership team to discuss long-term vision, growth, and team alignment.
OUR HYBRID WORK PHILOSOPHY 🤝
Great work can happen anywhere but coming together helps us go further. Our team spends three days a week in the office (Tuesday-Thursday) to collaborate, solve problems, and learn from each other. With flexibility the rest of the week, it’s a balance designed to help everyone do their best work and keep growing.
OUR TOTAL REWARDS PHILOSOPHY 🎉
Our Total Rewards Philosophy centers around three core areas to reward and care for our People:
- Rewarding Impact: We lead with competitive pay to reward the impact, skills and traits that fuel our success.
- Fostering Holistic Wellbeing: We care deeply about and invest in the whole person with programs that support our people’s physical, mental, and financial well-being.
- Empowering Our Talent Culture: We build a culture of trust and empowerment by designing our rewards and benefits with transparency, equity, and flexibility, enabling our people to do their best work and stay for the long haul.
OUR PROMISE TO YOU 😍
- Financial Wellness: Own a piece of Docebo through our Employee Share Purchase Plan (ESPP) at a 15% discount, plus a competitive compensation package.
- Your Well-Being, Covered: You’ll get access to health benefits, so you can get the care you need when you need it.
- Rest, Relax, Repeat: Rest and recharge with paid vacation days, two company-wide Docebo Days, floating holidays for cultural celebrations, and your birthday off!
- Family First: We provide coverage offering you time with your little one(s) so you can soak up all those precious moments. Fun fact: we had 30 Docebian babies join the family in 2025!
- Fuel for Your Day: Receive a meal voucher for every working day, so you can focus on doing your best work while enjoying a meal that keeps you energized.
- Connections That Count: Connect with global communities through our Employee Resource Groups (including PRIDE, DWA, BIDOC, and Green Ambassadors) and company-wide events that keep the fun rolling all year long.
Location: San Francisco, CA | Seattle, WA | New York City, NY | Washington, DC
About Anthropic
Anthropic’s mission is to create reliable, interpretable, and steerable AI systems. We want AI to be safe and beneficial for our users and for society as a whole. Our team is a quickly growing group of committed researchers, engineers, policy experts, and business leaders working together to build beneficial AI systems.
About the Role
As part of the Anthropic security department, the compliance team owns understanding security and AI safety expectations, as established by regulators, customers and (nascent) industry norms (which we also seek to influence). The compliance team uses this understanding to provide direction to internal partners on the priorities of security and safety requirements they must meet. The compliance team assures regulators and customers that those expectations are met by earning security credentials and responding to direct inquiry about Anthropics security program from auditors, customers and partners.
This opportunity is unique, as we work to secure today’s most novel and valuable asset types, we must build a new kind of compliance program, assuring the safety of artificial intelligence capabilities.
Key responsibilities
Understand how Anthropic's security and privacy capabilities across major cloud platforms implement common frameworks (e.g., NIST 800-53, NIST 800-171, ISO 27001, ISO 27701, CSA CCM, and SOC 2).
Build scalable data center and hyperscaler processes and documentation systems that will support future expansion to additional geographies and compliance frameworks.
Assess and mitigate security and operational risks, implementing corrective actions, and managing vendor compliance.
Coordinate engagements with independent assessors to earn security and privacy certifications and attestations important to Anthropic customers and enterprise partnerships, and to meet regulatory obligations.
Write, update and enact policies capturing security, privacy, and AI safety requirements.
Maintain and enhance Anthropic's system of security controls through audit readiness, recordkeeping, and cross-functional communication.
Minimum qualifications
Have 8+ years of progressive experience in audit and compliance roles, with direct ownership of certification/attestation or security compliance implementation projects
Have worked in cloud-native environments and understand security and privacy considerations for multi-cloud and hybrid architectures
Can translate complex compliance requirements into actionable workstreams for technical and non-technical stakeholders
Have integrated with common controls frameworks or GRC systems that scaled with organizational growth
Write clear and useful security and privacy documentation for both external and internal audiences.
Thrive in ambiguous, fast-paced environments where you'll need to build processes from scratch
Are comfortable organizing time-bounded task management of delegated work streams across a diverse organization
Are energized by being the subject matter expert who educates the organization on new compliance requirements and auditors on current security practices
Preferred qualifications
Have worked in AI/ML companies and understand unique security considerations for model development and deployment
Have worked with cloud companies and understand cloud security controls and physical security requirements
Bring experience from high-growth technology companies managing rapid compliance expansion
Have some experience implementing automated enforcement of security controls (i.e., compliance as code)
Possess relevant certifications (CISA, CRISC, CISM, CISSP, or ISO 27001 Lead Auditor/Implementer)
The annual compensation range for this role is listed below.
For sales roles, the range provided is the role’s On Target Earnings ("OTE") range, meaning that the range includes both the sales commissions/sales bonuses target and annual base salary for the role.
Annual Salary:
$270,000
—
$345,000 USD
Logistics
Minimum education:
Bachelor’s degree or an equivalent combination of education, training, and/or experience
Required field of study:
A field relevant to the role as demonstrated through coursework, training, or professional experience
Minimum years of experience:
Years of experience required will correlate with the internal job level requirements for the position
Location-based hybrid policy:
Currently, we expect all staff to be in one of our offices at least 25% of the time. However, some roles may require more time in our offices.
Visa sponsorship:
We do sponsor visas! However, we aren't able to successfully sponsor visas for every role and every candidate. But if we make you an offer, we will make every reasonable effort to get you a visa, and we retain an immigration lawyer to help with this.
For roles performing work in California:
We will consider for employment all qualified applicants, including those with arrest or conviction records or criminal histories, in a manner consistent with the requirements of applicable state and local laws, including the San Francisco Fair Chance Ordinance, the City of Los Angeles’ Fair Chance Initiative for Hiring Ordinance, the Los Angeles County Fair Chance Ordinance for Employers, and the California Fair Chance Act.
We encourage you to apply even if you do not believe you meet every single qualification.
Not all strong candidates will meet every single qualification as listed. Research shows that people who identify as being from underrepresented groups are more prone to experiencing imposter syndrome and doubting the strength of their candidacy, so we urge you not to exclude yourself prematurely and to submit an application if you're interested in this work. We think AI systems like the ones we're building have enormous social and ethical implications. We think this makes representation even more important, and we strive to include a range of diverse perspectives on our team.
Your safety matters to us.
To protect yourself from potential scams, remember that Anthropic recruiters only contact you from @anthropic.com email addresses. In some cases, we may partner with vetted recruiting agencies who will identify themselves as working on behalf of Anthropic. Be cautious of emails from other domains. Legitimate Anthropic recruiters will never ask for money, fees, or banking information before your first day. If you're ever unsure about a communication, don't click any links—visit
anthropic.com/careers
directly for confirmed position openings.
How we're different
We believe that the highest-impact AI research will be big science. At Anthropic we work as a single cohesive team on just a few large-scale research efforts. And we value impact — advancing our long-term goals of steerable, trustworthy AI — rather than work on smaller and more specific puzzles. We view AI research as an empirical science, which has as much in common with physics and biology as with traditional efforts in computer science. We're an extremely collaborative group, and we host frequent research discussions to ensure that we are pursuing the highest-impact work at any given time. As such, we greatly value communication skills.
The easiest way to understand our research directions is to read our recent research. This research continues many of the directions our team worked on prior to Anthropic, including: GPT-3, Circuit-Based Interpretability, Multimodal Neurons, Scaling Laws, AI & Compute, Concrete Problems in AI Safety, and Learning from Human Preferences.
Come work with us!
Anthropic is a public benefit corporation headquartered in San Francisco. We offer competitive compensation and benefits, optional equity donation matching, generous vacation and parental leave, flexible working hours, and a lovely office space in which to collaborate with colleagues.
Guidance on Candidates' AI Usage:
Learn about
our policy
for using AI in our application process.
Location: Dubai, United Arab Emirates; Cairo, Egypt; India; Riyadh, Saudi Arabia
Job Description
We are looking for an experienced
SAP Basis & Security Consultant
to manage SAP technical administration, system performance, security, user access, and SAP landscape operations. The ideal candidate should have strong hands-on experience in SAP Basis as well as SAP Security and authorization management.
Key Responsibilities:
Perform SAP Basis administration across SAP environments.
Manage SAP system installation, configuration, upgrades, patches, and system maintenance.
Monitor SAP system performance, availability, and health.
Manage SAP transports, jobs, users, RFCs, interfaces, and system connectivity.
Handle SAP system copies, refreshes, backups, and recovery activities.
Troubleshoot SAP technical and performance issues.
Design and maintain SAP Security roles and authorizations.
Manage user provisioning, role assignments, access requests, and authorization concepts.
Perform SAP Security audits and support compliance requirements.
Identify and resolve authorization issues and security risks.
Support SAP GRC processes where applicable.
Work with functional and technical teams to ensure secure and stable SAP operations.
Support SAP upgrades, migrations, and cloud transformation projects when required.
Requirements:
6+ years of experience in
SAP Basis
.
Strong hands-on experience in
SAP Security and Authorizations
.
Experience managing SAP landscapes across
DEV, QA, and Production
.
Strong knowledge of SAP user administration, roles, profiles, authorizations, RFCs, transports, and system monitoring.
Experience with SAP HANA administration is preferred.
Experience with SAP S/4HANA is preferred.
Knowledge of SAP GRC Access Control is an advantage.
Experience with SAP cloud environments is an advantage.
Strong troubleshooting and problem-solving skills.
Good communication and stakeholder-management skills.
Mandatory Certification:
Valid SAP Cloud certification is mandatory.
Candidate must hold a recognized
SAP Cloud certification
, preferably related to
SAP S/4HANA Cloud, SAP BTP, or SAP Cloud Technology
.
Candidate must provide the
certification name and certificate/credential ID
.
УдалённоDubai, United Arab Emirates; Cairo, Egypt; India; Riyadh, Saudi Arabia
УдалённоNo matter what, working hours must overlap with GMT-3 for at least 20 hours/week
УдалённоRemote, United States; The base salary range for this role’s listed level is currently for residents of the United States only
УдалённоBrazil
УдалённоseniorRemote, Canada; Remote, United States; The base salary range for this role’s listed level is currently for residents of the United States only
Противоречивые условия: Please note that we are unable to consider applications from candidates based in France, Italy, or Germany for this role; Compensation for candidates based outside the US (including Canada, EMEA, and LATAM) will be determined based on location, experience, and skills during the interview process, and may differ from the listed US range; UNITED STATES - Remote, LATAM - Remote, EMEA - Remote
УдалённоСША; Lastly, the provided range is the expected salary for candidates in the U.S
ГибридToronto, Ontario
San Francisco, CA | Seattle, WA | New York City, NY | Washington, DC
Автоотклики