Вакансии

Задачи: — проводить penetration testing продуктов и сервисов Samsung; — искать и оценивать уязвимости; — проводить code review; — взаимодействовать с разработчиками. Требования: — опыт web application pentest от 3 лет; — знание Burp Suite, OWASP ZAP; — знание OWASP Top 10; — знание Python. Будет плюсом: Kali Linux, AWS, Docker, SAST, CI/CD и DevSecOps, Linux internals, AI Security. Изюминка вакансии: это именно security-команда R&D, а не классический внутренний ИБ-отдел — основной фокус на тестировании большого количества веб-приложений и поиске уязвимостей.

Location: US - Headquarters - Maryland - Columbia Who is Tenable? Tenable® is the Exposure Management company. Over 40,000 organizations around the globe rely on Tenable to understand and reduce cyber risk. Our global employees support 65 percent of the Fortune 500, 50 percent of the Global 2000, and large government agencies. Come be part of our journey! What makes Tenable such a great place to work? Ask a member of our team and they’ll answer, “Our people!” We work together to build and innovate best-in-class cybersecurity solutions for our customers; all while creating a culture of belonging, respect, and excellence where we can be our best selves. When you’re part of our #OneTenable team, you can expect to partner with some of the most talented and passionate people in the industry, and have the support and resources you need to do work that truly matters. We deliver results that exceed expectations and we win together! Applicants must be authorized to work for any employer in the U.S. without sponsorship. We are unable to provide sponsorship for work visas of any kind at the time of hire, or at any point during employment. This includes, but is not limited to: F1-OPT, F1-CPT, H-1B, TN, J-1, etc Your Role: As an AI Security Engineer on Tenable's Information Security team, you will help shape and mature our approach to securing AI both within Tenable's products and across the enterprise. AI introduces a new class of risk at the intersection of application security, cloud risk, and data governance, and you will be on the front lines of defining how we assess, test, and address it. You will apply hands-on AI engineering experience alongside deep product security and application security skills to design security controls for AI systems, lead assessments, and help engineering teams ship AI features securely. You will establish security standards for responsible AI use, influence decisions across the organization, and build tooling that raises our security posture. This role is ideal for a practitioner who has spent real time building with AI systems, looking under the hood of model internals, and wants to channel that experience into a security specialty. Your Opportunity: Design, implement, and maintain end-to-end security controls across the AI/ML lifecycle. Conduct safety research, inspecting model internals (e.g., detecting hidden deception, latent knowledge, or unwanted concepts across layers) as a core methodology. Perform AI safety assessments and threat modeling for AI/ML systems, identifying risks such as data poisoning, model evasion, model extraction, adversarial inputs, and integrity attacks. Design and implement robust security guardrails, controls, and boundary mechanisms for Large Language Models (LLMs), Small Language Models (SLMs), and open-source models. Act as a subject matter expert in AI safety research by inspecting model internals to detect hidden deception, latent knowledge, or unwanted concepts, ensuring highly transparent and aligned AI outputs. Continuously monitor the AI landscape for novel vulnerabilities and attack techniques, applying deep engineering experience to proactively defend enterprise AI deployments. Develop security reference architectures for AI deployment patterns, including MCP servers and agentic AI workflows and harnesses. Deploy controls to ensure model integrity, governance, and proper access control across models and feature stores. Build AI-driven tooling to strengthen cybersecurity posture across identity, incident management, vulnerability management, third-party risk, and emerging AI threat vectors. Perform AI safety, security assessments, threat modeling for AI/ML systems, identifying risks such as data poisoning, model evasion, model extraction, adversarial inputs, and integrity attacks. Collaborate with software engineers, and product teams to integrate security best practices into AI development, training, validation, and deployment processes. Drive Secure Software Development Lifecycle (SSDLC) and DevSecOps practices for AI-powered products, including threat modeling, security testing, penetration testing, and CI/CD pipeline security automation. Create security guidance, documentation, and training for internal engineering and development teams; develop metrics that drive desired security behaviors and outcomes. Research emerging trends in AI security and contribute to innovative solutions that support Tenable's AI initiatives. What You'll Need: 5 or more years of professional experience in information security or application security, with at least 1–2 years focused on securing AI/ML systems. Master’s Degree in Computer Science, Cybersecurity, Data Science, or a related field preferred; advanced degree preferred. Deep understanding of AI-specific security threats, including adversarial ML, data poisoning, prompt injection, model inversion, model evasion, and inference attacks. Strong coding experience in Python and/or Go. Experience with frameworks & libraries such as PyTorch, Hugging Face Transformers, TensorFlow or similar. Experience using specialized interpretability and probing tools/libraries such as TransformerLens, NNsight, Captum, or LIT (Learning Interpretability Tool). Familiarity with mechanistic & Architectural Concepts: inspecting internal model states, residual streams, attention patterns, activation steering, Sparse Autoencoders (SAEs), or feature attribution. Strong understanding of the ML/AI lifecycle and the security risks associated with each stage. Knowledge of cloud security platforms: AWS, Azure, or GCP including AI/ML-related services. Knowledge of data security principles, including encryption, masking, and tokenization. Knowledge of SSDLC, DevSecOps, and security testing practices, including SAST, DAST, SCA, and threat modeling. Knowledge of application security architecture best practices and patterns, including modern web applications, Docker, and microservices. Ability to work cross-functionally across engineering, product, and business teams. Strong written and verbal comAAmunication skills; able to clearly translate complex AI security risks for both technical and non-technical audiences. Strong problem-solving skills, attention to detail, and ability to lead projects with end-to-end ownership. Self-motivated and effective working independently and across distributed teams. And Ideally: Hands-on experience with AI red teaming, adversarial prompt testing, or LLM security assessments. Familiarity of AI security frameworks and standards, including OWASP LLM Top 10 and the NIST AI Risk Management Framework. Experience with application security assessment tools (Burp Suite, ZAP, Tenable WAS, etc). Familiarity with AI governance frameworks (EU AI Act, NIST AI RMF, etc.). Background in cloud security or large-scale SaaS product environments. Security certifications: CISSP, CSSLP, SANS GIAC, CEH, or AI-focused security certifications are a plus, but not necessary. #LI-Hybrid #LI-MS1 This is the base pay range for this position. Compensation for the role will depend on a number of factors, including the candidate's qualifications, skills, competencies, location and experience, and may fall outside of the range shown. Employees are also eligible for variable compensation in addition to base pay (commission for sales roles, bonus for non-sales roles), depending on company and individual performance. Tenable also offers a variety of comprehensive and competitive benefits which include: medical, dental, vision, disability and life insurance; 401(k) retirement savings with company match; an employee stock purchase plan; an employee referral program; flexible spending accounts; an Employee Assistance Program (EAP); education assistance; parental leave; paid time off (PTO); company-paid holidays; health and wellness events; and community programs. US Pay Range $122,500 — $163,166.67 USD We’re committed to promoting Equal Employment Opportunity (EEO) at Tenable - through all equal employment opportunity laws and regulations at the international, federal, state and local levels.  If you need a reasonable accommodation due to a disability during the application or recruiting process, please contact Recruiting@Tenable.com for further assistance. Tenable Data Consent Statement Tenable is committed to protecting the privacy and security of your personal data. Depending on your location, one or more of the following notices may apply to you: General Applicant Privacy Notice California Applicant Privacy Notice EU/EEA/UK Applicant Privacy Notice

Задачи: — Управление жизненным циклом уязвимостей в технологическом стеке Glean, включая обнаружение, приоритизацию, устранение, отчетность и измерение. — Усиление безопасности базовых образов ОС и обеспечение безопасности зависимостей открытого программного обеспечения, менеджеров пакетов и цепочки поставок ПО. — Интеграция SAST, DAST, сканирования зависимостей и автоматической проверки безопасности в CI/CD пайплайны. — Оценка, внедрение и разработка решений и инструментов безопасности, включая Google’s Assured OSS и аналогичные подходы. — Определение практик безопасного кодирования и продвижение их среди инженерных команд через руководство, обучение и наставничество. Требования: — Степень бакалавра в области компьютерных наук, кибербезопасности или смежной области, либо эквивалентный опыт. — Опыт работы в области безопасности приложений и управления уязвимостями не менее 8 лет. — Глубокое понимание уязвимостей программного обеспечения, включая CVE, OWASP Top 10 и риски цепочки поставок. — Опыт работы с инструментами SAST, DAST, сканирования зависимостей и управления уязвимостями (например, Snyk, GitHub Dependabot, Trivy, Clair, Burp Suite, OWASP ZAP). — Практический опыт облачной безопасности в AWS, GCP, включая контейнеры, Kubernetes и микросервисы. — Способность вести межфункциональные инициативы и продвигать безопасность среди инженерных команд. — Проактивность, прагматичность, умение решать проблемы и балансировать безопасность с производительностью и удобством использования. Условия: — Удаленная работа. — Годовой базовый оклад от $185,000 до $260,000, зависит от местоположения, уровня, знаний, навыков и опыта. — Возможность переменной компенсации, акций и социальных льгот. — Медицинское, офтальмологическое и стоматологическое страхование. — Щедрая политика отпусков. — Вклад в пенсионный план 401k. — Стипендия на улучшение домашнего офиса, ежегодные стипендии на образование и оздоровление. — Регулярные корпоративные мероприятия и ежедневные здоровые обеды. Дополнительно: — Компания поддерживает разнообразие и инклюзивность, не дискриминирует по различным признакам. — В процессе собеседования предусмотрено AI-ориентированное упражнение для оценки понимания и использования AI в работе. — Соблюдение международных норм по защите данных кандидатов (GDPR, CCPA и др.).

Задачи: — усиливать безопасность приложений RingCentral — безопасно внедрять AI-технологии Требования: — глубокое знание уязвимостей веб-приложений и способов их эксплуатации и устранения — опыт threat modeling, security design review и risk assessment — практический опыт с SAST, DAST, SCA, code review и penetration testing — понимание рисков LLM-приложений, AI-агентов, coding-ассистентов и MCP-серверов — навыки программирования или написания скриптов — умение давать инженерным командам понятные и практически применимые рекомендации — разговорный английский Будет плюсом: — опыт с LLM/RAG, AI-assisted security testing, WebRTC, видео- или аудиостримингом Условия: — график 4 дня в офисе в Софии, 1 день удалённо — релокационный пакет и помощь с документами

Задачи: — проводить пентест Web, API, мобильных приложений, инфраструктуры, сетей и облака; — выполнять white-box / SAST-анализ исходного кода; — работать с разработчиками, DevOps и Blue Team; — использовать Burp Suite, Nmap, Metasploit, Nessus/OpenVAS, Hydra, sqlmap, Impacket, BloodHound и др.; — участвовать в построении SecSDLC; — готовить отчёты по результатам работ. Требования: — знание OWASP Top 10 / API Top 10 / Mobile Top 10; — понимание TCP/IP, HTTP/S, DNS, LDAP, SMB; — опыт в Pentest / Network Security; — уверенное владение Linux; — опыт работы с Burp Suite, Nmap, Metasploit и инструментами анализа уязвимостей; — знание OWASP, MITRE ATT&CK, D3FEND.

Задачи: — Проводить проверки приложений и сервисов на наличие уязвимостей (SAST, SCA, DAST, обнаружение секретов, фаззинг), готовить POC‑эксплуатации и понятные отчёты для команд; — Проводить триаж уязвимостей: оценка риска и влияния, приоритизация, постановка задач на исправление, контроль сроков и качества устранения уязвимостей; — Участвовать в проектировании: проводить моделирование угроз (например, STRIDE), ревью архитектуры по безопасности и дизайн‑решений, формулировать требования к аутентификации, авторизации, шифрованию и журналированию; — Развивать SSDLC и DevSecOps: определять и внедрять контроли по безопасности на этапах требований, дизайна, разработки, тестирования и эксплуатации, настраивать гейты безопасности в GitLab CI/CD; — Сопровождать и развивать AppSec‑инструменты: интеграция сканеров в конвейер разработки, настройка политик, исключений и отчётности, участие в выборе и пилотах новых решений; — Участвовать в аудитах безопасности сервисов и разборах инцидентов: анализ причин, выработка устойчивых мер, предотвращающих повторное возникновение уязвимостей целого класса; — Консультировать команды разработки и архитекторов по вопросам безопасной разработки, разбору и устранению уязвимостей, шаблонам безопасного кодирования; — Проводить тренинги, воркшопы и семинары по AppSec (OWASP Top 10 / API Security, безопасная аутентификация и управление сессиями, защита API и интеграций и т.п.); — Исследовать новые векторы атак и тренды в AppSec, предлагать улучшения процессов и инструментов. Требования: — Высшее техническое образование (желательно профильное ИБ или сопоставимый практический опыт в разработке/безопасности приложений); — Опыт работы в роли инженера по безопасности приложений от 3 лет, участие в реальных проектах по защите веб‑ или API‑сервисов в продакшене; — Практический опыт внедрения и эксплуатации инструментов: SAST, SCA, DAST, фаззинг, поиск секретов. Интеграция этих инструментов в CI/CD (желательно GitLab CI/CD); — Опыт работы с Docker, Kubernetes, GitLab (или аналогичными системами контроля версий и CI/CD); — Умение проводить ревью кода с фокусом на безопасность, давать разработчикам понятные и практичные рекомендации; — Владение одним из языков программирования (Python / Go / Bash); — Глубокое понимание причин возникновения и способов эксплуатации уязвимостей из OWASP Top 10 и OWASP API Security, а также практического устранения этих проблем; — Навыки общения: умение объяснить сложные технические риски понятным языком, договариваться о приоритетах, конструктивно отстаивать позицию безопасности; — Готовность брать ответственность за результат: от качества найденных уязвимостей до того, чтобы команда действительно внедрила устойчивое исправление, а не обходной костыль; — Предпочтение отдаётся кандидатам, имеющим опыт работы в транзакционном бизнесе или платежных системах, с глубоким пониманием платёжных технологий и особенностей работы в сегментах B2B/B2G.

Компания Industry Soft Solutions — ИТ продуктовая компания, создающая и внедряющая программные решения для цифровой трансформации корпораций и государственных компаний. Разрабатывается промышленная AI-платформа для промышленных предприятий с акцентом на безопасность и стандартизацию. Предлагается оформление по ТК РФ с "белой" зарплатой, оплата больничных и отпусков, ДМС со стоматологией, компенсация профильных курсов и обучений. График работы пн-пт, выходные сб/вскр, возможны форматы работы: гибрид, офис, удаленно. Офис находится в деловом квартале "Новоспасский" рядом с метро Павелецкая. Компания обеспечивает помощь в адаптации, профессиональный и карьерный рост, лояльную корпоративную культуру и поддержку со стороны ТОП-менеджмента. Требования: — Высшее или неоконченное высшее в сфере ИТ, информационной безопасности или смежных областях; — Опыт в DevSecOps/DevOps от 3 лет; — Уверенное владение CI/CD, мониторингом (Prometheus, Grafana, ELK); — Опыт администрирования Linux (Ubuntu/CentOS/AstraLinux), Docker, Kubernetes, Helm; — Знание языков автоматизации: Python, Bash, PowerShell; — Опыт с СУБД: PostgreSQL (отказоустойчивые кластеры), Redis, ClickHouse; — Опыт работы с брокерами сообщений: Kafka, RabbitMQ; — Владение инструментами безопасности: SAST, DAST, SCA, Fuzzing; — Опыт работы со стандартами: OWASP Top-10, NIST, ГОСТ Р 56939-2016, требования ФСТЭК. Задачи: — Внедрение и поддержка инструментов анализа защищённости (SAST, DAST, SCA) в CI/CD (GitLab), анализ кода и уязвимостей, рекомендации разработчикам; — Работа с уязвимостями в контейнерных средах, контроль обновлений и патчинг, оценка рисков безопасности, настройка WAF, Anti-DDoS, анализ трафика (SELKS, Kibana, Prometheus/Grafana); — Обеспечение соответствия процессов разработки требованиям ФСТЭК, OWASP, NIST, ГОСТ Р 56939-2016, подготовка документации для сертификации ПО; — Администрирование Linux-серверов (Ubuntu, AstraLinux, RED OS, ALT Linux), управление Docker/Kubernetes/Helm, поддержка мониторинга и СУБД (PostgreSQL, Redis, ClickHouse, MongoDB); — Проектирование и настройка инфраструктуры у заказчика, включая виртуализацию (VMware, Proxmox, Hyper-V), брокеры сообщений, GitOps-процессы (ArgoCD, Flux), составление требований к оборудованию, написание проектной документации; — Автоматизация с помощью Ansible, Terraform, скриптов на Python/Bash/PowerShell; — Управление доступами и интеграция с IAM-системами (FreeIPA, ALD Pro, MS AD); — Настройка и поддержка систем резервного копирования (Veeam, WAL-G, clickhouse-backup), проверка восстановления.

Задачи: — Проводить оценку архитектуры решений и готовности сервиса к запуску с точки зрения безопасности; — Анализировать отчеты SSDLC сканеров, bug bounty; — Разрабатывать рекомендации по устранению уязвимостей, ставить задачи на команды, проверять устранения; — Дорабатывать правила для SSDLC сканеров и WAF; — Заниматься построением и развитием процессов SSDLC; — Заниматься написанием политик и инструкций по информационной безопасности в своей зоне ответственности; — Обучать и консультировать команды разработки в области информационной безопасности. Требования: — Знаешь принципы безопасной разработки; — Имеешь опыт анализа архитектуры приложений и отдельных технологических процессов с точки зрения безопасности; — Имеешь навыки определения и устранения уязвимостей в веб и мобильных приложениях; — Работал с инструментами SAST, DAST, SCA, WAF; — Знаешь типовые протоколы аутентификации, базовые принципы криптографии; — Имеешь навыки работы в команде. Желательно, но не обязательно: — Умение разбираться в чужом коде (Java, JavaScript, TypeScript, Kotlin, Swift); — Навыки автоматизации задач с помощью скриптовых языков (Python, Go); — Практический опыт работы с Linux, Docker, Kubernetes. Условия: — Оформление по трудовому кодексу. Полностью белая зарплата. — Каждый месяц отдельная сумма на питание. — Регулярные тимбилдинги, спортивные забеги, корпоративные праздники. — ДМС включает стоматологию и полис путешественника. — Обучение за счёт компании: тренинги, конференции, митапы, курсы английского. — Выдача ноутбука и всего необходимого для работы. — Возможность работать в красивом и удобном офисе с кофе, сладостями и фруктами. — Бесплатные онлайн-консультации психологов, юристов, специалистов по финансам и ЗОЖ, ветеринаров. — Офисы в Нижнем Новгороде, Москве и Петербурге.

Location: Toronto; Calgary; Boston; Canada; Seattle; New York; Vancouver; California; Ottawa; Montreal Workplace: Remote WHO ARE WE? Cohere is the leading security-first enterprise AI company. We build cutting-edge foundation AI models and end-to-end products that are designed to solve real-world business problems. We’re training and deploying frontier models for enterprises who are building AI systems. We believe that our work is instrumental to the widespread adoption of AI and we are looking for folks that want to be part of that. We obsess over what we build. Each one of us is responsible for contributing to increasing the capabilities of our models and the value they drive for our customers. Cohere is a team of researchers, engineers, designers, and more, who are all passionate about their craft. We are a global technology company headquartered in Toronto with key offices in London, New York City, San Francisco, Montreal, Paris, Berlin and Seoul. Join us! WHY THIS ROLE Enterprises hand Cohere their most sensitive data and put our models inside workflows they can't afford to get wrong. Securing that means working on problems the industry hasn't settled yet, what authorization means when an agent acts on a user's behalf, how to contain tools that consume untrusted input, and whether tenant boundaries hold when a model can be steered by the data it reads. The established playbooks only take you so far. We're hiring a Senior Product Security Engineer to work these problems alongside the engineers building the products, reviewing architecture and code, threat modeling before implementation, testing what ships, and turning what you learn into defaults other teams inherit. This is a hands-on engineering role, not an advisory one. WHAT YOU’LL DO - Lead security reviews. Review architecture, code, and security-sensitive changes. Identify both individual vulnerabilities and the recurring design patterns behind them. - Secure AI-powered products. Evaluate risks such as prompt injection, unsafe tool use, identity and delegation failures, excessive agency, data exposure, tenant isolation, and sandbox escapes. - Threat model new capabilities. Identify trust boundaries, abuse cases, and high-impact failure modes before implementation. Translate findings into practical, prioritized mitigations. - Perform hands-on testing. Investigate suspected vulnerabilities, develop proofs of concept, assess exploitability and impact, and partner with engineers through remediation. - Build scalable guardrails. Develop secure defaults, approved patterns, reusable controls, review requirements, and automated checks that reduce recurring risks. - Strengthen engineering capability. Pair with engineers, document practical guidance, and help product teams develop durable security expertise. - Influence risk decisions. Explain technical findings, business impact, and remediation options clearly to engineers, product leaders, and executives. YOU MAY BE A GOOD FIT IF - You have strong software engineering fundamentals and can independently understand, test, and contribute fixes to production codebases. - You are proficient in at least one of Python, Go, or TypeScript. - You have led security reviews or threat models for complex production systems and can point to meaningful design or risk improvements that resulted. - You understand common vulnerability classes and their underlying design failures, including injection, authorization flaws, IDOR, SSRF, unsafe deserialization, race conditions, cryptographic misuse, and software supply-chain risks. - You understand modern application architecture, including web applications, APIs, OAuth/OIDC, cloud platforms, containers, Kubernetes, and CI/CD systems. - You can reason rigorously about untrusted input, authorization, isolation, identity, delegation, and data boundaries. Direct experience with agentic AI systems is valuable but not required. - You have driven security improvements involving multiple engineering teams, including situations where influence mattered more than authority. - You communicate clearly with both technical and non-technical audiences. NICE TO HAVE - Experience building or operating security tooling such as SAST, DAST, SCA, custom linters, or policy-as-code. - Experience securing multi-tenant SaaS, enterprise software, or systems that process sensitive customer data. - Offensive security experience through penetration testing, red teaming or security research. - Experience operating or participating in a vulnerability disclosure or bug bounty program. - Contributions to open-source security projects, published research, conference talks, or credited vulnerability discoveries. FULL-TIME EMPLOYEES AT COHERE ENJOY THESE PERKS: - A weekly lunch stipend of $75/£75 or equivalent in your local currency for lunch. - Full health and dental benefits, including a separate budget for mental health. - RRSP matching, 401K, Pension Scheme. - 100% Parental Leave top-up for up to 6 months, for either parent. - Annual enrichment benefits: Arts & culture, fitness/wellness, quality time, and a workspace improvement credit. Education & learning stipend for conferences, courses, and coaching. - 6 weeks of paid vacation (30 working days!) - Budget for traveling to other offices if you are remote, plus an annual company offsite. HOW AND WHERE WE WORK: - Cohere is remote-friendly, but we also have offices in Toronto, London, New York City, San Francisco, Montreal, Paris, Berlin and Seoul with more opening soon. - For those in the office: a daily lunch program, plenty of snacks, and regular community and social events. - For those not near an office: a co-working benefit so you can work alongside others in your city. - Everyone receives a $500 home office stipend to set up your workspace properly. If any of the above doesn’t line up exactly with your experience, we still encourage you to apply. We strive to create an inclusive work environment for all; we welcome applicants from all backgrounds and are committed to providing equal opportunities. Should you require any accommodations during the recruitment process, please submit an Accommodations Request Form https://docs.google.com/forms/d/12a6IrLdF3kI2nonKSr4tiFuz18rLQbaeYV-JM9L4o9Q/edit, and we will work together to meet your needs. We may use AI-enabled tools to screen and assess applicants against the criteria for this position. This helps our recruiters identify potentially qualified candidates, but it doesn't limit the applications our recruiters may review or consider. Beware of Scams: Cohere will never ask for payment or third-party services (e.g., CV writing) as part of our hiring process. All legitimate roles are listed on the Cohere careers page and LinkedIn only, with all communications from Cohere employees coming from an @cohere.com or @cw.cohere email alias. If jobs are viewed on other sites then please verify these through our official careers https://cohere.com/careers page.

Location: Toronto; San Francisco; London; New York; Montreal Workplace: Remote WHO ARE WE? Cohere is the leading security-first enterprise AI company. We build cutting-edge foundation AI models and end-to-end products that are designed to solve real-world business problems. We’re training and deploying frontier models for enterprises who are building AI systems. We believe that our work is instrumental to the widespread adoption of AI and we are looking for folks that want to be part of that. We obsess over what we build. Each one of us is responsible for contributing to increasing the capabilities of our models and the value they drive for our customers. Cohere is a team of researchers, engineers, designers, and more, who are all passionate about their craft. We are a global technology company headquartered in Toronto with key offices in London, New York City, San Francisco, Montreal, Paris, Berlin and Seoul. Join us! As a Senior Security Engineer you will: - Serve as trusted advisor to team’s leadership and partner teams by clearly articulating business risks associated with security issues - Lead security operation functions – including vulnerability management, SAST, DAST, detection engineering, and incident response – in CI/CD and cloud-native production environments - Integrate security into our applications throughout the software development lifecycle - Collaborate with product and development teams, driving the success of larger projects to ensure that software is built and deployed securely without compromising agility and speed - Driving and supporting bug bounty program, application security reviews and threat modeling, including code review and dynamic testing - Assess and integrate security tools to automate and scale security processes, i.e: evaluate open-source vs vendor solutions - Gather and analyze security metrics to address security issues with cross-team dependencies - Be a problem solver who is empathetic to developer concerns and will employ constructive and flexible approach to building innovative solutions You may be a good fit if: - 5+ years previous experience in Application/Product Security or Security Operations with a strong focus on security tool onboarding and optimization - You have an understanding of vulnerability management, network security, cloud security concepts, and industry best practices across many fields of security - You are comfortable with ambiguity and are able to make informed decisions with little data - You employ a flexible and constructive approach when solving problems - You are able to make trade-offs between build vs. buy decisions - help build solutions and able to review what tools are available - You understand secure engineering best practices, can articulate problem statements and propose solutions to both technically savvy and non-technical audiences - You have a deep technical understanding of common security vulnerabilities and risks, as well as countermeasures and compensating controls - You’re a hands-on security engineer interested in automating controls FULL-TIME EMPLOYEES AT COHERE ENJOY THESE PERKS: - A weekly lunch stipend of $75/£75 or equivalent in your local currency for lunch. - Full health and dental benefits, including a separate budget for mental health. - RRSP matching, 401K, Pension Scheme. - 100% Parental Leave top-up for up to 6 months, for either parent. - Annual enrichment benefits: Arts & culture, fitness/wellness, quality time, and a workspace improvement credit. Education & learning stipend for conferences, courses, and coaching. - 6 weeks of paid vacation (30 working days!) - Budget for traveling to other offices if you are remote, plus an annual company offsite. HOW AND WHERE WE WORK: - Cohere is remote-friendly, but we also have offices in Toronto, London, New York City, San Francisco, Montreal, Paris, Berlin and Seoul with more opening soon. - For those in the office: a daily lunch program, plenty of snacks, and regular community and social events. - For those not near an office: a co-working benefit so you can work alongside others in your city. - Everyone receives a $500 home office stipend to set up your workspace properly. If any of the above doesn’t line up exactly with your experience, we still encourage you to apply. We strive to create an inclusive work environment for all; we welcome applicants from all backgrounds and are committed to providing equal opportunities. Should you require any accommodations during the recruitment process, please submit an Accommodations Request Form https://docs.google.com/forms/d/12a6IrLdF3kI2nonKSr4tiFuz18rLQbaeYV-JM9L4o9Q/edit, and we will work together to meet your needs. We may use AI-enabled tools to screen and assess applicants against the criteria for this position. This helps our recruiters identify potentially qualified candidates, but it doesn't limit the applications our recruiters may review or consider. Beware of Scams: Cohere will never ask for payment or third-party services (e.g., CV writing) as part of our hiring process. All legitimate roles are listed on the Cohere careers page and LinkedIn only, with all communications from Cohere employees coming from an @cohere.com or @cw.cohere email alias. If jobs are viewed on other sites then please verify these through our official careers https://cohere.com/careers page.

Location: Salt Lake City, Utah, United States About the Role ICapital is looking for a hands-on Application Security practitioner to join a small, high-impact team building a modern AppSec program. This individual will work directly with the Head of AppSec and senior team members, executing secure design, API security, and developer enablement. Responsibilities Support threat modeling and design reviews across a broad and growing service portfolio. Support shift-left security initiatives, security in CI/CD, developer guidance, and SAST and SCA remediation workflows. Contribute to API security across the organization, assessing API exposure, validating authentication and authorization patterns. Write Python automation that scales AppSec capacity: triage tooling, finding pipelines, security context enrichment. Work directly with developers to remediate SAST and SCA findings, reduce false positive noise, and build security habits across engineering. Qualifications Hands-on experience across some secure design and threat modeling, API security, offensive security, or SAST/SCA program work Real understanding of attack patterns and exploitation techniques Familiar with OWASP Top 10 in practice API security experience with REST and GraphQL assessment Able to build and maintain security automation in Python, tooling that scales AppSec capacity Understanding of web application and API security Able to operate with autonomy in an environment still building its processes Relevant certifications, cloud-native environment experience and exposure to AI/LLM security are a plus Experience as a developer or engineer and fluency in Ruby, Python, and Scala are a plus Benefits The base salary range for this role is $100,000 to $130,000.  iCapital offers a compensation package which includes salary, equity for all full-time employees, and an annual performance bonus. Employees also receive a comprehensive benefits package that includes an employer matched retirement plan, generously subsidized healthcare with 100% employer paid dental, vision, telemedicine, and virtual mental health counseling, parental leave, and unlimited paid time off (PTO). We believe the best ideas and innovation happen when we are together. Employees in this role will work in the office Monday-Thursday, with the flexibility to work remotely on Friday. For additional information on iCapital, please visit https://www.icapitalnetwork.com/about-us Twitter: @icapitalnetwork | LinkedIn: https://www.linkedin.com/company/icapital-network-inc | Awards Disclaimer: https://www.icapitalnetwork.com/about-us/recognition/ iCapital is proud to be an Equal Employment Opportunity and Affirmative Action employer. We do not discriminate based upon race, religion, color, national origin, gender, sexual orientation, gender identity, age, status as a protected veteran, status as an individual with a disability, or other applicable legally protected characteristics.

Location: Lisbon, Portugal About the role iCapital is building a modern Application Security program. We’re looking for a senior, hands-on engineer to join a small team and help shape how we design, build and secure our applications—from secure design and threat modelling to API security, automation and security checks in CI/CD. You will sit within the Information Security organization and work directly with the Head of AppSec, engineering teams and product stakeholders. You should enjoy understanding complex applications, investigating weaknesses in code and architecture, and helping developers implement practical fixes. We’re still developing the program’s processes, so you’ll take ownership of defined technical workstreams and help establish how we work. This role combines hands-on delivery with the ability to set technical direction, influence engineering decisions and build repeatable security practices. What you’ll do Help build and mature the Secure Design and Threat Modeling practice, defining review methodology, standards and sign-off criteria with the Head of AppSec. Drive API security posture, assessing exposure, authentication, authorization and business-logic risks. Conduct targeted application and API security testing and support offensive security initiatives to identify weaknesses and validate controls. Build and maintain Python automation for security workflows, finding triage, data enrichment and integrations with development tools. Work with developers to investigate and fix findings from penetration testing, static application security testing (SAST) and software composition analysis (SCA), improving scan quality and reducing unnecessary friction. Embed security into development through design reviews, CI/CD checks, secure coding guidance and reusable solutions. Establish clear remediation ownership, priorities, timelines and escalation paths, working with engineering teams to validate fixes and resolve risks. What you’ll bring Substantial hands-on application security experience, whether gained in a dedicated security role or through security-focused software engineering work. Secure design and threat modeling skills, grounded in practical knowledge of web and API vulnerabilities, exploitation patterns and effective fixes. The ability to review application code, investigate security issues and engage with developers at technical depth. Python proficiency and experience building maintainable automation that others can rely on. Experience integrating security into development workflows through design reviews, developer guidance or CI/CD. Comfort owning technical workstreams independently, making risk-based decisions and influencing architecture across engineering and product teams. We value demonstrated security expertise and engineering ability over specific previous job titles. You should bring depth in the core disciplines, but you do not need to have led every AppSec specialty. Helpful, but not required Deeper experience in application penetration testing, GraphQL security or business-logic testing. Familiarity with cloud-native environments and attack surface management. Software development experience with Ruby or Scala. Experience with AI-assisted security tooling or AI/LLM application security. We believe the best ideas and innovation happen when we are together. Employees in this role will work in the office four days, with the flexibility to work remotely one day (Friday). Benefits iCapital offers a comprehensive benefits package that includes a total compensation program consisting of competitive salary, annual performance bonus, and equity for all full-time employees; healthcare with 100% employer-paid health and dental insurance; and generous paid time off (PTO). For additional information on iCapital Network, please visit https://www.icapitalnetwork.com/about-us Twitter: @icapitalnetwork | LinkedIn: https://www.linkedin.com/company/icapital-network-inc

Location: Bengaluru, India We are looking for a Senior QE Engineer (L3) with solid experience across the full testing lifecycle and strong Playwright and TypeScript skills. You will analyze requirements, design tests with AI-assisted tooling, build UI and API automation within the sprint, perform manual testing where it is required, verify defects through resolution, and contribute to release readiness for your assigned product area. AI-assisted work is part of everyday QE practice on this engagement, with Cursor used for scripting and test generation. You will also define test strategy for complex UI applications, design frameworks, own CI integration on GitHub Actions, govern the suite, and mentor L1 and L2 engineers when they are assigned to the area. This position is intended for Hyderabad-based candidates who are available to work from the office. The client operates a scaled Quality Engineering function across a broad technology landscape: SaaS and custom-built systems spanning ERP, CRM, CMS, LMS, e-commerce, exam and certification delivery, and supporting data platforms running across AWS and Azure. Quality is a continuous team responsibility, supported by an AI-native testing platform, automation-first practices, and a structured weekly release cadence. Playwright with TypeScript is the enterprise automation standard. QE engineers own the full quality lifecycle for their assigned product area and contribute to a shared automation platform already in production. Analyze stories, acceptance criteria, and specifications, and design test cases with AI-assisted tooling to identify scenarios, coverage gaps, and risks before development begins. Define test strategy and coverage for complex UI applications, and design and implement Playwright and TypeScript automation frameworks. Build and maintain automated UI and API coverage in TypeScript and Playwright within the sprint, including API component tests and API automation inside end-to-end flows. Perform manual testing where it is required, including where automation is not possible or not sufficient, and use exploratory testing as part of that work. Use Postman for exploratory, contract, and functional API validation. Use service virtualization so UI and API suites can run when a dependency is unavailable. Own CI/CD integration for UI and API suites on GitHub Actions, including cross-browser and cross-platform execution on LambdaTest. Design test suites in TestRail and keep them aligned with automated coverage and CI results. Report, track, and verify defects through resolution in Jira, coordinating with developers and product teams on priority and impact. Use Cursor daily to write, review, and refactor tests, and use GenAI, LLMs, agentic workflows, and existing RAG and MCP solutions in test design, generation, and maintenance. Support release readiness for the assigned product area by reviewing Allure results. Monitor automation health and defect trends and raise quality concerns proactively. Mentor engineers when they are assigned to the area, review automation contributions, and keep framework standards and documentation current. Use AWS or Azure for deployment, secrets, database services, and the cloud-native infrastructure that test environments depend on. 6 to 10 years of quality engineering experience across the full testing lifecycle, including manual testing where it is required, exploratory testing, defect management, and automation. Strong Playwright and TypeScript proficiency for UI framework design, API component tests, and API checks inside end-to-end flows. Experience with API validation using Postman or an equivalent tool. Experience with service virtualization for dependencies that are unavailable during testing. Experience with CI/CD and cross-browser execution using GitHub Actions, LambdaTest, or equivalent tools. Experience with test management and defect tracking using TestRail, Jira, or equivalent tools. Experience with release reporting using Allure or an equivalent tool. Hands-on use of Cursor or an equivalent AI coding assistant, with working familiarity with GenAI, LLMs, agentic workflows, RAG, and MCP using existing framework capabilities. Understanding of microservices, REST, and GraphQL sufficient to design and execute API tests. Familiarity with AWS or Azure, including deployment, secrets, database services, and cloud-native test infrastructure. Experience mentoring junior engineers. Experience governing automation frameworks through code review and documentation. Experience working on Agile teams. Analytical skills to define test scope and coverage. Ability to communicate clearly with developers, product, and delivery teams. Hands-on experience implementing AI-driven test generation and execution, self-healing automation, intelligent test selection, or predictive defect analysis within a Playwright and TypeScript platform. Experience bringing SAST, SCA, DAST, and code quality thresholds into UI or API pipelines (Checkmarx, Snyk, OWASP ZAP, SonarQube, or equivalent). Knowledge of AI-driven test optimization and coverage analytics (SeaLights or equivalent). Real-device or mobile-web execution on LambdaTest or an equivalent platform. Exposure to enterprise SaaS platforms such as ERP, CRM, CMS, or LMS systems in a QE context. Familiarity with performance or accessibility testing approaches.

Location: Hybrid About Us At Cloudflare, we are on a mission to help build a better Internet. Today the company runs one of the world’s largest networks that powers millions of websites and other Internet properties for customers ranging from individual bloggers to SMBs to Fortune 500 companies. Cloudflare protects and accelerates any Internet application online without adding hardware, installing software, or changing a line of code. Internet properties powered by Cloudflare all have web traffic routed through its intelligent global network, which gets smarter with every request. As a result, they see significant improvement in performance and a decrease in spam and other attacks. Cloudflare was named to Entrepreneur Magazine’s Top Company Cultures list and ranked among the World’s Most Innovative Companies by Fast Company. At Cloudflare, we’re not looking for people who wait for a polished roadmap; we’re looking for the builders who see the cracks in the Internet that everyone else has simply learned to live with. We value candidates who have the instinct to spot a "normalized" problem and the AI-native curiosity to create a solution using the latest tools. Our culture is built on iteration, leveraging AI to ship faster today to make it better tomorrow, while ensuring that every improvement, no matter how small, is shared across the team to lift everyone up. If you’re the type of person who values curiosity over bureaucracy, and that AI is a partner in solving tough problems to keep the Internet moving forward, you’ll fit right in. Available Locations: Austin, TX Role Summary As a Product Security Engineer, you will support security assessments and vulnerability operations for Cloudflare’s core software products. In this role, you will analyze system architecture, threat model new features, and ensure that product-related security findings are accurately triaged, routed to the correct engineering owners, and mitigated within our SLAs. On any given day, you might conduct a deep-dive security review on a new feature design, triage a complex bug bounty submission, or work directly with engineering teams to resolve vulnerabilities from different sources like bug bounties, SAST, fuzzing and penetration tests. You will also work autonomously to identify areas where our manual processes slow down. You will write code and integrate AI/LLM solutions to automate initial triage and data enrichment, building tools that help the team handle security findings at scale. In short, your work will sit at the intersection of Product Security, Vulnerability Operations, and internal AI Tooling. Ideally, you have experience in conducting academic/vulnerability research with a focus on systems security. Responsibilities Implement AI Security Solutions: Identify process bottlenecks and build AI-driven tools or scripts to help automate code analysis, optimize triage, and streamline Product Security workflows. Security Reviews & Threat Modeling: Conduct structured security reviews and threat modeling sessions (e.g., STRIDE) across product features, defining security requirements early in the development lifecycle. Product Vulnerability Management: Manage the operational lifecycle of product security findings. Ensure vulnerabilities are verified, mapped to the correct engineering owner, and tracked to mitigation in alignment with established SLAs. Bug Bounty Triage: Perform the technical triage and validation of Cloudflare’s external Bug Bounty submissions, verifying exploitability and evaluating business risk. Pentest Coordination: Support internal and external penetration testing engagements by reviewing findings, clarifying technical context, and assisting development teams with remediation strategies. Engineering Collaboration: Partner closely with DevOps and product teams, acting as a reliable security point of contact and helping developers implement secure coding practices. Desirable Skills, Knowledge, and Experience Product/AppSec Expertise: 5+ years of experience in Product or Application Security within large-scale distributed cloud environments or SaaS platforms. Practical AI & Automation Engineering: Demonstrated ability to build production-grade automation scripts and tools. Must possess hands-on engineering experience leveraging AI/LLMs to solve operational or technical challenges. Threat Modeling & Risk Analysis: Competency in threat modeling methodologies and the ability to evaluate code flaws to determine their actual engineering and security impact. Vulnerability Lifecycle Operations: Experience tracking, routing, and driving the remediation of software vulnerabilities across engineering groups while working against defined SLAs. Strong Collaboration & Communication: Ability to collaborate effectively across teams, clearly communicating technical security risks to software engineers and resolving ownership ambiguity constructively. Bonus points Offensive Security Tooling: Familiarity with modern exploitation techniques, fuzzing frameworks, or automated scanning utilities. Program Management Experience: Experience scaling crowdsourced security programs (e.g., HackerOne, Bugcrowd) or optimizing agile project management workflows within JIRA. Experience in integrating hardware security features into production code bases Equity This role is eligible to participate in Cloudflare’s equity plan. Benefits Cloudflare offers a complete package of benefits and programs to support you and your family.  Our benefits programs can help you pay health care expenses, support caregiving, build capital for the future and make life a little easier and fun!  The below is a description of our benefits for employees in the United States, and benefits may vary for employees based outside the U.S. Health & Welfare Benefits Medical/Rx Insurance Dental Insurance Vision Insurance Flexible Spending Accounts Commuter Spending Accounts Fertility & Family Forming Benefits On-demand mental health support and Employee Assistance Program Global Travel Medical Insurance Financial Benefits Short and Long Term Disability Insurance Life & Accident Insurance 401(k) Retirement Savings Plan Employee Stock Participation Plan Time Off Flexible paid time off covering vacation and sick leave Leave programs, including parental, pregnancy health, medical, and bereavement leave What Makes Cloudflare Special? We’re not just a highly ambitious, large-scale technology company. We’re a highly ambitious, large-scale technology company with a soul. Fundamental to our mission to help build a better Internet is protecting the free and open Internet. Project Galileo : Since 2014, we've equipped more than 2,400 journalism and civil society organizations in 111 countries with powerful tools to defend themselves against attacks that would otherwise censor their work, technology already used by Cloudflare’s enterprise customers--at no cost. Athenian Project : In 2017, we created the Athenian Project to ensure that state and local governments have the highest level of protection and reliability for free, so that their constituents have access to election information and voter registration. Since the project, we've provided services to more than 425 local government election websites in 33 states. 1.1.1.1 : We released 1.1.1.1 to help fix the foundation of the Internet by building a faster, more secure and privacy-centric public DNS resolver. This is available publicly for everyone to use - it is the first consumer-focused service Cloudflare has ever released. Here’s the deal - we don’t store client IP addresses never, ever. We will continue to abide by our privacy commitment and ensure that no user data is sold to advertisers or used to target consumers. Sound like something you’d like to be a part of? We’d love to hear from you! Please note that applicants who progress to the offer stage of the interview process may be asked to attend an in-person interview within one of the Cloudflare Offices or Cloudflare Hubs.  More details about this will be available at that stage of the interview process. This position may require access to information protected under U.S. export control laws, including the U.S. Export Administration Regulations. Please note that any offer of employment may be conditioned on your authorization to receive software or technology controlled under these U.S. export laws without sponsorship for an export license. Cloudflare is proud to be an equal opportunity employer.  We are committed to providing equal employment opportunity for all people and place great value in both diversity and inclusiveness.  All qualified applicants will be considered for employment without regard to their, or any other person's, perceived or actual race, color, religion, sex, gender, gender identity, gender expression, sexual orientation, national origin, ancestry, citizenship, age, physical or mental disability, medical condition, family care status, or any other basis protected by law. We are an AA/Veterans/Disabled Employer. Cloudflare provides reasonable accommodations to qualified individuals with disabilities.  Please tell us if you require a reasonable accommodation to apply for a job. Examples of reasonable accommodations include, but are not limited to, changing the application process, providing documents in an alternate format, using a sign language interpreter, or using specialized equipment.  If you require a reasonable accommodation to apply for a job, please contact us via e-mail at hr@cloudflare.com or via mail at 101 Townsend St. San Francisco, CA 94107.

Location: Hong Kong, Hong Kong SAR; Singapore, Singapore Who We Are At OKX, we believe that the future will be reshaped by crypto, and ultimately contribute to every individual's freedom. OKX is a leading crypto exchange, and the developer of OKX Wallet, giving millions access to crypto trading and decentralized crypto applications (dApps). OKX is also a trusted brand by hundreds of large institutions seeking access to crypto markets. We are safe and reliable, backed by our Proof of Reserves. Across our multiple offices globally, we are united by our core principles: We Before Me , Do the Right Thing , and Get Things Done . These shared values drive our culture, shape our processes, and foster a friendly, rewarding, and diverse environment for every OK-er. OKX is part of OKG, a group that brings the value of Blockchain to users around the world, through our leading products OKX, OKX Wallet, OKLink and more. About the Opportunity As a Staff Engineer, y ou'll own the build-out of our security engineering and DevSecOps capabilities: designing and developing the security products, platform services, and SDKs/Agents that embed protection directly into how code is written, built, shipped, and run. This is a role for someone with real depth in security, broad coverage across the stack, and the engineering muscle to ship. Just as important is the ability to drive adoption — security that lands in complex, fast-moving business environments rather than sitting in a policy document. What You’ll Be Doing Architect and build our end-to-end DevSecOps platform and the SDKs/Agents behind our security products, covering code, build, artifacts, images, deployment, and runtime. Lead runtime protection through RASP and Java Agent — bytecode instrumentation, runtime hooking, and detection/interception engines using ASM, ByteBuddy, and Instrumentation, with continuous tuning for performance, stability, and compatibility. Integrate and productise scanning capabilities across SAST, DAST, IAST, SCA, code scanning, and image scanning. You'll embed tools like SonarQube and Coverity deep into CI/CD and close the loop from detection through blocking, remediation, and re-test. Go deep on application security offence and defence — designing detection, remediation, hardening, and counter-measures for XSS, SQL injection, SSRF, deserialisation, command execution, authentication/authorisation flaws, and API security. Bring AI-native security engineering to life. Apply LLMs and AI Agents to vulnerability analysis, rule generation, false-positive attribution, remediation guidance, security knowledge capture, and engineering automation — and build a coherent view of the architecture, mechanics, and security implications. Embed as the security technical expert inside engineering teams, driving security standards, onboarding specifications, release gates, risk tiering, and remediation mechanisms that measurably lift the security baseline and delivery quality. Partner across engineering, architecture, SRE, QA, and business teams on priority projects, solving the genuinely hard security problems and turning the solutions into reusable platform capability and repeatable practice. What We Look For In You Strong computer science and security fundamentals — deep understanding of operating systems, networking, compilers and the JVM, distributed systems, application security, cloud-native security, and supply chain security. Both breadth and depth. Expert-level Java, with hands-on depth in the JVM, ClassLoader, Java Agent, ASM, ByteBuddy, bytecode instrumentation, and performance profiling and tuning. Plus working proficiency in Python or Go. Substantial production experience with RASP, SAST, DAST, IAST, SCA, image security, and code scanning — enough to design a capability, integrate the engine, build the platform around it, and take it to scale independently. Real offensive and defensive experience. You understand the root causes, exploitation paths, detection logic, bypass techniques, and fixes for common web, API, and microservices vulnerabilities — and can design from both the attacker's and defender's point of view. Fluency with LLMs and AI Agents, including a considered view on model capability limits, agent architecture, tool calling, context engineering, evaluation methods, and how AI is reshaping both security engineering and the attack surface. Strong engineering execution paired with product instinct — able to lead the design and delivery of security products, platform modules, and SDKs/Agents while balancing security outcomes against performance overhead, integration cost, and long-term operability. Exceptional ownership, cross-team communication, and the persistence to move security governance, rule enforcement, and remediation through to a clear result. Nice to Haves Security engineering experience at a top-tier internet company, cloud provider, or leading security vendor You've led the build of a DevSecOps platform, application security platform, RASP, code scanning platform, or cloud-native security platform Background in security product development, SDK/Agent engineering, vulnerability research, red team exercises, or purple team work Shipped AI + Security work — security copilots, intelligent rule generation, automated analysis, or remediation recommendation systems Perks & Benefits Competitive total compensation package L&D programs and Education subsidy for employees' growth and development Various team building programs and company events Wellness and meal allowances Comprehensive healthcare schemes for employees and dependants More that we love to tell you along the process! Notice: All official OKX vacancies are published on this website. While roles may appear on selected third-party platforms from time to time, information on other sites may be inaccurate or outdated. If in doubt, please apply directly through our official careers website. Information collected and processed as part of the recruitment process of any job application you choose to submit is subject to OKX 's Candidate Privacy Notice .

Location: Remote, Singapore GitLab is the intelligent orchestration platform for DevSecOps. GitLab enables organizations to increase developer productivity, improve operational efficiency, reduce security and compliance risk, and accelerate digital transformation. More than 50 million registered users and more than 50% of the Fortune 100* trust GitLab to ship better, more secure software faster. The same principles built into our products are reflected in how our team works: we embrace AI as a core productivity multiplier, with all team members expected to incorporate AI into their daily workflows to drive efficiency, innovation, and impact. GitLab is where careers accelerate, innovation flourishes, and every voice is valued. Our high-performance culture is driven by our values and continuous knowledge exchange, enabling our team members to reach their full potential while collaborating with industry leaders to solve complex problems. Co-create the future with us as we build technology that transforms how the world develops software. * Fortune 500® is a registered trademark of Fortune Media IP Limited, used under license. Claim based on GitLab data. Fortune 100 refers to the top 20% ranked companies in the 2025 Fortune 500 list, published in June 2025. Fortune and Fortune Media IP Limited are not affiliated with, and do not endorse products or services of GitLab. An overview of this role As a Customer Success Architect, you'll serve as a trusted strategic advisor and technical authority to some of GitLab's most complex and high-value Enterprise and Government customers across Singapore. In this role, you will be driving and shaping how our largest customers adopt GitLab's intelligent DevSecOps platform to achieve their business goals and realise meaningful, long-term outcomes. You will be working closely with customers after the sale to turn pre-sales command plans into clear success plans, guide them through their customer journey, and drive adoption, utilization, and technical maturity. You will also be directly influencing renewal and expansion decisions through your post-sales engagements with executive-level decision makers in the account. This is a senior individual-contributor role for someone who has already led high-stakes pre or post sales customer engagements in large complex accounts across multiple industry domains to drive quantifiable business outcomes..The individual is comfortable operating with  ambiguity, and can credibly advise VP- and C-level stakeholders on business transformation, application modernization, platform strategy, architecture, and organizational DevSecOps transformation. You'll also be shaping playbooks and best practices, and acting as an escalation point for the team's most technically or politically complex situations. Reporting into the APJ Customer Success organization, you'll own a portfolio of GitLab's most strategic enterprise and Government accounts, act as the executive-level technical liaison for these accounts, and drive cross-functional resolution of their highest-priority issues — coordinating and, where needed, directing the efforts of Product Management, Engineering, Sales, Professional Services, and Support. You'll bring deep technical expertise in CI/CD, cloud platforms, multi-cloud, hybrid architecture and enterprise DevSecOps practices.You will use that expertise to shape customers' long-term platform strategy, apply best practices, configure GitLab for their environments and stay current with platform capabilities. In your first year, success will look like establishing yourself as the trusted senior advisor across a portfolio of flagship accounts, building strong relationships with key stakeholders, materially improving and increasing platform maturity, leading retention and renewal conversations, increasing customer satisfaction across your portfolio and contributing to the broader CSA team's technical standards and ways of working. Some examples of our projects: Turning pre-sales command plans into measurable customer success plans that align technical adoption with business outcomes Leading and driving the technical strategy behind a large-scale DevSecOps platform consolidation for a regulated Enterprise account or Government, including guiding enterprise customers on GitLab best practices across CI/CD, DevSecOps, cloud architecture, TCO, applying compliance and architecture as well as business case presentations to customer executives Owning end-to-end resolution of a critical, multi-team escalation for a flagship account — driving root cause analysis, coordinating Engineering/Product/Support, and personally briefing customer executives on remediation What you’ll do Owns a book of Enterprise and Government customers and drive adoption, retention, expansion, and overall satisfaction through ongoing strategic, business and technical engagement. Serves as the senior post-sales strategic, business and technical advisor for a portfolio of GitLab's most complex, highest-value enterprise and Government accounts, shaping multi-year platform and DevSecOps strategy in partnership with customer executives, coordinating responses to questions, issues, and escalations across Support, Product Management, Sales, and Professional Services. Translates ambiguous, high-stakes business outcomes into rigorous Customer Success Plans that are regularly reviewed with customer stakeholders. The Customer Success Plans contain clearly defined business outcome related goals, quantifiable benefits, realistic adoption milestones and remediation actions. Prepares executive-ready reporting conducted on a regular basis with clear accountability for outcomes that demonstrate impact on adoption, retention, and expansion of GitLab products and services. Provides deep technical guidance on enterprise-scale CI/CD architecture, DevSecOps maturity models, platform consolidation strategy, including advising on complex trade-offs (e.g., multi-cloud vs. hybrid, self-managed vs. GitLab Dedicated, etc). Owns the full lifecycle of your account portfolio's adoption, retention, and expansion outcomes, with direct accountability for the commercial and technical health of flagship relationships. Leads end-to-end resolution of critical, cross-functional account escalations, ensuring root causes are identified, follow-up actions are owned, holding internal teams accountable to timelines, driving the root cause analysis and personally managing executive communication and risk. Leads end-to-end resolution of critical, cross-functional account escalations, ensuring   root causes are identified, follow-up actions are owned, holding internal teams accountable to timelines, driving the driving root cause analysis and personally managing executive communication and risk. Designs and delivers technical enablement programs at scale, identifying systemic maturity gaps across a portfolio and building the roadmap (not just individual sessions) that closes them. Advises key customers stakeholders on cloud and platform architecture decisions with enterprise-wide impact, which includes  multi-region deployment strategy, secrets management architecture and network/security topology for regulated environments. Guides customers on GitLab platform best practices including Git workflows, branching strategies, CI/CD pipeline design, DevSecOps adoption patterns, and security scanning configuration. Provides hands-on technical enablement and onboarding, including education on GitLab features, releases, and use cases, and identification of training and maturity opportunities aligned to customer goals. Engages customers on cloud platform architecture decisions relevant to their GitLab deployment — including self-managed vs. GitLab Dedicated, Runner configuration and auto-scaling, secrets management, and network topology considerations. Advises customers on DevSecOps consolidation value — articulating the TCO, compliance, and developer experience case for platform consolidation over fragmented toolchains. Collaborates with Professional Services, Sales, and internal teams to identify expansion opportunities, recommend enablement interventions, and ensure a seamless customer journey from onboarding through renewal. What you’ll bring Must be a Singapore Citizen and based in Singapore Mandatory English language proficiency Hands-on experience building or owning CI/CD pipelines end to end, including pipeline as code, multi-stage design, artifact management, and troubleshooting in real-world environments. A career built across different direct customer facing engagement roles such as Technical Account Management, Technical Solution Sales, Pre-sales, Business Development, Consulting, Professional services across customers in different industry vertical domains like Government, Banking, Financial and Insurance Services, Manufacturing, Telecommunications, engagement with multiple technology and platform transition experience such as from on-premise deployments to Cloud, application modernization experience from monolith to microservices,  from Waterfall to DevOps to DevSecOps and others to provide the depth and breadth of experience to advise customers on transformations and deployments that you've already seen play out elsewhere across your multiple customer engagements, more than once. A long-standing demonstrated track record as the person other senior people call when an account is in genuine crisis or  gained across a sustained career of Enterprise or Government account ownership Credible judgment earned by personally owning the outcomes of dozens of complex enterprise customer account engagements over the course of a career, including situations with real commercial, technical, and reputational stakes A consistent track record of being trusted by customer executives and internal leadership to operate with minimal oversight in ambiguous and high-pressure situations Deep,hands-on expertise in DevSecOps practices, including shift-left security and integrating SAST, DAST, SCA, and container scanning into development workflows as well as architecting and troubleshooting CI/CD pipelines at enterprise scale Expert-level understanding of Git, merge request workflows and delivery lifecycles, having personally guided organizations through branching strategies such as trunk-based development and GitFlow, and modern software delivery lifecycles. Demonstrated experience with infrastructure as code, GitOps, Cloud and on-premises environments with relevant experience that support GitLab deployments, including networking, identity and access management (IAM), secrets management, and deployment considerations for regulated or high-security environments Demonstrated experience partnering with customers to turn business requirements into actionable success plans, with measurable goals and verifiable business outcomes that are suitable for executive-level quarterly reporting. Demonstrated ability to drive product adoption, dive deep into the accounts assigned and scale out the level of influence in the account. Demonstrated ability to build and defend executive-level business cases (TCO, compliance, risk) that influence budget and platform strategy decisions Demonstrated ability to operate with autonomy in ambiguous, high-stakes situations with strong communication, stakeholder management, and organizational experience  to manage a portfolio of enterprise and Government customers, balance multiple priorities, guide escalations, and coordinate effectively across customer teams and internal cross functional teams to resolve issues appropriately and in a timely manner. About the team The Customer Success Architect team is part of GitLab's Customer Experience organization. It supports strategic enterprise and Government accounts across the APJ region through hands-on technical guidance, consultative partnership, and practical problem solving. We act as a reliable technical advisor and an important link between customers and the broader GitLab ecosystem. We bring platform, cloud, and DevSecOps depth to customer engagements and work closely with Product Management, Engineering, Sales, Support, and Professional Services to address questions, guide customers through technical choices, navigate escalations, and help them realize measurable value from GitLab. Composed of team members working remotely across time zones, we operate asynchronously to support a focused set of strategic accounts across the region. It's a team well suited for people who enjoy solving complex customer challenges, building long-term partnerships, and helping enterprise organizations grow their maturity with GitLab in practical, measurable ways. How GitLab Supports Full-Time Employees Benefits to support your health, finances, and well-being Flexible Paid Time Off Team Member Resource Groups Equity Compensation & Employee Stock Purchase Plan Growth and Development Fund Parental Leave Please note that we welcome interest from candidates with varying levels of experience; many successful candidates do not meet every single requirement. Additionally, studies have shown that people from underrepresented groups are less likely to apply to a job unless they meet every single qualification. If you're excited about this role, please apply and allow our recruiters to assess your application. Country Hiring Guidelines: GitLab hires new team members in countries around the world. All of our roles are remote, however some roles may carry specific location-based eligibility requirements. Our Talent Acquisition team can help answer any questions about location after starting the recruiting process. Privacy Policy: Please review our Recruitment Privacy Policy. Your privacy is important to us. GitLab is proud to be an equal opportunity workplace and is an affirmative action employer. GitLab’s policies and practices relating to recruitment, employment, career development and advancement, promotion, and retirement are based solely on merit, regardless of race, color, religion, ancestry, sex (including pregnancy, lactation, sexual orientation, gender identity, or gender expression), national origin, age, citizenship, marital status, mental or physical disability, genetic information (including family medical history), discharge status from the military, protected veteran status (which includes disabled veterans, recently separated veterans, active duty wartime or campaign badge veterans, and Armed Forces service medal veterans), or any other basis protected by law. GitLab will not tolerate discrimination or harassment based on any of these characteristics. See also GitLab’s EEO Policy and EEO is the Law . If you have a disability or special need that requires accommodation , please let us know during the recruiting process .

Location: Boston, MA Workplace: OnSite At WHOOP, we're on a mission to unlock and inspire performance for life. WHOOP empowers members to perform at a higher level and live longer through a deeper understanding of their bodies and daily lives. Protecting our members’ data and ensuring our systems scale securely and reliably is core to this mission. As a Director of Product Security you will play a critical role in shaping, driving, and leading our software engineering teams towards a secure software development lifecycle and strengthening product-facing identity and authentication capabilities that protect our members. This role will strategically craft the roadmap in collaboration with stakeholders across the business and staff the team to fulfill growing security needs across engineering. In addition to core product security responsibilities, you will partner closely with functions across Product, Software, Legal, Compliance, and enterprise security to meaningfully move the security posture of the company. We are seeking a leader and strategic partner with prior experience driving the engineering side of security for software teams. RESPONSIBILITIES - Build, lead, and grow multiple engineering teams executing on product-facing security strategy, including member authentication, code security, cloud security across AWS accounts, privacy by design, and threat modeling. - Lead application vulnerability management programs across bug bounties, code vulnerabilities, container vulnerabilities, and infrastructure vulnerabilities. - Build, integrate, and mature DevSecOps tooling and developer security controls, including SAST, SCA, container scanning, secrets detection, CI/CD security checks, and secure-by-default developer workflows. - Define and communicate long-term product security strategy, product architecture standards, and design principles for product-facing systems. - Partner with engineering, office of the CISO, and compliance leadership to embed privacy and security by design across the software development lifecycle. - Establish and enforce best practices, standards, and processes for secure software development, testing, and deployment. - Provide mentorship, guidance, and career development for engineering managers and individual contributors. - Foster a culture of innovation, teamwork, psychological safety, and continuous learning within the Product Security organization. QUALIFICATIONS - Demonstrated success scaling a security team whilst crafting clear and efficient team domains. - Proven experience as a technical leader managing multiple teams or a growing security engineering organization. - Experience growing high level individual contributor career growth at the staff level or higher. - Deep understanding of product security principles, including vulnerability management, data privacy, threat modeling, secure SDLC practices,and secure-by-default engineering patterns. - Experience building or integrating developer security tooling to improve secure-by-default practices. - Strong technical background in software development, testing, and deployment processes. - Excellent communication, interpersonal, and leadership skills with the ability to influence across teams and levels. BONUS QUALIFICATIONS - Experience with AWS cloud environments and data-driven decision-making. - Hands-on experience with containerized microservice environments. - Background in incident response and post-mortem analysis for security events. - Familiarity with automation frameworks for vulnerability scanning, compliance checks, or infrastructure security. ABOUT YOU - You’re a strategic and people-focused leader who thrives on balancing hands-on technical oversight with long-term organizational growth. - You have experience building and scaling security engineering focused teams. - You’re passionate about creating secure, privacy-first systems that protect member data and enable innovation. - You collaborate effectively across technical and non-technical teams and can operate confidently in both strategic and tactical domains. - Above all, you believe that security enables innovation, and you lead by fostering a culture that supports both speed and safety. Learn more about our Software Org and how to be successful in your engineering career at WHOOP via our Career Framework https://engineering.prod.whoop.com/careerframework.   This role is based in the WHOOP office located in Boston, MA. The successful candidate must be prepared to relocate if necessary to work out of the Boston, MA office.   Interested in the role, but don’t meet every qualification? We encourage you to still apply! At WHOOP, we believe there is much more to a candidate than what is written on paper, and we value character as much as experience. As we continue to build a diverse and inclusive environment, we encourage anyone who is interested in this role to apply.   WHOOP is an Equal Opportunity Employer and participates in E-verify https://www.e-verify.gov/ to determine employment eligibility. It is unlawful in Massachusetts to require or administer a lie detector test as a condition of employment or continued employment. An employer who violates this law shall be subject to criminal penalties and civil liability.

Location: Hybrid About Us At Cloudflare, we are on a mission to help build a better Internet. Today the company runs one of the world’s largest networks that powers millions of websites and other Internet properties for customers ranging from individual bloggers to SMBs to Fortune 500 companies. Cloudflare protects and accelerates any Internet application online without adding hardware, installing software, or changing a line of code. Internet properties powered by Cloudflare all have web traffic routed through its intelligent global network, which gets smarter with every request. As a result, they see significant improvement in performance and a decrease in spam and other attacks. Cloudflare was named to Entrepreneur Magazine’s Top Company Cultures list and ranked among the World’s Most Innovative Companies by Fast Company. At Cloudflare, we’re not looking for people who wait for a polished roadmap; we’re looking for the builders who see the cracks in the Internet that everyone else has simply learned to live with. We value candidates who have the instinct to spot a "normalized" problem and the AI-native curiosity to create a solution using the latest tools. Our culture is built on iteration, leveraging AI to ship faster today to make it better tomorrow, while ensuring that every improvement, no matter how small, is shared across the team to lift everyone up. If you’re the type of person who values curiosity over bureaucracy, and that AI is a partner in solving tough problems to keep the Internet moving forward, you’ll fit right in. Available Locations: Austin, TX About the role As a Senior Product Security Engineer, you will lead security assessments and vulnerability operations for Cloudflare’s core software products. In this role, you will analyze system architecture, threat model new features, and ensure that product-related security findings are accurately triaged, routed to the correct engineering owners, and mitigated within our SLAs. On any given day, you might conduct a deep-dive security review on a new feature design, triage a complex bug bounty submission, or work directly with engineering teams to resolve vulnerabilities from different sources like bug bounties, SAST, fuzzing and penetration tests. You will also work autonomously to identify areas where our manual processes slow down. You will write code and integrate AI/LLM solutions to automate initial triage and data enrichment, building tools that help the team handle security findings at scale. In short, your work will sit at the intersection of Product Security, Vulnerability Operations, and internal AI Tooling. Ideally, you have experience in conducting academic/vulnerability research with a focus on systems security. Responsibilities Autonomously Drive AI Security Innovation: Proactively identify gaps in our current capabilities and independently architect, build, and deploy AI-driven solutions to automate code analysis, optimize triage, and scale Product Security workflows. Security Architecture & Threat Modeling: Lead deep-dive security reviews and complex threat modeling sessions across distributed systems, embedding strict security requirements into product designs before development begins. Product-Focused Vulnerability Management: Own the lifecycle of product security findings. Ensure vulnerabilities are accurately triaged, mapped to the correct engineering owner, and mitigated in alignment with established SLAs. Bug Bounty Leadership: Oversee the technical triage and validation of Cloudflare’s external Bug Bounty program, prioritizing submissions based on real-world exploitability and business risk. Pentest Strategy & Support: Shape the scope of internal and external penetration testing engagements, serving as the technical liaison to ensure findings are deeply understood and remediated by development teams. Strategic Influence & Mentorship: Act as a force-multiplier for security across Cloudflare; mentor junior engineers, cultivate security champions within engineering organizations, and establish modern, paved-road developer guardrails. Desirable Skills, Knowledge, and Experience: Senior-Level Product/AppSec Expertise: Extensive, battle-tested experience in Product or Application Security within large-scale distributed cloud environments or SaaS platforms. Practical AI & Automation Engineering: Demonstrated ability to build production-grade automation scripts and tools . Must possess hands-on engineering experience leveraging AI/LLMs to solve operational or technical challenges. Advanced Threat Modeling & Risk Analysis: Mastery of threat modeling methodologies (e.g., STRIDE) and an analytical mindset capable of translating complex theoretical risks into prioritized, actionable business context. Vulnerability Lifecycle Ownership: Proven track record of managing, routing, and driving the remediation of vulnerabilities across multi-stakeholder engineering organizations while strictly enforcing SLAs. High Influence & Communication: Superb cross-functional leadership skills; the ability to confidently influence senior engineering leaders, resolve ownership ambiguity, and champion security initiatives without explicit authority. Bonus points: Offensive Mastery: Familiarity with offensive security tooling and modern exploitation techniques used during professional penetration testing. Program Management Experience: Experience scaling crowdsourced security programs (e.g., HackerOne, Bugcrowd) or optimizing agile project management workflows within JIRA. Experience in integrating hardware security features into production code bases Equity This role is eligible to participate in Cloudflare’s equity plan. Benefits Cloudflare offers a complete package of benefits and programs to support you and your family.  Our benefits programs can help you pay health care expenses, support caregiving, build capital for the future and make life a little easier and fun!  The below is a description of our benefits for employees in the United States, and benefits may vary for employees based outside the U.S. Health & Welfare Benefits Medical/Rx Insurance Dental Insurance Vision Insurance Flexible Spending Accounts Commuter Spending Accounts Fertility & Family Forming Benefits On-demand mental health support and Employee Assistance Program Global Travel Medical Insurance Financial Benefits Short and Long Term Disability Insurance Life & Accident Insurance 401(k) Retirement Savings Plan Employee Stock Participation Plan Time Off Flexible paid time off covering vacation and sick leave Leave programs, including parental, pregnancy health, medical, and bereavement leave What Makes Cloudflare Special? We’re not just a highly ambitious, large-scale technology company. We’re a highly ambitious, large-scale technology company with a soul. Fundamental to our mission to help build a better Internet is protecting the free and open Internet. Project Galileo : Since 2014, we've equipped more than 2,400 journalism and civil society organizations in 111 countries with powerful tools to defend themselves against attacks that would otherwise censor their work, technology already used by Cloudflare’s enterprise customers--at no cost. Athenian Project : In 2017, we created the Athenian Project to ensure that state and local governments have the highest level of protection and reliability for free, so that their constituents have access to election information and voter registration. Since the project, we've provided services to more than 425 local government election websites in 33 states. 1.1.1.1 : We released 1.1.1.1 to help fix the foundation of the Internet by building a faster, more secure and privacy-centric public DNS resolver. This is available publicly for everyone to use - it is the first consumer-focused service Cloudflare has ever released. Here’s the deal - we don’t store client IP addresses never, ever. We will continue to abide by our privacy commitment and ensure that no user data is sold to advertisers or used to target consumers. Sound like something you’d like to be a part of? We’d love to hear from you! Please note that applicants who progress to the offer stage of the interview process may be asked to attend an in-person interview within one of the Cloudflare Offices or Cloudflare Hubs.  More details about this will be available at that stage of the interview process. This position may require access to information protected under U.S. export control laws, including the U.S. Export Administration Regulations. Please note that any offer of employment may be conditioned on your authorization to receive software or technology controlled under these U.S. export laws without sponsorship for an export license. Cloudflare is proud to be an equal opportunity employer.  We are committed to providing equal employment opportunity for all people and place great value in both diversity and inclusiveness.  All qualified applicants will be considered for employment without regard to their, or any other person's, perceived or actual race, color, religion, sex, gender, gender identity, gender expression, sexual orientation, national origin, ancestry, citizenship, age, physical or mental disability, medical condition, family care status, or any other basis protected by law. We are an AA/Veterans/Disabled Employer. Cloudflare provides reasonable accommodations to qualified individuals with disabilities.  Please tell us if you require a reasonable accommodation to apply for a job. Examples of reasonable accommodations include, but are not limited to, changing the application process, providing documents in an alternate format, using a sign language interpreter, or using specialized equipment.  If you require a reasonable accommodation to apply for a job, please contact us via e-mail at hr@cloudflare.com or via mail at 101 Townsend St. San Francisco, CA 94107.