Вакансии

Location: Serbia Who we are: Action1 is an autonomous endpoint management platform trusted by many Fortune 500 companies. Cloud-native, infinitely scalable, highly secure, and configurable in minutes, it just works—and is always free for the first 200 endpoints, with no functional limitations. By pioneering autonomous OS and third-party patching, peer-to-peer patch distribution, and real-time vulnerability assessment without requiring a VPN, Action1 eliminates routine IT labor, helps prevent ransomware and other security risks, and protects the digital employee experience. In 2025, Action1 was recognized by the Inc. 5000 as the fastest-growing private software company in America. Action1 is founder-led by Alex Vovk and Mike Walters, entrepreneurs who previously founded Netwrix, a multibillion-dollar cybersecurity company. The Role We are looking for a Product Security Engineer to join the team responsible for securing Action1’s multi-tenant SaaS platform. In this role, you will work closely with engineering, product, and security teams to identify risks early, support vulnerability handling, strengthen secure development practices, and make product security practical, clear, and actionable. This is a hands-on role for someone who understands both software engineering and cybersecurity, enjoys working directly with developers, and wants to build security into the product without slowing teams down unnecessarily. What you'll do: Support Product Security Incident Response Team (PSIRT) and vulnerability-handling activities Validate, triage, track, and coordinate security reports Provide practical remediation guidance to engineering teams Help validate security fixes and reduce product security risks Review code, APIs, and system architecture to identify security issues early Conduct threat modeling and security design reviews Improve security automation within engineering workflows Support SAST, SCA, secrets scanning, and other security controls Maintain software bills of materials (SBOMs), dependency visibility, and remediation follow-up Support security assessments, vulnerability assessments, and penetration testing Maintain vulnerability-handling playbooks, product security procedures, and incident response runbooks Requirements What we are looking for: 3+ years of experience in product security, application security, DevSecOps, or a related cybersecurity field Strong software engineering background and the ability to work effectively with engineering teams Understanding of application, API, infrastructure, and software supply chain security risks Experience applying cloud security concepts and practices Understanding of identity and access management, network security, logging, monitoring, and secure cloud architecture patterns Familiarity with vulnerability management, incident response, security assessments, and secure software development lifecycle practices Experience with threat modeling and security design reviews Strong communication skills, including professional communication with external security researchers and vendors Ability to work independently and collaboratively in a fast-moving environment Nice to have: Genuine interest in cybersecurity and motivation to grow as a product security expert Hands-on experience with AWS security controls, best practices, and architecture patterns Hands-on experience with C++ or JavaScript Experience with security testing and automation using scripts, APIs, CI/CD pipelines, or specialized tools Experience conducting threat modeling for SaaS, API, cloud, or on-premises product components Experience with SBOM generation, dependency visibility, or software supply chain security Benefits What we offer: A fully remote work environment The opportunity to work on a real-world security product used by IT and security teams High ownership and a direct impact on product security practices Close collaboration with engineering, product, and security teams A fast-growing software company with low bureaucracy and practical decision-making The opportunity to improve security processes, automation, and engineering workflows A supportive team that values clear thinking, ownership, and continuous learning

Location: Remote; Serbia; Poland Workplace: Remote We are looking for a Senior Penetration Tester to strengthen the security of high-load products by identifying vulnerabilities across applications, infrastructure, cloud environments, and payment flows. In this role, you will work closely with engineering, product, fraud, and compliance teams to improve security posture through offensive security assessments and practical remediation. Responsibilities: - Plan and execute penetration testing activities across web applications, APIs, mobile applications, internal and external infrastructure, and AWS cloud environments - Perform offensive security exercises, including red team and assumed-breach scenarios covering privilege escalation, lateral movement, persistence, and data exfiltration - Assess the security of cloud-native services, Kubernetes environments, microservices, and CI/CD pipelines - Identify vulnerabilities affecting payment systems, wallets, KYC/AML processes, bonus mechanisms, affiliate tracking, and other business-critical workflows - Work with Product, Engineering, AppSec, Payments, and Fraud teams to prioritize findings and support remediation efforts - Develop custom scripts and internal tools to improve testing capabilities where standard solutions are insufficient - Contribute to threat modeling activities and support secure-by-design initiatives - Review penetration testing plans, reports, and provide technical guidance to junior and middle security specialists - Research emerging vulnerabilities, MITRE ATT&CK techniques, security advisories, and translate them into actionable improvements - Support security assessments for new products, releases, and market launches, including effort estimation and pre-certification activities - Act as a security advisor for technical and business stakeholders on offensive security matters Requirements: - 4+ years of hands-on experience in penetration testing or offensive security - Proven practical experience in at least three of the following areas: - Web applications / APIs - Internal networks - External infrastructure - Cloud environments (AWS/GCP) - Mobile applications (iOS/Android) - OSCP or an equivalent offensive security certification - Strong knowledge of SAST, SCA, DAST, AWS/GCP, MITRE ATT&CK, OWASP ASVS, OWASP WSTG, and PTES - Good understanding of application architecture, including MVC and data flow principles - Knowledge of supply chain attack techniques - Experience writing scripts in Python and Bash - Understanding of IAM models within at least one major cloud provider - Hands-on experience testing Kubernetes-based environments, cloud-native applications, CI/CD pipelines (GitLab, GitHub Actions, Jenkins) and Infrastructure as Code solutions (Terraform, Helm, CloudFormation) - Strong reporting, documentation, and communication skills - Ability to balance security priorities with business and release deadlines - Solid understanding of security frameworks and compliance standards, including PCI DSS, ISO 27001, NIST, and GDPR - At least Upper-Intermediate level of English Would be a plus: - Advanced offensive security certifications such as OSWE, OSEP, OSED, CRTO, BSCP, ARTE, or GRTE - Experience designing secure architectures for Kubernetes and AWS environments - Previous background in iGaming, fintech, or payment products - Public security research, CVEs, advisories, technical publications, or conference presentations - Completion of HTB Pro Labs or strong CTF achievements - Contributions to open-source offensive or defensive security projects What's in it for you: - Fully remote working format - Competitive salary based on experience - Paid annual leave and sick leave - Opportunities for professional and career growth - Supportive environment focused on continuous development and long-term growth

RELOCATION TO UAE CoreConnect, a flagship product by VentureOne, the commercialization arm of the Advanced Technology Research Council, acts as the digital glue within the complex ecosystem of autonomous mobility in logistics. CoreConnect is building the infrastructure layer for autonomous operations in complex ecosystems. We develop a robot orchestration platform that enables logistics and other operators to deploy, manage, and scale fleets of autonomous robots across real-world environments. Our technology sits at the intersection of robotics, operations software, and intelligent automation. Role Overview We are seeking a Senior Software Engineer (Backend) who prioritizes system reliability and product impact. You will be a key contributor to CoreConnect, developing a scalable Hexagonal Backend API service that serves as the primary interface for our commercial ecosystem. We value engineers who operate with a high degree of autonomy, technical pragmatism, and a commitment to operational excellence. We are specifically looking for candidates who demonstrate ownership, pragmatism, and feel comfortable with navigating ambiguity. Key Responsibilities Core Engineering & Architecture: Design, implement, and optimize scalable Kotlin Spring Boot backend services using a Hexagonal architecture for high-performance fleet orchestration. Data & Integration Strategy: Manage complex data layers (Postgres/PostGIS, TimescaleDB) and develop a Unified Abstraction Layer to integrate diverse autonomous vehicle APIs for fleet-agnostic control. Real-time Systems & Optimization: Drive the technical roadmap for real-time data engineering, resolving bottlenecks in high-frequency data ingestion (MQTT/WebSockets) to ensure sub-second latency. Security, Scalability & Observability: Enforce standards for platform security and observability, implementing Multi-tenant Architecture (RLS) and Role-Based Access Control (RBAC). Cross-Functional Collaboration: Partner closely with Product, Engineering Leadership, and DevSecOps to build high-quality solutions that drive measurable business outcomes. Engineering Culture: Mentor engineers, lead rigorous code reviews, introduce process improvements, and foster a culture of operational excellence. Qualifications Experience & Education: Bachelor’s degree or higher in Computer Science or other relevant fields and 5+ years of professional experience with Java or Kotlin and Spring Boot delivering well-tested, complex systems in a SaaS startup environment. Architecture & Data Mastery: Deep proficiency in distributed systems, Hexagonal Architecture, and scalable API design. Expertise in SQL (PostgreSQL), geospatial data (GIS/PostGIS), and time-series data (TimescaleDB). Real-Time & Integrations: Experience architecting low-latency communication (WebSockets, MQTT) and building abstraction layers for third-party vendor APIs. Mindset & Execution: Proven ability to navigate ambiguity, balance architectural purity with commercial objectives (managing technical debt, shipping MVPs), and take full ownership of the code lifecycle and incident management (root-cause analysis and prevention). Security & Quality: A consistent focus on software quality and security best practices with hands-on experience in automated testing (unit and integration test suites), SAST, DAST, and setting up platform observability tooling. Complementary Expertise: Frontend Proficiency: Practical experience building interfaces with React or Next.js and TypeScript. Infrastructure & DevOps: Mastery of cloud environments, specifically AWS and Kubernetes (EKS), along with CI/CD pipelines and Infrastructure as Code (Terraform or Helm). Industry Experience: Direct background in logistics, robotics, or fleet management systems. Communication: Fluency in Business English is a must. What We Offer We provide a competitive, tax-free salary and a comprehensive benefits package in a collaborative, innovative, and inclusive work environment. Our benefits include an education allowance, free on-site meals, annual flight allowance, health coverage, relocation support (if applicable), and access to well-being activities such as sports and recreational events. Join us to drive innovation and shape the future of technology!

Role Description The Risk Manager - Platform Risk reports to the Senior Manager of Risk Management and IT Compliance team within Tech Risk Operations (TRO). This is a first-line of defense risk team responsible for Central Tech business unit risks & Security risks across the company. The Risk Manager - Platform Risk is a people manager role, focused on leading a team of individuals to enable consistent identification of technology-related risks for key Central Tech business unit technology platforms. These technology platforms enable the business to build and run in-house developed applications that support the core of our Business. The Risk Manager - Platform Risk possesses both a strong technical understanding of DevOps IT technology and expertise in various risk domains. These domains include cybersecurity, IT, privacy, regulatory compliance, broader enterprise risks, Trust & Safety, cybersecurity regulatory compliance, and e-commerce fraud. This role involves identifying technology-related risks across core DevOps technology platforms, encompassing both public cloud and on-premise infrastructure. This includes (but is not limited to) public and private cloud platforms, like AWS, GCP, Azure, Kubernetes, Gitlab, CI/CD Tooling, etc. This role also requires embedding secure software development principles and tooling (SAST, DAST, SCA) into BAU development practices, to apply them effectively to DevOps technology platforms. The Risk Manager - Platform Risk is also a subject matter expert leveraging a deep understanding of the enterprise risk discipline combining deep knowledge of theory and organizational practice or expertise across several different disciplines within a function. Effective first-line risk professionals are adaptable individuals who can engage with diverse senior technical stakeholders (Senior Engineering Managers, Product Owners, developers, etc.) This necessitates strong communication skills, technical proficiency, an ability to foster collaboration, incorporate different viewpoints, and steer efforts toward positive business results in managing IT risks and ensuring IT regulatory compliance obligations are met. This position requires strong stakeholder management skills and requires an individual who can convince others who are skeptical or unwilling to accept new concepts, practices and approaches. This position involves extensive collaboration with senior technical stakeholders to ensure the consistent maintenance of existing IT controls across the organization. Success in this role requires exceptional stakeholder management skills, including the ability to build strong relationships, effectively communicate complex information, and persuasively influence individuals and teams, even when faced with resistance to necessary changes and the adoption of new security protocols. The ability to navigate organizational complexities and foster a culture of IT risk management, security awareness and compliance is critical. This role is also a people manager position and is fully responsible for managing a team of individuals and continuously improving the area under their scope. This manager will be responsible for leading and managing a team of internal and/or external resources (e.g. Risk Analysts, Risk Officers, consultants). They are comfortable leading a team to come up with robust, scalable and automated solutions that mitigate key risks while enabling successful business operations across multiple core platforms. Key Responsibilities and Duties — Attract, engage, develop, and retain talent to their full potential by fostering a supportive work environment that emphasizes continuous feedback, coaching, and mentorship programs, ensuring comprehensive growth for all crafts. — Coaching your team on and consistently role model the Booking values on Think Customer First, Own It, Learn Forever, Succeed Together, and Do the Right Thing. — Drive initiatives effectively involving multiple technical first-line senior stakeholders, re-prioritising tasks when beneficial. — Formulate and implement tactical plans and objectives within Platform Risk Management that are in alignment with Central Tech business objectives and ensure the achievement of annual goals. — Establish team priorities, delegate projects, allocate resources, and provide regular communication to management and business partners regarding business performance and project progress. — Advise first-line stakeholders with specialized knowledge and expertise in IT risk, cybersecurity and regulatory compliance risk. — Assume responsibility for the identification of technological risks and the formulation of control design proposals. — Offer guidance on control design that is sustainable and appropriately scaled, ensuring that solutions are commensurate with the complexity of the issues addressed and avoiding unnecessary overengineering. — Drive business engagement in the Central Tech business unit to provide risk and compliance awareness for teams that have a clear need to manage risks without significantly affecting their development velocity and/or play a key role towards achieving strategic objectives in the company. — Develop and maintain IT and security policies and procedures for secure software development & collaborate with development teams to integrate secure software development practices and principles into CI/CD pipelines. — Support senior stakeholders across central tech helping to promote and embed risk and compliance ownership across the business as well as to broaden and expand their knowledge base of both the internal and external risk environment. — Follow broader ERM strategy defined by R&C and implement it into execution within the first-line of defense (business) and drive continuous improvement of risk assessment methodologies through ongoing collaboration with second-line risk and controls teams, ensuring alignment with practical business objectives. — Support the team to identify ways to increase their business impact and improve the team’s product(s) and ways of working. — Liaise with other risk and audit teams (Risk and Controls, Internal Audit, external auditors, etc.) to provide a more in-depth technical risk perspective, as needed. — Stay current with emerging cyber threats and security best practices in DevOps environments. Knowledge and Skills — Strong risk and control or audit/assurance background with a deep understanding of operational and technology risk - L4 — Strong working experience with IT General Controls (ITGCs), especially in fast-paced DevOps environments — Strong understanding of technology risk management, controls, and compliance, especially for public cloud platforms and DevOps Tooling - L4 — Experience and understanding of applicable regulations such as Sarbanes Oxley, PCI-DSS, GDPR and CCPA - L4 — Familiarity with industry-standard Cybersecurity regulatory frameworks such as NIST, ISO27001 and CIS - L3 — Understanding of cybersecurity risks and data protection principles - L3 — Technical AWS certifications (AWS Certified Solutions Architect, AWS Certified Security) are a plus — Knowledge of secure software development practices and tooling (SAST, DAST, and SCA tools) — Ability to cultivate solid relationships with business partners in order to drive the adoption of the risk management culture — Thorough technical understanding of internal control requirements and design and experience in applying them in various businesses — Able to split large tasks into logical, manageable and decoupled actions which are managed effectively and delivered on time — Be flexible and agile in response to the change in business, change in stakeholder expectations and/or change in regulatory/operating environment of B.com Level of Education: Bachelor/Master Years of relevant Job Knowledge: Extensive Knowledge (8 - 12 years) Benefits & Perks — Headquarters located in one of the most dynamic and cosmopolitan cities in Europe: Amsterdam. — Contribute to a high‑scale, sophisticated, world‑class product and see the real‑time impact of your work on millions of travelers worldwide. — Be part of a truly international fast‑paced environment and performance‑driven culture. — Full relocation support for you and your family to move to Amsterdam. — We have fine‑tuned this process by successfully relocating hundreds of Technology professionals to Amsterdam in recent years. — Performance‑based company that offers 29 vacation days, career advancement, and lucrative compensation, including bonuses and stock potential. — Discount on Booking.com accommodations with the “Booking Deal” including other perks and benefits. — Company‑sponsored family and social activities to help our employees become integrated with each other and Dutch culture. — Diverse and creative colleagues from every corner of the world. — Health, life, and disability insurance*. — Annual paid time off and generous paid leave scheme including: parent, grandparent, bereavement, and care leave. — Hybrid working including flexible working arrangements, and up to 20 days per year working from abroad (home country). — Industry‑leading product discounts for yourself, friends, and family, including automatic Genius Level 3 status and quarterly Booking.com wallet credit. — Free access to online learning platforms, development and mentorship programs, and a complimentary Headspace membership. — On‑site meals, coffee, and snacks, including healthy and vegan options, daily*. — Benefits may vary slightly depending on location and contract type.

Location: Paris ABOUT MISTRAL Mistral provides full-stack AI solutions: from frontier models to developer tools, applications, and compute. We partner with enterprises tackling the hardest problems across high-stakes industries like finance, manufacturing, defense, healthcare, and the public sector, co-creating customized AI systems that they can run on their terms. We are a dynamic, collaborative team passionate about AI and its potential to transform society. Our diverse workforce thrives in competitive environments and is committed to driving innovation. Our teams are distributed between Europe, North America, Asia and the Middle East. We are creative, low-ego and team-spirited. Role Summary    We are seeking experienced Software Engineer, Developer Experience to own and fostering a collaborative, automated, and efficient software development lifecycle. In this role, you will collaborate closely with product engineering teams to ensure consistent code health, accelerate development velocity through well-maintained CI pipelines, faster builds, and secure release processes. Your mission: empowering our software engineering team with seamless workflows while securing our production environments.   Location: Paris 🇫🇷   What you will do   As a Software Engineer, Developer Experience, your responsibilities will include (but may not be limited to):   Developer Experience • Build, monitor, and enhance CI/CD pipelines to streamline development workflows and accelerate deployments. • Design, operate and maintain scalable, reliable and secure multi-cloud infrastructures • Identify areas for improvement and create innovative solutions that enable high developer velocity   Team Collaboration & Advocacy • Standardize DevOps practices to ensure consistency across all engineering teams. • Establish measurable KPIs for security performance, reliability, and compliance adherence. • Partner with development and operations teams to embed security into daily workflows. • Lead training initiatives to upskill teams on secure coding, threat modeling, and incident response. • Champion a security-first mindset, driving cultural adoption of DevSecOps principles across the organization.   Representative projects - Improve CI/CD and build systems - Optimize cloud registries (Docker, Azure, GCP) - Implement static and dynamic code analysis tool - Implement automated vulnerability analysis       About you   • 5+ years of successful experience in a similar role (DevOps, Developer Experience, Platform Engineer, Internal tooling engineer, SRE...)   • Strong proficiency in: - Scripting languages (Go, Python...) and software development best practices. - Developer experience engineering: developer workflow optimization, tooling and automation for productivity, real-time developer support and escalation paths - Site Reliability Engineering: CI/CD, containerization, orchestration, infra-as-code, monitoring, logging, alerting, observability...   • Exposure to: - Multi-cloud infrastructures (AWS / GCP / Azure or On-Prem) - Security Tools & Approaches: OWASP, SAST, DAST, SCA, vulnerability scanners   • Proven: - Problem-solving and communication skills — ability to contextualizing, gauging risks and getting buy-in for high stakes and impactful solutions. - Ownership, high agency and desire to improve things for others. - Autonomy, self-drive and ability to work well in a fast-paced startup environment. - Low ego and team spirit mindset.   WHAT WE OFFER We offer a comprehensive benefits package designed to support your well-being, growth, and work-life balance. Benefits vary by country and may include healthcare coverage, parental leave, retirement plans, relocation support, wellness programs, meal and transportation allowances, and other location-specific perks. For the most up-to-date details on benefits available in your location, please refer to our Benefits page https://app.notion.com/p/mistralai/Benefits-at-Mistral-36e6ba59a7fe836b93dd01737fcc27ef?source=copy_link. PRIVACY POLICY Your privacy matters to us. You can learn more about how we handle your personal data in our Applicant Privacy Policy https://legal.mistral.ai/terms/applicant-privacy-policy.

Location: Baku Workplace: onsite ABOUT YOU Xsolla seeks a security engineer to join a new security team during a critical build-out phase. You work across application security and infrastructure security - reviewing code, hardening cloud environments, supporting incident response, and partnering with engineering teams to improve security posture across the company. This is a generalist role well-suited to an early-team hire. You are comfortable working across domains rather than specializing in one, and you grow into deeper expertise as the team and program mature. You collaborate closely with the security program manager and work directly with engineering teams on secure design, findings, and remediation. Our tech stack includes GCP, vSphere/ESX, Kubernetes and container workloads, MariaDB, CockroachDB, Go, PHP, and Python. You do not need expertise in all of these, but you are comfortable navigating a mixed environment and learning what you need. As always true in job descriptions, there is an intangible value that is hard to capture. We look for a diverse set of perspectives and skills. Even if you don't match every requirement, we encourage you to apply if you think you can be highly successful in this role.   ABOUT US   Xsolla is a global commerce company with robust tools and services to help developers solve the inherent challenges of the video game industry. From indie to AAA, companies partner with Xsolla to help them fund, distribute, market, and monetize their games. Grounded in the belief in the future of video games, Xsolla is resolute in the mission to bring opportunities together, and continually make new resources available to creators. Headquartered and incorporated in Los Angeles, California, Xsolla operates as the merchant of record and has helped over 1,500+ game developers to reach more players and grow their businesses around the world. With more paths to profits and ways to win, developers have all the things needed to enjoy the game. For more information, visit xsolla.com. Responsibilities Perform Application Security Reviews - Conduct code reviews, run SAST / DAST and dependency scanning tools, and work with engineering to resolve findings. Participate in Threat Modeling - Contribute to threat modeling sessions for new features and architecture changes, helping identify risks early in the design process. Help Harden Cloud and Container Infrastructure - Work on GCP, Kubernetes, and IAM configurations to strengthen the security of our cloud and container environments. Participate in Pen Test Remediation - Help triage penetration test findings and work with engineering teams to implement fixes, coordinating closely with the security program manager. Partner with Engineering on Secure Design - Review architectures, advise on secure implementation patterns, and help teams make informed security decisions. Identify and Track Security Findings - Document findings, assess severity, and track them through the remediation lifecycle to resolution. Support Incident Response - Help investigate and document security events, contribute to root-cause analysis, and support containment efforts. Write Async Security Guidance - Produce advisories, best-practice documentation, and practical guidance that helps engineering teams build securely across time zones. Support Product Security - Work with partners on the security posture of customer-facing services, contributing to reviews and assessments as needed. What You Bring Foundational AppSec Knowledge - Understands common vulnerability classes, secure coding patterns, and how to conduct a meaningful code review. Cloud Environment Exposure - Has worked with GCP or a similar cloud provider and is comfortable with IAM , networking, and container concepts. Code Literacy - Reads and reviews code in one or more of: Go, Python, PHP. Does not need to be a software engineer, but can follow logic and spot issues. Security Tooling Familiarity - Has used or is familiar with SAST , DAST , or dependency scanning tools and understands how they fit into a development workflow. Strong Written Communication - Writes clear, concise async documentation - findings, advisories, guidance - that works across time zones and audiences. Collaborative Mindset - Partners effectively with engineering teams. Focuses on helping teams build securely rather than just identifying problems. Self-Directed with Growth Mindset - Eager to learn, comfortable with ambiguity, and able to make progress with minimal direction in a new and evolving team. Nice to Have Threat modeling experience; Hands-on Kubernetes or container security experience; Infrastructure security background - Linux, networking, vSphere/ ESX; Familiarity with NIST CSF , PCI , SOC 2, or ISO 27001 from a technical perspective; Detection engineering or incident response experience; Experience building security automation or internal tooling; Relevant certifications ( OSCP , GWAPT , CKS , or similar hands-on certs). Xsolla operates across multiple time zones. Strong written communication is essential - you will need to document your work clearly so findings and context are not lost across handoffs. We value directness, intellectual honesty, and follow-through. If you do not know something, say so and find out. If you find something, explain it clearly and see it through to resolution.

Location: Baku Workplace: onsite ABOUT YOU We are looking for a junior application security specialist to join a growing security team at Xsolla. This is a hands-on role where you will work closely with senior specialists to identify, assess, and help remediate security vulnerabilities across our products and infrastructure. You will be involved in day-to-day AppSec work - code reviews, vulnerability triage, threat modeling, and security testing. You are curious, detail-oriented, and eager to develop deep expertise in application security. You do not need to have all the answers, but you ask the right questions and follow through. This is a strong learning environment. You will be exposed to real-world security challenges in a payment platform operating at scale, and supported by experienced security specialists who will help you grow.   ABOUT US   Xsolla is a global commerce company with robust tools and services to help developers solve the inherent challenges of the video game industry. From indie to AAA, companies partner with Xsolla to help them fund, distribute, market, and monetize their games. Grounded in the belief in the future of video games, Xsolla is resolute in the mission to bring opportunities together, and continually make new resources available to creators. Headquartered and incorporated in Los Angeles, California, Xsolla operates as the merchant of record and has helped over 1,500+ game developers to reach more players and grow their businesses around the world. With more paths to profits and ways to win, developers have all the things needed to enjoy the game. For more information, visit xsolla.com. Responsibilities Triage Security Findings - Assess incoming bug bounty reports and scanner findings. Evaluate validity, calculate real severity, and escalate appropriately with clear written summaries. Assist with Vulnerability Assessments - Participate in security assessments of web applications and APIs. Help identify and document risks in new features and existing systems. Write Clear Security Documentation - Document findings, reproduction steps, and remediation guidance in a way that engineering teams can act on. Support Threat Modeling - Participate in threat modeling sessions. Learn to identify trust boundaries, data flows, and attack surfaces in system designs. Monitor Security Tools - Help operate SAST , DAST , and dependency scanning tooling. Track findings, reduce noise, and support remediation workflows. Support Code Reviews - Review code for common vulnerability classes under guidance of senior specialists. Learn to identify security issues across PHP, Python, and Go codebases. Stay Current - Follow developments in the security community. Bring awareness of new vulnerability classes, CVEs, and attack techniques relevant to our stack. What You Bring Web Security Fundamentals - Solid understanding of common vulnerability classes: OWASP Top 10, CSRF , XSS , IDOR , SQL injection, open redirect, authentication and session management weaknesses. You understand root causes, not just names. Web and Browser Fundamentals - Solid understanding of how web applications work: HTTP request/response cycle, client-server model, REST APIs, how browsers handle same-origin policy, cookies and their attributes, and CORS . This is the foundation everything else builds on. Security Testing Tools - Hands-on experience with Burp Suite or similar web application security testing tools. You have used them to intercept, modify, and replay requests — not just run automated scans. Vulnerability Documentation - Able to reproduce a vulnerability and write it up clearly: reproduction steps, proof of concept, and impact statement. Findings that engineering teams cannot reproduce or understand do not get fixed. Secure Development Awareness - Familiarity with foundational secure coding concepts: input validation, output encoding, parameterized queries, and least privilege. Code Readability - Ability to read and follow code in at least one language relevant to web security - PHP, Python, JavaScript, or Go. You don't need to be a developer, but you need to follow logic and spot security-relevant patterns. Analytical Thinking - You reason through problems methodically. You can explain not just what a vulnerability is but why it exists, how it is exploited, and what fixing it actually requires. Clear Written Communication - You write findings and summaries that are precise, reproducible, and useful to the engineers who need to act on them. Curiosity and Initiative - You dig into problems rather than stopping at the surface. When something looks wrong, you investigate before concluding Nice to Have Participation in bug bounty programs or CTF competitions; Basic scripting ability for automation - Python or Bash; Familiarity with CI/CD pipelines and where security tooling fits; Exposure to cloud environments - GCP, AWS, or Azure; Relevant coursework or certifications - eWPT, CEH , PortSwigger Web Security Academy progress, or similar entry-level credentials. Xsolla operates across multiple time zones. Strong written communication is essential - you will need to document your work clearly so findings and context are not lost across handoffs. We value directness, intellectual honesty, and follow-through. If you do not know something, say so and find out. If you find something, explain it clearly and see it through to resolution.

Location: Tel Aviv-Yafo, Tel Aviv District, Israel About Aidoc Aidoc is the market leader in healthcare AI and has developed the world's largest clinical frontier model, supporting nearly 50 million patients each year. Aidoc is deployed in more than 2,000 medical centers worldwide. Since our founding in 2016, Aidoc has raised over $500 million and achieved a record number of FDA-cleared solutions. Medical diagnosis is hitting a breaking point, where the number of physicians hasn't kept up with the rapidly growing patient load. This leads to misdiagnosis and treatment delays that result in hundreds of thousands of deaths every year. Aidoc assists clinicians by precisely highlighting diseases directly on medical images, preventing misdiagnosis and ensuring that urgent patients receive the immediate attention they need. About this role As a Senior Product Security Engineer, you will help ensure that security is built into the products, platforms, AI systems, and clinical workflows that support healthcare providers and patients at scale. This is a hands-on technical role focused on securing real systems in production, influencing architecture, and partnering closely with engineering, AI, DevOps, product, quality and regulatory. You will work across cloud-native services, medical imaging workflows, healthcare integrations, AI/ML pipelines, APIs, data flows, and regulated product development processes. Your work will directly support Aidoc's ability to deliver secure, reliable, and trusted clinical AI solutions to healthcare organizations worldwide. What Makes This Role Unique at Aidoc Clinical AI with real-world patient impact - Aidoc operates in an environment where security is not only about protecting systems and data. Security decisions can affect clinical workflows, care-team coordination, customer trust, and patient safety. Highly sensitive healthcare data - You will help protect medical imaging data, clinical metadata, PHI/PII, customer environments, and AI-driven workflows that require strong privacy, access control, data protection, and auditability. Security for AI/ML and medical imaging systems - The role extends beyond traditional AppSec into AI/ML security, data pipeline protection, inference integrity, model-related risks, and misuse scenarios in clinical workflows. Complex healthcare integrations - Aidoc integrates with hospital systems and healthcare workflows that may include PACS, EHR, VNA, RIS/worklists, scheduling systems, and communication platforms. You will help secure the data flows, authentication models, APIs, and deployment patterns behind these integrations. Engineering-driven security in a regulated environment - This is not a checkbox compliance role. However, because Aidoc operates in healthcare and clinical AI, security must be practical, evidence-based, and aligned with regulatory, customer, and quality expectations. Cloud-native scale and production ownership - You will work with modern cloud infrastructure, Kubernetes, containers, CI/CD pipelines, identity and access management, observability, vulnerability management, and software supply-chain controls. Responsibilities Secure product and clinical workflows end-to-end - Work directly with engineering and product teams to identify, prioritize, and remediate security risks across services, APIs, medical imaging workflows, AI outputs, data flows, and customer-facing product features. Drive secure-by-design architecture - Provide practical security guidance on authentication, authorization, tenant/customer isolation, encryption, secrets management, service-to-service communication, audit logging, and secure data handling. Strengthen cloud-native security - Improve security across cloud environments, Kubernetes, containers, IAM, network segmentation, workload identity, infrastructure-as-code, logging, monitoring, and cloud security posture management. Embed security into the development lifecycle - Integrate, tune, and operationalize security tooling across CI/CD pipelines, including SAST, SCA, IaC scanning, container scanning, secrets detection and build/release integrity controls. Own vulnerability management as an engineering system - Prioritize vulnerabilities based on exploitability, product exposure, customer impact, clinical risk, and regulatory relevance. Drive remediation with engineering teams and reduce recurring issues through root-cause improvements. Secure AI/ML-driven features and data pipelines - Partner with AI, data, and platform teams to identify risks related to training and inference data, model inputs and outputs, model misuse, data leakage, access to sensitive datasets, pipeline integrity, and production monitoring. Improve software supply-chain security - Reduce risk across open-source dependencies, third-party components, third-party algorithms, container images, build systems, artifact repositories, release pipelines, and deployment processes. Mentor and enable engineers - Help developers understand security risks, make secure design decisions, and take ownership of security in their code, services, and infrastructure. Communicate risk clearly - Translate technical security findings into clear risk, impact, and trade-off language for engineering, product, leadership, quality, regulatory, and customer-facing stakeholders. Requirements 5+ years of experience in Product Security, Application Security, Cloud Security, or a similar hands-on security engineering role. Strong hands-on experience securing production systems, not only performing assessments or reviews. Strong understanding of secure design, threat modeling, and architecture risk analysis. Deep knowledge of application security, including OWASP Top 10, API security, authentication, authorization, access control, secure session handling, input validation, and modern attack vectors. Experience securing distributed systems, APIs, web applications, backend services, and cloud-native architectures. Strong experience with cloud environments, especially AWS and/or Azure, including IAM, network security, encryption, logging, monitoring, and workload security. Experience with Kubernetes, containers, infrastructure-as-code, CI/CD pipelines, and modern DevOps workflows. Practical experience with security tooling such as SAST, SCA, IaC scanning, container scanning, secrets detection, SBOM tools, vulnerability scanners, and cloud security tools. Experience with vulnerability management, risk prioritization, remediation planning, and working with engineering teams to fix issues at scale. Strong understanding of software supply-chain security, including dependency risk, build/release integrity, artifact security, and third-party component governance. Experience working with modern development stacks such as Python, Java, JavaScript/TypeScript, React, microservices, APIs, and cloud-native services. Ability to influence engineers through technical credibility, practical guidance, and strong collaboration. Strong communication skills and the ability to explain security risks to technical and non-technical stakeholders. Working at Aidoc Our Perks: Be part of something big - using cutting-edge technologies to transform the Healthcare industry (while saving patients’ lives) We work in a hybrid model, with our new offices located at 34 HaMasger Street in Tel Aviv and parking for employees. Amazing and healthy breakfasts and lunches prepared daily by our personal chef! Stocked up kitchen & meal card Wellness: Aidoc employees-only gym, plus Pilates, Yoga, and functional workouts classes. Amazing culture - collaborative, transparent & fun! Attractive compensation package & benefits Aidoc is deeply committed to creating an inclusive workplace, and to the principle of equal opportunity for all individuals. We prohibit discrimination and harassment based on race, color, religion, sex, sexual orientation, gender identity, national origin, age, disability, veteran status, or any other status protected by law.

Location: Hong Kong, Hong Kong SAR; Singapore, Singapore OKX will be prioritising applicants who have a current right to work in Singapore, and do not require OKX's sponsorship of a visa. Who We Are At OKX, we believe that the future will be reshaped by crypto, and ultimately contribute to every individual's freedom. OKX is a leading crypto exchange, and the developer of OKX Wallet, giving millions access to crypto trading and decentralized crypto applications (dApps). OKX is also a trusted brand by hundreds of large institutions seeking access to crypto markets. We are safe and reliable, backed by our Proof of Reserves. Across our multiple offices globally, we are united by our core principles: We Before Me , Do the Right Thing , and Get Things Done . These shared values drive our culture, shape our processes, and foster a friendly, rewarding, and diverse environment for every OK-er. OKX is part of OKG, a group that brings the value of Blockchain to users around the world, through our leading products OKX, OKX Wallet, OKLink and more. About The Opportunity As a Technical Expert, you will lead the development of the company’s core security engineering and DevSecOps capabilities, with a strong focus on security product development, platform engineering, and SDK /Agent development . The ideal candidate should demonstrate deep security expertise, broad technical coverage, strong hands-on engineering capability, and exceptional influence in driving security governance across business teams . What You’ll Be Doing Lead the architecture and core development of the company’s end-to-end DevSecOps platform, security products, and SDKs/Agents , covering code, build, artifacts, images, deployment, and runtime security. Own the design and development of RASP / Java Agent runtime protection , leveraging ASM, ByteBuddy, and Java Instrumentation for bytecode enhancement, runtime hooks, detection and blocking engines, while continuously improving performance, stability, and compatibility. Build and integrate SAST, DAST, IAST, SCA, code security scanning, and image security scanning into CI/CD workflows, and drive deep integration of tools such as SonarQube and Coverity to form a closed loop of scanning, gating, remediation, and re-validation. Drive core application security protection and offensive/defensive capabilities across scenarios such as XSS, SQL injection, SSRF, deserialization, command execution, authentication/authorization flaws, privilege escalation, and API security . Advance AI-Native Security Engineering by applying LLMs and AI Agents to vulnerability analysis, rule generation, false-positive reduction, remediation suggestions, security knowledge management, and workflow automation, while building deep understanding of their architecture, principles, and security implications. Partner closely with business engineering teams to drive security standards, integration rules, quality gates, risk classification, remediation workflows, and overall security governance adoption. Collaborate with engineering, architecture, operations, QA, and business stakeholders to solve complex security problems and turn them into scalable product capabilities, engineering solutions, and governance mechanisms. What We Look For In You Strong fundamentals in computer science and security, with deep understanding of operating systems, networking, compilers/ JVM internals, distributed systems, application security, cloud-native security, and software supply chain security , with both breadth and depth in security technologies. Expert-level Java proficiency , especially in JVM internals, ClassLoader , Java Agent, ASM, ByteBuddy, bytecode instrumentation, profiling, and performance tuning ; proficient in Python or Golang as well. Proven hands-on experience with RASP, SAST, DAST, IAST, SCA, image security, and code security scanning , with the ability to independently design, integrate, and productionize security capabilities. Strong offensive and defensive security experience , with deep understanding of vulnerability root causes, exploitation techniques, detection logic, bypass methods, and remediation strategies in web, API, and microservice environments. Strong practical experience with LLMs and AI Agents , plus deep understanding of model architecture, agent design, tool invocation, context engineering, evaluation methods, and the impact of AI on both security engineering and attacker capabilities. Strong engineering and product mindset, capable of leading the design and implementation of security products, platform modules, and SDKs/Agents while balancing security effectiveness, performance overhead, integration cost, and operability . Strong ownership, communication skills, and cross-functional influence, with a proven ability to drive business teams on security governance, policy adoption, and remediation outcomes. Preferred Qualifications Background from top-tier Internet companies, cloud providers, or leading cybersecurity vendors ; Experience leading DevSecOps platforms, application security platforms, RASP systems, code scanning platforms, or cloud-native security platforms ; Strong experience in security product development, SDK /Agent development, vulnerability research, penetration testing, red/blue team exercises, or incident response ; Hands-on experience in AI + Security initiatives such as security copilots, intelligent rule generation, automated vulnerability analysis, or remediation recommendation systems. Perks & Benefits Competitive total compensation package L&D programs and education subsidy for employees' growth and development Various team building programs and company events Wellness and meal allowances Comprehensive healthcare schemes for employees and dependants More that we love to tell you along the process! Notice: All official OKX vacancies are published on this website. While roles may appear on selected third-party platforms from time to time, information on other sites may be inaccurate or outdated. If in doubt, please apply directly through our official careers website. Information collected and processed as part of the recruitment process of any job application you choose to submit is subject to OKX 's Candidate Privacy Notice .

Location: Hong Kong, Hong Kong SAR; Singapore, Singapore OKX will be prioritising applicants who have a current right to work in Singapore, and do not require OKX's sponsorship of a visa. Who We Are At OKX, we believe that the future will be reshaped by crypto, and ultimately contribute to every individual's freedom. OKX is a leading crypto exchange, and the developer of OKX Wallet, giving millions access to crypto trading and decentralized crypto applications (dApps). OKX is also a trusted brand by hundreds of large institutions seeking access to crypto markets. We are safe and reliable, backed by our Proof of Reserves. Across our multiple offices globally, we are united by our core principles: We Before Me , Do the Right Thing , and Get Things Done . These shared values drive our culture, shape our processes, and foster a friendly, rewarding, and diverse environment for every OK-er. OKX is part of OKG, a group that brings the value of Blockchain to users around the world, through our leading products OKX, OKX Wallet, OKLink and more. About The Opportunity As a Technical Expert, you will own the core build-out of the company's R&D Efficiency Platform, proactively identifying and eliminating risks across the delivery pipeline through CI/CD, DevSecOps, Change Management, and AI-Native upgrades—reducing delivery cost while improving quality and efficiency via platformization and automation. What You’ll Be Doing Build core capabilities of the R&D Efficiency Platform and onboard business systems to improve overall engineering efficiency and delivery quality; Design and optimize CI/CD pipelines (GitLab, Pipeline, ArgoCD), driving standardization, automation, and observability; Drive the AI-Native evolution of CI/CD , introducing AI Agent / LLM for intelligent code review, pipeline self-healing, smart test orchestration, and change-risk prediction; Build DevSecOps capabilities , embedding Shift-Left Security across the lifecycle with SAST, DAST, SCA, image/secret scanning, and security gates to ensure supply-chain security; Establish standardized Change Management , covering requests, risk assessment, approvals (CAB), canary releases, rollback, and change traceability; Apply Kubernetes, microservice governance (Nacos, Apollo, Kong), and Aliyun / AWS cloud services to ensure platform stability and scalability. What We Look For In You Solid Computer Science fundamentals (OS, networking, distributed systems, data structures & algorithms); Proficient in DevOps toolchains , CI/CD, Kubernetes, and microservice stacks; Familiar with DevSecOps concepts and security toolchains, understanding supply-chain security and compliance; Knowledge of AI / LLM in engineering-efficiency and CI/CD scenarios, with an AI-Native engineering mindset; Familiar with the Java stack, with broad awareness of multi-language and business-side technologies; Strong product sense, ownership, and ability to work under pressure; Fluent English communication for efficient cross-regional collaboration. Perks & Benefits Competitive total compensation package L&D programs and education subsidy for employees' growth and development Various team building programs and company events Wellness and meal allowances Comprehensive healthcare schemes for employees and dependants More that we love to tell you along the process! Notice: All official OKX vacancies are published on this website. While roles may appear on selected third-party platforms from time to time, information on other sites may be inaccurate or outdated. If in doubt, please apply directly through our official careers website. Information collected and processed as part of the recruitment process of any job application you choose to submit is subject to OKX 's Candidate Privacy Notice .

Location: Spain; United Kingdom; Serbia; Germany Who we are Action1 is an autonomous endpoint management platform trusted by many Fortune 500 companies. Cloud-native, infinitely scalable, highly secure, and configurable in minutes—it just works and is always free for the first 200 endpoints with no functional limits. By pioneering autonomous OS and third-party patching with peer-to-peer patch distribution and real-time vulnerability assessment without requiring a VPN, Action1 eliminates routine IT labor, helps prevent ransomware and security risks, and protects the digital employee experience. In 2025, Action1 was recognized by Inc. 5000 as the fastest-growing private software company in America . The company is founder-led by Alex Vovk and Mike Walters , entrepreneurs who previously founded Netwrix, a multi-billion-dollar cybersecurity company. The Role We are looking for a Product Security Engineer to join the team responsible for securing Action1’s multi-tenant SaaS product. In this role, you will work closely with engineering, product, and security teams to identify risks early, support vulnerability handling, improve secure development practices, and help make product security practical, clear, and actionable. This is a hands-on role for someone who understands both software engineering and cybersecurity, enjoys working directly with developers, and wants to help build security into the product without slowing teams down unnecessarily. What you’ll do Support PSIRT and vulnerability handling activities Validate, triage, track, and coordinate security reports Provide practical remediation guidance to engineering teams Help validate security fixes and reduce product security risks Review code, APIs, and architecture to identify security issues early Conduct threat modeling and security design reviews Improve security automation in engineering workflows Support SAST, SCA, secrets scanning, and other security controls Maintain SBOMs, dependency visibility, and remediation follow-up Support security assessments, vulnerability assessments, and penetration testing Maintain vulnerability handling playbooks, product security procedures, and incident response runbooks What we’re looking for 3+ years of experience in product security, application security, DevSecOps, or a related cybersecurity field Strong software engineering background and ability to work effectively with engineering teams Understanding of application, API, infrastructure, and software supply chain security risks Experience applying cloud security concepts and practices Understanding of IAM, network security, logging, monitoring, and secure cloud architecture patterns Familiarity with vulnerability management, incident response, security assessments, and secure SDLC practices Experience with threat modeling and security design reviews Strong communication skills, including professional communication with external researchers and vendors Ability to work independently and as part of a team in a fast-moving environment Nice to have Genuine interest in cybersecurity and motivation to grow as a product security expert Hands-on experience with AWS security controls, best practices, and architecture patterns Hands-on experience with C++ or JavaScript Experience with security testing and automation using scripting, APIs, CI/CD pipelines, or specialized tools Experience with threat modeling for SaaS, API, cloud, or on-prem product components Experience with SBOM generation, dependency visibility, or software supply chain security What we offer Fully remote work environment Opportunity to work on a real security product used by IT and security teams High ownership and direct impact on product security practices Close collaboration with engineering, product, and security teams Fast-growing software company with low bureaucracy and practical decision-making Opportunity to improve security processes, automation, and engineering workflows Supportive team that values clear thinking, ownership, and continuous learning

Location: Morocco; Egypt Project Responsibilities Operate and maintain on-premise infrastructure environments across DEV, TEST, STAGING, UAT, and PROD. Ensure network zoning and environment segregation in line with External / DMZ / Internal architecture. Configure and support Web Application Firewalls (WAFs) and controlled traffic flows between zones. Operate and maintain External and Internal API Gateways. Support enterprise integrations via the Software AG integration platform. Operate identity and access management infrastructure, including miniOrange IdP, MFA, and OIDC integrations. Design, maintain, and operate CI/CD pipelines using Azure DevOps, including secure release promotion. Implement and operate Secure SDLC controls (SAST, SCA, DAST). Implement and maintain monitoring, logging, and audit capabilities (Prometheus, Grafana, Graylog, Sentry, SIEM forwarding). Support backup, replication, and disaster recovery activities, including DR testing. Requirements Must-haves 5+ years of experience in DevOps or Infrastructure Engineering. Experience with on-premise infrastructure deployment and operations in enterprise environments. Experience managing multiple isolated environments (DEV, TEST, STAGING, UAT, PROD). Knowledge of network security zoning architectures (External / DMZ / Internal). Hands-on experience working with Web Application Firewalls (WAFs). Experience configuring and supporting External and Internal API Gateways. Experience working with enterprise integration / ESB platforms (Software AG). Experience integrating and operating Identity Providers (IdP) (miniOrange). Knowledge of OIDC / OAuth2 authentication flows and Multi-Factor Authentication (MFA). Experience with TLS / mTLS secure communication and PKI-based certificate management. Hands-on experience with CI/CD pipelines using Azure DevOps. Experience implementing Secure SDLC practices, including SAST, SCA, and DAST. Knowledge of threat modeling techniques, specifically STRIDE. Experience with monitoring and observability tools (Prometheus, Grafana). Experience with centralized logging and application monitoring (Graylog, Sentry, SIEM integration). Experience supporting backup, replication, and disaster recovery processes, including DR testing.

Location: Mumbai Who We Are: Galaxy Digital Inc. (Nasdaq: GLXY) is a global leader in digital assets and data center infrastructure, growing the economy that runs on code. Galaxy delivers the onchain infrastructure that connects institutions to digital assets, including trading, advisory, asset management, staking, self-custody, and tokenization. Galaxy also develops and operates data center infrastructure to power AI and HPC workloads. Anchored by its Helios campus in Texas, Galaxy is building a multi-gigawatt pipeline of more than 5.7 GW of potential capacity, positioning it among the largest and fastest-growing data center developers in North America. The Company is headquartered in New York City, with offices across North America, Europe, the Middle East, and Asia. Additional information about Galaxy's businesses and products is available on www.galaxy.com . What We Value: We are a diverse team of free thinkers, and fast movers united to help investors and creators energize the global economy. We are looking for individuals who thrive in a culture of builders and overachievers and embrace high performance, transparent feedback, and a mission-first approach. Our culture shapes our way of working and gets us where we want to be. Seek Excellence. Be Selective To Be Effective. Be Highly Aligned, Loosely Coupled. Disagree Transparently. Encourage Independent Decision-Making. Build Dream Teams. Who We Are: Galaxy is a global leader in digital assets and data center infrastructure, delivering solutions that accelerate progress in finance and artificial intelligence. We believe that blockchain and digital asset innovation will transform how value moves through the world – and we’re building the products and services to make that future a reality. Our institutional digital assets platform spans trading, investment banking, asset management, staking, self-custody, and tokenization technology. We also invest in and operate cutting-edge data center infrastructure to power AI and high-performance computing, addressing the growing demand for scalable energy and compute in the U.S. We work at the intersection of finance and technology, helping institutions, startups, and developers navigate a digitally native economy. Led by CEO and Founder Michael Novogratz, our team blends deep crypto expertise with institutional experience and a shared commitment to shaping the future of Web3 and AI. Galaxy is headquartered in New York City, with offices across North America, Europe, the Middle East, and Asia. To learn more about our businesses and products, visit www.galaxy.com. What We Value: We are a diverse team of free thinkers, and fast movers united to help investors and creators energize the global economy. We are looking for individuals who thrive in a culture of builders and overachievers and embrace high performance, transparent feedback, and a mission-first approach. Our culture shapes our way of working and gets us where we want to be. Seek Excellence. Be Selective To Be Effective. Be Highly Aligned, Loosely Coupled. Disagree Transparently. Encourage Independent Decision-Making. Build Dream Teams. Who You Are: Galaxy is seeking a Senior Product Security Engineer with an expertise in securing micro services and cloud applications, and with a thorough understanding of product and software engineering processes. The engineer will participate in assessments of advanced trading systems and blockchain architectures, followed by the facilitation and/or implementation of remediations. The engineer will report to the Director of Product Security and work closely with Engineering, Product and Infrastructure teams to design and deliver secure software solutions at a rapid growth company. What You’ll Do: Assist engineering and software delivery teams in assessing the security of the applications, software, and operational components including: Participate in relevant secure software design and code reviews Assist with development and review of test plans to ensure effective security coverage Assist teams with the mitigation of findings: assess the impacts, propose possible solutions, and provide technical guidance for implementation Provide expertise and advice on cloud application and infrastructure security design patterns Provide training and thought leadership for secure software development practices Review and improve implementations of authentication, authorization, data access and other security layers of our product stack Research and collaborate with product team members to make proposals to adopt advanced security patterns - e.g. MPC, multi-signature, confidential computing What We’re Looking For: Bachelor or post-graduate diploma in cybersecurity or technology 5 years work experience in product security, application security, cloud security, or software development of security features Threat modeling, risk assessment, controls review Programming languages Managing SAST, DAST, SCA, and helping software engineers with understanding vulnerabilities and selecting appropriate mitigation In depth understanding of at least a few of the following topics: authentication and authorization technology, TLS and PKI, network security, cloud security, system security Strong analysis skills, detail oriented, strategic thinking Strong verbal and written communication skills, collaborative and solution-driven Security or cloud certifications Bonus Points: Familiar with Cryptocurrency What We Offer: Competitive base salary and discretionary bonus Competitive paid time off Great office location in central Mumbai (BKC) Company-paid health and protective benefits for employees and their eligible dependents Free virtual coaching sessions through Headspace Opportunities to learn about the Crypto industry Smart, entrepreneurial, and fun colleagues *Benefits may vary depending on location. Galaxy respects diversity and seeks to provide equal employment opportunities to all employees and job applicants for employment without regard to actual or perceived age, race, color, creed, religion, sex or gender (including pregnancy, childbirth, lactation and related medical conditions), gender identity or gender expression (including transgender status), sexual orientation, marital or partnership or caregiver status, ancestry, national origin, citizenship status, disability, military or veteran status, protected medical condition as defined by applicable state or local law, genetic information or predisposing genetic characteristic, or other characteristic protected by applicable federal, state, or local laws and ordinances. We will endeavor to make a reasonable accommodation to the known limitations of a qualified applicant with a disability unless the accommodation would impose an undue hardship on the operation of our business. If you believe you require such assistance to complete the application process or to participate in an interview, please contact careers@galaxy.com.

Location: London; Sofia About Us The Financial Times is one of the world’s leading news organisations, globally recognised for its authority, integrity and accuracy, with a mission to deliver quality information and services worldwide. At the FT, curiosity thrives and ambitious thinking is rewarded. Here, you’re given the chance to reach millions, create work that matters and deliver impartial journalism in a polarised world. In our warm, collaborative culture, you’ll connect with a diverse community of experts who support your growth, career aspirations and wellbeing. Your future at the FT will be filled with opportunities that challenge and inspire you. With no fixed path, you’ll discover new skills and forge a career that can take you anywhere. Build a newsworthy career at the FT. Our Commitment to Diversity, Equity and Inclusion We believe in the power of unique perspectives and want all voices in our organisation to be heard, respected and valued. A supportive workplace is one where employees feel they can be themselves and operate to their full potential. We are committed to removing barriers for everyone, with a focus on addressing those faced by underrepresented groups. The Role Overview We’re looking for a Cyber Security Engineer to help improve application security across the FT’s cloud-native technology estate. This is a hands-on role focused on making secure engineering easier for product, platform and software engineering teams. Application security experience is essential for this role. You’ll help improve developer-friendly security guardrails across GitHub-based CI/CD pipelines, application repositories and engineering workflows. This includes working with SAST, software composition analysis, secret scanning, vulnerability management and secure coding guidance so that security findings are clear, actionable and owned by the right teams. You’ll work closely with engineers to support practical threat modelling, triage application vulnerabilities, improve security playbooks and help teams remediate issues in a pragmatic way. You do not need to be a deep AWS or cloud security specialist, but some exposure to AWS, cloud security or infrastructure-as-code security would be useful. We’re looking for someone with practical AppSec experience who wants to grow their impact - someone who enjoys working with engineers, improving tooling and helping security become part of normal delivery rather than a last-minute checkpoint. What you’ll bring to the role Application security experience: practical experience identifying, explaining and helping remediate application security risks in modern engineering environments. Developer-friendly security mindset: you enjoy working with engineers, explaining risks clearly and helping teams adopt secure practices without unnecessary friction. Vulnerability management experience: experience triaging and tracking application vulnerabilities from sources such as SAST, dependency scanning, secret scanning, penetration tests, bug bounty reports or third-party advisories. CI/CD and code security awareness: familiarity with security tooling in development workflows, such as SAST, software composition analysis, secret scanning or repository security controls. Threat modelling awareness: experience participating in, supporting or facilitating lightweight threat-modelling sessions for applications, services or new features. Automation mindset: ability to write scripts or small tools, ideally in Python, to reduce manual effort, improve visibility or make security workflows easier. Cloud security awareness: Some exposure to AWS, cloud security or infrastructure-as-code security would be useful, but is not essential. Growth mindset: willingness to keep developing across application security, cloud security, secure development and modern engineering practices. Required Experience, Essential Practical experience in application security. Experience working with software engineers to explain and remediate security issues. Familiarity with common web application security risks and secure coding practices. Experience with vulnerability triage, prioritisation and remediation tracking. Experience using or interpreting findings from tools such as SAST, software composition analysis, secret scanning or similar. Experience participating in or supporting threat-modelling activities. Ability to write scripts or small tools, ideally in Python, to automate tasks or improve visibility. Strong communication and collaboration skills. Familiarity with Agile or Scrum ways of working. Desirable Exposure to AWS security, cloud security or infrastructure-as-code security. Experience with Terraform or CloudFormation. Experience with container or Kubernetes security. Experience with bug bounty, penetration testing or security testing programmes. Experience with Splunk or similar logging/SIEM platforms. Exposure to AI security, such as LLM-enabled applications, AI-assisted development workflows or prompt/data leakage risks. Experience building dashboards, metrics or reports to support vulnerability management. Relevant security certifications or training, such as AWS security training, secure coding training, GIAC, ISC2, CREST or equivalent practical experience. What’s in it for you? Our benefits Our benefits vary by location but we are committed to providing best-in-class perks across all our offices. These include generous annual leave, medical cover, inclusive parental leave packages, subsidised gym memberships and opportunities to give back to the community. Full details of our benefits are available here. We currently operate a hybrid model which requires staff to work onsite 50% of the time, subject to role requirements & regular review. While flexible working requests will be considered, not all patterns are suitable for all roles. We believe this balanced approach supports flexibility and protects our culture, making collaboration and communication easier, building stronger relationships and team cohesion, and supporting peer learning.  We reserve discretion on reasonable notice to change this approach either generally or for specific individuals or teams. Accessibility We are a disability confident employer and Valuable 500 signatory. Please let us know if you require any reasonable adjustments/personalisation as part of the application process or to enable you to attend an interview. If you would like to discuss your requirements or have any questions, email talent@ft.com and a member of our team will be happy to help. Further information At the FT, we embrace innovation and the use of technology and appreciate that individuals may leverage AI tools as part of their job application process. Whilst we are happy for you to use AI to assist with your application, it is essential that all information provided is authentic and accurately represents your skills, experience, and qualifications. Candidates should be aware that the use of AI throughout the application process may be monitored to ensure a fair and transparent hiring process for all.

Location: London; Sofia About Us The Financial Times is one of the world’s leading news organisations, globally recognised for its authority, integrity and accuracy, with a mission to deliver quality information and services worldwide. At the FT, curiosity thrives and ambitious thinking is rewarded. Here, you’re given the chance to reach millions, create work that matters and deliver impartial journalism in a polarised world. In our warm, collaborative culture, you’ll connect with a diverse community of experts who support your growth, career aspirations and wellbeing Your future at the FT will be filled with opportunities that challenge and inspire you. With no fixed path, you’ll discover new skills and forge a career that can take you anywhere. Build a newsworthy career at the FT. Our Commitment to Diversity, Equity and Inclusion We believe in the power of unique perspectives and want all voices in our organisation to be heard, respected and valued. A supportive workplace is one where employees feel they can be themselves and operate to their full potential. We are committed to removing barriers for everyone, with a focus on addressing those faced by underrepresented groups. The Role Overview We’re looking for a Senior Cyber Security Engineer to help mature application and cloud security across the FT’s cloud-native, AWS-hosted technology estate. This role has an approximate 50/50 focus across application security and cloud security, working closely with product, platform and engineering teams to make secure delivery easier by default. You’ll shape and improve developer-friendly guardrails across GitHub-based CI/CD pipelines, AWS environments and infrastructure-as-code workflows. This includes improving SAST, software composition analysis, secret scanning, IaC scanning, vulnerability management and AWS misconfiguration management so that findings are actionable, low-noise and owned by the right teams. Day to day, you’ll run practical threat-modelling sessions, review application and cloud designs, improve security playbooks, support vulnerability and misconfiguration remediation, and build automation that reduces toil. We’re looking for someone who has demonstrably improved security outcomes in real engineering environments, not just someone with theoretical knowledge of tools or frameworks. Depending on team structure, you may also mentor or line-manage one or two security engineers, while remaining hands-on and close to the technical work. What you’ll bring to the role Application and cloud security experience: practical experience across both application security and cloud security, ideally in AWS-hosted, cloud-native environments. Developer-friendly security mindset: you know how to work with engineers, explain risk clearly and design controls that help teams move securely without unnecessary friction. Vulnerability management at scale: experience improving how application vulnerabilities, dependency risks, bug bounty findings, penetration test findings and advisories are identified, prioritised, owned and remediated across engineering teams. Cloud misconfiguration & vulnerability management: experience identifying and reducing infrastructure-as-code and AWS vulnerabilities & misconfigurations at scale through pragmatic guardrails, tooling and clear remediation paths. Threat modelling: confidence running lightweight, practical threat-modelling sessions that lead to useful engineering decisions and risk reduction. CI/CD and code security: hands-on experience with security tooling such as SAST, software composition analysis, secret scanning and IaC scanning. Automation mindset: ability to write scripts or small tools, ideally in Python, to reduce toil, improve visibility and surface meaningful risk. Security leadership: ability to mentor other security engineers and influence engineers across the wider organisation. Depending on team structure, this may include line management. AI security awareness: experience of leveraging AI to improve and scale appsec and cloud sec controls would be useful, but is not essential. Key Responsibilities Improve application security guardrails Tune and evolve SAST, software composition analysis, secret scanning and related controls so they are actionable, low-noise and useful to engineering teams. Improve cloud and IaC security guardrails Help identify, prioritise and reduce AWS and infrastructure-as-code misconfigurations and vulnerabilities at scale. Drive vulnerability management Improve how application vulnerabilities, dependency risks, bug bounty findings, penetration test findings and third-party advisories are triaged, prioritised and remediated. Drive cloud misconfiguration management Help teams understand, own and remediate cloud security issues using pragmatic, developer-friendly workflows. Run practical threat modelling Facilitate lightweight threat-modelling sessions for new products, features, services and architectural changes. Build automation and tooling Create or improve scripts, integrations, dashboards and workflows that reduce manual effort and make risk easier to understand. Support secure architecture decisions Provide application and cloud security input into design reviews, AWS architecture decisions and larger technical changes. Partner with engineering teams Work closely with product, platform and software engineering teams to embed security into design, delivery and operational practices. Support incidents and lessons learned Provide application and cloud security expertise during incidents and feed lessons learned back into patterns, tooling and guidance. Mentor others Coach security engineers and engineering teams on practical security approaches. Depending on team structure, this may include line management of one or two security engineers. Required Experience, Essential: Strong practical experience in application security and cloud security, ideally with a balanced focus across both. Hands-on AWS security experience, including common misconfiguration patterns and practical remediation approaches. Experience improving vulnerability management across engineering teams, including prioritisation, ownership, remediation tracking and noise reduction. Experience in improving cloud or IaC misconfiguration management at scale in a developer-friendly way. Experience integrating, tuning or improving security tooling in CI/CD workflows, such as SAST, software composition analysis, secret scanning or IaC scanning. Experience running practical threat-modelling sessions that influence design, delivery or remediation decisions. Ability to write scripts or small tools, ideally in Python, to automate security workflows or improve visibility. Strong communication and collaboration skills, with the ability to influence engineers and technical leaders without relying on gatekeeping. Evidence of improving application security, cloud security or vulnerability management practices in a real engineering environment. Familiarity with Agile or Scrum ways of working. Desirable Experience with leveraging AI for AppSec and CloudSec. AWS Certified Security – Speciality or equivalent practical AWS security experience. Terraform or CloudFormation expertise. Incident-management or incident-response experience. Experience with Splunk or similar logging/SIEM platforms. Experience with security metrics, dashboards or reporting that helped drive measurable risk reduction. Experience mentoring or line-managing security engineers. What’s in it for You? Our benefits vary by location but we are committed to providing best-in-class perks across all our offices. These include generous annual leave, medical cover, inclusive parental leave packages, subsidised gym memberships and opportunities to give back to the community. Full details of our benefits are available here . We currently operate a hybrid model which requires staff to work onsite 50% of the time, subject to role requirements & regular review. While flexible working requests will be considered, not all patterns are suitable for all roles. We believe this balanced approach supports flexibility and protects our culture, making collaboration and communication easier, building stronger relationships and team cohesion, and supporting peer learning.  We reserve discretion on reasonable notice to change this approach either generally or for specific individuals or teams. Accessibility We are a disability confident employer and Valuable 500 signatory. Please let us know if you require any reasonable adjustments/personalisation as part of the application process or to enable you to attend an interview. If you would like to discuss your requirements or have any questions, email talent@ft.com and a member of our team will be happy to help. Further information At the FT, we embrace innovation and the use of technology and appreciate that individuals may leverage AI tools as part of their job application process. Whilst we are happy for you to use AI to assist with your application, it is essential that all information provided is authentic and accurately represents your skills, experience, and qualifications. Candidates should be aware that the use of AI throughout the application process may be monitored to ensure a fair and transparent hiring process for all.

Location: Chicago, IL, USA; New York, NY, USA; San Francisco, CA, USA About the role We are looking for a Product Security Manager to lead a team focused on cloud, application, and AI security within our Product Security organization. This role is responsible for securing our cloud infrastructure, protecting applications, and enabling safe adoption of AI across our products and internal systems. You will work closely with engineering, product, and platform teams to ensure that Chime applications and systems are designed and operated securely. While cloud and application security are core pillars of this role, AI security is an increasingly critical area of focus. You will help define how we safely leverage AI technologies while managing risks such as data exposure, misuse, and insecure integrations. This role operates within a flexible POD model, requiring you and your team to move fluidly across security domains based on business priorities. In this role, you can expect to Own the security posture of cloud infrastructure, application systems, and AI-enabled applications across product surfaces Influence platform teams' roadmaps and drive alignment on security priorities without direct authority Partner with engineering and product teams to embed security into system design and development workflows Lead and grow a team of security engineers, setting a high bar for technical execution, ownership, and impact Define and execute strategy for securing cloud-native architectures and applications at scale Establish guardrails and secure design patterns for AI adoption, including safe integration of third-party and internal AI systems Identify and mitigate risks related to AI systems, including prompt injection, data leakage, and misuse of models or APIs Build scalable controls and automation around identity, access, encryption, and application security, including secure SDLC and vulnerability management processes Lead and support response efforts for security incidents related to cloud, application, and AI risks To begin in this role, you have 5+ years of experience in security engineering, with significant experience in cloud and application security 2+ years of experience managing or leading security engineers Strong understanding of cloud platforms (AWS, GCP), Infrastructure as Code (IaC), and modern infrastructure patterns Experience with industry tooling for SAST, DAST, SCA, WAF, and CNAPP Experience designing or securing applications that handle sensitive or regulated data Experience securing or evaluating AI/ML systems, or demonstrated ability to operate effectively in ambiguous and emerging security domains Strong technical judgment and the ability to go deep in architecture and security discussions when needed Experience operating in fast-paced, product-driven environments with shifting priorities Strong communication skills with the ability to translate security risks into business impact #LI-SL1 #LI-Onsite Below is the base salary offered for this role and level of experience. Full-time employees may also be eligible for bonus(es), competitive equity, and benefits. For commissioned roles, the base salary listed in this job description does not include incentive/variable pay. The actual base salary offered may be higher, depending on your location, skills, qualifications, and experience. Wage Notice $152,000 — $210,000 USD A little about us At Chime, we believe that everyone can achieve financial progress. We created Chime—a financial technology company, not a bank*—on the premise that core banking services should be helpful, easy, and free. Through our user-friendly tools and intuitive platforms, we empower our members to take control of their finances and work towards their goals. Whether it's starting a savings account, purchasing a first car or home, launching a business, or pursuing higher education, we're proud to have helped millions unlock their financial potential. We're a team of problem solvers, dreamers, and builders with one shared obsession: our members. From day one, Chimers have worked tirelessly to out-hustle and out-execute competitors to bring our mission to life. Their grit and determination inspire us to work harder every day to deliver the very best experience possible. We each bring an owner's mindset to our work, refusing to be outdone and holding ourselves accountable to meet and exceed the highest bars for our teams, our company, and our members. We believe in being bold, dreaming big, and taking risks, while also working together, embracing our diverse perspectives, and giving each other honest feedback. Our culture remains deeply entrepreneurial, encouraging every Chimer to see themselves as stewards of our mission to help everyday Americans unlock their financial progress. We know that to achieve our mission, we must earn and keep people's trust—so we hold ourselves to the highest standards of integrity in everything we do. These aren't just words on a wall—our values are embedded in every aspect of our business, serving as a north star that guides us as we work to help millions achieve their financial potential. Because if we don't—who will? *Chime is a financial technology company, not a bank. Banking services provided by The Bancorp Bank, N.A. or Stride Bank, N.A., Members FDIC. What we offer for our full-time, regular employees 🏢 Our in-office work policy is designed to keep you connected - with four days a week in the office and Fridays from home for those near one of our offices, plus team and company-wide events depending on location. Whether you’re coming in regularly or are part of our fully remote program, you’ll stay engaged with your work and teammates. 💻 Benefits that support your work and life, including backup child, elder, and pet care and subsidized commuter benefits for eligible employees. ✨ Comprehensive health, financial, and wellbeing benefits designed to support you at every stage of life. 🏝 Generous vacation policy and company-wide paid days off 🫂 1% of your time off to support local community organizations of your choice 👟 Annual wellness stipend to use towards eligible wellness related expenses 👶 Up to 22 weeks of paid parental leave for birthing parents and 12 weeks of paid parental leave for non-birthing parents 👪 Access to family planning reimbursement 💚 A challenging and fulfilling opportunity to join one of the most experienced teams in FinTech and help millions unlock financial progress We know that great work can’t be done without a diverse team and inclusive environment. That’s why we specifically look for individuals of varying strengths, skills, backgrounds, and ideas to join our team. We believe this gives us a competitive advantage to better serve our members and helps us all grow as Chimers and individuals. Chime is proud to be an Equal Opportunity Employer. We consider qualified applicants without regard to race, color, ancestry, religion, sex, national origin, sexual orientation, gender identity, age, marital or family status, disability, genetic information, veteran status, or any other legally protected basis under provincial, federal, state, and local laws, regulations, or ordinances. We will also consider qualified applicants with criminal histories in a manner consistent with the requirements of state and local laws, including the San Francisco Fair Chance Ordinance, Cook County Ordinance, NYC Fair Chance Act, and the LA City Fair Chance Ordinance, and consistent with Canadian provincial and federal laws. If you have a disability or special need that requires accommodation during any stage of the application process, please contact: accommodations@chime.com . To learn more about how Chime collects and uses your personal information during the application process, please see the Chime Applicant Privacy Notice .

Location: Remote - Colombia ; Remote - Costa Rica ; Remote - Mexico About Backblaze Backblaze provides reliable, high-availability cloud storage trusted by consumers, SMBs, enterprises, and developers in over 150 countries. Backblaze B2 Cloud Storage supports data-intensive workloads including backup, media, analytics, and modern AI pipelines. Our teams focus on building secure, durable, scalable systems with a strong emphasis on application security from day one and protecting customers to keep them safe. But while there is a lot to celebrate in our past, there is almost as much opportunity ahead of us. About the Role We are seeking an Application Security Engineer to improve application security across the software used to enable Backblaze B2 Cloud Storage and Computer Backup. The primary role is to build security into how the product is used, how data is stored and how customers can use it. This role will require development skills and application security knowledge to build security into the product and new features. Leveraging AI is key. This is a hands-on role that requires application development knowledge. This role is expected to know and use the latest AI to help with both development and security. The primary requirements include; development in common web languages, application security and AI tool usage. Leverage AI tools and software for Building new and maintaining existing software security features Meeting evolving software security needs in existing software Developing new components as needed Perform security assessments and code reviews on internal and external customer-facing applications Work closely with engineers to remediate security vulnerabilities using AI tools Develop security automation and tooling to improve security Support bug bounty program and vulnerability handling Investigate newly reported vulnerabilities Determine ways to remediate them Provide guidance to engineering based on known vulnerabilities found in existing applications Understanding cryptography and secure authentication Knowledge of cloud environments and security they provide Support and develop on large software stack using Apache Tomcat running across a large number of servers JavaServer Pages (JSP) containing older features Node/JavaScript developed features and pages An architecture split among many different servers – supporting browsers and custom client software Strong security knowledge across large software stacks running on multiple servers Ability to reach out and learn about technologies or implementations as necessary The Right Fit: Application Development and Security knowledge AI knowledge and experience using it for development & security Understanding of: AI Frameworks and tooling, core web security, common web security flaws, coding agents Strong understanding of OWASP Top 10 vulnerabilities Experience with security testing tools such as: SAST / DAST scanners Fuzzing tools Vulnerability scanners Familiar with web technologies: HTTP, REST APIs, etc. Experience with Web Applications, Cloud Systems and Linux Environments Determining how new and old security needs can leverage AI workflows and integrations to improve them AI Coding tools such as Gemini, Claude Code, ChatGPT, Cursor or others Experience with programming languages such as: Java, JSP, JavaScript, TypeScript, Go, Python and C/C++ Why Backblaze Build secure software used by companies worldwide Work at the intersection of AI, data, and cloud storage Collaborate with experienced engineering, security, product, and QA teams Competitive compensation and benefits Remote-first culture supporting work-life balance At this point, we hope you're feeling excited about the job description you're reading. Even if you don't meet every requirement, we still encourage you to apply. Learning, developing, and growing are key parts of our culture. We're eager to meet people who believe in our mission and can contribute to our team in various ways. We want people to feel comfortable expressing their true selves and to come, stay, and do their best work here. At Backblaze, we value being fair and good to our customers, partners, and employees. That’s why diversity, equity, and inclusion are at the core of our values. We are committed to fostering a workforce where all employees feel a sense of belonging regardless of race, ethnicity, nationality, gender, sexual orientation, age, religion, socio-economic status, ability, veteran status, and education. We believe that our dedication to cultivating a diverse workspace not only allows us to better serve our customers in over 175 countries but further reinforces our commitment to doing the right thing. We are proud to be an Equal Opportunity Employer. To understand more about the data we collect and process as part of your application, please view our Backblaze Employee Privacy Notice . #LATAM

Location: Baku Workplace: onsite ABOUT YOU We are looking for a senior application security specialist to join a growing security team at Xsolla. This is a hands-on role where you will own security initiatives end-to-end - identifying, assessing, and driving remediation of security vulnerabilities across our products and infrastructure. You will lead day-to-day AppSec work - deep code reviews, vulnerability triage, threat modeling, and security testing - and set the standards for how this work is done. You are rigorous, pragmatic, and able to balance security risk against business velocity in a payment platform operating at scale. You will also mentor junior specialists and help raise the security bar across engineering teams. ABOUT US   Xsolla is a global commerce company with robust tools and services to help developers solve the inherent challenges of the video game industry. From indie to AAA, companies partner with Xsolla to help them fund, distribute, market, and monetize their games. Grounded in the belief in the future of video games, Xsolla is resolute in the mission to bring opportunities together, and continually make new resources available to creators. Headquartered and incorporated in Los Angeles, California, Xsolla operates as the merchant of record and has helped over 1,500+ game developers to reach more players and grow their businesses around the world. With more paths to profits and ways to win, developers have all the things needed to enjoy the game. For more information, visit xsolla.com. Responsibilities Own Vulnerability Management - Lead triage of bug bounty reports and scanner findings. Set severity standards, drive escalation policy, and ensure remediation SLAs are met across teams. Lead Security Assessments - Plan and conduct in-depth security assessments and penetration tests of web applications, APIs, and services. Define assessment scope and methodology. Drive Threat Modeling - Facilitate threat modeling sessions with engineering teams. Identify trust boundaries, data flows, and attack surfaces early in the design phase, and embed the practice into the SDLC . Own AppSec Tooling Strategy - Select, operate, and tune SAST , DAST , SCA , and secrets-scanning tooling. Design noise-reduction and auto-triage workflows; integrate security gates into CI/CD. Lead Secure Code Reviews - Perform security-focused code reviews across PHP, Python, and Go codebases. Define secure coding guidelines and review checklists for engineering teams. Mentor and Educate - Coach junior security specialists, run internal security training, and champion security awareness among developers. Write Clear Security Documentation - Document findings, reproduction steps, and remediation guidance in a way engineering teams can act on. Set the documentation standard for the team. What You Bring 4+ years in application security or a closely related security engineering role, with demonstrable ownership of AppSec programs or major initiatives. Deep Web Security Expertise - Expert-level understanding of vulnerability classes ( OWASP Top 10 and well beyond: SSRF , deserialization, request smuggling, OAuth/ OIDC flaws, business logic abuse). You understand root causes, exploitation chains, and realistic impact in production systems. Offensive Testing Proficiency - Extensive hands-on experience with Burp Suite and manual testing methodology. You can find vulnerabilities that scanners miss and chain low-severity issues into meaningful impact. Code Fluency - Comfortable reading and auditing code in at least one of: PHP, Python, Go, JavaScript. Able to trace data flows across services and spot vulnerable patterns without runtime access. Secure SDLC Experience - Practical experience embedding security into development workflows: security requirements, design review, CI/CD security gates, and developer enablement. Risk Communication - You can calculate and defend real severity, push back on inflated findings, and explain risk to both engineers and leadership in their own language. Analytical Thinking - You reason through problems methodically and can explain not just what a vulnerability is, but why it exists, how it is exploited, and what fixing it actually requires. Ownership and Follow-Through - You drive findings to resolution across team boundaries without being asked. Nice to Have Track record in bug bounty programs (accepted reports on major platforms) or notable CTF results; Strong automation skills - Python or Go for building internal security tooling; Experience securing cloud-native environments - GCP preferred; Kubernetes security a plus; Advanced certifications - OSWE , OSCP , BSCP , or GWAPT; Experience in payments, fintech, or other regulated environments ( PCI DSS familiarity); CVE credits, public security research, or conference talks. Xsolla operates across multiple time zones. Strong written communication is essential - you will need to document your work clearly so findings and context are not lost across handoffs. We value directness, intellectual honesty, and follow-through. If you do not know something, say so and find out. If you find something, explain it clearly and see it through to resolution.