Вакансии

Job description.

Detection & Response engineers own their detections end to end: you write them, you tune them, and your team is paged when they fire. The security team is spread across the globe with a follow-the-sun pager rotation so nobody is paged at 3am local.

Location: Ebene Workplace: OnSite Company Description We’re http://checkout.comCheckout.com http://Checkout.com. You might not know our name, but companies like eBay, Spotify, Klarna, Uber, and Sony do, because we’re behind many of the digital experiences you use every day. We are where the world checks out, enabling over 10 billion transactions yearly for more than one billion global shoppers. Whether you want to book a holiday, order food, renew a subscription, or check out online, there’s a good chance our tech powers the payments behind the scenes. Our platform helps the most ambitious businesses deliver effortless digital experiences, at scale. If you want to do career-defining work, you’ve come to the right place. We move fast, think globally, and believe great teams are built by hiring exceptional people with conviction, curiosity, and the desire to make an impact. With 20 offices across six continents and London as our HQ, we’re shaping the future of fintech – and we’re just getting started. As a Security Analyst at Checkout.com http://Checkout.com, you are a frontline defender of our global financial ecosystem. Joining our high-velocity 24/7 Security Operations Center (SOC), you won’t just watch dashboards—you will actively hunt, triage, and neutralize threats in real-time. This is a high-impact role where you’ll leverage a world-class security stack to protect millions of transactions and ensure the integrity of our global fintech platform. Key Responsibilities - Proactive monitoring using Azure Sentinel (SIEM) - End to end support for Security incident - Utilise Wiz and Qualtys to identify misconfiguration and vulnerabilities - Stay ahead of the curve by analyzing threat feeds and adapting our defenses against emerging fintech-specific attack vectors - Manage and optimize SentinelOne to ensure total visibility and protection across our organisation - Audit and secure access patterns within Okta and Active Directory, enforcing a Zero Trust philosophy - Support PCI DSS and SOC2 audits by maintaining rigorous evidence collection and control validation. - Analyze traffic patterns in Netskope to detect data exfiltration or anomalous user behavior. - Provide 24/7 security coverage on a rotational shift basis, including weekends and holidays, to ensure continuous monitoring of the environment. - Act as the first point of contact during assigned shifts, escalating high-priority incidents promptly. Skills & Experience Required - Experience: 2+ years in a Security Analyst or similar role, preferably within a tech or fintech environment. - Technical Skills: Hands-on experience with SIEM tools (e.g., Azure Sentinel), endpoint protection platforms, and vulnerability scanners. - Cloud Knowledge: Familiarity with cloud platforms like AWS, including basic understanding of cloud security best practices. - Networking: Basic understanding of network security concepts, including firewall configurations and IDS/IPS monitoring. - Compliance Knowledge: Awareness of PCI DSS and its relevance to security operations. - Incident Response: Understanding of incident response processes, including containment, eradication, and recovery. - Certifications: Relevant certifications such as CompTIA Security+, CEH, or GIAC are a plus. Additional Information Bring all of you to work We create the conditions for high performers to thrive, through real ownership, fewer blockers, and work that makes a difference from day one. Here, you’ll move fast, take on meaningful challenges, and be recognized for the impact you deliver. It’s a place where ambition gets met with opportunity, and where your growth is in your hands. We work as one team, and we back each other to succeed. So whatever your background or identity, if you’re ready to grow and make a difference, you’ll be right at home here. It’s important we set you up for success and make our process as accessible as possible. So let us know in your application, or tell your recruiter directly, if you need anything to make your experience or working environment more comfortable. Life at Checkout.com http://Checkout.com We understand that work is just one part of your life. Our hybrid working model offers flexibility, with three days per week in the office to support collaboration and connection. Curious about what it’s like to be part of our team? Visit our Careers Page https://www.checkout.com/careers to learn more about our culture, open roles, and what drives us. For a closer look at daily life at Checkout.com http://Checkout.com, follow us on LinkedIn https://www.linkedin.com/company/checkout/life/ and Instagram https://www.instagram.com/checkout_com/

Location: Remote - Colombia ; Remote - Costa Rica ; Remote - Mexico About Backblaze Backblaze is the object storage leader in the open cloud movement, fueling customer success with cloud storage built purposefully to unlock budgets, unburden administrators, and unleash innovators. Together with our partners, we’re helping customers break free from the restrictive, overpriced legacy solutions that hold them back, and blaze forward with the full power of the open cloud in their hands. Founded in 2007, we scaled the business with less than $3 million in outside funding until 2021, when we did a traditional IPO on the Nasdaq stock exchange. Today, Backblaze generates over $136M ARR and is the leading specialized storage cloud, managing over three billion gigabytes of data storage for 500K+ customers in 175+ countries, including businesses, developers, IT professionals, and individuals. But while there is a lot to celebrate in our past, there is almost as much opportunity ahead of us. We’re seeking a Red Team Security Engineer to join our team! About the Role The Red Team Security Engineer continuously validates whether vulnerabilities, configurations, identities, applications, infrastructure, and AI-enabled systems can be exploited by realistic adversaries. The role combines traditional offensive security with AI-assisted and agentic adversary emulation to validate exposure and continuously improve defensive controls. Key Responsibilities Emulate external attackers, malicious insiders, compromised identities, and autonomous adversarial agents. Validate whether vulnerabilities and configuration weaknesses identified are reachable and practically exploitable. Develop and execute realistic attack paths across web applications, APIs, cloud infrastructure, identity systems, endpoints, and other enterprise services. Use AI-assisted and agentic techniques for reconnaissance, vulnerability analysis, attack-path discovery, and controlled offensive testing. Test AI applications and agents for prompt injection, tool abuse, excessive privilege, identity compromise, and other emerging attack classes. Validate compensating controls and mitigations before or after deployment. Conduct purple-team exercises with Security Analytics and Security Operations to validate telemetry, detection, and response effectiveness. Translate offensive findings into actionable improvements to architecture, configuration, detections, and response capabilities. Qualifications Experience in red teaming, penetration testing, adversary emulation, or offensive security engineering. Strong web, API, cloud, identity, operating-system, and network security fundamentals. Experience validating practical exploitability and developing realistic attack paths. Strong understanding of MITRE ATT&CK and modern adversary techniques. Familiarity with OWASP Top 10 for LLM, OWASP Top 10 for Agentic Applications, and MITRE ATLAS. Scripting or software-development experience. Experience safely using automation or AI-assisted techniques in offensive-security workflows. Experience assessing cloud-native or AI-enabled systems, conducting purple-team exercises, or simulating autonomous adversaries is preferred. At this point, we hope you're feeling excited about the job description you're reading. Even if you don't meet every requirement, we still encourage you to apply. Learning, developing, and growing are key parts of our culture. We're eager to meet people who believe in our mission and can contribute to our team in various ways. We want people to feel comfortable expressing their true selves and to come, stay, and do their best work here. At Backblaze, we value being fair and good to our customers, partners, and employees. That’s why diversity, equity, and inclusion are at the core of our values. We are committed to fostering a workforce where all employees feel a sense of belonging regardless of race, ethnicity, nationality, gender, sexual orientation, age, religion, socio-economic status, ability, veteran status, and education. We believe that our dedication to cultivating a diverse workspace not only allows us to better serve our customers in over 175 countries, but further reinforces our commitment to doing the right thing. We are proud to be an Equal Opportunity Employer. To understand more about the data we collect and process as part of your application, please view our Backblaze Employee Privacy Notice.

Location: Lisbon, Portugal; Madrid, Spain; Prague, Czechia CloudLinux is a global remote-first company. We are driven by our principles: do the right thing, employees first, we are remote first, and we deliver high-volume, low-cost Linux infrastructure and security products that help companies to increase the efficiency of their operations. Every person on our team supports each other and does what we can to ensure we all are successful. Check out our website for more information: cloudlinux.com We are currently hiring a Staff Security Engineer within the Imunify360 product. Imunify360 is CloudLinux's security suite for Linux web servers. It protects hundreds of thousands of hosting servers and the websites running on them, so it sees most large-scale web attacks early — often in the first hours. Check out our website for more information: https://imunify360.com/ Role Mission & Scope At Imunify360, protecting customers from evolving cyber threats requires close collaboration between security research, engineering, and other teams. Responding to complex attack campaigns involves more than identifying threats — it requires understanding attack techniques, developing effective detection and mitigation strategies, and ensuring customers are protected. As a Staff Security Engineer , you'll take end-to-end technical ownership of complex security challenges, from initial threat discovery and analysis to detection, mitigation, and post-incident review. This is a hands-on technical leadership role focused on practical security engineering rather than SOC monitoring, compliance, or purely theoretical research. You'll analyze malware and exploit code, develop detection and mitigation tools, anticipate emerging attack techniques, and ensure security findings translate into production-ready detections, mitigations, and fixes. You'll work closely with engineering, security research, support, external partners, and the broader security community to coordinate responses and drive continuous improvements in our security capabilities. As an individual contributor , you won't have direct reports or people management responsibilities. All security research and testing are conducted within authorized boundaries, with clearly defined scope and responsible disclosure practices. Your mission is to strengthen Imunify360's ability to detect, prevent, and respond to emerging threats, delivering measurable security improvements that protect customers at scale. What you will own Malware and campaign mitigation Lead response to large-scale exploitation and malware campaigns: triage, root cause, and mitigation across every protection layer of the product. Reverse-engineer malware and exploits targeting Linux servers and web applications. Track campaigns over time, not just individual samples: cluster indicators, connect activity to known actors and toolkits, anticipate the next variant. Define and run measurable outcomes per campaign: time to detect, time to protect, cleanup effectiveness, reinfection rate. Security response coordination Own the security incident and response process, both for threats against our customers and for vulnerabilities in our own product: severity model, runbooks, communication, escalation. Coordinate with external parties — software vendors, partners, CERTs/CSIRTs, abuse desks, other security vendors. Drive responsible disclosure where we find vulnerabilities. Be the technical voice in security advisories and partner briefings, together with Product and Support. Triage external vulnerability reports. Offensive security on our own product Red-team our product and infrastructure. Assume a capable attacker who already has a foothold. Threat-model new features before they ship; own the security review gate for high-risk changes. Turn findings into fixes with the owning teams, not just reports. Detection engineering and tooling Raise the quality bar of detections: false-positive budgets, test corpora, staged rollout with measurement gates and fast rollback. Build and automate the analysis pipeline: dynamic analysis, honeypots, telemetry-driven hunting, ML-assisted triage where it measurably helps. Write production code for these tools; expect 30–50% of your time to be hands-on building. Turn telemetry into intelligence: emerging exploits, attacker infrastructure, trends — shared as internal briefs and selected public research. People multiplier (no direct reports) Mentor analysts and engineers; raise the security skill level across teams. Bar-raiser in security hiring loops. Key Milestones 30 days: Analyzed real threats end-to-end. Mapped the current response flow and where it breaks. Shipped at least one detection or mitigation to production. 90 days: Security response process and severity model published and agreed. Led at least one real campaign response with a written post-mortem. Baseline response metrics in place. 6 months: Time from first sighting to protection measurably reduced vs. baseline. First red-team review completed, top findings fixed. Working relationships with key external partners. 12 months: Recognized internally and externally as the owner of security response. Public research or disclosures published. Teams can run a standard campaign response without you. Requirements Must have 10+ years in security engineering, malware research, incident response, or offensive security, with several years leading cross-team work at Staff/Principal/Lead scope. Deep hands-on malware analysis and reverse engineering skills. Strong web application security and practical exploitation experience. Deep Linux knowledge from both the attacker's and the defender's side. Proven incident response leadership on large-scale events: you have run the response, written the advisory, and closed the post-mortem. Production coding in Python plus a systems language (Go, Rust or C). Experience with coordinated vulnerability disclosure and working with the security community. Clear, short writing for both engineers and non-technical stakeholders; works well async across time zones. Daily user of AI tools for analysis and coding, with critical judgment about their output. Nice to have Background in hosting or large web ecosystems. Detection authoring at scale (signatures, WAF/IDS rules). Kernel-level monitoring and rootkit detection. Threat intelligence practice and actor tracking. ML for malware classification. Public track record: CVEs, published research, talks, CTFs, open-source security tools. Relevant certifications are a plus, not a requirement. Benefits What's in it for you? Stay hands-on technically while owning complex, high-impact engineering work. Work on challenging Linux, automation, and cybersecurity problems across mature and newer products. Influence technical direction and make meaningful architectural decisions. Work independently with a high level of ownership and autonomy. Fully remote work with flexible working hours. 24 paid vacation days, 10 national holidays, and unlimited sick leave. Private medical insurance compensation. Co-working and gym/sports reimbursement. Education budget. Opportunity to receive a reward for innovative ideas that the company can patent. By applying for this position, you consent to the processing of your personal data as described in our Privacy Policy ( https://cloudlinux.com/candidate-privacy-notice ), which provides detailed information on how we maintain and handle your data.

Location: Dubai, United Arab Emirates; London, United Kingdom; Paris, France; Rome, Italy; Russia AHS, is seeking a highly professional, discreet, and experienced Close Protection Officer / Travelling Security to provide personal security and protection for a high-profile principal during daily activities, private engagements, and international travel. The successful candidate will be responsible for maintaining a secure environment, conducting proactive risk assessments, coordinating travel security arrangements, and ensuring the principal's safety, privacy, and comfort at all times. This role requires exceptional situational awareness, sound judgement, flexibility, and the ability to operate discreetly within a private, high-net-worth environment. Responsibilities Provide close protection and personal security for the principal during daily activities, private engagements, and international travel. Conduct advance security assessments of destinations, venues, residences, hotels, and travel routes. Plan and coordinate secure movements, transportation, and travel logistics. Identify potential security threats and implement appropriate preventive measures. Maintain continuous situational awareness and respond effectively to security incidents or emergencies. Coordinate with local security teams, venue personnel, drivers, and relevant authorities when required. Protect the principal's privacy and maintain strict confidentiality regarding personal, professional, and travel-related information. Monitor changing security conditions and adapt protection arrangements accordingly. Maintain professional conduct, readiness, and flexibility in line with the principal's schedule and operational requirements. Prepare security briefings, incident reports, and relevant risk assessments as required. Requirements Proven experience in close protection, executive protection, travelling security, or a comparable personal security role. Experience protecting high-net-worth individuals, senior executives, VIPs, or private principals is highly desirable. Relevant close protection or security training and certifications. Strong knowledge of threat assessment, advance planning, secure movement, and emergency response procedures. Experience accompanying principals on international travel and operating in different security environments. Excellent situational awareness, discretion, communication, and decision-making skills. Physically fit, professionally presented, and capable of maintaining a high level of readiness. Flexible and available to accommodate international travel and changing operational schedules. High level of integrity, confidentiality, emotional control, and professionalism. Valid driving licence and strong driving skills are an advantage. First aid and emergency medical response training are preferred. This position requires the highest standards of discretion and confidentiality when handling all matters relating to the principal, their family, residences, movements, and private affairs. Personal Attributes Discreet, trustworthy, and security-conscious. Calm and composed under pressure. Proactive, observant, and detail-oriented. Adaptable to demanding schedules and international environments. Able to work independently while coordinating effectively with the principal's wider support team. Benefits Why Join AHS? Innovative Environment : Be part of a forward-thinking company that embraces innovation and creativity in the luxury real estate market. Career Advancement : Enjoy opportunities for professional growth and development, with a clear path for career progression. Exclusive Properties : Work with a portfolio of some of the most prestigious and exclusive properties in the market. Collaborative Culture : Join a team-oriented environment where collaboration and mutual support are highly valued. Client-Centric Approach : Be part of a company that prioritizes exceptional customer service and client satisfaction. Competitive Compensation : Receive a competitive salary and benefits package that rewards your hard work and dedication. Global Network : Leverage a robust network of industry contacts and high-net-worth clients. Cutting-Edge Technology : Utilize the latest sales management software and CRM systems to enhance your efficiency and effectiveness. Recognition and Rewards : Benefit from a culture that recognizes and rewards outstanding performance and achievements. Work-Life Balance : Enjoy a supportive work environment that values work-life balance and employee well-being. Please Note: Due to the high volume of applications we receive, only shortlisted candidates will be contacted. We appreciate your understanding.

Location: Poland; Brazil; Peru; Sweden; Argentina; Romania; Cyprus; Czech Republic; Hungary; Mexico; Chile; Bulgaria Workplace: Remote BUILDING THE FUTURE OF OPEN FINANCE Payward - the parent company behind Kraken, NinjaTrader, Breakout, xStocks, Payward Services and CF Benchmarks - has spent the last 15 years building one of the most modern and globally accessible financial infrastructure platforms in the industry, built to advance an open, global financial system. THE TEAM xStocks brings real-world assets on-chain as tokenized securities that are regulated, fully-backed, and tradable across multiple blockchains. Built within Payward, the xStocks team runs the infrastructure that issues, custodies, and settles these instruments across EVM, Solana, TON, Tron, and more. The platform moves real value, so security is not a feature bolted on at the end. It is a property of everything the team ships. This is a hybrid engineering and security seat built for someone who is genuinely both: you ship products alongside the engineering team when the security queue is quiet, and you own security work end to end when it lands. You report into engineering and partner closely with the Payward security, CISO, and compliance functions. THE OPPORTUNITY - Own security deliverables end to end. Coordinate and review smart-contract audits, respond to security questionnaires and due-diligence requests, support CISO and compliance initiatives, and turn findings into tracked, closed-out fixes. - Run offensive assessments against our own platforms. Pentest the web apps, APIs, backend services, and on-chain components, and build the tooling to do it repeatedly rather than once. - Continuously assess posture. Threat-model new and existing systems, review architecture and key-management flows, and maintain a living view of the risks and their mitigations. - Review code for security. Be a default reviewer on changes touching auth, cryptography, custody, signing, and fund movement across our chains. - Harden the platform. Improve secrets handling, IAM and least-privilege, dependency and supply-chain hygiene, and detection and logging for security-relevant events. - Secure custody and signing workflows. Review and harden transaction signing flows, MPC and HSM integrations, signer permissions, admin roles, approval policies, and break-glass procedures. - Contribute to product engineering. Pick up regular backlog work in TypeScript so you stay close to the codebase you are defending. - Support incidents. Help with detection, triage, response, and post-mortems, and feed the lessons back into the program. WHAT YOU BRING - An engineer first. You write and review production code comfortably, TypeScript and Node.js in our stack, and you understand systems deeply enough to break them. - Strong application and infrastructure security fundamentals. The OWASP-class vulnerability landscape, authn and authz, injection, SSRF, supply-chain risk, and secure design. You have done real offensive work in pentesting, vuln research, or red-team. - Applied cryptography and blockchain security. Symmetric and asymmetric primitives, hashing, signatures, and key management, plus the security model of EVM, Solana, and ideally TON or Tron. You can read a smart contract and reason about how it fails. - Ownership. You can take an ambiguous security item, an audit, a questionnaire, or an incident, and drive it to closure without being managed through it. - Clear communication. You can explain a risk to engineers, to a CISO, and to an auditor, and tailor the message to each. - An automation instinct. You do not want to catch the same issue manually twice, so you turn findings into tests, alerts, controls, documentation, or platform improvements. - Risk judgment. You can tell a theoretical issue from a material one, and communicate severity, likelihood, impact, and remediation tradeoffs clearly. NICE TO HAVE - Experience commissioning or remediating third-party smart-contract audits. - Familiarity with custody and signing infrastructure such as HSMs, MPC, and ForDefi-style providers, and with on-chain transaction security. - Cloud security depth in GCP or AWS, IAM, and container and runtime hardening. - Detection engineering and security observability, including SIEM and log-based detections. - Relevant certifications such as OSCP, OSWE, or GWAPT. - Prior work in a regulated fintech or tokenization/DeFi environment. Unless a specific application deadline is stated in the job posting, applications are accepted on an ongoing basis. Please note, applicants are permitted to redact or remove information on their resume that identifies age, date of birth, or dates of attendance at or graduation from an educational institution. We consider qualified applicants with criminal histories for employment on our team, assessing candidates in a manner consistent with the requirements of the San Francisco Fair Chance Ordinance. OUR COMMITMENT Payward is powered by people from around the world and we celebrate the diverse talents, backgrounds, contributions, and unique perspectives that everyone brings to the table. We hire based on merit, seeking out people with the right abilities, knowledge, and skills for the job. We encourage you to apply for roles where you don't fully meet the listed requirements, especially if you're passionate or knowledgeable about crypto. We may ask candidates to complete job-related skills or work-style assessments as part of our hiring process. These assessments evaluate competencies relevant to the role and are applied consistently across candidates for similar positions. Results are considered alongside experience and interviews, and are not the sole basis for any employment decision. As an equal opportunity employer, we don't tolerate discrimination or harassment of any kind, whether based on race, ethnicity, age, gender identity, citizenship, religion, sexual orientation, disability, pregnancy, veteran status, or any other protected characteristic as outlined by federal, state, or local laws. Stay connected Follow us on Twitter https://twitter.com/krakenfx Learn on the Kraken Blog https://blog.kraken.com/#:~:text=Enter%20your%20email%20address Connect on LinkedIn https://www.linkedin.com/company/kraken-exchange/ Candidate Privacy Notice https://www.kraken.com/legal/candidate-privacy-notice

is looking for IT security engineers to lead identity, endpoint, access, automation, and operational security programs.

is looking for privacy and trust operations leads to build privacy, compliance, risk, and trust governance programs.

SpaceXAI is looking for Infrastructure Security Engineers to build and secure bare-metal, private-cloud, network, container, and hybrid-cloud infrastructure.

Location: EMEA - Remote Please note that we are unable to consider applications from candidates based in France, Italy, or Germany for this role. Money is moving onto the internet, and the shift has a name: Open Money. This is money that is open, portable, agentic, and owned by you. MetaMask spent the last ten years building it; with 100M+ downloads, users in ~190 countries, and trillions in cumulative transaction volume, it's the most trusted self-custodial financial platform on the internet. Now we're building the operating system for your money: one place to hold, move, grow, and use anything you own.  Join a remote-first, global team rebuilding how money works: a problem that touches everyone, every day. About the role MetaMask is a self-custody wallet that does not hold users’ private keys. Blockchain transactions are generally irreversible, meaning a vulnerability in the product or its software delivery chain can lead directly to financial losses for users. As a result, MetaMask attracts sustained attention from financially motivated attackers and sophisticated supply chain actors. We are looking for a Senior Manager, Application Security to lead application security across the MetaMask extension, mobile app, Snaps, backend services, DeFi primitives, stablecoins, and supporting smart contracts. The role covers architecture, code, dependencies, build and release controls, security testing, and vulnerability disclosure. This is a hands-on leadership role. You will set the strategy and operating model, lead a small senior team, and remain directly involved in code review and threat modelling. You will report to the Head of Security and work closely with MetaMask Engineering leadership to ensure security risks are understood, owned, and addressed. Responsibilities Leadership and planning Lead and develop the Application Security team, including hiring, performance management and career development, while remaining directly involved in technical work. Set the Application Security strategy, annual goals and quarterly OKRs in line with company objectives and the approved Target Operating Model. Define and track KPIs to measure performance and progress. Report AppSec progress, coverage, remediation performance and material gaps to Security leadership and contribute to Risk Committee reporting. Secure design and delivery Define security review requirements across development and release, assess whether they are met and escalate unresolved risks. Lead threat modelling and security design reviews across clients, APIs and backend services, including authentication, key management, signing and delegated actions. Assess trust boundaries across the full system and participate in architecture and RFC reviews. Define software supply chain security requirements and work with engineering teams to implement and validate controls for dependencies, builds, artefacts and publishing. Lead security code reviews across MetaMask applications and smart contracts, working with engineers and relevant specialists to address findings. Define and evolve the secure development lifecycle to incorporate AI agents, including their access, actions and human review requirements. Set security standards for AI development tools, generated code and AI components in products. Integrate security testing into development and delivery workflows, including static and dynamic analysis, dependency scanning, secrets detection and AI scanning. Evaluate tools and validate their findings. Help engineers prevent recurring vulnerabilities through secure coding guidance, reusable libraries, training and the security champions programme. Vulnerability management and external testing Own application vulnerability assessment, triage, prioritisation and remediation tracking within the organisation’s vulnerability management framework. Correlate findings across clients, services and supporting infrastructure with the relevant owners to assess combined impact. Ensure findings have clear owners and deadlines, verify fixes and escalate overdue risks. Set the scope and proposed investment for bug bounty, penetration testing and AI security scanning based on risk and results. Manage external providers, researcher relationships, rewards and payouts, and coordinate vulnerability disclosure. Assurance and incident support Provide evidence of application security controls for audits and assurance reviews, and support customer and partner due diligence. Provide application security expertise during incidents, including vulnerability analysis and remediation support. Qualifications Required : At least eight years in application security or software engineering with a security focus, including two years leading people. Strong practical code review skills in TypeScript/JavaScript, Go or Solidity across browser extensions, mobile applications and backend services, with the ability to identify vulnerabilities and work with engineers to fix them. Proven experience securing applications across clients and backend services, including distributed authentication, authorisation and key management. Experience building or substantially improving an AppSec programme, including security reviews, automated testing, AI scanning, vulnerability management and developer support, with sound judgement on where AI adds value and how to validate its findings. Practical experience securing software supply chains, including dependency policies, software composition analysis, npm, artefact integrity and CI/CD. Experience running bug bounty and penetration testing programmes, including selecting and managing external providers. Working knowledge of EVM smart contract security, including common vulnerabilities, review methods, upgrade and admin controls, and assessing external audits. A record of delivering security improvements through engineering teams outside your reporting line. Clear written communication, from actionable threat models to concise summaries of risk for executives. Preferred : Offensive security qualifications such as OSCP, OSWE or OSWA, or a proven record in bug bounty programmes or CTF competitions. Experience securing browser extensions or mobile applications. Experience securing development workflows that use AI, or AI components in production applications. Experience in crypto, Web3 or another sector facing sustained attacks, such as fintech, payments or infrastructure. Knowledge of or a strong interest in applied cryptography. Familiarity with attacks by state actors against software companies, particularly DPRK supply chain and social engineering campaigns. Experience providing evidence of secure development controls for SOC 2 or ISO 27001 assessments. Don't meet all the requirements? Don't sweat it. We’re passionate about building a diverse team of humans and as such, if you think you've got what it takes for our chaotic-but-fun, remote-friendly, start-up environment—apply anyway, detailing your relevant transferable skills in your cover letter. While we have a pretty good idea of what we need, we're ready for you to challenge our thinking on who needs to be in this role. In the rapidly evolving Web3 space, we believe that everyone is a builder. This expansive paradigm requires a range of backgrounds, talents, skills, and experiences to influence and shape the future. At MetaMask, this diversity fuels our ability to shift control and redefine the realm of possibility. We are committed to ensuring that our technology empowers people and communities through decentralized technologies. We welcome the range of perspectives and differences and celebrate them. We're excited to see how your unique skills as a builder can contribute to our vision, drive innovation, and help us shape a more inclusive Web3. MetaMask is an equal opportunity employer. All employment decisions are made without regard to race, color, national origin, ancestry, sex, gender, gender identity or expression, sexual orientation, age, genetic information, religion, disability, medical condition, pregnancy, marital status, family status, veteran status, or any other characteristic protected by law. MetaMask is aware of fraudulent recruitment practices and we encourage all applicants to review our best practices to protect yourself, which can be found on our page. MetaMask may use artificial intelligence (AI) tools to support parts of our recruitment process, such as reviewing applications, screening resumes, or conducting initial candidate assessments. These tools are designed to assist our recruiting team and improve efficiency — they do not replace human judgment. A human recruiter or hiring manager reviews every candidate, and all final hiring decisions are made by people, not AI. It is a requirement of employment in this position that applicants may be required to submit to background and identity verification checks, including but not limited to employment, education, criminal record checks, and other such checks as determined necessary by the company.

Location: Hyderabad, India Our Global Structure Deliveroo is now part of DoorDash, bringing together teams with even greater reach, scale, and ambition. Depending on your role, you may collaborate with teammates, systems, and leaders across DoorDash and Wolt. Together, we’re unlocking new possibilities as one global team. Join us in our mission to transform the way people shop and eat, where impact, innovation, and growth drive everything we do. Our Information Security team enables innovation at speed—securely. As digital guardians of DoorDash, Deliveroo, and Wolt, we safeguard our systems and the data of our employees, customers, riders, and partners. We defend against emerging cyber threats and embed security into every facet of the business. From building resilient defenses and responding to incidents to empowering teams with security knowledge, we are trusted partners protecting these global brands from the inside out. About the Role The Senior Security Operations Centre Specialist offers a unique opportunity to shape our global Security Operations strategy across a global footprint of DoorDash, Deliveroo, and Wolt. This role provides the platform to optimize our technology and AI investments while pioneering new methods to protect our data, people, and partners. As we expand, your specialist capabilities will be essential to our continued success. What you’ll be doing Work in a 24/7 global security operations centre, including scheduled night and weekend shifts. Lead the triage and investigation of security alerts, including phishing, malware, network attacks, security hygiene and privacy related incidents within specified SLAs. Mentor a team of SOC Specialists, providing the necessary guidance and feedback to deliver a best-in-class security service to the business. Lead the development and continuously improve operational documentation, processes and playbooks Build and manage autonomous AI runbooks to automate and scale our alert triage capabilities. Lead incident response and escalation, ensuring lessons learned are translated into continuous security improvements. Support the design, development and review of threat-detection use-cases to identify suspicious activity across our cloud environment. Feed into the risk framework of emerging and observed threats from intelligence and / or incidents (e.g., post incident activity / repair items). Support wider security incident investigations involving Threat Intelligence and Incident Response & Digital Forensics stakeholders. Keep up to date with current security trends, advisories, publications and security research across the threat landscape Leverage metrics and KPIs to improve security posture and identify opportunities for strategic optimisation Collaborate with the team to develop and help deliver cybersecurity awareness programs for employees, emphasising incident reporting and best practices. Requirements 6–8 years of experience in SOC, demonstrating success in managing security incidents and delivering platform optimisations while acting as a technical mentor and lead for shift operations. Proven experience building threat detection capabilities in a cloud-centric, fast-moving organisation. Hands-on experience with AWS security config, SOAR, GSO, EDR/XDR, Splunk and SQL queries. Practical experience ideating, configuring, managing defensive security solutions and technical project management Committed to continuous improvement, leveraging feedback to elevate both personal and team performance. Exceptional collaborative team player and a knowledge-sharing mindset. Working knowledge of security compliance standards, e.g. ISO27001, GDPR, NIS2 and PCI-DSS. Capable of working well both independently and collaboratively, whilst keeping calm, under the pressure of an incident with potentially high impact to the business. Able to communicate effectively during or after any incident update to both technical and non-technical stakeholders. Coordinate with the US, UK and EU central security teams as required. Preferred, but not required Understanding of IAM cloud security principles Experience in a DevOps environment with familiarity of CI/CD pipelines Hands-on experience with container technologies and orchestration services Knowledge of cloud security data encryption standards and principles Why Deliveroo? At Deliveroo, you’ll do work that matters—solving real-world problems in a three-sided marketplace that’s constantly evolving. We’re food lovers, problem solvers, community organisers, proud parents, and more, brought together by a shared drive to make things better. Working here you can expect to: 🔧 Solve meaningful problems at real scale Work on a complex, always-on marketplace that impacts millions every day. 🌱See your impact, fast Ship, test and improve ideas quickly in a low-hierarchy, high-ownership environment. 🧠Grow through challenge and ownership Take on big, ambiguous problems and accelerate your career with strong support. 🌎A culture built for builders High standards, collaboration, flexible working and continuous learning. Our Global Structure Deliveroo is now part of DoorDash, bringing together teams with even greater reach, scale, and ambition. Depending on your role, you may collaborate with teammates, systems, and leaders across DoorDash and Wolt. Together, we’re unlocking new possibilities as one global team. Diversity, Equity and Inclusion At Deliveroo, we know that a great workplace reflects the world around us and that true diversity and inclusion make us stronger, more creative, and better at what we do. We’re committed to fostering an environment where everyone can do their best work and feel they belong. We believe in equality of opportunity and welcome candidates from all backgrounds regardless of age, gender, ethnicity, disability, sexual orientation, gender identity, socio-economic background, religion, or belief. If you have a disability or long-term health condition and need support to apply for one of our roles, or require any reasonable adjustments during the recruitment process, you’ll have the opportunity to let us know once you’ve submitted your application. We’ll share details on how to request support so we can ensure you have a fair and equitable experience. If you’re excited about making a real impact in a fast-moving marketplace and growing your career alongside ambitious, supportive teams, we’d love to hear from you! Beware of recruitment scams: DASH Brands will never ask you to pay money or share sensitive financial information during hiring — learn more about DASH Brands' legitimate recruiting process at careersatdoordash.com/recruitment-scam-awareness .

Runpod is looking for a Director of Security to lead security strategy, compliance, secure development, incident response, and security operations.

Anthropic is looking for a Senior Staff Security Engineer to lead incident response and build threat detection and response capabilities.

Location: US - Headquarters - Maryland - Columbia Who is Tenable? Tenable® is the Exposure Management company. Over 40,000 organizations around the globe rely on Tenable to understand and reduce cyber risk. Our global employees support 65 percent of the Fortune 500, 50 percent of the Global 2000, and large government agencies. Come be part of our journey! What makes Tenable such a great place to work? Ask a member of our team and they’ll answer, “Our people!” We work together to build and innovate best-in-class cybersecurity solutions for our customers; all while creating a culture of belonging, respect, and excellence where we can be our best selves. When you’re part of our #OneTenable team, you can expect to partner with some of the most talented and passionate people in the industry, and have the support and resources you need to do work that truly matters. We deliver results that exceed expectations and we win together! Your Role: Tenable's InfoSec team is looking for a Security Engineer to join our Security Engineering & Architecture group. This role was built deliberately to span disciplines rather than specialize in one: you'll split your time between securing our cloud environments and supporting general security engineering disciplines across the business — covering cloud and non-cloud systems alike. If you're early-career but curious across the breadth of InfoSec rather than narrowly focused on one domain, this role is built for you. Your Opportunity: Support day-to-day cloud security operations — monitoring, triage, and remediation of findings across AWS, Azure, and/or GCP environments using CNAPP/CSPM tooling. Contribute to Security Architecture Reviews for new systems, integrations, and vendor onboarding — regardless of whether the system in question is cloud-hosted, on-prem, or SaaS. You'll work directly with the architects and engineers who own this process today, learning the methodology and eventually taking reviews from intake to sign-off. Help identify and document misconfigurations, excessive permissions, and insecure IaC patterns (Terraform/CloudFormation), and help track remediation through to closure. Participate in risk assessments and threat modeling exercises for new projects — applying the same core analysis skills whether the subject is a cloud workload, an internal application, or a third-party integration. Assist with IAM/RBAC reviews and least-privilege efforts; flag static credentials, over-broad roles, and gaps in audit logging wherever they appear in the environment. Build foundational familiarity with how AI/agentic systems intersect with our environment — cloud-hosted LLM services (AWS Bedrock, Azure OpenAI, GCP Vertex AI), the Model Context Protocol (MCP), and the basic risk surface of agent/tool-calling architectures and apply that awareness during reviews when these systems show up in scope. Work cross-functionally with engineering, GRC, and TPRM to keep architecture reviews and cloud findings moving — this role is a connective thread between teams, not a silo. What You'll Need: 2–3 years of experience in a security engineering, cloud security, IT security, or related technical role (internships and adjacent IT/ops experience count). Working knowledge of at least one major cloud provider (AWS, Azure, or GCP) — IAM fundamentals, networking basics, and common misconfiguration patterns. Basic understanding of security architecture review or threat modeling concepts (e.g., STRIDE, data flow diagrams) — or clear aptitude and interest in learning them. Familiarity with core security engineering practices: least-privilege access, audit logging, secrets management (no static credentials), and secure configuration baselines. Comfort reading documentation and asking good questions across unfamiliar systems — this role touches a lot of different architectures, so curiosity matters more than deep specialization in any one of them. Strong written communication — you'll be documenting review findings and cloud remediation guidance for technical and non-technical audiences alike. And Ideally: Exposure to IaC security scanning (Terraform/CloudFormation) or CNAPP/CSPM/CIEM platforms. Some hands-on exposure to a formal architecture/design review process, even informally (e.g., reviewing a peer's system design for security gaps). Basic familiarity with AI/LLM concepts — prompts, context windows, tool/function calling, RAG — and awareness of frameworks like the OWASP Top 10 for LLM Applications or the NIST AI RMF. A relevant certification (Security+, AWS/Azure/GCP security certs, or similar) or equivalent self-directed learning. Prior exposure to compliance frameworks (SOC 2, FedRAMP, ISO 27001) relevant to architecture review sign-off #LI-Hybrid #LI-MS1 This is the base pay range for this position. Compensation for the role will depend on a number of factors, including the candidate's qualifications, skills, competencies, location and experience, and may fall outside of the range shown. Employees are also eligible for variable compensation in addition to base pay (commission for sales roles, bonus for non-sales roles), depending on company and individual performance. Tenable also offers a variety of comprehensive and competitive benefits which include: medical, dental, vision, disability and life insurance; 401(k) retirement savings with company match; an employee stock purchase plan; an employee referral program; flexible spending accounts; an Employee Assistance Program (EAP); education assistance; parental leave; paid time off (PTO); company-paid holidays; health and wellness events; and community programs. US Pay Range $102,500 — $136,500 USD We’re committed to promoting Equal Employment Opportunity (EEO) at Tenable - through all equal employment opportunity laws and regulations at the international, federal, state and local levels.  If you need a reasonable accommodation due to a disability during the application or recruiting process, please contact Recruiting@Tenable.com for further assistance. Tenable Data Consent Statement Tenable is committed to protecting the privacy and security of your personal data. Depending on your location, one or more of the following notices may apply to you: General Applicant Privacy Notice California Applicant Privacy Notice EU/EEA/UK Applicant Privacy Notice

Location: North America Workplace: Remote At Linear, we're building the product development system for teams and agents. AI is fundamentally changing how software gets built, and we’re shaping the tools this new era requires. Founded in 2019, Linear has become the platform of choice for more than 30,000 companies (including OpenAI, Coinbase, and Ramp) to plan, build, and ship their products. Today, our team is distributed across North America, Europe, and Australia, and we’re continuing to grow internationally. What unites us is relentless focus, fast execution, and a deep care for software craftsmanship. At Linear, we are committed to quality. Security is an essential part of that quality — not a layer that we add later, but something we build in from the start. We have a foundational security program we're proud of but, as Linear evolves our product and scales into enterprise, there's meaningful work ahead: staying ahead of vulnerabilities as our attack surface grows, responding fast and cleanly when incidents happen, and hardening our product and infrastructure. As Security Engineer at Linear, you'll be operating in a high-autonomy role with real scope, doing hands-on security work across the product and infrastructure we build. Location & work mode Linear is a remote-first company. This role is open to candidates based in North America. You can work from anywhere within this region. We value deep focus and async collaboration, with intentional moments to connect in person through team off-sites, optional co-working, and occasional travel. What you’ll do Depending on your experience / skillset and our broader priorities, you could: - Operate, automate, and extend vulnerability management end-to-end: triage, prioritize, and drive remediation across product, infrastructure, and dependencies, and keep the program’s SLAs meaningful rather than theoretical - Run our bug bounty program: triage incoming reports, validate severity, work with engineering on fixes, and keep researcher relationships professional and responsive - Lead product security testing: threat model new features (including AI/agent-facing surfaces), review designs and code for security-relevant risk, and do hands-on testing (manual and tool-assisted) rather than relying solely on scanners - Be a primary responder for security incidents: lead investigation and containment, drive postmortems, and turn lessons into concrete hardening work - Own meaningful chunks of our cloud/infra security posture on GCP/k8s/Postgres: harden configurations, close gaps surfaced by audits or scanning, and partner with infra engineering on secure defaults - Build and maintain security tooling and automation, including using AI/LLM tooling to speed up triage, code review, and repetitive investigation work, so the program scales without linear headcount growth - Partner with the GRC/Trust function: feed real findings into the risk register and control evidence, and help make sure compliance requirements reflect actual engineering practice What we’re looking for - A generalist, senior-level security engineer (5+ years across security engineering, with real depth in at least two of: vulnerability management, product/appsec testing, incident response, and cloud security). We need breadth, rather than a narrow specialist in any one of these. - Hands-on and technical: you can read and reason about code (we use a lot of TypeScript), you’re comfortable in cloud environments (GCP a plus), and you can go deep on a finding rather than just filing a ticket for someone else to fix. You’re comfortable using AI coding/security tools as force multipliers (Linear Agent, Claude, Codex, etc). - Calm under pressure: you can lead an incident from first alert through postmortem without needing to be told what to do next - A builder: you’d rather write a script or ship a tool than repeat a manual process a third time - A pragmatic risk-reducer: you optimize for actually reducing risk, not for checking a box or maximizing findings count - Autonomy-oriented: comfortable setting your own priorities, working with significant independence, and knowing when to escalate - A clear communicator: able to explain a technical finding to a non-technical stakeholder and write it up so it’s actually actionable Our tech This is a hands-on security engineering role. You'll be running tools, reading/writing code, building detections, working in our cloud environment, and partnering closely with the engineers who build our product. Our stack is fronted by Cloudflare and runs on Google Cloud with k8s, Postgres, and Node. For day-to-day work, we use: - Linear, GitHub, Slack, and Google Workspace for collaboration - Claude and ChatGPT for general & engineering-specific AI tasks - Vanta for compliance automation and evidence collection Our security-specific tooling includes: - GitHub Advanced Security - RunReveal - SentinelOne What we offer We're a small, focused team that cares deeply about the quality of our work and the people we do it with. Here's what you can expect: - Competitive salary and equity - Employee-friendly equity terms including early exercise in the US and extended exercise windows - Daily meal and coffee stipend on every workday - Paid co-working space or desk - Health coverage (based on country requirements) - 5 weeks paid vacation, plus local statutory holidays - 4 months paid parental leave - Paid month off after 4 years & every 2 years thereafter - Regular team events and off-sites - Remote-first with no required commute Learn how we think and work - Read Me https://linear.app/readme a story about our mission - Our hiring process: How we hire at Linear https://linear.app/now/how-we-hire-at-linear - How we work: Designing remote work at Linear https://linear.app/now/designing-remote-work-at-linear - Why and how we do work trials https://linear.app/blog/why-and-how-we-do-work-trials-at-linear Linear blog post - How we use AI in design https://designerfund.substack.com/p/ai-design-linear feature of Linear's design team - Scaling our real-time sync engine https://linear.app/blog/scaling-the-linear-sync-engine talk by our cofounder, Tuomas Artman, at Linear's 2023 offsite - Our recent tender offer: Sharing Linear’s growth with the people building it https://linear.app/now/sharing-growth-with-the-people-building-linear Linear is an equal opportunity employer. We do not discriminate based on race, color, religion, gender identity or expression, sexual orientation, national origin, age, disability, veteran status, or any other protected characteristic under applicable law.

— Управление доступами и Data Governance; — Оценка рисков, моделирование угроз и реагирование на инциденты (SIEM/SOAR);

Location: United Kingdom, London Why Sony Interactive Entertainment? Sony Interactive Entertainment isn’t just the Best Place to Play — it’s also the Best Place to Work. Sony Interactive Entertainment (SIE) is the company behind the PlayStation brand. As a subsidiary of Sony Group Corporation, we’re part of a proud legacy of innovation and excellence. SIE is a dynamic technology company, delivering cutting-edge hardware and network services to more than 100 million people and an entertainment leader, home to some of the most beloved and recognizable intellectual properties (IP) in the world. Our role at SIE is to create and nurture the experiences under the PlayStation brand, a name synonymous with entertainment excellence and creativity. Sony Interactive Entertainment Security Architecture | Cloud | AI Security | Enterprise Platforms We are seeking a Staff Security Architect to help shape and secure the next generation of enterprise, cloud, platform, and AI-enabled technology. This role combines deep security architecture expertise with strong engineering judgment and the ability to influence technical direction across complex, global environments. The successful candidate will partner with engineering, infrastructure, product, and security teams to identify systemic risk, develop scalable security patterns, and guide secure adoption of emerging technologies, including generative AI and agentic systems. Key Responsibilities Design, review, and approve security architecture for enterprise, cloud, SaaS, platform, and application environments, balancing business objectives, engineering constraints, and risk. Lead cloud security architecture across AWS, Google Cloud, and hybrid environments, including identity, network security, data protection, logging and monitoring, key management, workload isolation, security posture management, and the effective use of native and third-party cloud security controls. Define and review security architecture for SaaS and PaaS platforms, including identity federation, privileged access, tenant configuration, data protection, API and integration security, logging, third-party risk, and secure adoption of enterprise SaaS services. Drive security throughout the software delivery lifecycle, including source control, CI/CD pipelines, build systems, artifact repositories, infrastructure as code, secrets management, code and artifact signing, software provenance, deployment automation, and security controls for developer platforms. Lead security architecture for AI-enabled systems, including generative AI, large language models, retrieval-augmented generation, AI agents, model-serving platforms, and AI-assisted developer workflows. Design mitigations for risks such as prompt injection, insecure tool use, excessive agency, sensitive-data disclosure, model or supply-chain compromise, unsafe output handling, and abuse of AI services. Define security requirements for AI data, models, prompts, embeddings, vector stores, APIs, tools, and agent identities, including least-privilege access, secrets management, encryption, isolation, provenance, logging, monitoring, and lifecycle controls. Architect and improve identity, authentication, authorization, network security, key management, cryptography, application security, and production security controls across complex environments. Identify security design gaps in existing and proposed systems; translate findings into practical architecture improvements, reference patterns, hardening standards, preventative controls, and responsible automation that improves repeatability and operational effectiveness. Provide technical leadership across multi-disciplinary teams, clearly articulating risks, tradeoffs, and recommended solutions to engineering leaders, business stakeholders, and audiences without a security background. Required Qualifications 15+ years of relevant experience in security architecture, security engineering, product security, cloud security, infrastructure security, or related disciplines, with demonstrated leadership at senior or staff level. Deep knowledge of security architecture principles across cloud, application, network, identity, platform, infrastructure, and enterprise environments. Hands-on experience designing or securing cloud-based and containerized environments, including major cloud platforms such as AWS or Google Cloud. Strong understanding of modern identity and access management, PKI, OAuth/OIDC, SAML, TLS, VPNs, secrets management, key management systems, cloud KMS, and HSMs. Expertise in network and application security controls such as WAFs, NGFWs, segmentation, DMZ design, DDoS mitigation, load balancing, proxies, intrusion detection/prevention, and host-based controls. Experience with secure software development, threat modeling, CI/CD and developer platforms, application security, and engineering mitigations across the software lifecycle. Working knowledge of AI/ML security concepts and the ability to evaluate security risks in generative AI, LLM, and agentic system architectures, including data flows, trust boundaries, model access, and tool integrations. Strong critical thinking, risk prioritization, communication, and influence skills, with the ability to lead through ambiguity and work effectively across global, cross-functional teams. Bachelor's degree in Computer Science, Mathematics, Engineering, Information Security, or equivalent practical experience. Preferred Qualifications Experience securing AI/ML platforms, generative AI applications, model gateways, RAG architectures, vector databases, or agentic workflows in production environments. Experience with AI security evaluation, red teaming, adversarial testing, model abuse testing, or control validation for AI-enabled systems. Experience securing large-scale Linux, distributed, multi-tenant, or high-availability production environments. Development or automation experience in Python, C++, Java, or similar languages. Recognized technical leadership through patents, publications, open-source contributions, conference participation, teaching, or security community involvement. Penetration testing, adversarial security, or attacker-minded design experience. Master's degree or Ph.D. in Computer Science, Mathematics, Engineering, Information Security, or a related field. Please note, Sony Interactive Entertainment conducts background checks at the offer stage for all new employees (which may include criminal background checks for some roles) and will need to process personal information to support these checks. Please refer to our Candidate Privacy Notice for more information about what personal information we collect, how we use it, who we share it with, and your data protection rights. Equal Opportunity Statement: Sony is an Equal Opportunity Employer. All persons will receive consideration for employment without regard to gender (including gender identity, gender expression and gender reassignment), race (including colour, nationality, ethnic or national origin), religion or belief, marital or civil partnership status, disability, age, sexual orientation, pregnancy, maternity or parental status, trade union membership or membership in any other legally protected category. We strive to create an inclusive environment, empower employees and embrace diversity. We encourage everyone to respond. Sony Interactive Entertainment is a Fair Chance employer and qualified applicants with arrest and conviction records will be considered for employment.