Вакансии

Location: London Workplace: Hybrid Attio is the CRM for agentic revenue. Designed for the most ambitious go-to-market teams, it gives companies the power to understand every customer, automate at scale, and build their go-to-market motion exactly as they need. We've raised $116M from some of the world's best investors: GV (Google Ventures), Redpoint, Balderton, Point Nine, and 01A. We hire builders who thrive on complex technical challenges, hold themselves to a high bar, and genuinely care about delighting the people who use what they build. The team here brings sharp judgement, real craft, and the drive to do exceptional work. We're obsessed about the details and energized by the frontier. If you want to do the best work of your career, this is the right place. ABOUT THE ROLE Attio is an AI-native platform trusted with our customers' most sensitive data - and keeping that data secure is foundational to everything we build. As we scale, so does the challenge: a large multi-tenant SaaS platform, AI-driven product features that introduce entirely new attack surfaces, and an engineering team shipping fast with AI-assisted development. We're looking for a Security Engineering Lead to build and lead Attio's Product Security function, spanning application security and security operations. You'll work alongside our Engineering Leadership to make Attio secure by design, lead the response when things go wrong, and recruit a world-class team of Security Engineers and SecOps practitioners. This is a rare opportunity to define how security works at a company operating at the frontier of AI. This is a hands on engineering role with team leadership responsibility over our growing product security function. You will not be responsible for GRC, we want you focussed on building. WHAT YOU’LL DO - Build and lead Attio’s Product Security function. Secure Attio’s large-scale, AI-native SaaS platform, and the sensitive customer data on which it operates. - Work with Engineering Leadership peers to ensure that Attio is secure by design. - Understand and mitigate the unique risks and attack vectors associated with AI-driven product features, and AI-assisted software development. - Ensure that Attio is at the forefront of secure software development and operational practices. - Lead production security incident response; deeply understand security issues and their associated root causes and risks, create remediation plans, and drive to resolution. - Recruit and retain a world-class team of Security Engineers and SecOps practitioners. WHAT YOU’LL BRING - Full understanding of the Application Security landscape in a high scale, multi-tenant SaaS context. - Appreciation of the tools and techniques used to secure SaaS applications, through prevention, detection and remediation of security issues. Understanding of how to integrate those tools into an effective, scalable, cost-efficient program that delivers a secure service. - First-class incident response skills, through the entire incident lifecycle of detection, remediation, clean-up, and post-incident corrective action. - Experience leading a team with line management. You should be a mentor who can recruit, retain and develop a high-quality Product Security team that continues to deliver for the business as Attio scales. DESIRABLE - Background in software engineering - Experience of running an Application Security program in a high scale, multi-tenant SaaS context. - Experience of hiring and managing a team of Security Engineers, and working with cross-functional partners. - Experience of security certification and re-certification programs. - Project or program management experience. WHAT WE OFFER - Competitive salary of £120,000 to £150,000 - Equity in an early-stage tech company on an incredible trajectory - 25 days holiday plus local public holidays - Apple hardware - Private medical insurance through AXA - Pension contribution through Hargreaves Lansdown - Enhanced family leave - Team off-site in fun places! (We've been to Barcelona, Lisbon, Malta, and Split so far)

Location: Salt Lake City, Utah, United States About the Role iCapital is seeking a Cyber Case Manager to join the Global Information Security team within Cyber Security Operations. As the Security Operations Center (SOC) continues to grow, dedicated ownership of the case lifecycle has become essential to ensuring incidents and investigations are consistently tracked and driven to closure. The Cyber Case Manager serves as the single point of accountability for that lifecycle – from intake through resolution – ensuring every case is owned, prioritized, progressing, and documented. This individual-contributor will report to the Security Operations leader. Responsibilities Own the end-to-end lifecycle of security cases including intake, ownership assignment, progress tracking, and driving cases to resolution and closure. Serve as the single point of accountability for case status across the SOC, maintaining an accurate, prioritized, real-time view of all open incidents and investigations. Exercise authority to assign, reprioritize, and escalate cases across SOC Analysts, Threat Detection Engineering, and Incident Response to keep work moving and eliminate stalled cases. Enforce case-handling SLAs and quality standards; proactively identify aging, blocked, or at-risk cases and escalate to the Security Operations Leader. Coordinate cross-functional workstreams spanning incident response, DFIR, insider-threat cases, vulnerability-remediation tracking, audit and GRC findings, and eDiscovery and legal-hold requests. Manage case documentation and evidence integrity – ensuring timelines, actions, decisions, and artifacts are captured consistently and remain audit-ready. Integrate case workflows with SIEM/SOAR so alerts, enrichment, and automated actions flow into and out of the case record without manual re-keying. Produce case metrics and leadership reporting, including MTTD, MTTR, backlog, aging, closure rates, and SLA adherence for SOC leadership and stakeholders. Build and continuously improve case-management processes, intake criteria, and runbooks to increase throughput and reduce manager overhead. Facilitate case reviews, shift and regional handoffs, and post-incident lessons-learned, ensuring action items are tracked to completion. Leverage the SOC’s SIEM and SOAR platforms, with Jira and Confluence as the system of record. Collaborate with Legal, Compliance, Human Resources, SOC Analysts, Security Engineering, Cloud Security, Incident Response, and business stakeholders to support sensitive investigations, maintain confidentiality and chain of custody, and strengthen iCapital’s overall cyber resiliency. Participate in incident-driven after-hours coordination as needed to keep high-priority cases moving. Qualifications 3–6 years of experience in cyber security operations, incident response, or security case and program management Bachelor’s degree in information security, computer science, or information technology is preferred Experience in a regulated industry; financial services or fintech is preferred Hands-on experience managing incident or case queues in a SOC or incident response environment Working knowledge of SIEM and SOAR platforms and how alerts and cases flow through them Proficiency with Jira and Confluence for workflow management, tracking, and documentation Strong understanding of the incident response lifecycle and frameworks such as NIST and MITRE ATT&CK Demonstrated ability to coordinate across teams and drive work to closure through influence and follow-through, without direct reporting authority over those teams Familiar with handling sensitive investigations, evidence handling, and chain-of-custody principles Exceptional organization, prioritization, and attention to detail while managing many concurrent cases Excellent written and verbal communication skills, with the ability to report status clearly to both technical and executive audiences Relevant certifications (i.e. GCIH, GCFE, PMP, ITIL, or Splunk and SOAR) are preferred Experience with dedicated case-management or SOAR platforms (i.e. ServiceNow SIR, TheHive, Splunk SOAR and Phantom) Exposure to insider-threat, DFIR, eDiscovery, legal-hold, or GRC and audit workflows Familiar with cloud environments, AWS is preferred and knowledge of Agile frameworks is preferred Benefits The base salary range for this role is $100,000 to $130,000. iCapital offers a compensation package which includes salary, equity for all full-time employees, and an annual performance bonus. Employees also receive a comprehensive benefits package that includes an employer matched retirement plan, generously subsidized healthcare with 100% employer paid dental, vision, telemedicine, and virtual mental health counseling, parental leave, and unlimited paid time off (PTO). We believe the best ideas and innovation happen when we are together. Employees in this role will work in the office Monday-Thursday, with the flexibility to work remotely on Friday. For additional information on iCapital, please visit https://www.icapitalnetwork.com/about-us Twitter: @icapitalnetwork | LinkedIn: https://www.linkedin.com/company/icapital-network-inc | Awards Disclaimer: https://www.icapitalnetwork.com/about-us/recognition/ iCapital is proud to be an Equal Employment Opportunity and Affirmative Action employer. We do not discriminate based upon race, religion, color, national origin, gender, sexual orientation, gender identity, age, status as a protected veteran, status as an individual with a disability, or other applicable legally protected characteristics.

Location: London 500M+ downloads. 80M+ monthly users. A decade of building – and we’re still accelerating. Flo is the world’s #1 health & fitness app worldwide on a mission to build a better future for female health. Backed by a $200M investment led by General Atlantic, we became the first product of our kind to reach a $1B valuation in 2024 – and we’re not slowing down. With 7M paid subscribers and the highest-rated experience in the App Store’s health category, we’ve spent 10 years earning trust at scale. Now, we’re building the next generation of digital health – AI-powered, privacy-first, clinically backed – to help our users know their body better. The job About the role You’ll help Flo build a trusted, secure, audit-ready platform for the millions of people who use our women’s health app. You’ll support our SOC 2 Type II and ISO 27001 programs and help implement HIPAA safeguards, all within Flo’s integrated Information Security and Privacy Management System (ISPMS). This is a hands-on role. It needs strong applied security architecture skills, especially secure design reviews and technical control validation across AWS (EKS, Lambda, RDS, S3, VPC, IAM, KMS). You’ll work with our professional services partners, auditors, the Security team, and the Privacy, Product and Platform Engineering teams. Together you’ll design controls that reduce friction, so the business can move fast and stay secure. What you’ll do Support SOC 2 and ISO 27001 certifications and HIPAA safeguard implementation, and act as a point of contact for external auditors. Define and maintain security policies, standards and procedures. Help control owners put controls into practice and automate evidence gathering for audit readiness. Run technical design reviews and architectural risk assessments for AWS services, including data flows that handle PHI. Work with Engineering to harden AWS workloads (EKS, EC2, data pipelines) against industry best practices. Improve Flo’s security risk management framework, and track and report risks to leadership. Contribute to vendor risk management, including contract reviews and security assessments. Roll out security training and awareness campaigns. What you’ll bring 7+ years in security architecture, compliance or risk management. A degree in a related field is a plus. Hands-on experience with ISO 27001 and/or SOC 2 in a cloud-based SaaS environment. Familiarity with security controls for sensitive data. Experience with GRC and compliance automation platforms. The ability to manage several audit workstreams at once. Excellent communication skills, and the ability to turn compliance requirements into clear actions for engineering and business teams. Nice to have Working knowledge of the HIPAA Security Rule and PHI handling (highly valued). CISA, CISM or CISSP certification. Experience with NIST 800-53, CSA, CIS or HITRUST. A background in healthcare or another regulated industry. Experience building compliance roadmaps at a startup. Exposure to Kubernetes/Docker, serverless, big data platforms or DevSecOps. Experience with Agile delivery and vendor management. Annual Salary Range (ranges may vary based on skills and experience) £100,000 — £130,000 GBP How we work We’re a mission-led, product-driven team. We move fast, stay focused and take ownership – from brief to build to impact. Debate is encouraged. Decisions are shared. We care about craft, ship with purpose, and always raise the bar. You’ll be working with people who take their work seriously, not themselves. It takes commitment, resilience, and the drive to keep going when things get tough. Because better health outcomes are worth it. What you'll get We support impact with meaningful reward. Here’s what that looks like: Competitive salary and annual reviews Opportunity to participate in Flo’s performance incentive scheme Paid holiday, sick leave, and female health leave Enhanced parental leave and pay for maternity, paternity, same-sex and adoptive parents Accelerated professional growth through world-changing work and learning support In-person collaboration and work in a hybrid model, with 3 days per week spent in the office 5-week fully paid sabbatical at 5-year Floversary Flo Premium for friends & family, plus more health, pension and wellbeing perks Diversity, equity and inclusion Our strength is in our differences. At Flo, hiring is based on merit, skill and what you bring to the role – nothing else. We’re proud to be an equal opportunity employer, and we welcome applicants from all backgrounds, communities and identities. Read our privacy notice for job applicants .

Location: Amman, Jordan We are looking to hire a skilled GRC officer who will be responsible for assessing the effectiveness, efficiency, and security of our IT systems, while ensuring compliance against industry standards, best practices, and internal processes and procedures. As part of his duties, he will be responsible for overseeing compliance with and reporting to Management on how to mitigate possible risk. Responsibilities Develop, review, monitor, and implement the company's information security management system, including processes, policies, systems, and procedures, and continuously improve the ISMS to keep up with changing regulatory requirements and industry best practices. Develop, review, and monitor the Firm’s business continuity & disaster recovery plan and identify potential risks areas and ensure steps are taken to mitigate same. Investigate and report violations of processes, procedures and regulatory standards across the operations of the Firm including but not limited to engineering and operations departments with effective action plans in response to discoveries and compliance violations. Build an internal audit plan and schedule to cover all aspects as per the management needs. Prepare internal audit reports detailing findings, recommendations, and corrective actions. Plan and conduct regular audits and assessments to identify areas of non-compliance and develop corrective action plans. Monitor and report on compliance issues, including data breaches, security incidents, and regulatory changes, and take appropriate actions to address them. Ensure that compliance-related issues are communicated effectively to the leadership team and the board of directors. Provide guidance and training employees on security & compliance-related topics, based on the best practices and industry standards. Foster a culture of compliance within the organization, where all employees understand the importance of compliance and their role in maintaining it. Liaise with external auditors and regulators as necessary to demonstrate compliance with relevant laws and regulations. Collaborate with cross-functional teams to ensure that compliance & ISMS requirements are integrated into all aspects of software development, project management and operations, etc. Migrate, manage, and excel the GRC tasks to a well-known GRC tool. Perform and manage an enterprise risk assessment across the organization, based on a defined risk management policy, and procedure. Work closely with all departments on risk management tasks, including identification & mitigation of risks. Work closely with all departments on their new tools and software’s to make sure it follows ProgressSoft vision, policies, and to reflect on any required changes to the current processes and internal controls. Ability to read and understand third party agreements from Clients & assess the level of risk acceptance towards security terms and conditions. Ability to perform third party risk assessments (Vendor & Client). Understand the internal workflows and procedures, assess any areas for improvement. Requirements : Bachelor’s degree in computer science or any related field. Minimum of 1-2 years’ experience in areas related to Governance, Compliance Officer, IT Auditor or Information Technology Risk Management. Strong knowledge of IT auditing principles, practices, and frameworks (e.g., GRCP, COBIT, ISO 27001, or related discipline). Familiarity with security frameworks and compliance requirements (e.g., ISO27001, GDPR, PADSS). Familiarity of cybersecurity & compliance regulations across Middle East countries (e.g. Jordan/ UAE/ Oman/ Kuwait/ Qatar etc.). Proficiency in risk and audit tools and methodologies. Provide insights for informed decision-making. Excellent analytical, critical thinking and problem-solving skills. Excellent reporting and presentation skills. Exposure to IT Governance and its activities. Ability to work independently and as part of a team. Ability to multi-task, pay attention to details and meet deadlines. Performance goal/KPI Ensure staff members comply with all laid down processes and procedures. Presentation to the top management and as may be required. Ensure Staff members comply with the of technology at all levels. Submission of timely and regular reporting to Management on the status of progress and achievements.

Location: San Francisco, CA Workplace: OnSite ABOUT US Sierra is the leading platform for customer-facing AI agents, working with many of the world's biggest brands — including The GAP, Rocket Mortgage, SoFi, Sutter Health, and SoftBank — to transform how they serve customers and grow their businesses. We are primarily an in-person company based in San Francisco, with growing offices across North America, Europe, and Asia. We are guided by a set of values that are at the core of our actions and define our culture: Trust, Customer Obsession, Craftsmanship, Intensity, and a commitment to balancing Family along the way. These values are the foundation of our work, and we are committed to upholding them in everything we do. Sierra was co-founded by Bret Taylor https://www.linkedin.com/in/brettaylor/ and Clay Bavor https://www.linkedin.com/in/claybavor/ who first met while working together at Google over 20 years ago. Bret currently serves as Chairman of the Board of Open AI. Previously, he was co-CEO of Salesforce and CTO of Facebook. Clay spent 18 years at Google, where he most recently led Google Labs. WHAT YOU’LL DO - Drive high-impact security and infrastructure initiatives end-to-end. Lead complex, cross-functional programs spanning cloud infrastructure, platform security, identity and access management, detection and response, vulnerability management, and secure software delivery from problem definition through execution and sustained outcomes. - Own execution, planning, and program health. Be accountable for sequencing work, managing dependencies, tracking risk, and ensuring delivery of Sierra’s most critical security programs, with clear milestones and outcomes. - Help shape Sierra’s security strategy. Partner with security and engineering leadership to define priorities, investment areas, and execution plans that align risk reduction with platform growth, customer trust, and long-term scalability. - Build and strengthen security foundations. Drive programs that establish durable security primitives such as identity boundaries, access controls, logging and detection baselines, incident readiness, and secure defaults that future teams and features can confidently build on. - Translate ambiguity into clear execution. Decompose loosely defined security, risk, and compliance challenges particularly in emerging AI domains into structured programs, prioritized workstreams, and measurable outcomes. - Lead communication and alignment. Provide clear updates to leadership on program health, risks, dependencies, and tradeoffs; surface issues early and drive cross-functional alignment. WHO YOU'LL WORK WITH - Engineering: Infrastructure, Data Platform and Agent SDK engineers to shape technical requirements, manage dependencies, and deliver resilient systems. - Security & GRC: Security engineering, risk, compliance, and privacy partners to align on threat models, control strategy, audits, and risk management in a rapidly evolving AI landscape. - Product and GTM: Product, Agent Development, and Sales to operationalize security commitments and respond to sophisticated customer and regulator expectations. - Legal: On security terms, third-party risk, and contractual obligations. - Executive Leadership: Senior leaders who rely on you for clarity, prioritization, and confidence in Sierra’s security strategy and execution. WHAT YOU'LL BRING - Experience running security-focused technical programs in fast-growing SaaS or platform environments. - Strong technical fluency across cloud infrastructure, IAM, infrastructure as code, observability, secure CI/CD, and incident response. - Ability to execute through ambiguity, prioritize effectively, and keep teams moving. - Comfort operating in environments where things aren’t fully built yet and helping decide what needs to be built first. - Clear, concise communication with senior technical and business leaders. - A collaborative, pragmatic style with high ownership and high agency. EVEN BETTER... - Experience scaling security programs globally in AI-first or data-intensive SaaS environments. - Exposure to emerging AI risk, data governance, or agent and model-related security considerations. - Experience supporting security initiatives in public-sector, regulated and/or multi-cloud environments (AWS, GCP, Azure). - Relevant security, cloud, AI or technical program management certifications. - Familiarity with regulatory and compliance frameworks (ISO 27001, PCI DSS, FedRAMP, HIPAA) OUR VALUES - Trust: We build trust with our customers with our accountability, empathy, quality, and responsiveness. We build trust in AI by making it more accessible, safe, and useful. We build trust with each other by showing up for each other professionally and personally, creating an environment that enables all of us to do our best work. - Customer Obsession: We deeply understand our customers’ business goals and relentlessly focus on driving outcomes, not just technical milestones. Everyone at the company knows and spends time with our customers. When our customer is having an issue, we drop everything and fix it. - Craftsmanship: We get the details right, from the words on the page to the system architecture. We have good taste. When we notice something isn’t right, we take the time to fix it. We are proud of the products we produce. We continuously self-reflect to continuously self-improve. - Intensity: We know we don’t have the luxury of patience. We play to win. We care about our product being the best, and when it isn’t, we fix it. When we fail, we talk about it openly and without blame so we succeed the next time. - Family: We know that balance and intensity are compatible, and we model it in our actions and processes. We are the best technology company for parents. We support and respect each other and celebrate each other’s personal and professional achievements. WHAT WE OFFER We want our benefits to reflect our values and offer the following to full-time employees: - Flexible (unlimited) paid time off - Medical, dental, and vision benefits for you and your family - Life insurance and disability benefits - Retirement plan dependent on country of employment - Parental leave - Fertility and family building benefits - Lunch, as well as delicious snacks and coffee to keep you energized when working onsite - Discretionary benefit stipend giving people the ability to spend where it matters most - Free alphorn lessons These benefits are further detailed in Sierra's policies, may vary by region and employment type, and are subject to change at any time, consistent with the terms of any applicable compensation or benefits plans. Eligible full-time employees can participate in Sierra's equity plans subject to the terms of the applicable plans and policies. BE YOU, WITH US We're working to bring the transformative power of AI to every organization in the world. To do so, it is important to us that the diversity of our employees represents the diversity of our customers. We believe that our work and culture are better when we encourage, support, and respect different skills and experiences represented within our team. We encourage you to apply through the link on this page even if your experience doesn't precisely match the job description. Sierra is a proud equal opportunity employer. All qualified applicants will receive consideration for employment without regard to any characteristic protected by applicable federal, state or local laws, including veteran status and disability status. Hiring decisions are made by people, based on merit. If you need a reasonable accommodation for a disability, a religious practice, pregnancy or any related condition at any point in the application or interview process, contact us at accommodations@sierra.ai. Requests are handled confidentially and do not affect your candidacy. We will consider qualified applicants with arrest and conviction records in accordance with applicable fair chance laws.

Location: EMEA About the team The Security Team is responsible for providing key security capabilities covering application, cloud and enterprise security, incident response, detection and GRC. Our team is looking for an experienced, hands-on security practitioner, who will drive the adoption of modern security processes and tooling, with focus on supporting our engineering and product teams in improving the security posture of our platforms and services. What you will do: - Identify security gaps and vulnerabilities in all ClickHouse offerings triage a wide range of vulnerabilities reported via our bug bounty program, responsible disclosure, GitHub Issues covering web, API and server - client assets including low level memory issues like heap or buffer overflows - Improve and develop security assurance activities - pentests, vulnerability assessments, bug bounty programs, fuzzing - Plan and execute internal red team assessments and penetration tests against ClickHouse infrastructure, cloud environments, designing realistic adversary scenarios to test detection, response and control effectiveness - Assess AI/LLM-specific attack surface across ClickHouse's own AI-powered features and internal AI tooling, including prompt injection, model/data exfiltration, and unsafe agentic tool-use patterns - Build and operate agentic tooling for reconnaissance, exploit-chaining and attack-path discovery, and apply LLM-assisted fuzzing to accelerate vulnerability discovery across ClickHouse's products and infrastructure - Partner with detection engineering to validate and improve detection coverage during red team exercises, measuring and reporting on control effectiveness and time to detect/respond - Handle information security events and incidents across ClickHouse products and services - Develop processes, tooling and automation to scale security processes and mitigate risks to the business What you bring along: - 7+ years of experience in pentesting, red teaming and product security - Experience supporting engineering and product implementation efforts by performing threat assessments, assurance activities, advisory as well as, in some cases, implementation work across distributed systems covering web, API, client/server assets - Hands-on experience conducting offensive security engagements - internal red teaming, penetration testing and adversary simulation - across cloud, network and application environments - Ability to design adversary scenarios grounded in real threat intelligence (e.g. ransomware operators, supply chain attackers, insider threat) tailored to ClickHouse's risk profile as a multi-tenant cloud data platform - Strong written and verbal communication skills, with ability to translate attack chains into clear, actionable findings for engineering and leadership - Experience building or adapting agentic and LLM-assisted tooling for offensive security use cases (recon automation, exploit chaining, fuzzing harnesses), with judgment on where AI genuinely speeds up an engagement versus adds noise - Familiarity with AI/LLM-specific vulnerability classes and testing methodology - Strong knowledge of and experience with one or more cloud service providers (e.g. AWS, GCP, Azure), Kubernetes, Cilium - Experience implementing and operating engineering security tools and processes (e.g. static / dynamic code analysis, software composition analysis, SBOM, OWASP SAMM, client and network fuzzing tools) - Security as code mindset, with focus on solving problems with automation and scale in mind Bonus Points: - BS, MS, or PhD in Computer Science or related field - Previous contributions to open source projects - Security or cloud related certifications (AWS, GCP, Azure) - Previous experience in using AI security harnesses for pentesting purposes - Experience building or operating internal red team tooling and infrastructure from scratch, rather than relying solely on off-the-shelf frameworks - Offensive security certifications (e.g. OSCP, OSCE, OSEP, OSWE) PERKS - Flexible work environment - ClickHouse is a globally distributed company and remote-friendly. We currently operate in over 25 countries. - Healthcare - Employer contributions towards your healthcare. - Equity in the company - Every new team member who joins our company receives stock options. - Time off - Flexible time off in the US, generous entitlement in other countries. - A USD$500 Home office setup if you’re a remote employee. - Global Gatherings – We believe in the power of in-person connection and offer opportunities to engage with colleagues at company-wide offsites. CULTURE - WE ALL SHAPE IT As part of a rapidly scaling start-up, you will be instrumental in shaping our culture. Are you interested in finding out more about our culture? Learn more about our values here https://clickhouse.com/company/careers. Check out our blog posts https://clickhouse.com/blog or follow us on LinkedIn https://www.linkedin.com/company/clickhouseinc/life/0c1ee7f4-2129-488d-b413-e7f6270659fd/?viewAsMember=true to find out more about what’s happening at ClickHouse. EQUAL OPPORTUNITY & PRIVACY ClickHouse provides equal employment opportunities to all employees and applicants and prohibits discrimination and harassment of any type based on factors such as race, color, religion, age, sex, national origin, disability status, genetics, protected veteran status, sexual orientation, gender identity or expression, or any other characteristic protected by federal, state or local laws. Please see here https://clickhouse.com/legal/applicant-privacy-notice for our Privacy Statement.

Location: London, United Kingdom About Nebius: Nebius is leading a new era in cloud infrastructure for the global AI economy. We are building a full-stack AI cloud platform that supports developers and enterprises from data and model training through to production deployment, without the cost and complexity of building large in-house AI/ML infrastructure. Built by engineers, for engineers. From large-scale GPU orchestration to inference optimization, we own the hard problems across compute, storage, networking and applied AI. Listed on Nasdaq (NBIS) and headquartered in Amsterdam, we have a global footprint with R&D hubs across Europe, the UK, North America and Israel. Our team of 1,500+ includes hundreds of engineers with deep expertise across hardware, software and AI R&D. The role Nebius is seeking a IT Risk & Controls Manager to act as an embedded risk partner to our engineering and technology organizations. You will help scale and strengthen a modern IT SOX and controls framework across Nebius’s custom-built AI cloud platform, infrastructure, corporate technology environment and other systems supporting financial reporting. This role goes beyond traditional IT audit testing. You will work directly with engineering leaders, system owners, Finance, Internal Controls and external auditors to identify risk, design scalable controls, improve evidence quality, drive remediation and embed compliance into the way our technology organizations operate. The successful candidate will combine deep IT risk and controls expertise with meaningful in-house technology experience. You must be equally comfortable discussing technical control design with engineers, explaining risk implications to business leaders and aligning audit expectations with external assurance providers. Your responsibilities will include: Act as the risk and controls partner for an assigned technology organization or system portfolio, developing a detailed understanding of its architecture, operations, risks and financial-reporting dependencies. Own and continuously improve the relevant IT risk and control framework, including system scoping, risk assessment, RCM and control-catalogue maintenance, documentation and control ownership. Lead IT SOX readiness for assigned systems, including walkthrough preparation, evidence-quality review, testing coordination, issue evaluation and remediation oversight. Partner with engineering, platform, infrastructure, security and corporate IT teams to design and implement scalable controls that address risk while supporting operational efficiency. Design, assess and enhance ITGCs across areas such as user access, privileged access, segregation of duties, change management, SDLC, system operations, incident management and third-party services. Assess IT application controls, automated controls and IT-dependent business controls, including the completeness and accuracy of system-generated information used in business-process controls. Evaluate how business controls depend on systems, integrations, configurations, reports and underlying ITGCs, and work with both business and IT control owners to resolve gaps. Apply risk and controls thinking to modern engineering practices, including cloud infrastructure, DevOps, CI/CD, repositories, deployment processes, containerized environments and audit logging. Lead the assessment and remediation of control gaps arising from new systems, major technology transformations, platform changes, integrations and acquisitions. Review third-party assurance reports and determine the impact of vendor controls and complementary user-entity controls on the Nebius control environment. Maintain effective working relationships with external auditors and advisers, aligning on audit scope, evidence expectations, testing approaches, reliance opportunities, timelines and issue resolution. Translate complex technical risks and auditor requirements into practical guidance for engineering and system owners. Use data analytics, automation, continuous monitoring and AI-assisted tools to improve control coverage, evidence quality and the efficiency of the IT SOX program. Contribute to the development of IT controls methodology, standards, tooling, training, reporting and the broader Risk Partner operating model. Provide clear, concise updates on control health, audit readiness, deficiencies and remediation progress to senior technology and Finance stakeholders. We expect you to have: A degree in Information Systems, Computer Science, Engineering, Accounting, Finance or a related discipline, or equivalent professional experience. At least eight years of progressive experience in IT risk, IT controls, IT SOX, technology assurance, IT audit or a closely related area. Meaningful in-house technology or corporate ownership experience is required. Big Four or consulting experience is valuable when combined with subsequent in-house responsibility, but an exclusively advisory or external-audit background will not be sufficient. Experience working in a first-line technology, engineering, systems or IT operations role, or as an embedded in-house risk partner supporting a technology organization. Hands-on experience in an engineering-led technology, cloud, SaaS, platform or digital-product environment. Strong practical knowledge of SOX 404, ITGCs, IT application controls, automated controls, COSO and COBIT. Demonstrated experience with control design, implementation, monitoring, evidence review, audit readiness, issue evaluation and remediation. Practical understanding of modern technology environments, including cloud infrastructure, IAM, DevOps, CI/CD, SDLC, software repositories, deployment practices, system integrations and container orchestration such as Kubernetes. Experience connecting business-process controls to supporting systems, automated controls, IPEs/IUCs and underlying IT dependencies. The ability to communicate effectively with engineers, technical leaders, Finance stakeholders and external auditors. Strong judgment and the confidence to challenge control owners while developing practical, scalable solutions. A highly autonomous and hands-on approach, with the ability to operate effectively in an evolving environment with incomplete processes and competing priorities. Strong written and verbal English. The ability to work effectively across international time zones and travel when needed to build relationships with key technology and audit stakeholders. It will be an added bonus if you have: A professional certification such as CISA, CRISC, CISM, CIA, CPA or an equivalent qualification. Experience building or materially transforming an IT SOX or technology-controls framework in a listed or pre-IPO technology company. Experience in AI infrastructure, cloud platforms, large-scale SaaS, fintech, marketplaces or another engineering-intensive environment. Experience with GRC and audit-management tools such as Workiva, Jira, ServiceNow GRC or similar platforms. Experience with enterprise SaaS and financial systems such as NetSuite, HR platforms, billing systems, procurement tools or treasury systems. Experience onboarding acquired companies or newly implemented systems into SOX scope. Experience with control automation, continuous monitoring, data analytics or AI-assisted assurance. Exposure to AI governance, AI/ML control environments or controls supporting AI-enabled development and operations. Benefits & Perks: Competitive compensation Career growth and learning opportunities Flexibility and ownership Collaborative and innovative culture Opportunity to work on impactful AI projects International environment and talented teams What's it like to work at Nebius: Fast moving - Bold thinking - Constant growth - Meaningful impact - Trust and real ownership - Opportunity to shape the future of AI Equal Opportunity Statement: Nebius is an equal opportunity employer. We are committed to fostering an inclusive and diverse workplace and to providing equal employment opportunities in all aspects of employment. We do not discriminate on the basis of race, color, religion, sex (including pregnancy), national origin, ancestry, age, disability, genetic information, marital status, veteran status, sexual orientation, gender identity or expression, or any other characteristic protected by applicable law. Applicants must be authorized to work in the country in which they apply and will be required to provide proof of employment eligibility as a condition of hire. If you need accommodations during the application process, please let us know.

Location: Spain About Nebius: Nebius is leading a new era in cloud infrastructure for the global AI economy. We are building a full-stack AI cloud platform that supports developers and enterprises from data and model training through to production deployment, without the cost and complexity of building large in-house AI/ML infrastructure. Built by engineers, for engineers. From large-scale GPU orchestration to inference optimization, we own the hard problems across compute, storage, networking and applied AI. Listed on Nasdaq (NBIS) and headquartered in Amsterdam, we have a global footprint with R&D hubs across Europe, the UK, North America and Israel. Our team of 1,500+ includes hundreds of engineers with deep expertise across hardware, software and AI R&D. The role Nebius is seeking a IT Risk & Controls Manager to act as an embedded risk partner to our engineering and technology organizations. You will help scale and strengthen a modern IT SOX and controls framework across Nebius’s custom-built AI cloud platform, infrastructure, corporate technology environment and other systems supporting financial reporting. This role goes beyond traditional IT audit testing. You will work directly with engineering leaders, system owners, Finance, Internal Controls and external auditors to identify risk, design scalable controls, improve evidence quality, drive remediation and embed compliance into the way our technology organizations operate. The successful candidate will combine deep IT risk and controls expertise with meaningful in-house technology experience. You must be equally comfortable discussing technical control design with engineers, explaining risk implications to business leaders and aligning audit expectations with external assurance providers. Your responsibilities will include: Act as the risk and controls partner for an assigned technology organization or system portfolio, developing a detailed understanding of its architecture, operations, risks and financial-reporting dependencies. Own and continuously improve the relevant IT risk and control framework, including system scoping, risk assessment, RCM and control-catalogue maintenance, documentation and control ownership. Lead IT SOX readiness for assigned systems, including walkthrough preparation, evidence-quality review, testing coordination, issue evaluation and remediation oversight. Partner with engineering, platform, infrastructure, security and corporate IT teams to design and implement scalable controls that address risk while supporting operational efficiency. Design, assess and enhance ITGCs across areas such as user access, privileged access, segregation of duties, change management, SDLC, system operations, incident management and third-party services. Assess IT application controls, automated controls and IT-dependent business controls, including the completeness and accuracy of system-generated information used in business-process controls. Evaluate how business controls depend on systems, integrations, configurations, reports and underlying ITGCs, and work with both business and IT control owners to resolve gaps. Apply risk and controls thinking to modern engineering practices, including cloud infrastructure, DevOps, CI/CD, repositories, deployment processes, containerized environments and audit logging. Lead the assessment and remediation of control gaps arising from new systems, major technology transformations, platform changes, integrations and acquisitions. Review third-party assurance reports and determine the impact of vendor controls and complementary user-entity controls on the Nebius control environment. Maintain effective working relationships with external auditors and advisers, aligning on audit scope, evidence expectations, testing approaches, reliance opportunities, timelines and issue resolution. Translate complex technical risks and auditor requirements into practical guidance for engineering and system owners. Use data analytics, automation, continuous monitoring and AI-assisted tools to improve control coverage, evidence quality and the efficiency of the IT SOX program. Contribute to the development of IT controls methodology, standards, tooling, training, reporting and the broader Risk Partner operating model. Provide clear, concise updates on control health, audit readiness, deficiencies and remediation progress to senior technology and Finance stakeholders. We expect you to have: A degree in Information Systems, Computer Science, Engineering, Accounting, Finance or a related discipline, or equivalent professional experience. At least eight years of progressive experience in IT risk, IT controls, IT SOX, technology assurance, IT audit or a closely related area. Meaningful in-house technology or corporate ownership experience is required. Big Four or consulting experience is valuable when combined with subsequent in-house responsibility, but an exclusively advisory or external-audit background will not be sufficient. Experience working in a first-line technology, engineering, systems or IT operations role, or as an embedded in-house risk partner supporting a technology organization. Hands-on experience in an engineering-led technology, cloud, SaaS, platform or digital-product environment. Strong practical knowledge of SOX 404, ITGCs, IT application controls, automated controls, COSO and COBIT. Demonstrated experience with control design, implementation, monitoring, evidence review, audit readiness, issue evaluation and remediation. Practical understanding of modern technology environments, including cloud infrastructure, IAM, DevOps, CI/CD, SDLC, software repositories, deployment practices, system integrations and container orchestration such as Kubernetes. Experience connecting business-process controls to supporting systems, automated controls, IPEs/IUCs and underlying IT dependencies. The ability to communicate effectively with engineers, technical leaders, Finance stakeholders and external auditors. Strong judgment and the confidence to challenge control owners while developing practical, scalable solutions. A highly autonomous and hands-on approach, with the ability to operate effectively in an evolving environment with incomplete processes and competing priorities. Strong written and verbal English. The ability to work effectively across international time zones and travel when needed to build relationships with key technology and audit stakeholders. It will be an added bonus if you have: A professional certification such as CISA, CRISC, CISM, CIA, CPA or an equivalent qualification. Experience building or materially transforming an IT SOX or technology-controls framework in a listed or pre-IPO technology company. Experience in AI infrastructure, cloud platforms, large-scale SaaS, fintech, marketplaces or another engineering-intensive environment. Experience with GRC and audit-management tools such as Workiva, Jira, ServiceNow GRC or similar platforms. Experience with enterprise SaaS and financial systems such as NetSuite, HR platforms, billing systems, procurement tools or treasury systems. Experience onboarding acquired companies or newly implemented systems into SOX scope. Experience with control automation, continuous monitoring, data analytics or AI-assisted assurance. Exposure to AI governance, AI/ML control environments or controls supporting AI-enabled development and operations. Benefits & Perks: Competitive compensation Career growth and learning opportunities Flexibility and ownership Collaborative and innovative culture Opportunity to work on impactful AI projects International environment and talented teams What's it like to work at Nebius: Fast moving - Bold thinking - Constant growth - Meaningful impact - Trust and real ownership - Opportunity to shape the future of AI Equal Opportunity Statement: Nebius is an equal opportunity employer. We are committed to fostering an inclusive and diverse workplace and to providing equal employment opportunities in all aspects of employment. We do not discriminate on the basis of race, color, religion, sex (including pregnancy), national origin, ancestry, age, disability, genetic information, marital status, veteran status, sexual orientation, gender identity or expression, or any other characteristic protected by applicable law. Applicants must be authorized to work in the country in which they apply and will be required to provide proof of employment eligibility as a condition of hire. If you need accommodations during the application process, please let us know.

Location: Berlin, Germany About Nebius: Nebius is leading a new era in cloud infrastructure for the global AI economy. We are building a full-stack AI cloud platform that supports developers and enterprises from data and model training through to production deployment, without the cost and complexity of building large in-house AI/ML infrastructure. Built by engineers, for engineers. From large-scale GPU orchestration to inference optimization, we own the hard problems across compute, storage, networking and applied AI. Listed on Nasdaq (NBIS) and headquartered in Amsterdam, we have a global footprint with R&D hubs across Europe, the UK, North America and Israel. Our team of 1,500+ includes hundreds of engineers with deep expertise across hardware, software and AI R&D. The role Nebius is seeking a IT Risk & Controls Manager to act as an embedded risk partner to our engineering and technology organizations. You will help scale and strengthen a modern IT SOX and controls framework across Nebius’s custom-built AI cloud platform, infrastructure, corporate technology environment and other systems supporting financial reporting. This role goes beyond traditional IT audit testing. You will work directly with engineering leaders, system owners, Finance, Internal Controls and external auditors to identify risk, design scalable controls, improve evidence quality, drive remediation and embed compliance into the way our technology organizations operate. The successful candidate will combine deep IT risk and controls expertise with meaningful in-house technology experience. You must be equally comfortable discussing technical control design with engineers, explaining risk implications to business leaders and aligning audit expectations with external assurance providers. Your responsibilities will include: Act as the risk and controls partner for an assigned technology organization or system portfolio, developing a detailed understanding of its architecture, operations, risks and financial-reporting dependencies. Own and continuously improve the relevant IT risk and control framework, including system scoping, risk assessment, RCM and control-catalogue maintenance, documentation and control ownership. Lead IT SOX readiness for assigned systems, including walkthrough preparation, evidence-quality review, testing coordination, issue evaluation and remediation oversight. Partner with engineering, platform, infrastructure, security and corporate IT teams to design and implement scalable controls that address risk while supporting operational efficiency. Design, assess and enhance ITGCs across areas such as user access, privileged access, segregation of duties, change management, SDLC, system operations, incident management and third-party services. Assess IT application controls, automated controls and IT-dependent business controls, including the completeness and accuracy of system-generated information used in business-process controls. Evaluate how business controls depend on systems, integrations, configurations, reports and underlying ITGCs, and work with both business and IT control owners to resolve gaps. Apply risk and controls thinking to modern engineering practices, including cloud infrastructure, DevOps, CI/CD, repositories, deployment processes, containerized environments and audit logging. Lead the assessment and remediation of control gaps arising from new systems, major technology transformations, platform changes, integrations and acquisitions. Review third-party assurance reports and determine the impact of vendor controls and complementary user-entity controls on the Nebius control environment. Maintain effective working relationships with external auditors and advisers, aligning on audit scope, evidence expectations, testing approaches, reliance opportunities, timelines and issue resolution. Translate complex technical risks and auditor requirements into practical guidance for engineering and system owners. Use data analytics, automation, continuous monitoring and AI-assisted tools to improve control coverage, evidence quality and the efficiency of the IT SOX program. Contribute to the development of IT controls methodology, standards, tooling, training, reporting and the broader Risk Partner operating model. Provide clear, concise updates on control health, audit readiness, deficiencies and remediation progress to senior technology and Finance stakeholders. We expect you to have: A degree in Information Systems, Computer Science, Engineering, Accounting, Finance or a related discipline, or equivalent professional experience. At least eight years of progressive experience in IT risk, IT controls, IT SOX, technology assurance, IT audit or a closely related area. Meaningful in-house technology or corporate ownership experience is required. Big Four or consulting experience is valuable when combined with subsequent in-house responsibility, but an exclusively advisory or external-audit background will not be sufficient. Experience working in a first-line technology, engineering, systems or IT operations role, or as an embedded in-house risk partner supporting a technology organization. Hands-on experience in an engineering-led technology, cloud, SaaS, platform or digital-product environment. Strong practical knowledge of SOX 404, ITGCs, IT application controls, automated controls, COSO and COBIT. Demonstrated experience with control design, implementation, monitoring, evidence review, audit readiness, issue evaluation and remediation. Practical understanding of modern technology environments, including cloud infrastructure, IAM, DevOps, CI/CD, SDLC, software repositories, deployment practices, system integrations and container orchestration such as Kubernetes. Experience connecting business-process controls to supporting systems, automated controls, IPEs/IUCs and underlying IT dependencies. The ability to communicate effectively with engineers, technical leaders, Finance stakeholders and external auditors. Strong judgment and the confidence to challenge control owners while developing practical, scalable solutions. A highly autonomous and hands-on approach, with the ability to operate effectively in an evolving environment with incomplete processes and competing priorities. Strong written and verbal English. The ability to work effectively across international time zones and travel when needed to build relationships with key technology and audit stakeholders. It will be an added bonus if you have: A professional certification such as CISA, CRISC, CISM, CIA, CPA or an equivalent qualification. Experience building or materially transforming an IT SOX or technology-controls framework in a listed or pre-IPO technology company. Experience in AI infrastructure, cloud platforms, large-scale SaaS, fintech, marketplaces or another engineering-intensive environment. Experience with GRC and audit-management tools such as Workiva, Jira, ServiceNow GRC or similar platforms. Experience with enterprise SaaS and financial systems such as NetSuite, HR platforms, billing systems, procurement tools or treasury systems. Experience onboarding acquired companies or newly implemented systems into SOX scope. Experience with control automation, continuous monitoring, data analytics or AI-assisted assurance. Exposure to AI governance, AI/ML control environments or controls supporting AI-enabled development and operations. Benefits & Perks: Competitive compensation Career growth and learning opportunities Flexibility and ownership Collaborative and innovative culture Opportunity to work on impactful AI projects International environment and talented teams What's it like to work at Nebius: Fast moving - Bold thinking - Constant growth - Meaningful impact - Trust and real ownership - Opportunity to shape the future of AI Equal Opportunity Statement: Nebius is an equal opportunity employer. We are committed to fostering an inclusive and diverse workplace and to providing equal employment opportunities in all aspects of employment. We do not discriminate on the basis of race, color, religion, sex (including pregnancy), national origin, ancestry, age, disability, genetic information, marital status, veteran status, sexual orientation, gender identity or expression, or any other characteristic protected by applicable law. Applicants must be authorized to work in the country in which they apply and will be required to provide proof of employment eligibility as a condition of hire. If you need accommodations during the application process, please let us know.

Location: Remote - United States About Nebius: Nebius is leading a new era in cloud infrastructure for the global AI economy. We are building a full-stack AI cloud platform that supports developers and enterprises from data and model training through to production deployment, without the cost and complexity of building large in-house AI/ML infrastructure. Built by engineers, for engineers. From large-scale GPU orchestration to inference optimization, we own the hard problems across compute, storage, networking and applied AI. Listed on Nasdaq (NBIS) and headquartered in Amsterdam, we have a global footprint with R&D hubs across Europe, the UK, North America and Israel. Our team of 1,500+ includes hundreds of engineers with deep expertise across hardware, software and AI R&D. The role Nebius is seeking a IT Risk & Controls Manager to act as an embedded risk partner to our engineering and technology organizations. You will help scale and strengthen a modern IT SOX and controls framework across Nebius’s custom-built AI cloud platform, infrastructure, corporate technology environment and other systems supporting financial reporting. This role goes beyond traditional IT audit testing. You will work directly with engineering leaders, system owners, Finance, Internal Controls and external auditors to identify risk, design scalable controls, improve evidence quality, drive remediation and embed compliance into the way our technology organizations operate. The successful candidate will combine deep IT risk and controls expertise with meaningful in-house technology experience. You must be equally comfortable discussing technical control design with engineers, explaining risk implications to business leaders and aligning audit expectations with external assurance providers. Your responsibilities will include: Act as the risk and controls partner for an assigned technology organization or system portfolio, developing a detailed understanding of its architecture, operations, risks and financial-reporting dependencies. Own and continuously improve the relevant IT risk and control framework, including system scoping, risk assessment, RCM and control-catalogue maintenance, documentation and control ownership. Lead IT SOX readiness for assigned systems, including walkthrough preparation, evidence-quality review, testing coordination, issue evaluation and remediation oversight. Partner with engineering, platform, infrastructure, security and corporate IT teams to design and implement scalable controls that address risk while supporting operational efficiency. Design, assess and enhance ITGCs across areas such as user access, privileged access, segregation of duties, change management, SDLC, system operations, incident management and third-party services. Assess IT application controls, automated controls and IT-dependent business controls, including the completeness and accuracy of system-generated information used in business-process controls. Evaluate how business controls depend on systems, integrations, configurations, reports and underlying ITGCs, and work with both business and IT control owners to resolve gaps. Apply risk and controls thinking to modern engineering practices, including cloud infrastructure, DevOps, CI/CD, repositories, deployment processes, containerized environments and audit logging. Lead the assessment and remediation of control gaps arising from new systems, major technology transformations, platform changes, integrations and acquisitions. Review third-party assurance reports and determine the impact of vendor controls and complementary user-entity controls on the Nebius control environment. Maintain effective working relationships with external auditors and advisers, aligning on audit scope, evidence expectations, testing approaches, reliance opportunities, timelines and issue resolution. Translate complex technical risks and auditor requirements into practical guidance for engineering and system owners. Use data analytics, automation, continuous monitoring and AI-assisted tools to improve control coverage, evidence quality and the efficiency of the IT SOX program. Contribute to the development of IT controls methodology, standards, tooling, training, reporting and the broader Risk Partner operating model. Provide clear, concise updates on control health, audit readiness, deficiencies and remediation progress to senior technology and Finance stakeholders. We expect you to have: A degree in Information Systems, Computer Science, Engineering, Accounting, Finance or a related discipline, or equivalent professional experience. At least eight years of progressive experience in IT risk, IT controls, IT SOX, technology assurance, IT audit or a closely related area. Meaningful in-house technology or corporate ownership experience is required. Big Four or consulting experience is valuable when combined with subsequent in-house responsibility, but an exclusively advisory or external-audit background will not be sufficient. Experience working in a first-line technology, engineering, systems or IT operations role, or as an embedded in-house risk partner supporting a technology organization. Hands-on experience in an engineering-led technology, cloud, SaaS, platform or digital-product environment. Strong practical knowledge of SOX 404, ITGCs, IT application controls, automated controls, COSO and COBIT. Demonstrated experience with control design, implementation, monitoring, evidence review, audit readiness, issue evaluation and remediation. Practical understanding of modern technology environments, including cloud infrastructure, IAM, DevOps, CI/CD, SDLC, software repositories, deployment practices, system integrations and container orchestration such as Kubernetes. Experience connecting business-process controls to supporting systems, automated controls, IPEs/IUCs and underlying IT dependencies. The ability to communicate effectively with engineers, technical leaders, Finance stakeholders and external auditors. Strong judgment and the confidence to challenge control owners while developing practical, scalable solutions. A highly autonomous and hands-on approach, with the ability to operate effectively in an evolving environment with incomplete processes and competing priorities. Strong written and verbal English. The ability to work effectively across international time zones and travel when needed to build relationships with key technology and audit stakeholders. It will be an added bonus if you have: A professional certification such as CISA, CRISC, CISM, CIA, CPA or an equivalent qualification. Experience building or materially transforming an IT SOX or technology-controls framework in a listed or pre-IPO technology company. Experience in AI infrastructure, cloud platforms, large-scale SaaS, fintech, marketplaces or another engineering-intensive environment. Experience with GRC and audit-management tools such as Workiva, Jira, ServiceNow GRC or similar platforms. Experience with enterprise SaaS and financial systems such as NetSuite, HR platforms, billing systems, procurement tools or treasury systems. Experience onboarding acquired companies or newly implemented systems into SOX scope. Experience with control automation, continuous monitoring, data analytics or AI-assisted assurance. Exposure to AI governance, AI/ML control environments or controls supporting AI-enabled development and operations. #LI-DY1 Pay Transparency We offer competitive compensation and benefits packages. Actual compensation will be determined based on job-related factors, including experience, skills, qualifications, the level at which the candidate is hired, and geographic location, consistent with applicable law. Base Compensation Range $120,000 — $180,000 USD Benefits & Perks: Competitive compensation Career growth and learning opportunities Flexibility and ownership Collaborative and innovative culture Opportunity to work on impactful AI projects International environment and talented teams What's it like to work at Nebius: Fast moving - Bold thinking - Constant growth - Meaningful impact - Trust and real ownership - Opportunity to shape the future of AI Equal Opportunity Statement: Nebius is an equal opportunity employer. We are committed to fostering an inclusive and diverse workplace and to providing equal employment opportunities in all aspects of employment. We do not discriminate on the basis of race, color, religion, sex (including pregnancy), national origin, ancestry, age, disability, genetic information, marital status, veteran status, sexual orientation, gender identity or expression, or any other characteristic protected by applicable law. Applicants must be authorized to work in the country in which they apply and will be required to provide proof of employment eligibility as a condition of hire. If you need accommodations during the application process, please let us know.

Location: Amsterdam, Netherlands About Nebius: Nebius is leading a new era in cloud infrastructure for the global AI economy. We are building a full-stack AI cloud platform that supports developers and enterprises from data and model training through to production deployment, without the cost and complexity of building large in-house AI/ML infrastructure. Built by engineers, for engineers. From large-scale GPU orchestration to inference optimization, we own the hard problems across compute, storage, networking and applied AI. Listed on Nasdaq (NBIS) and headquartered in Amsterdam, we have a global footprint with R&D hubs across Europe, the UK, North America and Israel. Our team of 1,500+ includes hundreds of engineers with deep expertise across hardware, software and AI R&D. The role Nebius is seeking a IT Risk & Controls Manager to act as an embedded risk partner to our engineering and technology organizations. You will help scale and strengthen a modern IT SOX and controls framework across Nebius’s custom-built AI cloud platform, infrastructure, corporate technology environment and other systems supporting financial reporting. This role goes beyond traditional IT audit testing. You will work directly with engineering leaders, system owners, Finance, Internal Controls and external auditors to identify risk, design scalable controls, improve evidence quality, drive remediation and embed compliance into the way our technology organizations operate. The successful candidate will combine deep IT risk and controls expertise with meaningful in-house technology experience. You must be equally comfortable discussing technical control design with engineers, explaining risk implications to business leaders and aligning audit expectations with external assurance providers. Your responsibilities will include: Act as the risk and controls partner for an assigned technology organization or system portfolio, developing a detailed understanding of its architecture, operations, risks and financial-reporting dependencies. Own and continuously improve the relevant IT risk and control framework, including system scoping, risk assessment, RCM and control-catalogue maintenance, documentation and control ownership. Lead IT SOX readiness for assigned systems, including walkthrough preparation, evidence-quality review, testing coordination, issue evaluation and remediation oversight. Partner with engineering, platform, infrastructure, security and corporate IT teams to design and implement scalable controls that address risk while supporting operational efficiency. Design, assess and enhance ITGCs across areas such as user access, privileged access, segregation of duties, change management, SDLC, system operations, incident management and third-party services. Assess IT application controls, automated controls and IT-dependent business controls, including the completeness and accuracy of system-generated information used in business-process controls. Evaluate how business controls depend on systems, integrations, configurations, reports and underlying ITGCs, and work with both business and IT control owners to resolve gaps. Apply risk and controls thinking to modern engineering practices, including cloud infrastructure, DevOps, CI/CD, repositories, deployment processes, containerized environments and audit logging. Lead the assessment and remediation of control gaps arising from new systems, major technology transformations, platform changes, integrations and acquisitions. Review third-party assurance reports and determine the impact of vendor controls and complementary user-entity controls on the Nebius control environment. Maintain effective working relationships with external auditors and advisers, aligning on audit scope, evidence expectations, testing approaches, reliance opportunities, timelines and issue resolution. Translate complex technical risks and auditor requirements into practical guidance for engineering and system owners. Use data analytics, automation, continuous monitoring and AI-assisted tools to improve control coverage, evidence quality and the efficiency of the IT SOX program. Contribute to the development of IT controls methodology, standards, tooling, training, reporting and the broader Risk Partner operating model. Provide clear, concise updates on control health, audit readiness, deficiencies and remediation progress to senior technology and Finance stakeholders. We expect you to have: A degree in Information Systems, Computer Science, Engineering, Accounting, Finance or a related discipline, or equivalent professional experience. At least eight years of progressive experience in IT risk, IT controls, IT SOX, technology assurance, IT audit or a closely related area. Meaningful in-house technology or corporate ownership experience is required. Big Four or consulting experience is valuable when combined with subsequent in-house responsibility, but an exclusively advisory or external-audit background will not be sufficient. Experience working in a first-line technology, engineering, systems or IT operations role, or as an embedded in-house risk partner supporting a technology organization. Hands-on experience in an engineering-led technology, cloud, SaaS, platform or digital-product environment. Strong practical knowledge of SOX 404, ITGCs, IT application controls, automated controls, COSO and COBIT. Demonstrated experience with control design, implementation, monitoring, evidence review, audit readiness, issue evaluation and remediation. Practical understanding of modern technology environments, including cloud infrastructure, IAM, DevOps, CI/CD, SDLC, software repositories, deployment practices, system integrations and container orchestration such as Kubernetes. Experience connecting business-process controls to supporting systems, automated controls, IPEs/IUCs and underlying IT dependencies. The ability to communicate effectively with engineers, technical leaders, Finance stakeholders and external auditors. Strong judgment and the confidence to challenge control owners while developing practical, scalable solutions. A highly autonomous and hands-on approach, with the ability to operate effectively in an evolving environment with incomplete processes and competing priorities. Strong written and verbal English. The ability to work effectively across international time zones and travel when needed to build relationships with key technology and audit stakeholders. It will be an added bonus if you have: A professional certification such as CISA, CRISC, CISM, CIA, CPA or an equivalent qualification. Experience building or materially transforming an IT SOX or technology-controls framework in a listed or pre-IPO technology company. Experience in AI infrastructure, cloud platforms, large-scale SaaS, fintech, marketplaces or another engineering-intensive environment. Experience with GRC and audit-management tools such as Workiva, Jira, ServiceNow GRC or similar platforms. Experience with enterprise SaaS and financial systems such as NetSuite, HR platforms, billing systems, procurement tools or treasury systems. Experience onboarding acquired companies or newly implemented systems into SOX scope. Experience with control automation, continuous monitoring, data analytics or AI-assisted assurance. Exposure to AI governance, AI/ML control environments or controls supporting AI-enabled development and operations. Benefits & Perks: Competitive compensation Career growth and learning opportunities Flexibility and ownership Collaborative and innovative culture Opportunity to work on impactful AI projects International environment and talented teams What's it like to work at Nebius: Fast moving - Bold thinking - Constant growth - Meaningful impact - Trust and real ownership - Opportunity to shape the future of AI Equal Opportunity Statement: Nebius is an equal opportunity employer. We are committed to fostering an inclusive and diverse workplace and to providing equal employment opportunities in all aspects of employment. We do not discriminate on the basis of race, color, religion, sex (including pregnancy), national origin, ancestry, age, disability, genetic information, marital status, veteran status, sexual orientation, gender identity or expression, or any other characteristic protected by applicable law. Applicants must be authorized to work in the country in which they apply and will be required to provide proof of employment eligibility as a condition of hire. If you need accommodations during the application process, please let us know.

Location: The Netherlands; Poland; Portugal; France; United Kingdom; Spain; Germany; Italy Workplace: Remote About the team  The Security Team is responsible for providing key security capabilities covering application, cloud and enterprise security, incident response, detection and GRC. Our team is looking for an experienced, hands-on security practitioner, who will drive the adoption of modern security processes and tooling, with focus on supporting our engineering and product teams in improving the security posture of our platforms and services. Note: This position can be fully remote anywhere in the Netherlands. What you will do: - Collaborate with engineering and product on improving existing and building new product features with focus on threat modeling, assurance and secure implementation, some examples of recent work include implementation of secure key management, passwordless authentication, m2m authentication, sandboxing and compute/network/storage isolation - Identify security gaps and vulnerabilities in ClickHouse Cloud and OSS, triage a wide range of vulnerabilities reported via our bug bounty program, responsible disclosure, GitHub Issues covering web, API and server - client assets including low level memory issues like heap or buffer overflows - Improve and develop security assurance activities - pentests, vulnerability assessments, bug bounty programs, fuzzing - Drive implementation and usage of engineering security tools - static, dynamic code analysis, dependency checks, code licensing compliance (working knowledge of Snyk, Semgrep, GitHub CodeQL) - Nurture the engineering - security relationship, identify and implement process and technology improvements - Handle information security events and incidents across ClickHouse products and services - Develop processes, tooling and automation to scale security processes and mitigate risks to the business What you bring along: - Experience supporting engineering and product implementation efforts by performing threat assessments, assurance activities, advisory as well as, in some cases, implementation work across distributed systems covering web, API, client/server assets - Strong knowledge of and experience with one or more cloud service providers (e.g. AWS, GCP, Azure), Kubernetes, Cilium - Experience implementing and operating engineering security tools and processes (e.g. static / dynamic code analysis, software composition analysis, SBOM, OWASP SAMM, client and network fuzzing tools) - Significant development and automation experience, ability to work with C++ code - Security as code mindset, with focus on solving problems with automation and scale in mind Bonus Points: - BS, MS, or PhD in Computer Science or related field - Previous contributions to open source projects - Security or cloud related certifications (AWS, GCP, Azure) PERKS - Flexible work environment - ClickHouse is a globally distributed company and remote-friendly. We currently operate in over 25 countries. - Healthcare - Employer contributions towards your healthcare. - Equity in the company - Every new team member who joins our company receives stock options. - Time off - Flexible time off in the US, generous entitlement in other countries. - A USD$500 Home office setup if you’re a remote employee. - Global Gatherings – We believe in the power of in-person connection and offer opportunities to engage with colleagues at company-wide offsites. CULTURE - WE ALL SHAPE IT As part of a rapidly scaling start-up, you will be instrumental in shaping our culture. Are you interested in finding out more about our culture? Learn more about our values here https://clickhouse.com/company/careers. Check out our blog posts https://clickhouse.com/blog or follow us on LinkedIn https://www.linkedin.com/company/clickhouseinc/life/0c1ee7f4-2129-488d-b413-e7f6270659fd/?viewAsMember=true to find out more about what’s happening at ClickHouse. EQUAL OPPORTUNITY & PRIVACY ClickHouse provides equal employment opportunities to all employees and applicants and prohibits discrimination and harassment of any type based on factors such as race, color, religion, age, sex, national origin, disability status, genetics, protected veteran status, sexual orientation, gender identity or expression, or any other characteristic protected by federal, state or local laws. Please see here https://clickhouse.com/legal/applicant-privacy-notice for our Privacy Statement.

Location: United States Workplace: Remote About the team  The Security Team is responsible for providing key security capabilities covering application, cloud and enterprise security, incident response, detection and GRC. Our team is looking for an experienced, hands-on security practitioner, who will drive the adoption of modern security processes and tooling, with focus on supporting our engineering and product teams in improving the security posture of our platforms and services.  What you will do: - Collaborate with engineering and product on improving existing and building new product features with focus on threat modeling, assurance and secure implementation, some examples of recent work include implementation of secure key management, passwordless authentication, m2m authentication, sandboxing and compute/network/storage isolation - Identify security gaps and vulnerabilities in ClickHouse Cloud and OSS, triage a wide range of vulnerabilities reported via our bug bounty program, responsible disclosure, GitHub Issues covering web, API and server - client assets including low level memory issues like heap or buffer overflows - Improve and develop security assurance activities - pentests, vulnerability assessments, bug bounty programs, fuzzing - Drive implementation and usage of engineering security tools - static, dynamic code analysis, dependency checks, code licensing compliance (working knowledge of Snyk, Semgrep, GitHub CodeQL) - Nurture the engineering - security relationship, identify and implement process and technology improvements - Handle information security events and incidents across ClickHouse products and services - Develop processes, tooling and automation to scale security processes and mitigate risks to the business What you bring along: - Experience supporting engineering and product implementation efforts by performing threat assessments, assurance activities, advisory as well as, in some cases, implementation work across distributed systems covering web, API, client/server assets - Strong knowledge of and experience with one or more cloud service providers (e.g. AWS, GCP, Azure), Kubernetes, Cilium, Crossplane - Experience implementing and operating engineering security tools and processes (e.g. static / dynamic code analysis, software composition analysis, SBOM, OWASP SAMM, client and network fuzzing tools) - Significant development and automation experience, ability to work with C++ code preferred - Security as code mindset, with focus on solving problems with automation and scale in mind Bonus Points: - BS, MS, or PhD in Computer Science or related field - Previous contributions to open source projects - Security or cloud related certifications (AWS, GCP, Azure) PERKS - Flexible work environment - ClickHouse is a globally distributed company and remote-friendly. We currently operate in over 25 countries. - Healthcare - Employer contributions towards your healthcare. - Equity in the company - Every new team member who joins our company receives stock options. - Time off - Flexible time off in the US, generous entitlement in other countries. - A USD$500 Home office setup if you’re a remote employee. - Global Gatherings – We believe in the power of in-person connection and offer opportunities to engage with colleagues at company-wide offsites. CULTURE - WE ALL SHAPE IT As part of a rapidly scaling start-up, you will be instrumental in shaping our culture. Are you interested in finding out more about our culture? Learn more about our values here https://clickhouse.com/company/careers. Check out our blog posts https://clickhouse.com/blog or follow us on LinkedIn https://www.linkedin.com/company/clickhouseinc/life/0c1ee7f4-2129-488d-b413-e7f6270659fd/?viewAsMember=true to find out more about what’s happening at ClickHouse. EQUAL OPPORTUNITY & PRIVACY ClickHouse provides equal employment opportunities to all employees and applicants and prohibits discrimination and harassment of any type based on factors such as race, color, religion, age, sex, national origin, disability status, genetics, protected veteran status, sexual orientation, gender identity or expression, or any other characteristic protected by federal, state or local laws. Please see here https://clickhouse.com/legal/applicant-privacy-notice for our Privacy Statement.

Location: Boston, MA Workplace: OnSite At WHOOP, we're on a mission to unlock and inspire performance for life. We are seeking a Incident Response Lead to drive security incident response across the enterprise. In this role, you will serve as the primary internal escalation point and hands-on responder for security incidents, partnering closely with WHOOP’s 24x7 SOC provider and cross-functional stakeholders to investigate, contain, and remediate threats. This is a highly technical individual contributor role with significant ownership and visibility across Security, IT, GRC, and Legal. RESPONSIBILITIES: - Lead hands-on incident response activities, serving as the primary internal escalation point for security events - Serve as the central incident commander across Security, IT, GRC, and Legal during active incidents - Partner with the SOC to validate alerts, guide investigations, and drive containment and eradication efforts - Conduct host, cloud, and log-based investigations, and coordinate with external forensic firms when needed - Maintain and continuously improve incident response playbooks, escalation procedures, and communication workflows - Lead post-incident reviews and root cause analysis, ensuring remediation actions are clearly defined and tracked - Develop and execute tabletop exercises and incident simulations to test and strengthen response readiness - Partner with GRC and Legal to support breach impact assessments and regulatory notification processes - Drive continuous improvement of detection and response capabilities across SIEM, EDR, cloud monitoring, and identity systems - Own incident metrics and reporting, including response times, trends, and systemic risk reduction initiatives - Participate in an on-call escalation rotation to provide after-hours incident leadership when required QUALIFICATIONS: - 7+ years of experience in incident response, digital forensics, threat detection, or SOC operations - Proven experience leading incident investigations in complex, cloud-native environments - Strong experience conducting host, cloud, and log-based investigations - Hands-on expertise with SIEM platforms, EDR tools, and cloud security monitoring - Experience working with external SOC or MDR providers - Strong understanding of attack frameworks (MITRE ATT&CK) and their application to detection and response - Experience supporting breach response obligations under GDPR, HIPAA, PCI, or similar regulatory frameworks - Excellent communication skills with the ability to coordinate cross-functional stakeholders under pressure - Bachelor’s degree or relevant certifications (GCIH, GCFA, CISSP, or equivalent) This role is based in the WHOOP office located in Boston, MA. The successful candidate must be prepared to relocate if necessary to work out of the Boston, MA office. Interested in the role, but don’t meet every qualification? We encourage you to still apply! At WHOOP, we believe there is much more to a candidate than what is written on paper, and we value character as much as experience. As we continue to build a diverse and inclusive environment, we encourage anyone who is interested in this role to apply. WHOOP is an Equal Opportunity Employer and participates in E-verify https://www.e-verify.gov/to determine employment eligibility The WHOOP compensation philosophy is designed to attract, motivate, and retain exceptional talent by offering competitive base salaries, meaningful equity, and consistent pay practices that reflect our mission and core values. At WHOOP, we view total compensation as the combination of base salary, equity, and benefits, with equity serving as a key differentiator that aligns our employees with the long-term success of the company and allows every member of our corporate team to own part of WHOOP and share in the company’s long-term growth and success. The U.S. base salary range for this full-time position is $130,000 - $170,000. Salary ranges are determined by role, level, and location. Within each range, individual pay is based on factors such as job-related skills, experience, performance, and relevant education or training.  In addition to the base salary, the successful candidate will also receive benefits and a generous equity package. These ranges may be modified in the future to reflect evolving market conditions and organizational needs. While most offers will typically fall toward the starting point of the range, total compensation will depend on the candidate’s specific qualifications, expertise, and alignment with the role’s requirements.

Location: Boston, MA Workplace: OnSite At WHOOP, we're on a mission to unlock and inspire performance for life. WHOOP is seeking a Governance, Risk, and Compliance Analyst II, to lead the day-to-day operation and support the ongoing risk management program at GRC in a fast-paced, high-growth environment. This role is responsible for operations of GRC initiatives - including but not limited to structured cybersecurity and AI risk assessments, exceptions management, SDLC reviews and security compliance process ownership. The role will partner closely with Legal, Security, Product, and other teams to advance compliance objectives, reduce enterprise risk, and strengthen operational resilience. The ideal candidate combines strong analytical thinking, critical risk mind-set, familiarity with AI governance and has the ability to communicate complex risk scenarios clearly to both technical and non-technical stakeholders. RESPONSIBILITIES: - Lead governance, risk assessment, and compliance activities specific to AI/ML systems, LLM integrations, AI agents, and retrieval-augmented workflows - Partner with the Senior Security Engineer, AI/ML to integrate risk assessment findings into GRC frameworks and translate technical risk into governance requirements - Develop, maintain, and refine AI risk and compliance controls aligned with relevant frameworks, including ISO/IEC 42001, NIST Cybersecurity Framework, NIST AI Risk Management Framework, EU AI Act, GDPR, and other applicable standard - Execute risk assessments for new AI vendors, LLM platforms, AI APIs, and enterprise AI tools, including third-party risk scoring, control mapping, and remediation tracking - Manage the vendor risk assessment lifecycle for AI/ML related suppliers, ensuring documented controls, evidence collection, and follow-up on remediation items - Support audit activities, capturing evidence and coordinating cross-functional stakeholders for internal and external compliance reviews involving AI systems - Develop and maintain AI-specific GRC policies, standards, and procedures that map to AI risk domains, explainability requirements, and compliance obligations - Facilitate AI risk and compliance reporting to leadership, including risk dashboards, trend analysis, control effectiveness measurements, and key metrics - Monitor emerging AI governance requirements, guidance, and best practices, translating them into GRC program updates and compliance recommendations - Support security incident documentation and post-incident analysis for AI system events, coordinating with Legal and Security teams to ensure appropriate governance response QUALIFICATIONS: - 6+ years of experience in Governance, Risk & Compliance, including risk assessment, policy development, audit coordination, and third-party risk management - Demonstrated experience performing governance or risk assessments for AI/ML systems, including LLM integrations, model pipelines, AI agents, or data-driven algorithmic systems - Experience translating AI-specific risks (i.e., data poisoning, prompt injection, model misuse, data leakage, explainability gaps) into documented control requirements and governance standards - Hands-on experience conducting third-party risk assessments for AI vendors, LLM platforms, AI APIs, or machine learning service providers - Experience mapping AI-related risks and controls to frameworks such as ISO/IEC 42001, NIST CSF, NIST AI RMF, ISO/IEC 42001, GDPR, PCI DSS, or similar standards - Strong understanding of data governance concepts relevant to AI systems, including training data lineage, data retention, model output handling, and human oversight requirements - Experience supporting regulatory readiness or compliance efforts related to AI systems - Proven ability to collaborate with engineering and security teams to validate control implementation and remediation - Bachelor’s degree in Information Security, Computer Science, Business Risk, Compliance, or a related field This role is based in the WHOOP office located in Boston, MA. The successful candidate must be prepared to relocate if necessary to work out of the Boston, MA office.   Interested in the role, but don’t meet every qualification? We encourage you to still apply! At WHOOP, we believe there is much more to a candidate than what is written on paper, and we value character as much as experience. As we continue to build a diverse and inclusive environment, we encourage anyone who is interested in this role to apply. WHOOP is an Equal Opportunity Employer and participates in E-verify https://www.e-verify.gov/to determine employment eligibility The WHOOP compensation philosophy is designed to attract, motivate, and retain exceptional talent by offering competitive base salaries, meaningful equity, and consistent pay practices that reflect our mission and core values. At WHOOP, we view total compensation as the combination of base salary, equity, and benefits, with equity serving as a key differentiator that aligns our employees with the long-term success of the company and allows every member of our corporate team to own part of WHOOP and share in the company’s long-term growth and success. The U.S. base salary range for this full-time position is $100,000 - $140,000. Salary ranges are determined by role, level, and location. Within each range, individual pay is based on factors such as job-related skills, experience, performance, and relevant education or training.  In addition to the base salary, the successful candidate will also receive benefits and a generous equity package. These ranges may be modified in the future to reflect evolving market conditions and organizational needs. While most offers will typically fall toward the starting point of the range, total compensation will depend on the candidate’s specific qualifications, expertise, and alignment with the role’s requirements.

Location: San Francisco Perplexity is seeking a highly experienced Governance, Risk & Compliance Analyst to join our world-class team. You will help shape our compliance and risk management program. If you are a self-motivated, organized professional with a passion for driving compliance and building customer trust, this is an exciting chance to join a fast-growing startup and help revolutionize the way people search and interact online. WHAT YOU'LL DO - Implement and lead frameworks such as SOC2, ISO 27001 and HIPAA. Ensuring compliance with certification requirements - Ensure and maintain compliance with GDPR, CCPA, CPRA and other privacy regulations - Design and build scalable audit management processes and documentation systems that will support future expansion to additional compliance frameworks - Build internal GRC platform and tooling - Conduct risk assessments and mitigate data security and compliance risks - Write, update and enact policies capturing security, privacy, and AI safety requirements - Follow and help shape the AI regulatory and standards landscape to keep the company at the forefront of industry developments and best practices WHAT YOU'LL BRING - 6+ years of experience leading engagements in audit and compliance - Experience translating complex compliance requirements into scalable automation using AI agents and custom built tooling - Worked in high tech companies in cloud-native environments - Able to translate complex compliance requirements into clear and actionable work-streams - Strong commitment to cross-functional collaboration with IT, Security, GTM, and Engineering - Self-motivated, detailed and organized, with a diligent approach to project completion - Excellent written, verbal, and interpersonal communication skills

Location: Metn, Lebanon The Company Toters is an on-demand e-commerce and delivery platform that enables customers to get anything in their city with the highest level of convenience. At Toters, technology is at the heart of everything we do. Our product teams build features that simplify customers’ lives, while our engineers create scalable solutions to deliver faster and more cost-effectively. If you thrive in a high-growth startup environment and want to help reshape how people shop across the Middle East, join us. Role Overview As a Senior Offensive Security Engineer (L5), you will own complex offensive security initiatives that span multiple teams. You will lead advanced penetration testing, red team exercises, and adversarial simulations to uncover systemic weaknesses in our web applications, APIs, mobile apps, cloud infrastructure, identity, payment-adjacent flows, and overall attack surface. You will act as a hands-on technical leader : influencing secure design decisions with evidence, mentoring mid-level and junior offensive engineers, and driving improvements that meaningfully reduce risk. Description In this senior role, you will take end-to-end ownership of offensive security efforts with a focus on high-impact outcomes. Your responsibilities include: Lead comprehensive penetration tests and red team / assumed-breach exercises targeting web applications, APIs, mobile applications, cloud infrastructure, and authentication systems (including identity and privileged-access paths). Lead mobile offensive testing on Android and iOS, including evaluation and bypass/validation of runtime protection, tamper resistance, certificate pinning / Certificate Transparency, and key/secret shielding using DexProtector or similar RASP / app-shielding tools, plus complementary tooling such as MobSF. Perform in-depth threat modeling and identify complex attack paths across services and trust boundaries (including authorization flaws, tenant isolation, token/session issues, edge/WAF bypass, and client-secret exposure). Deliver high-quality security assessment reports with clear risk ratings, business impact analysis, practical remediation guidance, and evidence quality that engineering and audit stakeholders can use in a SOC 2 and PCI DSS context—then re-test and validate fixes before closure. Collaborate with Engineering, DevOps, Product, and the Security Engineer track to influence secure architecture decisions and ensure vulnerabilities are addressed at the root cause. Develop and improve offensive security methodologies, tools, and automation to increase efficiency and coverage. AI-assisted testing is a must. Mentor mid-level and junior offensive security engineers, conduct offensive-focused code/design reviews, and help raise the overall security capability of the team. Participate in purple team exercises with the detection and incident response teams to improve defenses based on real attack simulations. Stay at the forefront of offensive security research, emerging threats, and TTPs, and assess their relevance to Toters. Contribute offensive input to security standards, policies, and secure development practices across the engineering organization (you advise; you do not own policy issuance or GRC evidence packs). Support structured disclosure (VDP / researcher reports) through reproduce, rate, de-duplicate, and validate. Key Qualifications Bachelor’s degree in Computer Science, Cybersecurity, or a related field, or equivalent practical experience. 6+ years of hands-on experience in offensive security, penetration testing, or red teaming. Strong expertise in web application, API, and mobile security testing (Android and iOS). Working knowledge of DexProtector or similar mobile shielding / RASP tooling: what it protects, how testers evaluate residual risk, and how to validate that hardening holds. Advanced proficiency with offensive security tools (Burp Suite, Metasploit, Cobalt Strike or equivalent adversary-emulation platforms, custom tooling, etc.). Proficient in writing robust, reusable scripts and small tools for automation (Python preferred, Bash for quick tasks). Solid experience with cloud security testing (AWS preferred) and infrastructure attack techniques. Proven ability to lead complex security assessments from scoping to reporting and remediation validation. Strong risk assessment and threat modeling skills, with the ability to communicate technical risks clearly to both technical and non-technical stakeholders. Familiarity with SOC 2 and PCI DSS as they apply to offensive work (scoped pentests, application/API/payment-adjacent testing, evidence-quality reporting). This role does not own control design or audit evidence collection. Experience mentoring engineers and influencing cross-team security practices. Excellent written and verbal communication skills in English. Nice to Have Industry-recognized certifications such as OSCP, OSCE, OSEP, CRTO, or PNPT. Experience running full-scope red team or assumed-breach exercises. Experience developing custom exploits, tooling, or automation for offensive security. Knowledge of MITRE ATT&CK and adversary emulation. AI and AI pentesting: testing LLM/agent applications (prompt injection, tool/plugin abuse, data-exfil via agents) and using AI-assisted pentest workflows with mandatory human review. Previous experience in high-scale e-commerce, delivery, or fintech environments, including payment API / tokenization / third-party PSP testing as a tester (not as PCI control owner). Fluency in Arabic and English (French is a plus). What We Offer Competitive compensation package. Discounts on Toters orders. First-class medical insurance. Ready to own offensive security at scale and help build a safer platform for millions across the Middle East? Apply now!

Location: Hong Kong, Hong Kong SAR; Singapore, Singapore Who We Are At OKX, we believe that the future will be reshaped by crypto, and ultimately contribute to every individual's freedom. OKX is a leading crypto exchange, and the developer of OKX Wallet, giving millions access to crypto trading and decentralized crypto applications (dApps). OKX is also a trusted brand by hundreds of large institutions seeking access to crypto markets. We are safe and reliable, backed by our Proof of Reserves. Across our multiple offices globally, we are united by our core principles: We Before Me , Do the Right Thing , and Get Things Done . These shared values drive our culture, shape our processes, and foster a friendly, rewarding, and diverse environment for every OK-er. About the Opportunity This is not a traditional GRC hire. The Tech G overnance Office is looking for someone who combines the governance judgment of a seasoned compliance professional with the drive of a forward-deployed engineer — someone who closes gaps by shipping solutions, navigates ambiguity without hand-holding, and operates with the urgency of a startup and the rigour of a regulated financial institution. You will own complex cross-functional workstreams independently — coordinating across Engineering, Legal, Product, and Finance — while managing external auditors and regulators. Strong written and verbal communication in both English and Mandarin is a meaningful advantage in this role. AI tooling is not optional; it is how you work. Who You Are Self-directed driver — You run cross-functional workstreams without being managed. Ambiguity is a starting point, not a blocker. AI-native operator — You already use AI to do more, faster — and you raise the floor for the teams around you. Clear communicator — You earn trust across regulators, auditors, and C-suite through precision and consistency — in any room. Culture Fit Pace Standards Startup velocity — Decisions move fast. Priorities shift. You ship, iterate, and adapt — without waiting for perfect conditions or top-down direction. Financial institution rigour — Audit trails matter. Regulators scrutinise. The bar for accuracy, documentation, and accountability is institutional-grade — always. > The tension between these two is not a bug — it is the job. We are looking for someone who holds both without compromise. What You’ll Be Doing Independently lead audit remediation programmes — assess gaps, develop structured plans, and drive verified closure across engineering, product, legal, and operations without escalation dependency. Own cross-functional governance workstreams — set milestones, coordinate accountability, and remove blockers across departments with limited management oversight. Conduct IT security and architecture governance reviews — assess whether systems and processes meet applicable standards, and issue findings with clear ownership and remediation timelines. Build and maintain the policy estate — draft, refine, and operationalise IT governance policies and procedures; translate regulatory requirements into implementation-ready guidance for first-line teams. Lead regulator and auditor engagement — serve as the primary coordination interface for external audit and regulatory correspondence, representing the Tech G overnance Office with credibility and precision. Deploy AI to accelerate compliance operations — prototype and scale AI-assisted workflows for evidence collection, control monitoring, audit response, and policy generation; drive team-wide adoption. Deliver Tech G overnance -level reporting — produce governance dashboards and executive briefs on remediation status, risk exposure, and regulatory posture, independently and to publication standard. Track the regulatory horizon — monitor evolving requirements across active jurisdictions, translate changes into prioritised internal action, and brief senior leadership proactively. What We Look For In You AI Adoption & Application — Must Have Active daily use of AI tools to accelerate compliance and governance work — demonstrated practice with measurable output impact, not theoretical awareness. Ability to identify, build, and scale AI-assisted workflows within a Tech G overnance office context — evidence automation, policy generation, audit response, or control monitoring. Working knowledge of AI governance and risk — sufficient to contribute to internal AI oversight frameworks and assess AI-related compliance obligations. Independent Cross-Functional Leadership — Must Have Demonstrated ability to own and drive complex, multi-stakeholder workstreams independently — setting direction, coordinating accountability, and delivering outcomes without management escalation. Track record of influencing without authority across engineering, legal, finance, and operations in a fast-moving environment. Comfortable operating under ambiguity and shifting priorities while maintaining institutional-grade standards for accuracy and documentation. Experience 8+ years in IT audit, risk management, compliance, or security governance 3+ years leading governance programmes at a large-scale internet, financial services, or crypto firm Exposure to IPO-readiness or high-scrutiny regulatory examination programmes preferred Frameworks & Standards ISO 27001, SOC 1/2, PCI-DSS, COBIT, NIST — deep working knowledge GDPR and APAC data protection regimes Crypto and blockchain-specific compliance risk awareness a strong asset Engineering Sensibility Able to read and interpret code, architecture diagrams, and technical design documents without engineer-translation dependency Familiarity with cloud environments (Alibaba Cloud, AWS, GCP) and associated security tooling Communication Executive-level written and verbal communication in English — board-ready governance briefs, regulator responses, and Tech G overnance -level reporting produced independently Proficiency in Mandarin (written and verbal) is a strong advantage for APAC regulatory and stakeholder engagement Preferred Qualifications Professional security or governance certification: CISA · CISSP · CRISC · CISM · CCISO · Agentic AI Experience building AI-powered compliance tooling — audit automation, continuous control monitoring, or policy-to-control mapping Prior involvement in SOX ITGC, SEC Reg S-K Item 106, or equivalent listing-authority tech governance programmes Crypto-native compliance exposure — Proof of Reserves, SAB 121, Travel Rule, AML/CFT programme governance Active regulatory footprint across MAS, VARA, FCA, HKMA/SFC, or equivalent Why This Role OKX operates across 50+ jurisdictions with live regulatory programmes. The Tech G overnance Office is building infrastructure-grade compliance capability — not checkbox compliance. This is a rare opportunity to shape how that work gets done: independently, at pace, and with AI at the centre of the method. Perks & Benefits Competitive total compensation package L&D programs and Education subsidy for employees' growth and development Various team building programs and company events Wellness and meal allowances Comprehensive healthcare schemes for employees and dependants More that we love to tell you along the process! OKX Statement: OKX is committed to equal employment opportunities regardless of race, color, genetic information, creed, religion, sex, sexual orientation, gender identity, lawful alien status, national origin, age, marital status, and non-job related physical or mental disability, or protected veteran status. Pursuant to the San Francisco Fair Chance Ordinance, we will consider for employment qualified applicants with arrest and conviction records. Notice: All official OKX vacancies are published on this website. While roles may appear on selected third-party platforms from time to time, information on other sites may be inaccurate or outdated. If in doubt, please apply directly through our official careers website. Information collected and processed as part of the recruitment process of any job application you choose to submit is subject to OKX 's Candidate Privacy Notice .