Location: United States; Canada
Workplace: Remote
ABOUT DOCKER
Docker has been one of the most loved brands in developer tooling, trusted by more than 20 million monthly users and over 20 billion container image pulls. From solo founders to the world's largest companies, developers rely on Docker to build, share, and run their applications across our suite of products including Docker Desktop, Docker Hub, and Docker Scout.
We are a globally distributed, remote-first team building the tools that define how software gets built and delivered. As AI agents redefine software development, Docker is at the center of that shift, providing the sandboxed environments, verified images, and secure infrastructure that make autonomous workflows trustworthy by default.
_______________________________________________________________________
As a Senior Security Engineer, Offensive Security, you'll help drive offensive security at Docker, putting our products, platforms, and cloud infrastructure under realistic adversarial testing to surface and drive out attack paths before real adversaries find them. You'll partner with engineering, product, and leadership to turn findings into durable fixes and to shape how security is designed into every Docker product.
You'll apply your expertise in penetration testing, threat modeling, and exploit development to find and eliminate risks across Docker products and infrastructure. Working across cloud infrastructure (AWS, GCP, Azure), containerized environments, and AI/ML products, you'll implement proactive security solutions that scale with Docker's growth.
This role offers the opportunity to help improve security programs at a company whose products are trusted by millions of developers worldwide. You'll work in a fast-paced, technically challenging environment where your security expertise directly impacts both Docker's platform and the broader container ecosystem.
RESPONSIBILITIES:
- Contribute to security initiatives that align with business goals, helping ensure security is a core component of our products and infrastructure
- Support and help implement key security programs such as automated security design reviews, and vulnerability management
- Build deep knowledge of software security and architecture, and act as a go-to resource for engineering teams
- Partner with engineering to design and implement security architecture and controls across Docker products and platforms
- Plan, scope, and execute penetration tests and red-team / adversary-emulation engagements against Docker's products and services
- Develop proof-of-concept exploits and produce clear, risk-rated findings with actionable remediation guidance, then retest fixes to confirm closure
- Build and maintain offensive security tooling and automation to expand testing coverage and repeatability
- Perform security reviews and threat modeling (design, architecture, and code) across Docker products and services, including emerging AI products, and write automated security tests and exploits
- Serve on rotating on-call schedule to respond to security events, investigate threats, and coordinate remediation efforts
- Educate and collaborate with cross-functional teams (e.g., engineering, product) to promote security practices
- Participate in Security Incident response
QUALIFICATIONS
- Have 3+ years in security engineering, including hands-on offensive security and penetration testing across applications and infrastructure
- Possess 2+ years of hands-on development experience in Python or Golang
- Demonstrate deep expertise in authentication, authorization, including technologies like OAuth, cryptography applications and Zero Trust principles.
- Have strong hands-on experience with securing cloud ecosystems (e.g. AWS, GCP, Azure)
- Have hands-on penetration testing experience across SaaS web applications and APIs., including manual exploitation beyond automated scanners
- Are proficient with offensive tooling and techniques such as. Burp Suite, and OWASP frameworks
- Can write security tests and develop exploits and proof-of-concepts that find real vulnerabilities in a product
- Understand AI/ML security risks and mitigations, including prompt injection, data poisoning, model extraction, and adversarial attacks
- Have practical experience using LLMs and agentic tooling to automate vulnerability discovery, reconnaissance, and pentesting workflows
- Have a track record of building security programs and automations from scratch, applying risk-based prioritization
- Have experience performing security reviews and building or improving security review automation
- Have excellent communication skills, allowing you to explain complex security concepts clearly to technical and non-technical stakeholders
- Understand industry standards, and actively keep up with emerging security technologies and models
- Are a team player who drives security change via collaboration and cross-functional partnerships
- Hold offensive security certifications such as OSCP, OSWE, OSEP, GXPN, GPEN, or CRTO
- Have published CVEs, original security research, or conference talks
Bonus if you:
- Have experience with container escape, Kubernetes attack paths, or cloud red teaming
- Have experience testing AI/ML systems for issues like prompt injection, model extraction, and data poisoning
WHAT TO EXPECT
FIRST 30 DAYS:
- Meet with security team and key partners across engineering
- Gain access to team owned systems, and internal documentation
- Complete security awareness training and compliance onboarding
- Review application architecture, tech stack and data flow
- Review risk registry and annual roadmap
- Familiarize oneself with team workflows and processes
- Shadow a fellow security engineer during their on-call/secops rotations
FIRST 90 DAYS:
- Conduct security review on emerging Docker products
- Scope and execute your first penetration test against a Docker product or service
- Actively participate in architecture design reviews with the team
- Contribute to a Security-owned project or initiative
- Collaborate with Docker developers to validate and resolve discovered vulnerabilities
- Enhance incident response capabilities by participating in on-call rotation and post-incident activities
- Create and maintain security documentation and runbooks
FIRST YEAR OUTLOOK
- Contribute to the security roadmap for improving security controls
- Strengthen Zero Trust architecture and least privilege access controls
- Enhance security monitoring and anomaly detection
- Perform security reviews for major product releases
- Own and run recurring penetration tests and adversary-emulation exercises across Docker products, and engage with external researchers
- Support audits and ensure compliance with SOC 2, ISO 27xxx
- Advocate for “security by design” in all product features
- Become well versed in Docker products and emerging AI technologies
Docker does not offer visa sponsorship for this role.
Compensation & Equity
Canada: CA$271,150 – CA$434,000 + equity
United States: $194,150 – $312,950 + equity
______________________________________________________________________
POSTING INFORMATION
- Open vacancy: This posting is for an existing open role.
- AI in hiring: Docker may use AI-assisted tools during our recruiting process.
- Interview recordings: Candidates will be invited to opt in to interview recordings to support interviewer calibration and consistent evaluations. Recordings are optional and require explicit consent.
______________________________________________________________________
PERKS & BENEFITS
- Remote-first by design – Work from your home, with offices in Seattle and Paris for connection and collaboration.
- Flexibility that fits your life – We trust you to manage your schedule while delivering great work.
- Time to recharge – Generous PTO, designated quarterly Whaleness Days, and a designated end-of-year Whaleness break.
- Home office support – Set up your workspace for comfort and success.
- Technology stipend – Equivalent to US$100 net per month to help support your work.
- Learning & development – Annual stipend for conferences, courses, certifications, and continued learning.
- Parental leave – 16 weeks of paid parental leave after six months of employment.
- Equity for all full-time employees – Share in Docker's long-term success as we continue to grow.
- Comprehensive benefits – Medical, retirement, and paid holidays vary by country.
- Docker swag – Because representing the whale never gets old.
Docker is proud to be an equal opportunity employer. We are committed to building a team that reflects a broad range of backgrounds, experiences, and perspectives. We believe diverse teams build better products, make better decisions, and better serve our global community.
#LI-REMOTE
Location: Remote-Friendly, United States; San Francisco, CA | Seattle, WA | New York City, NY | Washington, DC
About Anthropic
Anthropic’s mission is to create reliable, interpretable, and steerable AI systems. We want AI to be safe and beneficial for our users and for society as a whole. Our team is a quickly growing group of committed researchers, engineers, policy experts, and business leaders working together to build beneficial AI systems.
About the Team
The Security Engineering team's mission is to safeguard our AI systems and maintain the trust of our users and society at large. Whether we're developing critical security infrastructure, building secure development practices, or partnering with our research and product teams, we are committed to operating as a world-class security organization and keeping the safety and trust of our users at the forefront of everything we do.
What You’ll Do:
Conduct red and purple team engagements simulating advanced threat actors across our cloud infrastructure, endpoints and bare metal deployments.
Penetration test specific, high value deployments.
Contribute to AI-assisted security testing tooling and workflows.
Work cross functionally with other security and engineering teams, particularly on AI-specific attack scenarios.
Document and present findings to technical and executive audiences, translating attack narratives into actionable risk insights that inform security roadmaps.
Who You Are:
5+ years of hands-on experience in red teaming and offensive security operations
Deep expertise in at least two of: macOS security, Linux Security, Cloud security (GCP/AWS/Azure), Kubernetes, CI/CD pipelines
Track record of discovering novel attack vectors and chaining vulnerabilities creatively
Experience conducting adversarial simulations against well-defended environments
Strong engineering skills (Python, Go, or similar)
Ability to write clear findings that drive action, helping teams understand risk and prioritize fixes
Collaborative approach, working in close collaboration with the blue team
Strong candidates may also have experience with:
Prior work at organizations with state actor threat models
Interest in AI safety and how security engineering contributes to responsible AI developments
Background testing AI/ML systems or agentic workflows
Familiarity with detection engineering and SIEM/EDR platforms from the defensive side
Experience with data center security or hardware-based attacks
Deadline to apply: None. Applications will be received on a rolling basis.
The annual compensation range for this role is listed below.
For sales roles, the range provided is the role’s On Target Earnings ("OTE") range, meaning that the range includes both the sales commissions/sales bonuses target and annual base salary for the role.
Annual Salary:
$300,000
—
$320,000 USD
Logistics
Minimum education:
Bachelor’s degree or an equivalent combination of education, training, and/or experience
Required field of study:
A field relevant to the role as demonstrated through coursework, training, or professional experience
Minimum years of experience:
Years of experience required will correlate with the internal job level requirements for the position
Location-based hybrid policy:
Currently, we expect all staff to be in one of our offices at least 25% of the time. However, some roles may require more time in our offices.
Visa sponsorship:
We do sponsor visas! However, we aren't able to successfully sponsor visas for every role and every candidate. But if we make you an offer, we will make every reasonable effort to get you a visa, and we retain an immigration lawyer to help with this.
We encourage you to apply even if you do not believe you meet every single qualification.
Not all strong candidates will meet every single qualification as listed. Research shows that people who identify as being from underrepresented groups are more prone to experiencing imposter syndrome and doubting the strength of their candidacy, so we urge you not to exclude yourself prematurely and to submit an application if you're interested in this work. We think AI systems like the ones we're building have enormous social and ethical implications. We think this makes representation even more important, and we strive to include a range of diverse perspectives on our team.
Your safety matters to us.
To protect yourself from potential scams, remember that Anthropic recruiters only contact you from @anthropic.com email addresses. In some cases, we may partner with vetted recruiting agencies who will identify themselves as working on behalf of Anthropic. Be cautious of emails from other domains. Legitimate Anthropic recruiters will never ask for money, fees, or banking information before your first day. If you're ever unsure about a communication, don't click any links—visit
anthropic.com/careers
directly for confirmed position openings.
How we're different
We believe that the highest-impact AI research will be big science. At Anthropic we work as a single cohesive team on just a few large-scale research efforts. And we value impact — advancing our long-term goals of steerable, trustworthy AI — rather than work on smaller and more specific puzzles. We view AI research as an empirical science, which has as much in common with physics and biology as with traditional efforts in computer science. We're an extremely collaborative group, and we host frequent research discussions to ensure that we are pursuing the highest-impact work at any given time. As such, we greatly value communication skills.
The easiest way to understand our research directions is to read our recent research. This research continues many of the directions our team worked on prior to Anthropic, including: GPT-3, Circuit-Based Interpretability, Multimodal Neurons, Scaling Laws, AI & Compute, Concrete Problems in AI Safety, and Learning from Human Preferences.
Come work with us!
Anthropic is a public benefit corporation headquartered in San Francisco. We offer competitive compensation and benefits, optional equity donation matching, generous vacation and parental leave, flexible working hours, and a lovely office space in which to collaborate with colleagues.
Guidance on Candidates' AI Usage:
Learn about
our policy
for using AI in our application process.
Location: EMEA
About the team
The Security Team is responsible for providing key security capabilities covering application, cloud and enterprise security, incident response, detection and GRC. Our team is looking for an experienced, hands-on security practitioner, who will drive the adoption of modern security processes and tooling, with focus on supporting our engineering and product teams in improving the security posture of our platforms and services.
What you will do:
- Identify security gaps and vulnerabilities in all ClickHouse offerings triage a wide range of vulnerabilities reported via our bug bounty program, responsible disclosure, GitHub Issues covering web, API and server - client assets including low level memory issues like heap or buffer overflows
- Improve and develop security assurance activities - pentests, vulnerability assessments, bug bounty programs, fuzzing
- Plan and execute internal red team assessments and penetration tests against ClickHouse infrastructure, cloud environments, designing realistic adversary scenarios to test detection, response and control effectiveness
- Assess AI/LLM-specific attack surface across ClickHouse's own AI-powered features and internal AI tooling, including prompt injection, model/data exfiltration, and unsafe agentic tool-use patterns
- Build and operate agentic tooling for reconnaissance, exploit-chaining and attack-path discovery, and apply LLM-assisted fuzzing to accelerate vulnerability discovery across ClickHouse's products and infrastructure
- Partner with detection engineering to validate and improve detection coverage during red team exercises, measuring and reporting on control effectiveness and time to detect/respond
- Handle information security events and incidents across ClickHouse products and services
- Develop processes, tooling and automation to scale security processes and mitigate risks to the business
What you bring along:
- 7+ years of experience in pentesting, red teaming and product security
- Experience supporting engineering and product implementation efforts by performing threat assessments, assurance activities, advisory as well as, in some cases, implementation work across distributed systems covering web, API, client/server assets
- Hands-on experience conducting offensive security engagements - internal red teaming, penetration testing and adversary simulation - across cloud, network and application environments
- Ability to design adversary scenarios grounded in real threat intelligence (e.g. ransomware operators, supply chain attackers, insider threat) tailored to ClickHouse's risk profile as a multi-tenant cloud data platform
- Strong written and verbal communication skills, with ability to translate attack chains into clear, actionable findings for engineering and leadership
- Experience building or adapting agentic and LLM-assisted tooling for offensive security use cases (recon automation, exploit chaining, fuzzing harnesses), with judgment on where AI genuinely speeds up an engagement versus adds noise
- Familiarity with AI/LLM-specific vulnerability classes and testing methodology
- Strong knowledge of and experience with one or more cloud service providers (e.g. AWS, GCP, Azure), Kubernetes, Cilium
- Experience implementing and operating engineering security tools and processes (e.g. static / dynamic code analysis, software composition analysis, SBOM, OWASP SAMM, client and network fuzzing tools)
- Security as code mindset, with focus on solving problems with automation and scale in mind
Bonus Points:
- BS, MS, or PhD in Computer Science or related field
- Previous contributions to open source projects
- Security or cloud related certifications (AWS, GCP, Azure)
- Previous experience in using AI security harnesses for pentesting purposes
- Experience building or operating internal red team tooling and infrastructure from scratch, rather than relying solely on off-the-shelf frameworks
- Offensive security certifications (e.g. OSCP, OSCE, OSEP, OSWE)
PERKS
- Flexible work environment - ClickHouse is a globally distributed company and remote-friendly. We currently operate in over 25 countries.
- Healthcare - Employer contributions towards your healthcare.
- Equity in the company - Every new team member who joins our company receives stock options.
- Time off - Flexible time off in the US, generous entitlement in other countries.
- A USD$500 Home office setup if you’re a remote employee.
- Global Gatherings – We believe in the power of in-person connection and offer opportunities to engage with colleagues at company-wide offsites.
CULTURE - WE ALL SHAPE IT
As part of a rapidly scaling start-up, you will be instrumental in shaping our culture.
Are you interested in finding out more about our culture? Learn more about our values here https://clickhouse.com/company/careers. Check out our blog posts https://clickhouse.com/blog or follow us on LinkedIn https://www.linkedin.com/company/clickhouseinc/life/0c1ee7f4-2129-488d-b413-e7f6270659fd/?viewAsMember=true to find out more about what’s happening at ClickHouse.
EQUAL OPPORTUNITY & PRIVACY
ClickHouse provides equal employment opportunities to all employees and applicants and prohibits discrimination and harassment of any type based on factors such as race, color, religion, age, sex, national origin, disability status, genetics, protected veteran status, sexual orientation, gender identity or expression, or any other characteristic protected by federal, state or local laws.
Please see here https://clickhouse.com/legal/applicant-privacy-notice for our Privacy Statement.
Location: Serbia; Croatia; Poland; Belgium; India; Pakistan
About Us:
Where elite tech talent meets world-class opportunities!
At Xenon7, we work with leading enterprises and innovative startups on exciting, cutting-edge projects that leverage the latest technologies across various domains of IT including Data, Web, Infrastructure, AI, and many others. Our expertise in IT solutions development and on-demand resources allows us to partner with clients on transformative initiatives, driving innovation and business growth. Whether it's empowering global organizations or collaborating with trailblazing startups, we are committed to delivering advanced, impactful solutions that meet today’s most complex challenges.
About the Client:
Join one of Egypt’s premier financial institutions, renowned for its extensive suite of banking services, including Institutional Banking, Personal Banking, and Islamic Banking. With a global presence through over 50 branches and correspondents, we serve a diverse and dynamic clientele. As we embark on a groundbreaking digital transformation journey, we are committed to leveraging the latest technologies to establish a state-of-the-art data architecture that will redefine our performance and service delivery.
About the Role
As a leading financial institution in Egypt, we are heavily investing in localized AI and Machine Learning capabilities to drive innovation while maintaining total data sovereignty. Our Cybersecurity Department is looking for a highly skilled
AI Cybersecurity Engineer
with a deeply offensive mindset.
Operating entirely within our secure, high-performance
on-premises infrastructure
, you will act as an internal adversary. Your mission is to proactively threat model, simulate advanced cyberattacks (Red Teaming), and manage algorithmic risks to detect and neutralize vulnerabilities in our AI systems
before
they can be exploited.
Key Responsibilities
Predictive AI Threat Modeling:
Lead advanced threat-modeling exercises across the bank’s localized AI/ML pipelines, data repositories, and training environments. Anticipate sophisticated attacker behaviors to design preemptive security guardrails before models are moved to production.
AI Red Teaming & Offensive Simulations:
Conduct targeted offensive operations and ethical hacking against our on-premises AI infrastructure. Simulate real-world adversarial attacks, including
data poisoning, model inversion, membership inference, evasion attacks, and prompt injection
.
Framework Mapping with MITRE ATLAS:
Implement and operationalize the
MITRE ATLAS (Adversarial Threat Landscape for Artificial-Intelligence Systems)
framework. Map identified vulnerabilities to ATLAS tactics and techniques to build a robust, AI-specific defensive matrix aligned with traditional MITRE ATT&CK.
On-Premises Infrastructure Hardening:
Assess and secure the physical and virtual infrastructure hosting our AI workloads, including bare-metal GPU clusters, local containerized environments (Kubernetes/OpenShift), and private data registries, ensuring strict isolation from external threats.
Proactive Risk Management & Early Detection:
Collaborate with the SOC and data engineering teams to build predictive detection use-cases and custom alerts. Identify the early warning signs of an AI-targeted attack or data exfiltration attempt before malicious actors can compromise model integrity.
Requirements
Professional Experience:
5+ years
of dedicated experience in Offensive Security, Red Teaming, or Advanced Penetration Testing, with a proven pivot and at least
2 years of hands-on experience securing or attacking AI/ML workloads
.
Banking Sector Experience (Mandatory):
Prior experience working within a regulated financial institution in Egypt. You must understand the security constraints, compliance mandates, and audit rigor required by the
Central Bank of Egypt (CBE)
for on-premises operations.
Deep Mastery of AI Attack Frameworks:
Expert-level knowledge of
MITRE ATLAS
and the
OWASP Top 10 for Large Language Models (LLMs)
. You must have a proven track record of translating these theoretical frameworks into practical, automated offensive playbooks.
On-Prem & Core Technical Skills:
* Strong proficiency in
Python
or bash scripting to build custom exploit or testing tools.
Deep understanding of on-premises infrastructure components (Linux administration, private networking, storage area networks).
Direct experience with container security (
Docker, Kubernetes
) and secure MLOps pipelines.
Education & Certifications:
* Bachelor’s degree in Computer Science, Cybersecurity, Computer Engineering, or a strictly related field.
Highly valued offensive certifications:
OSCP, OSCE, CRTP, or GPEN
, alongside any specialized AI/ML security credentials.
Mindset & Communication:
A relentlessly curious, adversarial mindset balanced with strong risk management disciplines. The ability to clearly articulate complex, highly technical AI vulnerabilities into actionable remediation plans for data scientists and senior banking executives. Fluency in English.
Benefits
Attractive, market-leading salary package
Clear career advancement path with professional development opportunities
Location: Metn, Lebanon
The Company
Toters is an on-demand e-commerce and delivery platform that enables customers to get anything in their city with the highest level of convenience.
At Toters, technology is at the heart of everything we do. Our product teams build features that simplify customers’ lives, while our engineers create scalable solutions to deliver faster and more cost-effectively. If you thrive in a high-growth startup environment and want to help reshape how people shop across the Middle East, join us.
Role Overview
As a Senior Offensive Security Engineer (L5), you will own complex offensive security initiatives that span multiple teams. You will lead advanced penetration testing, red team exercises, and adversarial simulations to uncover systemic weaknesses in our web applications, APIs, mobile apps, cloud infrastructure, identity, payment-adjacent flows, and overall attack surface.
You will act as a
hands-on technical leader
: influencing secure design decisions with evidence, mentoring mid-level and junior offensive engineers, and driving improvements that meaningfully reduce risk.
Description
In this senior role, you will take end-to-end ownership of offensive security efforts with a focus on high-impact outcomes. Your responsibilities include:
Lead comprehensive penetration tests and red team / assumed-breach exercises targeting web applications, APIs, mobile applications, cloud infrastructure, and authentication systems (including identity and privileged-access paths).
Lead mobile offensive testing on Android and iOS, including evaluation and bypass/validation of runtime protection, tamper resistance, certificate pinning / Certificate Transparency, and key/secret shielding using DexProtector or similar RASP / app-shielding tools, plus complementary tooling such as MobSF.
Perform in-depth threat modeling and identify complex attack paths across services and trust boundaries (including authorization flaws, tenant isolation, token/session issues, edge/WAF bypass, and client-secret exposure).
Deliver high-quality security assessment reports with clear risk ratings, business impact analysis, practical remediation guidance, and evidence quality that engineering and audit stakeholders can use in a SOC 2 and PCI DSS context—then re-test and validate fixes before closure.
Collaborate with Engineering, DevOps, Product, and the Security Engineer track to influence secure architecture decisions and ensure vulnerabilities are addressed at the root cause.
Develop and improve offensive security methodologies, tools, and automation to increase efficiency and coverage. AI-assisted testing is a must.
Mentor mid-level and junior offensive security engineers, conduct offensive-focused code/design reviews, and help raise the overall security capability of the team.
Participate in purple team exercises with the detection and incident response teams to improve defenses based on real attack simulations.
Stay at the forefront of offensive security research, emerging threats, and TTPs, and assess their relevance to Toters.
Contribute offensive input to security standards, policies, and secure development practices across the engineering organization (you advise; you do not own policy issuance or GRC evidence packs).
Support structured disclosure (VDP / researcher reports) through reproduce, rate, de-duplicate, and validate.
Key Qualifications
Bachelor’s degree in Computer Science, Cybersecurity, or a related field, or equivalent practical experience.
6+ years of hands-on experience in offensive security, penetration testing, or red teaming.
Strong expertise in web application, API, and mobile security testing (Android and iOS).
Working knowledge of DexProtector or similar mobile shielding / RASP tooling: what it protects, how testers evaluate residual risk, and how to validate that hardening holds.
Advanced proficiency with offensive security tools (Burp Suite, Metasploit, Cobalt Strike or equivalent adversary-emulation platforms, custom tooling, etc.).
Proficient in writing robust, reusable scripts and small tools for automation (Python preferred, Bash for quick tasks).
Solid experience with cloud security testing (AWS preferred) and infrastructure attack techniques.
Proven ability to lead complex security assessments from scoping to reporting and remediation validation.
Strong risk assessment and threat modeling skills, with the ability to communicate technical risks clearly to both technical and non-technical stakeholders.
Familiarity with SOC 2 and PCI DSS as they apply to offensive work (scoped pentests, application/API/payment-adjacent testing, evidence-quality reporting). This role does not own control design or audit evidence collection.
Experience mentoring engineers and influencing cross-team security practices.
Excellent written and verbal communication skills in English.
Nice to Have
Industry-recognized certifications such as OSCP, OSCE, OSEP, CRTO, or PNPT.
Experience running full-scope red team or assumed-breach exercises.
Experience developing custom exploits, tooling, or automation for offensive security.
Knowledge of MITRE ATT&CK and adversary emulation.
AI and AI pentesting: testing LLM/agent applications (prompt injection, tool/plugin abuse, data-exfil via agents) and using AI-assisted pentest workflows with mandatory human review.
Previous experience in high-scale e-commerce, delivery, or fintech environments, including payment API / tokenization / third-party PSP testing as a tester (not as PCI control owner).
Fluency in Arabic and English (French is a plus).
What We Offer
Competitive compensation package.
Discounts on Toters orders.
First-class medical insurance.
Ready to own offensive security at scale and help build a safer platform for millions across the Middle East? Apply now!
Location: San Francisco; Remote (United States); London; Belgrade; New York City
Workplace: Hybrid
Perplexity is seeking a highly skilled, experienced and hands-on Offensive Security Engineer to join our dynamic security team, taking an adversarial approach to hardening Perplexity's infrastructure, applications, and AI systems. You'll plan and execute red team operations, penetration tests, and attack simulations across our cloud infrastructure, web and mobile applications, AI/ML pipeline, and corporate environment—finding real vulnerabilities before adversaries do and working directly with engineering teams to drive remediation.
Responsibilities
- Plan and execute red team and purple team engagements simulating advanced threat actors across cloud infrastructure (AWS, Kubernetes), endpoints, and application surfaces
- Conduct continuous penetration testing of web applications, APIs, mobile clients, browser extensions, cloud infrastructure, and internal services
- Assess AI/ML-specific attack surfaces including prompt injection, model exfiltration, agent abuse, tool-use exploitation, and MCP security boundaries
- Develop and maintain custom offensive tooling, exploits, and automation to improve the efficiency and coverage of security testing
- Perform open-scope adversary simulations that test detection and response capabilities end to end, collaborating closely with the defensive security team
- Drive threat modeling sessions with engineering teams to identify and prioritize attack vectors in new features and architectures
- Deliver clear, actionable findings to both technical and executive audiences; partner with engineering to validate remediations
- Contribute to the security of CI/CD pipelines, supply chain integrity, and secrets management through offensive assessment
- Stay current on emerging attack techniques, vulnerability research, and adversary tradecraft; bring external perspective into Perplexity's security strategy
Qualifications
- 5+ years of hands-on experience in offensive security, red teaming, or penetration testing
- Deep technical expertise in at least two of: cloud security (AWS/GCP/Azure), web/API application security, Kubernetes and container security, macOS/Linux endpoint security, network penetration testing, or CI/CD pipeline security
- Track record of discovering impactful vulnerabilities or developing novel attack techniques in production environments
- Strong programming and scripting skills in Python, Go, or similar languages; comfortable writing custom tooling and exploits
- Experience with industry-standard offensive tools (Burp Suite, Cobalt Strike / Sliver / Mythic, Metasploit, BloodHound, nuclei, etc.) and ability to operate beyond them
- Excellent written and verbal communication; able to translate complex technical findings into clear risk narratives
- Experience assessing AI/ML systems, LLM applications, or agentic workflows for security vulnerabilities
- Bonus: Published security research, conference talks (DEF CON, Black Hat, BSides), CVE credits, or meaningful bug bounty contributions
Location: Arlington, VA, United States
Job Title
Cyber Virtualization Engineer
Why IDS?
IDS believes in resolving conflict, building innovative approaches to do so. Combining operational expertise with an intimate understanding of today’s greatest challenges, we bring our customers the solutions required for success in a complex and multidimensional world. IDS tailors solutions for a diverse range of government, military, nonprofit, and public-sector clients.
Locations
Arlington, VA
Shifts Available
Please note, candidates must be flexible. Shift times are general hours; some projects may require earlier or later reporting based on customer requirements.
Job Description
SITE 525 is seeking a highly skilled
Cyber
Virtualization Engineer
to support the development and sustainment of advanced cyber training environments. This role involves hands-on engineering of secure, scalable, and AI-enabled virtual ranges that emulate realistic, adversarial network conditions across IT and OT domains. These environments are used for cyber mission rehearsals, red/blue/gray team operations, and full-spectrum cybersecurity exercises. Must be willing to travel up to 25%. Responsible for designing, deploying, and maintaining advanced virtualized training environments that replicate realistic, large-scale, and adversarial network conditions. This position focuses on engineering and integrating dynamic, hypervisor-driven platforms and virtualization technologies to support cyber mission rehearsals, red/blue/gray team operations, and full-spectrum training exercises.
Key Duties
Engineer and implement scalable virtualized environments leveraging hypervisors (KVM, VMware, Hyper-V), virtual machines, containers, and software-defined networking across hybrid, edge, and cloud infrastructures.
Implement and manage virtualization stacks including private cloud platforms, hypervisor clusters, and orchestration frameworks for large-scale, multi-tenant environments.
Develop automation and orchestration tooling for provisioning, snapshotting, and lifecycle management of virtualized assets using Infrastructure-as-Code and CI/CD pipelines.
Integrate advanced traffic simulation capabilities (burst, steady-state, geo-distributed, AI/ML-driven) to emulate realistic user and system behaviors within virtual ranges.
Build and maintain frameworks and tooling for user and NPC emulation across virtualized environments to enhance operational realism, including threat emulation and defensive toolsets for network monitoring, incident detection, and response.
Implement observability pipelines for performance monitoring, traffic replay, autoscaling validation, and centralized logging in production-grade virtual infrastructures.
Administer and secure hypervisor platforms and virtual networking components, ensuring isolation, resiliency, and compliance for mission-critical environments.
Manage network and server infrastructure including Active Directory, identity management systems, and virtualized security controls.
Integrate third-party virtualization and orchestration tools to improve fidelity and scalability of training environments.
Support exercise operations including setup, execution, troubleshooting, and real-time scenario management for White Cell operations.
Collaborate with technical working groups and stakeholders to validate and enhance virtualization strategies for cyber training environments.
Apply knowledge of OT systems (SCADA, ICS, PLCs, IoT/IIoT) within virtualized contexts for realistic emulation.
Relevant Technologies & Tools:
Virtualization & Hypervisors:
VMware ESXi/vSphere, KVM/QEMU, Microsoft Hyper-V, Proxmox, OpenStack
Virtual Infrastructure Management:
VM lifecycle management, snapshotting, cloning, orchestration frameworks
Cloud & Containerization:
Private cloud platforms, AWS, Azure, Kubernetes (K8s), Docker, Podman, hybrid and edge deployments
Networking & SDN:
Virtual switches (vSwitch, vDS), software-defined networking, network segmentation, VPNs, dynamic Network-as-Code tools
Automation & IaC:
Infrastructure-as-Code (Terraform, Ansible, Packer,
Helm, Nomad
), CI/CD integration for infrastructure
Performance & Observability:
Metrics collection, centralized logging, traffic replay, load simulation, autoscaling validation
Security in Virtualized Environments:
Identity management, Active Directory (GPOs, tiered admin scripts), secure isolation of virtual ranges
Cyber Range Engineering:
Virtualized cyber training environments, adversarial network simulation, AI/ML-driven traffic emulation
Traffic Simulation & User Emulation:
Lariat, CMU GHOSTS, MITRE Caldera, Red Canary, Atomic Red Team, TRex, BreakingPoint, Locust, k6, custom Python/TypeScript scripts, AI-enabled agents
Compliance & Assurance:
NIST 800-series, ISO 27001, FedRAMP, CUI-compliant controls
Monitoring & Control Interfaces:
Custom dashboards for exercise operations, centralized scenario orchestration
Requirements
Bachelor’s or Master’s degree in Cybersecurity, Computer Engineering, or related field.
5+ years of experience in cyber engineering, network operations, or cyber range development.
Top Secret security clearance.
Proficiency in virtualization, containerization, and cloud technologies.
Experience with offensive and defensive cybersecurity tools and frameworks.
Familiarity with AI/ML integration in cyber environments.
Strong scripting and automation skills (e.g., Python, Bash, PowerShell).
Experience with infrastructure-as-code tools (e.g., Terraform, Ansible).
Knowledge of OT systems and protocols.
Security certifications (e.g., CISSP, CEH, OSCP) are a plus.
Compensation
Competitive Hourly Pay
Benefits
Questions?
Please reach out to
lolney@idsinternational.com
for additional questions or information.
Location: Riyadh, KSA
Workplace: onsite
Tabby creates financial freedom in the way people shop, earn and save by reshaping their relationship with money. Over 25 million users choose Tabby to stay in control of their spending and make the most out of their money.
The company’s flagship offering allows shoppers to split their payments online and in-store with no interest or fees. Over 70,000 global brands and small businesses, including Amazon, Noon, IKEA, and SHEIN use Tabby to accelerate growth and gain loyal customers by offering easy and flexible payments online and in stores.
Tabby generates over $18 billion in annual transaction volume for its partner brands and is the highest-rated, most-reviewed, largest, and fastest-growing FinTech in the GCC region.
Tabby launched in 2019 and has since raised +$1 billion in equity and debt funding from global and regional investors, and is now valued at $6,5 billion.
We are looking for a
Cyber Security Lead
to join our Information Security team in Riyadh. You will provide technical leadership across defensive security, while managing a team of security engineers and analysts and driving security initiatives across the organization.
Key Responsibilities
Lead
security architecture and design reviews
across IT, cloud, and product initiatives.
Drive
cloud security
across GCP and AWS, including IAM, cloud security posture, and infrastructure security.
Lead the
Secure SDLC / DevSecOps
programme, including application security and security tooling across CI/CD.
Own
vulnerability management
, including vulnerability remediation, penetration testing and red team engagements.
Oversee
endpoint, infrastructure and network security
, including EDR, DLP and firewall security.
Lead
detection engineering, threat intelligence and incident response
, including complex security investigations.
Manage and develop a team of
security engineers and analysts
, including mentoring, performance management and career development.
Partner with Engineering, IT, Compliance and other teams to improve Tabby’s overall security posture and security standards.
Skills, Knowledge and Expertise
5+ years of experience in
cybersecurity / information security
, including technical leadership or senior-level responsibilities.
Experience leading security programmes across
security architecture, cloud security, vulnerability management and application security
.
Strong understanding of
defensive and offensive security
, including penetration testing, red/purple teaming, threat hunting and incident response.
Hands-on experience with
SIEM, EDR/XDR, vulnerability management, CSPM, DLP and security monitoring platforms
.
Strong knowledge of
GCP and/or AWS
, IAM, cloud security and infrastructure security.
Experience with
DevSecOps, Secure SDLC, SAST, DAST, SCA and container security
.
Strong scripting and automation skills and the ability to develop or oversee security tooling and integrations.
Knowledge of
SAMA CSF, NCA ECC, PCI-DSS and ISO 27001
.
Experience working in a
regulated FinTech or banking environment
.
Strong technical leadership, stakeholder management and team development skills.
CISSP/CISM and OSCP or equivalent
certifications are required.
Location: Remote - US
Founded in 2012, Bugcrowd is the preemptive security platform that unifies exposure discovery and assessment, offensive testing, and intelligence shaped by AI and human insight to help organizations avoid, discover, and validate real-world risk. Bugcrowd helps security teams move faster by identifying the exposures that matter most so they can act first and stay ahead of attackers. By combining the power of humans and AI, teams can preempt attack paths and prevent breaches. Based in San Francisco and New Hampshire, Bugcrowd is supported by General Catalyst, Rally Ventures, Costanoa Ventures, and others. Visit
www.bugcrowd.com
.
Job Summary
The Bugcrowd RL and Reasoning Team focuses on pushing the boundaries of autonomous cybersecurity by building authentic, verifiable reinforcement learning environments for world-leading foundational AI companies. As a Reinforcement Learning Engineer specializing in Reinforcement Learning from Verifiable Rewards (RLVR), you will design and scale automated verification pipelines that transform real-world software vulnerabilities into deterministic reward functions. In this role, you will bridge the gap between low-level security analysis and modern LLM reasoning models, engineering environments where AI agents learn to discover, exploit, and remediate software vulnerabilities with mathematical certainty. Instead of relying on subjective human feedback, your work directly powers the rigorous, verifiable reward signals that teach next-generation frontier AI models how to master complex cybersecurity domain logic. You will work at the intersection of fuzzing, dynamic program analysis, system exploitation, and scalable ML infrastructure to shape the safety and offensive/defensive capabilities of future artificial intelligence.
Essential Duties and Responsibilities
Design, build, and deploy high-throughput RLVR (Reinforcement Learning from Verifiable Rewards) environments that evaluate LLM action sequences against deterministic execution outcomes.
Develop automated test harnesses, sandboxes, and verification engines that convert complex vulnerability research (e.g., memory corruption, web security, logic bugs) into binary pass/fail reward signals.
Integrate Bugcrowd’s Mayhem automated analysis platform and real-world vulnerability feeds into continuous, scalable RL environment generation pipelines.
Architect safe, isolated, and highly reproducible execution environments (using Docker, BuildKit, or Nix) capable of running thousands of simultaneous agent-driven exploitation and patching trajectories.
Collaborate directly with researchers at frontier AI labs including Anthropic, OpenAI, and Cohere to define standard benchmark formats, observation spaces, and verifiable evaluation metrics for cybersecurity tasks.
Implement precise telemetry, ground-truth verification algorithms, and trajectory logging to analyze agent reasoning paths and prevent reward hacking or false positives.
Build low-level instrumentation and debugging tools to monitor memory states, process executions, and network behaviors during agent interaction cycles.
Optimize infrastructure performance and environment reset latency to support massive-scale parallel sampling and distributed RL training workflows.
Benchmark and evaluate frontier AI model performance across diverse offensive and defensive security challenges, such as automated fuzzing, exploit payload generation, and patch validation.
Education, Experience, Knowledge, Skills, and Abilities
Understanding of RL training workflows used by modern LLM systems, specifically execution-based feedback or Reinforcement Learning from Verifiable Rewards (RLVR).
Proficiency developing applications in Python and low-level systems programming in C, with Rust experience being a strong plus.
Solid understanding of software vulnerabilities, binary exploitation, fuzzing methodologies, or program analysis.
Experience with DevOps pipelines (e.g., GitHub Actions), reproducible builds (Docker, BuildKit, Nix), and comfort working with Linux systems and low-level debugging.
Experience working with or building benchmark environments (e.g., CTFs, SWE-bench, security challenges, or execution sandboxes).
Preferred Experience
Experience designing custom reward functions, ground-truth verifiers, or automated grading engines for AI safety and reasoning models.
Background in low-level program analysis tools, sanitizers (e.g., ASan/MSan), compiler instrumentation, or automated exploit generation tools.
Proven track record of participating in or developing competitive cybersecurity benchmarks, CTFs, or open-source AI evaluation frameworks.
Working Conditions and Physical Requirements
The ideal candidate must be able to complete all physical requirements of the job with or without reasonable accommodation.
Sitting and / or standing - Must be able to remain in a stationary position 50% of the time
Carrying and / or lifting - Must be able to carry / move laptop as needed throughout the work day.
Environment - remote, work-from-home 100% of the time.
Pay Range Disclosure
At Bugcrowd, we strive for fairness, equality and to create an environment that allows our people to perform at their very best. Our compensation philosophy is to foster a collaborative community that rewards, attracts and retains the best possible talent. The provided salary details are based on US national averages and we retain the flexibility to tailor to the needs of the business.
The national estimate for the current base range for the position of $176,400 - $242,550.
This position may also be eligible to participate in a discretionary bonus program or commission plan, subject to the rules governing the program, whereby an award, if any, depends on various factors, including, without limitation, individual and organizational performance.
Culture
At Bugcrowd, we understand that diversity in the workplace is vital to a company’s success and growth. We strive to make sure that people are included and have a sense of being part of making Bugcrowd not only a great product but a great place to work.
We regularly hear from both customers and researchers that Bugcrowd feels like a family, and we strive to maintain that internally as well.
Our team consists of a broad range of people: musicians, adventure sports junkies, nature lovers, parents, cereal enthusiasts, night owls, cyclists, artists—you get the point.
At Bugcrowd, we are solving security threats and vulnerabilities that are relevant to everyone, therefore we believe solving these problems takes all kinds of backgrounds. We value the perspectives and experiences people from underrepresented backgrounds bring.
Disclaimer
This position has access to highly confidential, sensitive information relating to the technologies of Bugcrowd. It is essential that the applicant possess the requisite integrity to maintain the information in the strictest confidence.
The company is authorized to obtain background checks for employment purposes under state and federal law. Background checks will be conducted for positions that involve access to confidential or proprietary information (including trade secrets).
Background checks may include Social Security verification, prior employment verification, personal and professional references, educational verification, and criminal history. Applicants with conviction histories will not be excluded from consideration to the extent required by
law.
Any personal data you submit in connection with your application will be processed in compliance with Bugcrowd's Privacy Policy, which you may review here:
https://www.bugcrowd.com/privacy
.
Equal Employment Opportunity:
Bugcrowd is EOE, Disability/Age Employer.
Individuals seeking employment at Bugcrowd are considered without regards to race, color, religion, national origin, age, sex, marital status, ancestry, physical or mental disability, veteran status, gender identity, or sexual orientation.
Bugcrowd is committed to the full inclusion of all qualified individuals. In keeping with our commitment, Bugcrowd will take the steps to assure that people with disabilities are provided reasonable accommodations. Accordingly, if reasonable accommodation is required to fully participate in the job application or interview process, to perform the essential functions of the position, and/or to receive all other benefits and privileges of employment, please contact HR at ADA at bugcrowd.com.
Apply at:
https://www.bugcrowd.com/about/careers/
О проекте
Международный проект в области AI Security, связанный с разработкой сред, которые помогают LLM-моделям проходить обучение с подкреплением для задач, связанных с кибербезопасностью. Эти среды содержат задания в различных областях кибербезопасности (пентестинг, реагирование на инциденты, эксплуатация, вредоносное ПО и т.д.), цель — создавать достаточно сложные задачи, чтобы модель допускала ошибки, но которые остаются решаемыми для профессиональных специалистов.
Важно: это не классическая позиция Pentester или Red Team Engineer. Основная задача — создавать сложные, но реалистичные и проверяемые security-сценарии, в которых LLM-модели совершают ошибки именно из-за недостатков в рассуждении (reasoning), а не из-за неоднозначных инструкций или ограничений среды.
Задачи:
— Проектировать security-сценарии для оценки и обучения LLM-моделей
— Создавать environments с использованием GitHub, Slack и других инструментов, встречающихся в реальной разработке
— Разрабатывать задачи, требующие сложного многошагового reasoning
— Моделировать реальные offensive security-сценарии (supply chain attacks, malicious pull requests, exploitation через GitHub Actions и другие техники)
— Проверять разработанные сценарии на нескольких frontier-моделях и анализировать причины их ошибок
— Формулировать ожидаемое поведение модели и описывать, почему конкретная ошибка считается reasoning failure
— Автоматизировать создание и проверку задач с использованием Python и других инструментов
Требования:
— 5+ лет практического опыта в Offensive Security, Application Security или Web Penetration Testing
— Практический опыт AI Red Teaming / LLM Security
— Глубокое понимание современных техник атак и поверхности атаки веб-приложений, API, GitHub, CI/CD и связанных экосистем
— Практический опыт проведения penetration testing и исследования безопасности приложений
— Опыт разработки на Python и/или JavaScript
— Навыки статического и динамического анализа кода (Python, JavaScript, Java)
— Умение самостоятельно исследовать новые направления, проектировать сложные сценарии и объяснять результаты своей работы
— Свободный английский язык (Upper-Intermediate / B2+)
— Практический опыт работы с современными LLM-моделями
— Понимание особенностей их работы, ограничений и типичных failure modes
— Интерес к AI Security и исследованию поведения LLM
— Опыт работы с Agentic AI, AI Agents или Model Evaluation
Будет большим плюсом:
— Опыт исследований безопасности GitHub Actions, CI/CD, Supply Chain Security
— Сертификаты OSWE, eWPTXv2, OWEE, OSWA или аналогичные
— Публикации, write-ups, участие в Bug Bounty, HackTheBox, TryHackMe, Pwn2Own или других исследовательских проектах
— Способность придумывать новые, не похожие на существующие сценарии атак, которые сломают сильную модель, исследовательское мышление и креативность
Условия:
— B2B-контракт (с ИП)
— Оплата в долларах США
— Part-time/Full-time: почасовая оплата за выполненные задачи, 1 задача занимает около 10-12 часов
— Локация — строго вне РФ/РБ
Location: San Francisco Bay Area, USA
Workplace: Hybrid
Why work at Higgsfield AI?
Higgsfield AI is the fastest-scaling generative AI company in history, hitting $1B in annual revenue run rate, 30M+ users worldwide, 6M+ generations per day, and powering 390 of Fortune 500 brands.
We're building at the absolute frontier of AI-powered video creation and next-generation creative tools. Joining Higgsfield means becoming part of a high-impact team shaping the future of AI-native experiences, at a company that isn't just moving fast, but rewriting what fast looks like.
About the role:
Higgsfield AI is looking for a hands-on Member of Technical Staff, Product Security to identify and eliminate security vulnerabilities across our rapidly evolving AI products and platforms.
As we build agentic systems, code-generating agents, generative AI models, and enterprise applications, you'll play a critical role in securing new features before they reach production.
Working closely with Product and Engineering, you'll conduct offensive security testing, identify architectural weaknesses, and drive fixes to their root cause. You'll also turn recurring vulnerabilities into scalable security standards and automated controls.
We're looking for someone with a proven track record of finding real vulnerabilities in production systems, strong technical judgment, and the ability to work directly with engineers to build more secure products.
WHAT YOU'LL DO
OFFENSIVE SECURITY & VULNERABILITY RESEARCH
- Conduct hands-on penetration testing of new products and features, including web applications, APIs, and administrative interfaces.
- Identify security risks across agentic systems, MCP servers, code-generating agents, and AI-powered applications.
- Independently map attack surfaces and uncover authorization, authentication, and multi-tenant isolation vulnerabilities.
- Develop proof-of-concept exploits, validate findings, and retest remediation efforts.
SECURE DESIGN & APPLICATION SECURITY
- Partner with Engineering early in product development to identify and prevent security flaws before release.
- Conduct threat modeling, architecture reviews, and security-focused code reviews.
- Analyze complex codebases to trace vulnerabilities to their root cause and recommend effective fixes.
- Assess security risks across generative AI products, user-deployed applications, and enterprise features such as SSO and role-based access controls.
SECURITY ENGINEERING & AUTOMATION
- Translate recurring vulnerabilities into secure development standards, reusable controls, and automated security checks.
- Build security tooling and integrate preventive controls into development and CI/CD workflows.
- Identify systemic weaknesses and implement solutions that prevent entire classes of vulnerabilities.
- Apply cloud, container, and infrastructure security knowledge to investigate vulnerabilities across the application stack.
TECHNICAL OWNERSHIP & COLLABORATION
- Own security findings from discovery through remediation, working directly with engineers to implement lasting fixes.
- Prioritize vulnerabilities based on exploitability, business impact, and real-world risk.
- Establish practical security standards that enable rapid product development without compromising security.
- Help define security practices for emerging AI technologies and new product architectures.
WHAT WE'RE LOOKING FOR
- 5+ years of hands-on experience in product security, application security, penetration testing, or vulnerability research.
- Proven track record of independently discovering and exploiting real vulnerabilities through application security work, bug bounty programs, or security research.
- Deep understanding of web application and API security, including authentication, authorization, and multi-tenant isolation.
- Strong ability to read and analyze modern codebases, identify root causes, and collaborate with engineers on remediation.
- Experience conducting threat modeling, secure design reviews, and hands-on penetration testing.
- Proficiency in scripting or programming languages such as Python, JavaScript, TypeScript, or Go.
- Familiarity with cloud infrastructure, containers, and modern application architectures.
- Ability to translate security findings into scalable engineering controls and automated checks.
- Strong technical judgment, independent problem-solving skills, and a proactive approach to identifying security risks.
Compensation & Benefits
- We offer a competitive and thoughtfully structured compensation package designed to align with impact, experience, and long-term growth.
- Base Salary: The anticipated salary range for this role is $200,000 - $300,000, depending on experience, skills, scope, and location.
• Bonus: This role is Bonus eligible and may participate in the Company's discretionary annual bonus program.
- Equity: In addition to cash compensation, employees are eligible to participate in the company’s stock option program and share in Higgsfield’s long-term growth.
- Benefits: We offer a comprehensive benefits package designed to support employees professionally and personally, including medical, dental, and vision insurance, a competitive 401(k) retirement plan with company matching, and additional benefits and perks.
- The opportunity to work on ambitious AI products alongside a highly experienced, fast-moving, and international team.
- Significant ownership, direct impact, and opportunities for professional growth as the company scales.
This is a hybrid role based in the San Francisco Bay Area. Team members are expected to work from our San Francisco office three full days per week, with the remaining days worked remotely and are expected to be available during agreed working hours and to maintain sufficient overlap with the relevant team’s time zone. We value in-person collaboration, active communication, responsiveness, and close partnership across teams.
Higgsfield AI is an equal opportunity employer. We are committed to building a diverse and inclusive team and do not discriminate on the basis of race, color, religion, sex, gender identity or expression, sexual orientation, national origin, age, disability, veteran status, or any other protected characteristic.
Location: San Francisco, CA | New York City, NY
About Anthropic
Anthropic’s mission is to create reliable, interpretable, and steerable AI systems. We want AI to be safe and beneficial for our users and for society as a whole. Our team is a quickly growing group of committed researchers, engineers, policy experts, and business leaders working together to build beneficial AI systems.
About the role
Anthropic’s mission is to ensure that the world safely makes the transition through transformative AI. Security is one of the clearest places where that mission plays out: the same capabilities that help attackers move faster can help defenders move faster too, and helping them use those capabilities safely and well is what this team is for. Security teams are among the earliest and most demanding users of frontier AI. They use Claude to review code at scale, find vulnerabilities before attackers do, and work through alert queues their analysts can’t keep up with. Anthropic’s Applied AI organization is building a dedicated Security team to help them do this well, and we are looking for its first leader.
You will build this team from zero. You’ll decide which security customers the team serves first, who you hire and in what order, and how the team works with Sales, Applied AI Engineering, and our security, legal, and trust partners. You’ll also stay hands-on with a few of our most important security customers, because what you learn in those accounts becomes the playbook for everyone else. You’ll also set the standard for how security customers use Claude responsibly, including where a person has to review the output before anyone acts on it.
What you’ll do
Hire, onboard, and develop the first Applied AI Architects on the Security team. Coach senior and early-career architects differently, and give each one clear goals.
Decide where the team spends its time: which segments and account types come first, which deals get architect coverage, and how to say no clearly when demand outruns headcount.
Partner with security account executives on joint account plans, regular pipeline and forecast reviews, and deals where the customer’s security review sets the close date.
Guide customers from discovery through evaluations and proofs of concept with written success criteria. Then take them from one-time code scans to sustained workloads: application security in the development lifecycle, continuous automated penetration testing, alert triage and investigation, and vulnerability and threat intelligence.
Work alongside the security ISVs, systems integrators, and managed security providers already in our customers’ accounts. Keep a clear line between what Anthropic delivers and what partners deliver.
Bring in Applied AI Engineers and our security, legal, and trust teams when a customer’s build or review needs them.
Write the first security playbooks, reference implementations, and evaluation approaches. Bring what you learn back to Product, Engineering, and Research, so Claude becomes more useful and more trustworthy for defenders at the same time.
Carry a small number of strategic security accounts yourself, from executive briefings with CISOs to hands-on workshops with their engineers.
You may be a good fit if you
Have 12+ years of industry experience with at least 4 years managing a team of customer-facing technical people, such as solutions architects, sales engineers, or security consultants, and can show how the team grew and performed under you.
Have hands-on security depth in at least one area, such as application security, detection and response, offensive security, or vulnerability management, deep enough that practitioners trust your judgment
. Application security experience highly preferred.
Have used LLMs for real security work, such as code review, vulnerability discovery, triage, or investigation, and can say where they helped and where they failed.
Have worked large enterprise security deals end to end, including customer security reviews, in close partnership with sales.
Care about making AI both safe and useful for defenders, and can explain security risk and value to a CISO and to the engineers who will run the work, in terms each one cares about.
The annual compensation range for this role is listed below.
For sales roles, the range provided is the role’s On Target Earnings ("OTE") range, meaning that the range includes both the sales commissions/sales bonuses target and annual base salary for the role.
Annual Salary:
$1
—
$2 USD
Logistics
Minimum education:
Bachelor’s degree or an equivalent combination of education, training, and/or experience
Required field of study:
A field relevant to the role as demonstrated through coursework, training, or professional experience
Minimum years of experience:
Years of experience required will correlate with the internal job level requirements for the position
Location-based hybrid policy:
Currently, we expect all staff to be in one of our offices at least 25% of the time. However, some roles may require more time in our offices.
Visa sponsorship:
We do sponsor visas! However, we aren't able to successfully sponsor visas for every role and every candidate. But if we make you an offer, we will make every reasonable effort to get you a visa, and we retain an immigration lawyer to help with this.
We encourage you to apply even if you do not believe you meet every single qualification.
Not all strong candidates will meet every single qualification as listed. Research shows that people who identify as being from underrepresented groups are more prone to experiencing imposter syndrome and doubting the strength of their candidacy, so we urge you not to exclude yourself prematurely and to submit an application if you're interested in this work. We think AI systems like the ones we're building have enormous social and ethical implications. We think this makes representation even more important, and we strive to include a range of diverse perspectives on our team.
Your safety matters to us.
To protect yourself from potential scams, remember that Anthropic recruiters only contact you from @anthropic.com email addresses. In some cases, we may partner with vetted recruiting agencies who will identify themselves as working on behalf of Anthropic. Be cautious of emails from other domains. Legitimate Anthropic recruiters will never ask for money, fees, or banking information before your first day. If you're ever unsure about a communication, don't click any links—visit
anthropic.com/careers
directly for confirmed position openings.
How we're different
We believe that the highest-impact AI research will be big science. At Anthropic we work as a single cohesive team on just a few large-scale research efforts. And we value impact — advancing our long-term goals of steerable, trustworthy AI — rather than work on smaller and more specific puzzles. We view AI research as an empirical science, which has as much in common with physics and biology as with traditional efforts in computer science. We're an extremely collaborative group, and we host frequent research discussions to ensure that we are pursuing the highest-impact work at any given time. As such, we greatly value communication skills.
The easiest way to understand our research directions is to read our recent research. This research continues many of the directions our team worked on prior to Anthropic, including: GPT-3, Circuit-Based Interpretability, Multimodal Neurons, Scaling Laws, AI & Compute, Concrete Problems in AI Safety, and Learning from Human Preferences.
Come work with us!
Anthropic is a public benefit corporation headquartered in San Francisco. We offer competitive compensation and benefits, optional equity donation matching, generous vacation and parental leave, flexible working hours, and a lovely office space in which to collaborate with colleagues.
Guidance on Candidates' AI Usage:
Learn about
our policy
for using AI in our application process.
Location: Huntsville, Alabama
Founded in 2012, Bugcrowd is the preemptive security platform that unifies exposure discovery and assessment, offensive testing, and intelligence shaped by AI and human insight to help organizations avoid, discover, and validate real-world risk. Bugcrowd helps security teams move faster by identifying the exposures that matter most so they can act first and stay ahead of attackers. By combining the power of humans and AI, teams can preempt attack paths and prevent breaches. Based in San Francisco and New Hampshire, Bugcrowd is supported by General Catalyst, Rally Ventures, Costanoa Ventures, and others. Visit
www.bugcrowd.com
.
Job Summary
The Staff Full Stack Engineer engineer role in which you lead technical efforts, owning system architecture and development across the stack. You will exercise high discretion over technical decisions to achieve business outcomes.
You will be building external attack surface management technology that builds a picture of a target organization from the outside: domains, hosts, software, people, registrations, documents the customer hands us. You will own the part of the system that turns all of that into facts an analyst can trust: what we observed, what we inferred from it, where each fact came from, and what a human decided about it. Your job is to make it a general framework for passive illumination, so the next data source is a week of work, not a new tab.
Education, Experience, Knowledge, Skills, and Abilities
7+ years of experience of software development experience
Strong proficiency in TypeScript and modern JavaScript.
Extensive experience with React and JavaScript web development frameworks (Next.js preferred)
Familiarity with OAuth2, JWT, and other authentication/authorization frameworks.
Experience with CI/CD pipelines and cloud deployment platforms (Vercel, AWS, Azure, or GCP)
Experience with ORM frameworks and relational databases (Prisma, Drizzle, PostgreSQL)
Excellent debugging, analytical, and problem-solving skills.
Cybersecurity knowledge, such as how penetration testing, OSINT, and red teaming works.
Active secret security clearance is required.
Preferred Experience
Hands-on experience with LLM APIs (OpenAI, Anthropic, etc.) and AI application development
Familiarity with AI orchestration frameworks and agent-based systems
Working Conditions & Physical Requirements
The ideal candidate must be able to complete all physical requirements of the job with or without reasonable accommodation.
Sitting and / or standing - Must be able to remain in a stationary position 50% of the time
Carrying and / or lifting - Must be able to carry / move laptop as needed throughout the work day.
Environment - hybrid, work-from-home most of the time with some onsite work.
Pay Range Disclosure
The base pay range for this role takes into account the wide range of factors that are considered in making compensation decisions, including but not limited to Qualifications, Geographical Location, Education/certifications, Experience, Skill Sets, Training, and other business and organizational needs.
At Bugcrowd, it is not typical for an individual to be hired at or near the top of the range for their role and compensation decisions are dependent on the facts and circumstances of each case. A reasonable estimate of the current range for the position i
s: $151,360 - $189,200.
This position may also be eligible to participate in a discretionary bonus program or commission plan, subject to the rules governing the program, whereby an award, if any, depends on various factors, including, without limitation, individual and organizational performance.
Culture
At Bugcrowd, we understand that diversity in the workplace is vital to a company’s success and growth. We strive to make sure that people are included and have a sense of being part of making Bugcrowd not only a great product but a great place to work.
We regularly hear from both customers and researchers that Bugcrowd feels like a family, and we strive to maintain that internally as well.
Our team consists of a broad range of people: musicians, adventure sports junkies, nature lovers, parents, cereal enthusiasts, night owls, cyclists, artists—you get the point.
At Bugcrowd, we are solving security threats and vulnerabilities that are relevant to everyone, therefore we believe solving these problems takes all kinds of backgrounds. We value the perspectives and experiences people from underrepresented backgrounds bring.
Disclaimer
This position has access to highly confidential, sensitive information relating to the technologies of Bugcrowd. It is essential that the applicant possess the requisite integrity to maintain the information in the strictest confidence.
The company is authorized to obtain background checks for employment purposes under state and federal law. Background checks will be conducted for positions that involve access to confidential or proprietary information (including trade secrets).
Background checks may include Social Security verification, prior employment verification, personal and professional references, educational verification, and criminal history. Applicants with conviction histories will not be excluded from consideration to the extent required by
law.
Any personal data you submit in connection with your application will be processed in compliance with Bugcrowd's Privacy Policy, which you may review here:
https://www.bugcrowd.com/privacy
.
Equal Employment Opportunity:
Bugcrowd is EOE, Disability/Age Employer.
Individuals seeking employment at Bugcrowd are considered without regards to race, color, religion, national origin, age, sex, marital status, ancestry, physical or mental disability, veteran status, gender identity, or sexual orientation.
Bugcrowd is committed to the full inclusion of all qualified individuals. In keeping with our commitment, Bugcrowd will take the steps to assure that people with disabilities are provided reasonable accommodations. Accordingly, if reasonable accommodation is required to fully participate in the job application or interview process, to perform the essential functions of the position, and/or to receive all other benefits and privileges of employment, please contact HR at ADA at bugcrowd.com.
Apply at:
https://www.bugcrowd.com/about/careers/
Location: Remote - Colombia ; Remote - Costa Rica ; Remote - Mexico
About Backblaze
Backblaze is the object storage leader in the open cloud movement, fueling customer success with cloud storage built purposefully to unlock budgets, unburden administrators, and unleash innovators. Together with our partners, we’re helping customers break free from the restrictive, overpriced legacy solutions that hold them back, and blaze forward with the full power of the open cloud in their hands.
Founded in 2007, we scaled the business with less than $3 million in outside funding until 2021, when we did a traditional IPO on the Nasdaq stock exchange. Today, Backblaze generates over $136M ARR and is the leading specialized storage cloud, managing over three billion gigabytes of data storage for 500K+ customers in 175+ countries, including businesses, developers, IT professionals, and individuals.
But while there is a lot to celebrate in our past, there is almost as much opportunity ahead of us. We’re seeking a
Red Team Security Engineer
to join our team!
About the Role
The Red Team Security Engineer continuously validates whether vulnerabilities, configurations, identities, applications, infrastructure, and AI-enabled systems can be exploited by realistic adversaries. The role combines traditional offensive security with AI-assisted and agentic adversary emulation to validate exposure and continuously improve defensive controls.
Key Responsibilities
Emulate external attackers, malicious insiders, compromised identities, and autonomous adversarial agents.
Validate whether vulnerabilities and configuration weaknesses identified are reachable and practically exploitable.
Develop and execute realistic attack paths across web applications, APIs, cloud infrastructure, identity systems, endpoints, and other enterprise services.
Use AI-assisted and agentic techniques for reconnaissance, vulnerability analysis, attack-path discovery, and controlled offensive testing.
Test AI applications and agents for prompt injection, tool abuse, excessive privilege, identity compromise, and other emerging attack classes.
Validate compensating controls and mitigations before or after deployment.
Conduct purple-team exercises with Security Analytics and Security Operations to validate telemetry, detection, and response effectiveness.
Translate offensive findings into actionable improvements to architecture, configuration, detections, and response capabilities.
Qualifications
Experience in red teaming, penetration testing, adversary emulation, or offensive security engineering.
Strong web, API, cloud, identity, operating-system, and network security fundamentals.
Experience validating practical exploitability and developing realistic attack paths.
Strong understanding of MITRE ATT&CK and modern adversary techniques.
Familiarity with OWASP Top 10 for LLM, OWASP Top 10 for Agentic Applications, and MITRE ATLAS.
Scripting or software-development experience.
Experience safely using automation or AI-assisted techniques in offensive-security workflows.
Experience assessing cloud-native or AI-enabled systems, conducting purple-team exercises, or simulating autonomous adversaries is preferred.
At this point, we hope you're feeling excited about the job description you're reading. Even if you don't meet every requirement, we still encourage you to apply. Learning, developing, and growing are key parts of our culture. We're eager to meet people who believe in our mission and can contribute to our team in various ways. We want people to feel comfortable expressing their true selves and to come, stay, and do their best work here.
At Backblaze, we value being fair and good to our customers, partners, and employees. That’s why diversity, equity, and inclusion are at the core of our values. We are committed to fostering a workforce where all employees feel a sense of belonging regardless of race, ethnicity, nationality, gender, sexual orientation, age, religion, socio-economic status, ability, veteran status, and education. We believe that our dedication to cultivating a diverse workspace not only allows us to better serve our customers in over 175 countries, but further reinforces our commitment to doing the right thing.
We are proud to be an Equal Opportunity Employer.
To understand more about the data we collect and process as part of your application, please view our
Backblaze Employee Privacy Notice.
Remote-Friendly, United States; San Francisco, CA | Seattle, WA | New York City, NY | Washington, DC
EMEA
Не хотите искать каждый день?
Настройте подбор один раз, и подходящие вакансии будут сами приходить в Telegram.
Настройте подбор, и подходящие вакансии будут приходить в Telegram.
ГибридSan Francisco; Remote (United States); London; Belgrade; New York City
Arlington, VA, United States
ОфисleadГеография найма не уточнена
УдалённоRemote - US
УдалённоГеография найма не уточнена
ГибридSan Francisco Bay Area, USA; Team members are expected to work from our San Francisco office three full days per week, with the remaining days worked remotely and are expected to be available during agreed working hours and to maintain sufficient overlap with the relevant team’s time zone
