Вакансии

Ищем AppSec инженера, способного выявлять уязвимости на уровне кода и архитектуры, а не на уровне отчётов сканеров. Ключевая ценность специалиста — глубокое понимание того, что именно находят SAST/DAST/SCA инструменты, где их слепые зоны, и умение закрывать эти зоны ручной работой.

Задачи: — Внедрение практик безопасной разработки в CI/CD (SAST, DAST, SCA, контроль секретов), участие в архитектурном ревью новых продуктовых функций и API, координация внешних пентестов и программ Bug Bounty, контроль устранения уязвимостей. — Обеспечение безопасности серверной инфраструктуры (Linux, Docker/Kubernetes), сетевого контура, настройка и оптимизация WAF, защита от DDoS-атак и ботов, развитие процессов управления доступами (IAM/PAM). — Развитие систем мониторинга и реагирования на инциденты безопасности (SIEM, стек логирования), расследование инцидентов совместно с инженерами DevOps. — Защита внутреннего контура компании и рабочих мест сотрудников, повышение осведомлённости сотрудников в области безопасности (Security Awareness), обеспечение соответствия требованиям законодательства по защите персональных данных (152-ФЗ) без излишней бюрократии. — Формирование стратегии и дорожной карты информационной безопасности в соответствии с бизнес-целями компании, выбор и защита решений и вендоров, планирование бюджета, ответственность за зрелость процессов безопасности на уровне всей компании. Требования: — Опыт работы в сфере информационной безопасности от 3 лет, предпочтительно в продуктовых IT-компаниях, e-commerce, travel-tech или финтех с высокими нагрузками. — Глубокое понимание уязвимостей веб- и мобильных приложений, а также микросервисных API (OWASP Top 10, OWASP API Security). — Уверенные знания администрирования и защиты Linux, принципов безопасности контейнеризации (Docker, Kubernetes) и сетевых протоколов. — Практический опыт внедрения и настройки инструментов информационной безопасности: сканеры уязвимостей, SAST/DAST/SCA-решения, системы управления секретами (например, HashiCorp Vault), WAF, SIEM/ELK. — Навыки автоматизации рутинных задач на Python, Go или Bash. — Опыт использования ИИ-моделей и агентов для проведения внутренних пентестов. — Знание требований 152-ФЗ и умение адаптировать регуляторные нормы к техническим решениям. — Бизнес-ориентированность и автономность, умение выстраивать диалог с разработчиками и балансировать между безопасностью и скоростью релиза. — Опыт проведения аудитов на соответствие стандартам PCI DSS и ISO/IEC 27001. — Готовность взять ответственность за направление и развиваться до руководителя функции информационной безопасности. Условия: — Возможность работать удаленно.

Развивать и поддерживать GitLab CI/CD-пайплайны. Обеспечивать стабильную и непрерывную работу сборочного конвейера.

Location: Belgrade; Lisbon Workplace: OnSite Aghanim is an integrated commerce, liveops automation, community engagement, and payments platform for video games.   Mobile games have traditionally depended on app stores for distribution, payments, and player relationships. We believe there is a better way. Aghanim helps game studios build direct relationships with players, sell directly, and build their future on their own terms. Today, more than 100 games worldwide are already building this future with Aghanim.   Our team brings together people across Los Angeles, New York, Seoul, Beijing, London, Lisbon, Belgrade and other locations around the globe, with deep expertise in gaming, fintech and technology. We move quickly, keep communication direct, and focus on getting things done. We believe the best people thrive when they have autonomy, ownership, and a stake in the company's success. [https://app.ashbyhq.com/api/images/user-content/4f457f07-466b-477b-b552-fbbabd850111/2de3a7cd-8843-41a9-8bbe-ceb897a42c4a/Logo%20(horizontal).svg] We’re looking for a hands-on DevSecOps Engineer to build security into our cloud infrastructure and delivery pipelines. You’ll work closely with DevOps and development teams to establish practical security standards as our platform grows. KEY RESPONSIBILITIES - Own cloud security on GCP: IAM, org policies, network security, and edge protection with Cloudflare. - Harden our GKE clusters and container supply chain. - Build automated security checks into CI/CD (SAST, dependency, container, and IaC scanning). - Own secrets management and least-privilege access across the platform. - Drive vulnerability and cloud posture management to remediation. - Build security monitoring and lead incident response. - Actively drive SOC 2 Type 2 and PCI DSS Level 1 work: implement controls, prepare evidence. REQUIRED QUALIFICATIONS - 5+ years in DevSecOps, cloud security, or a security-heavy DevOps/Platform role. - Strong production experience with GCP (AWS/Azure acceptable). - Hands-on experience securing Kubernetes and Terraform-managed infrastructure. - Practical knowledge of CI/CD security, cloud IAM, secrets, vulnerability management, and security monitoring. - Ability to build security practices from scratch and get teams to adopt them. - Strong English communication skills. NICE TO HAVE - Experience with Cloudflare, Datadog, Wiz, Drata, or GitHub Actions. - Prior SOC 2 or PCI DSS audit experience. - Background in payments, gaming, or high-load products. WHY JOIN US - World-class team – work alongside experienced professionals from around the globe who have built products used by millions of players - High growth, high impact – be part of a fast-growing company where ideas turn into products and reach customers in days, not months - Autonomy and ownership – we trust people to make decisions, take initiative, and drive results - Modern tools and technology – use AI, automation, and modern tools as part of your everyday work - Equity – participate in the company's growth and long-term success

Формировать требования информационной безопасности к новым и дорабатываемым информационным системам. Проводить экспертизу разрабатываемых/существующих ИТ-систем на соответствие требованиям информационной безопасности.

- Анализ безопасности программного обеспечения, создаваемого не техническими специалистами. - Организация процессов безопасной разработки, внедрение инструментов безопасной разработки.

Задачи: — Встраивать проверки безопасности в CI/CD, включая анализ кода, зависимостей, контейнерных образов и поиск секретов. — Настраивать проверки так, чтобы команда получала полезные результаты без избытка ложных срабатываний. — Обеспечивать безопасность Linux, Docker, Kubernetes и облачной инфраструктуры. — Управлять секретами, правами доступа и конфигурациями окружений. — Выявлять уязвимости, оценивать их критичность и помогать командам устранять риски. — Проверять Infrastructure as Code и разрабатывать безопасные шаблоны развёртывания. — Участвовать в разборе инцидентов и улучшать мониторинг событий безопасности. — Документировать решения и помогать разработчикам применять безопасные практики. Требования: — Практический опыт в DevSecOps либо опыт DevOps/SRE с задачами информационной безопасности. — Уверенное знание Linux, сетевых технологий, HTTP/HTTPS, TLS и принципов разграничения доступа. — Опыт работы с Docker, Kubernetes и одной из систем CI/CD: GitLab CI, GitHub Actions, Jenkins или аналогами. — Владение Terraform и/или Ansible. — Понимание SAST, DAST, SCA, сканирования контейнеров и подходов к управлению уязвимостями. — Навыки автоматизации на Python, Bash или Go. — Умение объяснять риски и предлагать практически выполнимые решения. Будет плюсом: — Опыт с Vault, Trivy, Semgrep, SonarQube, OWASP ZAP или аналогичными инструментами. — Знание AWS, Azure, GCP либо других облачных платформ. — Опыт настройки политик Kubernetes, OPA/Kyverno, Falco. — Знакомство с SBOM, подписанием артефактов и безопасностью цепочки поставки ПО. — Опыт моделирования угроз и участия в реагировании на инциденты.

Location: Москва Станьте частью сильной и дружной команды архитекторов кибербезопасности в Компании с одной из наиболее зрелых функций корпоративной архитектуры в стране. Вы будете напрямую участвовать в развитии безопасности ИТ‑ландшафта СБЕРа и компаний Группы. Вы будете формировать и развивать референсные модели и AI‑инструменты для автономизации работы архитекторов СБЕРа и компаний Группы. Обязанности * разработка и согласование архитектуры и архитектурных решений предметной области - Кибербезопасность ИТ-инфраструктуры * обеспечение контроля соответствия внедряемых решений архитектуре и архитектурным требованиям * разработка и согласование архитектурных стандартов в предметной области * разработка документов методологического обеспечения в предметной области * исследование рынка новых технологий и продуктов обеспечения информационной безопасности * разработка архитектурных концепций для Банка. Требования * опыт работы в сфере ИТ от 5 лет (в том числе в области ИБ от 3 лет), в том числе в финансовом секторе (в ведущих Банках Тор-20) и/или в крупнейших компаниях производителей СЗИ, ИТ-интеграторах, телекомах * опыт разработки/внедрения, проектирования комплексных решений по информационной безопасности, знание соответствующих технических решений * опыт реализации проектов по внедрению систем информационной безопасности * опыт функционального управления проектными командами * высшее техническое образование ведущих ВУЗов (желательна специализация по Информационной Безопасности) * владение методологиями и стандартами в области информационной безопасности (ГОСТ, ISO 27001, PCI DSS) * понимание и опыт работы в области корпоративной архитектуры или архитектуры решений, владение одним из архитектурных фреймворков (TOGAF, DoDAF, Gartner-Meta и т.д.). **Ключевые навыки:** * Знание технологий информационной безопасности на уровне архитектора  (проектировщика): сетевые средства защиты (МСЭ/NGFW, VPN, Anti-DDoS, WAF и др.), технологии поведенческой аналитики (UBA), решения по управлению инцидентами (SOC, SIEM, IRP), средства антивирусной защиты и защиты Endpoint , виртуализации (EDR/XDR, Sandbox), системы управления угрозами и уязвимостями (VM, TIP), анализ исходного кода (SAST, DAST и др.) защита данных (RMS, DAM/DAG) * Опыт работы и понимание принципов работы: сетевые технологий и сетевые протоколы, DevOps/DevSecOps, сетевые стеки ISO/OSI, TCP/IP, платформы виртуализации и контейнеризации, протоколы аутентификации и авторизации, принципы управления доступом (ABAC \\ RBAC), технологии хранения данных. Условия * комфортный современный офис рядом с м. Кутузовская * гибридный график (50/50) * ежегодный пересмотр зарплаты и годовая премия * корпоративный спортзал и зоны отдыха * более 400 образовательных программ СберУниверситета для профессионального и карьерного развития * расширенный ДМС, льготное страхование для семьи и корпоративная пенсионная программа * льготная ипотека в Сбере, подписка Прайм с возможностью совместного использования на трёх близких * вознаграждение за рекомендацию друзей в команду Сбера

Поддержка и развитие процессов безопасной разработки. Проведение аудитов безопасности и ревью продуктовых сервисов и приложений.

Location: Remote, United States GitLab is the intelligent orchestration platform for DevSecOps. GitLab enables organizations to increase developer productivity, improve operational efficiency, reduce security and compliance risk, and accelerate digital transformation. More than 50 million registered users and more than 50% of the Fortune 100* trust GitLab to ship better, more secure software faster. The same principles built into our products are reflected in how our team works: we embrace AI as a core productivity multiplier, with all team members expected to incorporate AI into their daily workflows to drive efficiency, innovation, and impact. GitLab is where careers accelerate, innovation flourishes, and every voice is valued. Our high-performance culture is driven by our values and continuous knowledge exchange, enabling our team members to reach their full potential while collaborating with industry leaders to solve complex problems. Co-create the future with us as we build technology that transforms how the world develops software. * Fortune 500® is a registered trademark of Fortune Media IP Limited, used under license. Claim based on GitLab data. Fortune 100 refers to the top 20% ranked companies in the 2025 Fortune 500 list, published in June 2025. Fortune and Fortune Media IP Limited are not affiliated with, and do not endorse products or services of GitLab. As a Manager, Customer Success , you will lead a North America-based team that helps customers realize value from GitLab through strong adoption, measurable outcomes, and trusted partnership. You will partner closely with both executive sponsors and day-to-day end users/practitioners to drive adoption and measurable outcomes. Reporting to the Director of Customer Success, , you will coach Customer Success Managers and Customer Success Architects to support account health across onboarding, adoption stages, executive business reviews, and renewals, while also improving how the team works. This is a people leadership role with broad scope: you will develop talent, strengthen customer relationships, and partner across Sales, Product, Engineering, and other teams so customers are supported through growth, change, and escalation. What you'll do Lead a team of Customer Success Managers and Customer Success Architects focused on customer adoption, account health, customer satisfaction, and advocacy. Coach team members through regular feedback, development support, and career growth conversations to strengthen knowledge, communication, and execution. Partner with the Director of Customer Success to define team goals, clarify responsibilities, and align priorities with company direction. Manage resource assignments, staffing levels, and hiring activity to support team coverage and customer needs. Develop senior-level relationships with customers and support the team in building trusted advisor partnerships. Collaborate with Sales, Product Management, Engineering, Professional Services, and other internal teams to create a consistent customer experience. Support customers during escalations by working with other leaders to coordinate clear, effective responses. Improve the processes and tools used by the team and oversee initiatives tied to objectives and key results. What you'll bring Experience leading customer-facing teams in software, technology, consulting, sales, or customer success environments. Ability to guide teams that drive software adoption and manage customer relationships across onboarding, adoption, business reviews, and renewals. Knowledge of software development lifecycle practices, related tools, and agile or DevOps ways of working. Familiarity with cloud or container technologies such as Kubernetes and Docker, application security concepts such as static application security testing (SAST) and dynamic application security testing (DAST), or cloud platforms such as Amazon Web Services (AWS), Google Cloud Platform (GCP), and Microsoft Azure. Skill in translating strategy into clear initiatives, coordinating execution, and tracking delivery across competing priorities. Capability to lead distributed teams across regions, cultures, and lines of business, while working effectively with senior executives and external stakeholders. Willingness to travel occasionally for customer meetings and team events, as needed. Strength in communication, coaching, feedback, delegation, planning, and process improvement. Warmth and care in your leadership approach—able to coach with empathy and build trust on a human level. Interest in candidates with transferable experience who can connect technical concepts to business value and collaborate well across functions. About the team On the Customer Success team, we are accountable for customer adoption, measurable outcomes, customer satisfaction, and building customer advocacy across GitLab. We also act as a key connection point between customers and the broader GitLab ecosystem, helping streamline collaboration with Product Management, Engineering, Sales, Professional Services, and other partners. In this role, you will manage a team in North America while collaborating asynchronously with stakeholders across regions, with a focus on helping customers succeed at scale and improving how the organization supports them. The base salary range for this role’s listed level is currently for residents of the United States only. This range is intended to reflect the role's base salary rate in locations throughout the US. Grade level and salary ranges are determined through interviews and a review of education, experience, knowledge, skills, abilities of the applicant, equity with other team members, alignment with market data, and geographic location. The base salary range does not include any bonuses, equity, or benefits. See more information on our benefits and equity . Sales roles are also eligible for incentive pay targeted at up to 100% of the offered base salary. United States Salary Range $124,800 — $210,600 USD How GitLab Supports Full-Time Employees Benefits to support your health, finances, and well-being Flexible Paid Time Off Team Member Resource Groups Equity Compensation & Employee Stock Purchase Plan Growth and Development Fund Parental Leave Please note that we welcome interest from candidates with varying levels of experience; many successful candidates do not meet every single requirement. Additionally, studies have shown that people from underrepresented groups are less likely to apply to a job unless they meet every single qualification. If you're excited about this role, please apply and allow our recruiters to assess your application. Country Hiring Guidelines: GitLab hires new team members in countries around the world. All of our roles are remote, however some roles may carry specific location-based eligibility requirements. Our Talent Acquisition team can help answer any questions about location after starting the recruiting process. Privacy Policy: Please review our Recruitment Privacy Policy. Your privacy is important to us. GitLab is proud to be an equal opportunity workplace and is an affirmative action employer. GitLab’s policies and practices relating to recruitment, employment, career development and advancement, promotion, and retirement are based solely on merit, regardless of race, color, religion, ancestry, sex (including pregnancy, lactation, sexual orientation, gender identity, or gender expression), national origin, age, citizenship, marital status, mental or physical disability, genetic information (including family medical history), discharge status from the military, protected veteran status (which includes disabled veterans, recently separated veterans, active duty wartime or campaign badge veterans, and Armed Forces service medal veterans), or any other basis protected by law. GitLab will not tolerate discrimination or harassment based on any of these characteristics. See also GitLab’s EEO Policy and EEO is the Law . If you have a disability or special need that requires accommodation , please let us know during the recruiting process .

Выстраивание и организация процессов безопасной разработки (DevSecOps), внедрение и интеграция инструментов AppSec. Анализ безопасности ПО, разрабатываемого бизнес-подразделениями и внешними подрядчиками (включая low-code/no-code решения и внутренние инструменты).

Location: Tel Aviv-Yafo, Tel Aviv District, Israel About Aidoc Aidoc is the market leader in healthcare AI and has developed the world's largest clinical frontier model, supporting nearly 50 million patients each year. Aidoc is deployed in more than 2,000 medical centers worldwide. Since our founding in 2016, Aidoc has raised over $500 million and achieved a record number of FDA-cleared solutions. Medical diagnosis is hitting a breaking point, where the number of physicians hasn't kept up with the rapidly growing patient load. This leads to misdiagnosis and treatment delays that result in hundreds of thousands of deaths every year. Aidoc assists clinicians by precisely highlighting diseases directly on medical images, preventing misdiagnosis and ensuring that urgent patients receive the immediate attention they need. Senior Application Security Engineer Join our existing R&D Security team as Aidoc's first dedicated Application Security Engineer. You will shape how application security works across R&D: choosing effective controls, building useful security tooling, and helping engineers adopt secure practices. You will work with security leadership, SecOps, product teams and engineers. Our products span Python services, web applications, desktop applications, mobile apps, and Aidoc servers in hospitals. What you will do? Lead threat modeling and security reviews across services, web, desktop, mobile and hospital applications. Focus on customer and hospital data isolation and medical-file handling. Review Python and JavaScript/TypeScript code and test applications and APIs. Turn findings into practical requirements, help developers resolve them, and verify fixes, including testing for bypasses. Improve SAST, DAST, SCA and secrets controls across the development workflow. Work with DevOps and developers to reduce noise and make results actionable. Build security automation, CI integrations and validation tests. Create reusable guidance and help teams adopt standards through design discussions, code reviews and developer coaching. Define security requirements and verify controls for clinical inference, training pipeline code and model artifacts with AI and Data Engineering. Assess developer AI tools, including coding assistants, AI agents and Model Context Protocol (MCP) integrations, for sensitive-data exposure, excessive tool permissions and untrusted inputs. Validate application risks, recommend remediation priorities, track agreed work and measure adoption and recurring defects. Support SecOps investigations and provide technical evidence to Quality and Regulatory partners. Responsibilities 5+ years of relevant experience in Application Security, Product Security, or a combination with software engineering. Built or substantially improved an AppSec program: selected priorities, introduced or improved tooling, gained developer adoption without formal authority, and measured results. Confident security review of Python and JavaScript/TypeScript, especially authorization and tenant isolation; hands-on web and API testing. Experience threat modeling and assessing systems you did not design, and translating findings into changes engineers can implement. Ability to write security automation, CI integrations and validation tests. Working knowledge of security risks in LLM applications, AI agents and MCP integrations, including prompt injection, sensitive-data exposure and tool permissions. Clear communication in English and sound judgment when explaining security trade-offs and guiding engineering teams. Requirements Electron, mobile or Windows-hosted application security; C#/.NET, PowerShell or Go. Deeper security experience with ML training pipelines, model artifacts or inference systems. Healthcare integrations, patient-data protection or regulated product development. You can develop expertise in our additional platforms and healthcare domain here. Your AppSec judgment and record of making a program work matter most. Our Perks: Be part of something big - using cutting-edge technologies to transform the Healthcare industry (while saving patients’ lives) We work in a hybrid model, with our new offices located at 34 HaMasger Street in Tel Aviv and parking for employees. Amazing and healthy breakfasts and lunches prepared daily by our personal chef! Stocked up kitchen & meal card Wellness: Aidoc employees-only gym, plus Pilates, Yoga, and functional workouts classes. Amazing culture - collaborative, transparent & fun! Attractive compensation package & benefits Aidoc is deeply committed to creating an inclusive workplace, and to the principle of equal opportunity for all individuals. We prohibit discrimination and harassment based on race, color, religion, sex, sexual orientation, gender identity, national origin, age, disability, veteran status, or any other status protected by law.

-Анализ безопасности программного обеспечения, создаваемого не техническими специалистами.

▫️ Разрабатывать и внедрять процессы по повышению уровня зрелости безопасной разработки. ▫️ Интегрировать инструменты безопасной разработки с DevOps-процессами.

Location: Москва Ищем инженера по безопасности приложений в команду, которая развивает внутренние инструменты безопасности для разработки. Это роль на стыке безопасности приложений, разработки и DevSecOps: вы будете не только находить риски, но и превращать требования безопасности в удобные автоматизированные проверки, встроенные в повседневный процесс разработки. Команда развивает и внедряет инструменты, которые помогают выявлять проблемы безопасности на разных этапах жизненного цикла разработки: на уровне исходного кода, зависимостей, интерфейсов взаимодействия, мобильных приложений и процессов поставки. Роль предполагает заметную инженерную составляющую: проектирование проверок, исследование подходов, интеграции и развитие корпоративных решений для практик SAST, SCA, DAST, MAST и смежных направлений. Обязанности ### Вам предстоит: * развивать инструменты проверки безопасности приложений, встроенные в процесс разработки * разрабатывать, поддерживать и улучшать автоматизированные проверки безопасности для различных классов задач: анализ исходного кода, зависимостей, секретов, API и других артефактов разработки * проектировать и внедрять интеграции инструментов безопасности в CI/CD и процессы разработки * разрабатывать и поддерживать правила и автоматизацию для практик SAST, SCA, DAST, MAST и смежных направлений * интегрировать инструменты безопасности в secure SDLC и CI/CD так, чтобы они были полезны разработчикам и не создавали лишних затруднений в работе * проводить моделирование угроз и проверку безопасности новых функций, сервисов и архитектурных решений на ранних этапах * валидировать результаты сканирования, фильтровать ложные срабатывания и приоритизировать уязвимости по уровню технических и бизнес-рисков для настройки правил и автоматизации * помогать командам разработки устранять уязвимости: объяснять причины, риски и варианты исправления понятным инженерным языком * искать точки, где ручную экспертизу можно превратить в автоматизированную проверку * участвовать в исследовании и развитии новых подходов и инструментов безопасности приложений в зависимости от потребностей команды и компании. Требования ### Что для нас важно: * знания и опыт в безопасности приложений, безопасности продукта или DevSecOps * владение хотя бы одним языком программирования для разработки и автоматизации: Python/Go/Java будут преимуществом * понимание secure SDLC и практик раннего встраивания безопасности в процесс разработки * понимание в работе инструментов и подходов из областей SAST/SCA/secret scanning/API * понимание типовых уязвимостей хотя бы для части из следующих стеков: Java, Go, Python, JavaScript/TypeScript, PHP, C/C++ * хорошее понимание OWASP Top 10, OWASP ASVS, принципов безопасной разработки API * понимание современных архитектур: микросервисы, REST/gRPC, Kubernetes, контейнеризация * умение самостоятельно исследовать проблему, предлагать инженерное решение и доводить его до рабочего результата. **Будет плюсом:** * опыт разработки или доработки статических анализаторов или внутренних инструментов для разработчиков * практический опыт в безопасности API * опыт построения корпоративных решений или внутренних платформ безопасности * знание подходов к проверке контрактов API и соответствия реализации спецификации * опыт работы с подходами к моделированию угроз * знания в области безопасности мобильных приложений: OWASP Mobile Top 10, MASVS, OWASP MASTG * практический опыт анализа и тестирования безопасности мобильных приложений с использованием инструментов вроде jadx, apktool, MobSF и аналогичных * участие в bug bounty, CTF или open-source проектах * опыт поиска и снижения доли ложных срабатываний в инструментах безопасности * инструментальное владение AI для анализа, генерации и автоматизации. Условия ### Мы предлагаем: * комфортный современный офис * офисныйформат работы * ежегодный пересмотр зарплаты, годовая премия * корпоративный спортзал и зоны отдыха * более 400 образовательных программ СберУниверситета для профессионального и карьерного развития * программа адаптации и помощь руководителя на старте * расширенный ДМС, льготное страхование для семьи и корпоративная пенсионная программа * гибкий дисконт по ипотечному кредиту, равный 1/3 ключевой ставки ЦБ * подписка Прайм с возможностью совместного использования на трёх близких * вознаграждение за рекомендацию друзей в команду Сбера.

Location: Foster City, CA Workplace: Hybrid Replit is the agentic software creation platform that enables anyone to build applications using natural language. With millions of users worldwide, Replit is democratizing software development by removing traditional barriers to application creation. About the role: We are looking for an Engineering Manager, Security to lead the teams that secure our cloud, our infrastructure, and the code we ship. You will manage two closely linked groups: - Cloud & Infrastructure Security: engineers who own cloud security posture, configuration hardening, and infrastructure vulnerability management across GCP, AWS, and Azure, plus containers, Kubernetes, and SaaS platforms. - Application Security & Secure SDLC: engineers who run our SCA, SAST, and IaC scanning programs, drive remediation with engineering teams, and deliver secure development training. The core responsibility of this role is getting vulnerabilities fixed on time. You will partner with engineering teams across the company to drive remediation of cloud, infrastructure, and code findings within SLA, so that we consistently meet our compliance commitments (SOC 2, ISO 27001, PCI DSS, FedRAMP, and customer contracts). You will hire and grow a high-performing team, set the strategy and roadmap for vulnerability management from code to cloud, and make secure-by-default the easiest path for every developer. You will not run incident response yourself, but you need to understand it well enough to support the incident response team with context, prioritization, and follow-up fixes.   What You'll Do: TEAM LEADERSHIP & STRATEGY - Build, lead, and mentor a team of cloud security, infrastructure vulnerability management, and application security engineers; own hiring, career development, and performance management. - Define the multi-year roadmap and quarterly OKRs for cloud security, vulnerability management, and Secure SDLC, balancing risk reduction against developer velocity. - Set clear ownership, operating rhythms, and on-call/escalation processes across the team. - Report on security posture, risk trends, and program metrics to engineering and executive leadership. REMEDIATION & COMPLIANCE DELIVERY - Own remediation SLAs by severity across cloud, infrastructure, container, and code findings, and make sure they map to our compliance obligations (SOC 2, ISO 27001, PCI DSS, FedRAMP, customer contracts). - Partner with engineering managers and tech leads to plan, prioritize, and land fixes within SLA without stalling roadmaps. - Run a regular remediation review with engineering leadership: open findings, SLA burn-down, upcoming SLA breaches, and owners. - Manage the exception and risk-acceptance process: documented justification, compensating controls, expiry dates, and approvals. - Build automated workflows that route findings to the right owning team, track them to closure, and escalate before SLAs are breached. - Work with Compliance/GRC to produce audit-ready evidence of remediation timeliness, and lead the security side of external audits for vulnerability management controls. - Track and report metrics such as SLA attainment, mean time to remediate, backlog age, and exceptions, by team and severity. CLOUD & INFRASTRUCTURE SECURITY - Lead infrastructure vulnerability management across cloud workloads, containers, registries, data stores, and platform services, from scanning and contextual risk triage to remediation workflows. - Oversee configuration hardening and secure baselines across GCP (primary) and supporting AWS and Azure environments. - Own the strategy for Cloud, Kubernetes, and Data Security Posture Management (CSPM, KSPM, DSPM) tooling; make sure findings are accurate, prioritized, and actionable. - Secure critical SaaS platforms with sound configurations, access controls, and integrations. - Partner with Platform and ML Infrastructure teams to secure multi-tenant and AI infrastructure. APPLICATION SECURITY & CODE SCANNING - Own the SCA, SAST, and IaC scanning programs end to end: tool selection, CI/CD integration, rule tuning, noise reduction, and developer experience. - Drive software supply chain security, including dependency management, SBOMs, artifact signing, and progress through SLSA levels. - Feed code-scanning findings into the central remediation workflow so they reach the owning team automatically and are tracked against SLA. - Shift IaC security left so misconfigurations are caught in pull requests, before they reach production. SECURE SDLC & DEVELOPER ENABLEMENT - Define and run the Secure SDLC program: security requirements, threat modeling, secure design reviews, and release gates proportionate to risk. - Build and deliver security training, including onboarding, role-based secure coding training, and targeted sessions driven by real vulnerability trends. - Develop paved roads, secure defaults, and guardrails that make the secure path the easiest path for engineers. - Grow a Security Champions network across engineering teams. INCIDENT RESPONSE PARTNERSHIP & COLLABORATION - Understand the incident response lifecycle well enough to support the IR team: supply asset, exposure, and vulnerability context, and help assess blast radius. - Own follow-up remediation from incidents and postmortems that touch cloud, infrastructure, or code, and track it to closure. - Feed incident learnings back into scanning rules, secure baselines, and developer training. - Collaborate with Security Monitoring/Detection, Incident Response, Offensive Security, PSIRT, Architecture, DevOps, and Platform Engineering. - Help communicate security advisories, best practices, and updates to customers. - Tune into threat intelligence alerts to promptly manage patching of critical, exploitable vulnerabilities.   Required Skills & Experience: - 8+ years in security engineering, cloud security, or DevSecOps, including 2+ years managing security engineers (or 3+ years as a tech lead with formal people-leadership responsibility). - Deep, hands-on knowledge of cloud security in GCP plus working knowledge of AWS and/or Azure: IAM, networking, logging, org policies, and security services. - Proven track record running vulnerability management programs at scale and driving remediation across many engineering teams to meet SLAs, across cloud infrastructure, containers, and application code. - Hands-on experience with CSPM/CNAPP platforms (e.g., Wiz, Orca, Prisma Cloud, Lacework, GCP Security Command Center). - Hands-on experience with SCA, SAST, and IaC scanning tools (e.g., Snyk, Semgrep, CodeQL, Checkmarx, Socket, Dependabot, Checkov, tfsec) and integrating them into CI/CD. - Strong understanding of Kubernetes and container security, and Infrastructure-as-Code (Terraform or similar). - Proven track record of building or maturing a Secure SDLC program, including developer security training. - Ability to write and review code or automation (Python, Go, TypeScript, or similar). - Strong understanding of how remediation SLAs and security controls map to compliance frameworks (SOC 2, ISO 27001, PCI DSS, FedRAMP, CIS, NIST), and experience producing audit evidence. - Working understanding of security incident response in cloud-native environments, enough to partner effectively with IR and detection teams. - Excellent communication skills, with the ability to influence engineering leaders and explain risk in business terms. Bonus Qualifications: - Experience securing developer platforms, multi-tenant SaaS, or AI/ML infrastructure. - Experience with software supply chain frameworks (SLSA, Sigstore, SBOM standards). - Experience building a Security Champions program or developer-facing security tooling. - Experience leading the security side of external audits (SOC 2 Type II, ISO 27001, PCI DSS, or FedRAMP). - Relevant certifications (e.g., CCSP, GCP Professional Cloud Security Engineer, OSCP, CSSLP), though not required. Full-Time Employee Benefits Include: 💰 Competitive Salary & Equity 💹 401(k) Program with a 4% match (US Only) ⚕️ Health, Dental, Vision and Life Insurance 🩼 Short Term and Long Term Disability 🚼 Paid Parental, Medical, Caregiver Leave 🏝 Flexible Time Off (FTO) + Holidays 🚗 Commuter Benefits (In-Office & US Only) 📱 Monthly Wellness Stipend 🧑‍💻 Autonomous Work Environment 🖥 In Office Set-Up Reimbursement (In-Office Only) 🚀 Quarterly Team Gatherings ☕ In Office Amenities (In-Office Only) Want to learn more about what we are up to? - Self-driving Company https://replit.com/blog/self-driving-company - Replit Agent at Scale https://replit.com/blog/evaluating-and-improving-agent-at-scale - AI Adoption https://replit.com/blog/ai-adoption - Build Open-Source Apps https://replit.com/build/open-source-app-builder   Interviewing + Culture at Replit - Operating Principles https://blog.replit.com/operating-principles - Reasons not to work at Replit https://blog.replit.com/reasons-not-to-join-replit To achieve our mission of making programming more accessible around the world, we need our team to be representative of the world. We welcome your unique perspective and experiences in shaping this product. We encourage people from all kinds of backgrounds to apply, including and especially candidates from underrepresented and non-traditional backgrounds.

Location: Intellias Meet your recruiter Diana Meneses diana.meneses@intellias.com https://www.linkedin.com... Vacancy details Information Security Security Engineer Senior United States Remote APPLY NOW REFER A FRIEND Dive deep into Digital! For 20 years Intellias has been developing top-tier digital solutions for the world’s leading companies, keeping them in line with the latest technology trends. Join in and provide innovations for the future! What project we have for you The Application Security Engineer maintains independence from the development teams, reporting to our Cybersecurity Business Analyst, but would spend most of their time working with the Dev and DevOps teams. Their focus would be: Implementing and configuring SAST (static application security testing) and DAST (dynamic application security testing) across our web properties, including TOA, APIs, AFB, and the Project One stack. Integrating security checks into our CI/CD pipelines. Working with the teams to ensure secrets are handled securely and building rotation practices in line with our policies and standards. Helping teams understand, prioritize, and remediate the findings these tools produce. What you will do Select, deploy, and tune SAST tooling across our repositories, integrating scans into pull requests and CI/CD pipelines with practical quality gates. Implement and operate DAST scanning against our web applications and APIs in staging and production-like environments. Add software composition analysis and dependency scanning to track vulnerable open-source components. Reduce false positives and alert fatigue through rule tuning, baselining, and severity thresholds so developers trust the results and act on them. Recommend and implement secrets management solutions and practices that align with our existing policies and standards for storing, distributing, rotating, and auditing secrets. Deploy secret scanning in repositories, commit hooks, and pipelines to catch hardcoded credentials before they ship, and partner with DevOps to remove long-lived credentials from pipelines, configurations, and infrastructure-as-code. Lead the response when secrets are exposed: revoke, rotate, assess impact, and fix the root cause. Triage findings from scanners, penetration tests, external reports, and internal reviews, prioritizing by exploitability, exposure, and business impact rather than raw severity scores. Work directly with developers and DevOps engineers to understand root causes, propose practical fixes, and agree on realistic remediation timelines. Track findings to closure in the teams’ existing workflow tools, and define and enforce remediation SLAs by severity. Identify recurring vulnerability patterns and address them at the source through shared libraries, secure defaults, and pipeline guardrails. Perform manual code reviews and targeted security testing on high-risk features such as authentication, file uploads, and APIs. Provide clear, actionable remediation guidance with code-level examples, and contribute to secure coding standards aligned to OWASP Top 10 and ASVS. Participate in design and architecture discussions to provide security input and threat modeling for new features and services. Build the roadmap, processes, and tooling strategy for a new application security function, including build-versus-buy recommendations and vendor evaluations. Define and report application security metrics to security leadership, such as scan coverage, mean time to remediate, and open critical and high findings. Support audit and compliance requirements related to secure development, and contribute to incident response for application-layer security events. What you need for this Required Qualifications: BA/BS in Computer Science, Information Technology, Cybersecurity, or a related field, with 5+ years of experience in application security, product security, or a security-focused engineering role, or equivalent practical experience. Hands-on experience deploying and operating SAST and DAST tools in CI/CD pipelines, including tuning them for accuracy. Experience implementing secrets management and secret scanning in a production environment. Strong knowledge of web application vulnerabilities (OWASP Top 10, CWE Top 25) and how to remediate them in code. Working knowledge of authentication and identity management workflows and protocols (e.g., SAML, OAuth 2.0, OpenID Connect, SSO, session management) and the common security flaws in how they are implemented. Ability to read and review code in at least one modern language (e.g., Python, JavaScript/TypeScript, Java, C#, Go). Working knowledge of CI/CD platforms (e.g., GitHub Actions, GitLab CI, Jenkins) and DevOps practices. Demonstrated experience working with developers to fix security issues, not just report them. Preferred Qualifications: Experience building or significantly maturing an application security program from scratch. Experience with threat modeling methodologies such as STRIDE or PASTA. Experience with cloud and container security (e.g., Microsoft Azure, AWS, or GCP; Docker and Kubernetes). Experience with infrastructure-as-code security scanning and API security testing. Experience evaluating security tooling, including build-versus-buy decisions. Familiarity with security compliance frameworks such as SOC 2, and with supply chain security concepts such as SBOMs and SLSA. Relevant certifications such as GWAPT, OSWE, CSSLP, or equivalent. Skills & Competencies: Strong systems thinking, with the ability to embed security controls into engineering workflows without slowing teams down. Sound judgment to prioritize findings based on real risk and to explain trade-offs to both engineers and leadership. Excellent written and verbal communication, with the ability to produce clear, actionable remediation guidance and documentation. Collaborative, pragmatic approach to influencing teams without direct authority. Ability to move effectively between hands-on technical work and program-level planning. Ability to work independently and drive initiatives through ambiguity in a function that is new to the organization. What it’s like to work at Intellias At Intellias, where technology takes center stage, people always come before processes. By creating a comfortable atmosphere in our team, we empower individuals to unlock their true potential and achieve extraordinary results. That’s why we offer a range of benefits that support your well-being and charge your professional growth. We are committed to fostering equity, diversity, and inclusion as an equal opportunity employer. All applicants will be considered for employment without discrimination based on race, color, religion, age, gender, nationality, disability, sexual orientation, gender identity or expression, veteran status, or any other characteristic protected by applicable law. We welcome and celebrate the uniqueness of every individual. Join Intellias for a career where your perspectives and contributions are vital to our shared success.

LightNet is looking for a Cybersecurity Engineer to implement, operate, and improve security controls across cloud infrastructure, IT systems, endpoints, identities, and applications.