Search Rust Jobs
258 published Rust roles — filter by keyword, skill, seniority or contract type.
258 results
Updated
Security Engineer / Research Engineer, RL Security
About Anthropic Anthropic’s mission is to create reliable, interpretable, and steerable AI systems. We want AI to be safe and beneficial for our users and for society as a whole. Our team is a quickly growing group of committed researchers, engineers, policy experts, and business leaders working together to build beneficial AI systems. About the role Reinforcement learning is how Claude learns to reason, write code, and act autonomously over long horizons. At frontier scale, an RL run is a large distributed system: training, sampling, and environment execution run concurrently across a large fleet of accelerators and hosts. As an engineer in RL Engineering, you'll work on keeping that system secure as it scales. This is a hands-on engineering role. You'll work in the RL codebase and the infrastructure underneath it, alongside the engineers and researchers who build and use it. The system is large and changes as fast as the research does, so security work here has to keep up with that pace without costing performance or velocity. We're hiring from two backgrounds: security engineers who want to work on large-scale ML systems, and ML systems or research engineers who want to work on security. Strong candidates have depth in one and real interest in the other. Key responsibilities - Design, build, and operate security controls for RL training systems and the infrastructure they run on - Work across the stack (orchestration, environments, training, inference) wherever the work is needed - Review designs and code across the RL stack, find security problems, and fix them - Build shared libraries and tooling that other RL engineers and researchers build on - Build the observability needed to understand what these systems are doing - Work with researchers and performance engineers to make sure security changes preserve training correctness and performance - Write clear design documents for what you build Minimum qualifications - Strong software engineering skills in Python and at least one systems language such as Rust, C++, or Go - Experience designing, building, and operating large-scale distributed systems or security systems in production - Strong understanding of security fundamentals - Working knowledge of Linux, containers, and cloud infrastructure - Experience debugging complex problems across many hosts and services - Ability to reason about tradeoffs between security, performance, and reliability - Strong written communication, including design documents Preferred qualifications - Experience running ML training or inference infrastructure at scale - Experience with infrastructure security, such as isolation, access control, networking, or identity - Experience with container orchestration such as Kubernetes, and with sandboxed or virtualized code execution at scale - Experience building observability for large fleets - Experience supporting research teams or other fast-moving internal users - Familiarity with reinforcement learning or large language model training workloads The annual compensation range for this role is listed below. For sales roles, the range provided is the role’s On Target Earnings ("OTE") range, meaning that the range includes both the sales commissions/sales bonuses target and annual base salary for the role. Annual Salary: $320,000 - $405,000 USD Logistics Minimum education: Bachelor’s degree or an equivalent combination of education, training, and/or experience Required field of study: A field relevant to the role as demonstrated through coursework, training, or professional experience Minimum years of experience: Years of experience required will correlate with the internal job level requirements for the position Location-based hybrid policy: Currently, we expect all staff to be in one of our offices at least 25% of the time. However, some roles may require more time in our offices. Visa sponsorship: We do sponsor visas! However, we aren't able to successfully sponsor visas for every role and every candidate. But if we make you an offer, we will make every reasonable effort to get you a visa, and we retain an immigration lawyer to help with this. We encourage you to apply even if you do not believe you meet every single qualification. Not all strong candidates will meet every single qualification as listed. Research shows that people who identify as being from underrepresented groups are more prone to experiencing imposter syndrome and doubting the strength of their candidacy, so we urge you not to exclude yourself prematurely and to submit an application if you're interested in this work. We think AI systems like the ones we're building have enormous social and ethical implications. We think this makes representation even more important, and we strive to include a range of diverse perspectives on our team. Your safety matters to us. To protect yourself from potential scams, remember that Anthropic recruiters only contact you from @anthropic.com email addresses. In some cases, we may partner with vetted recruiting agencies who will identify themselves as working on behalf of Anthropic. Be cautious of emails from other domains. Legitimate Anthropic recruiters will never ask for money, fees, or banking information before your first day. If you're ever unsure about a communication, don't click any links—visit anthropic.com/careers directly for confirmed position openings. How we're different We believe that the highest-impact AI research will be big science. At Anthropic we work as a single cohesive team on just a few large-scale research efforts. And we value impact — advancing our long-term goals of steerable, trustworthy AI — rather than work on smaller and more specific puzzles. We view AI research as an empirical science, which has as much in common with physics and biology as with traditional efforts in computer science. We're an extremely collaborative group, and we host frequent research discussions to ensure that we are pursuing the highest-impact work at any given time. As such, we greatly value communication skills. The easiest way to understand our research directions is to read our recent research. This research continues many of the directions our team worked on prior to Anthropic, including: GPT-3, Circuit-Based Interpretability, Multimodal Neurons, Scaling Laws, AI & Compute, Concrete Problems in AI Safety, and Learning from Human Preferences. Come work with us! Anthropic is a public benefit corporation headquartered in San Francisco. We offer competitive compensation and benefits, optional equity donation matching, generous vacation and parental leave, flexible working hours, and a lovely office space in which to collaborate with colleagues. Guidance on Candidates' AI Usage: Learn about our policy for using AI in our application process.
Staff Security Engineer, Abuse Control
Who we are About Stripe Stripe is a financial infrastructure platform for businesses. Millions of companies—from the world’s largest enterprises to the most ambitious startups—use Stripe to accept payments, grow their revenue, and accelerate new business opportunities. Our mission is to increase the GDP of the internet, and we have a staggering amount of work ahead. That means you have an unprecedented opportunity to put the global economy within everyone’s reach while doing the most important work of your career. About the team Abuse Control Engineering (ACE) is Stripe’s rapid-response technical defense and control incubator. When urgent abuse vectors emerge, ACE uses real-world attacker telemetry to prototype, test, and deploy software safeguards before vulnerabilities can be exploited at scale. We partner closely with Fraud, Risk, Abuse Research, and Product Engineering to run rigorous experiments that balance effective risk mitigation with legitimate user activity and conversion. Operating as both a strike team and an incubator, ACE builds automated regression suites to prevent threats from recurring and transfers mature controls to long-term product owners across Stripe. What you’ll do As an Abuse Control Engineer on the ACE team, you will design, prototype, and incubate technical defenses that safeguard Stripe’s financial ecosystem against complex, cross-cutting abuse vectors. When emerging threat patterns reveal weaknesses in Stripe products, ACE rapidly builds and experiments with technical safeguards. Guided by empirical evidence and Stripe’s Fraud Taxonomy 3.0 (FT3) framework, you will translate threat intelligence into precise technical control requirements, such as API rate limits, step-up challenges, parameter validation, and pre-debit holds. You will run experiments to evaluate risk reduction against the impact on legitimate user conversion, carefully balancing security and product velocity. You will manage controls through a structured incubation lifecycle, build automated regression suites to prevent threats from recurring, and partner with product engineering teams to transfer mature, long-term defenses. Responsibilities - Rapid control prototyping: Design, prototype, and deploy technical controls across API, protocol, and product boundaries to address high-impact abuse vectors. - Evidence-based technical requirements: Translate empirical attacker evidence and FT3 threat research from Abuse Research, Fraud, and Security teams into precise technical abuse requirements and control specifications. - Control co-design: Collaborate with teams across Stripe to design resilient, secure controls across payments, onboarding, identity, and Connect surfaces. - Risk experimentation: Run rigorous experiments and A/B tests to measure risk reduction against the impact on legitimate user conversion, optimizing controls to minimize friction while neutralizing threats. - Regression testing: Build comprehensive regression test suites and automated attack simulations with Abuse Research to ensure mitigated abuse vectors do not recur. - Stakeholder management: Execute ACE’s incubation model by defining handoff criteria, operational documentation, timelines, and target dates for transferring successful controls to product teams. Who you are We’re looking for someone who meets the minimum requirements to be considered for the role. If you meet these requirements, you are encouraged to apply. The preferred qualifications are a bonus, not a requirement. Minimum requirements - 10+ years of experience in security engineering, software engineering, application security, or anti-abuse engineering in a high-scale production environment. - A bachelor’s or master’s degree in computer science, cybersecurity, software engineering, or a related technical field, or equivalent practical experience. - A strong software development background, with proficiency in Python, Go, Java, or a similar production programming language, as well as advanced SQL skills for analyzing system telemetry. - Experience using frontier AI models for software development, learning, and analysis. - Hands-on experience building API-level safeguards, rate-limiting frameworks, authentication or authorization checks, or input-validation controls. - Experience with automated testing frameworks, including writing unit, integration, and regression tests for critical backend software. - Strong cross-functional collaboration and communication skills, with a track record of partnering across security, product, and platform teams to drive technical outcomes. Preferred qualifications - A track record of designing and executing A/B tests, evaluating control efficacy, and balancing security safeguards against user conversion friction. - Expertise in threat modeling, secure systems architecture, and modern application-security design principles. - Familiarity with established threat frameworks, such as FT3 or MITRE ATT&CK, and experience applying adversary kill-chain analysis to build resilient defenses. - Knowledge of financial fraud vectors, threat-actor tactics, techniques, and procedures, and attacker infrastructure, including account takeover, card testing, and credential stuffing. - Hands-on experience with large-scale data-processing platforms, such as Databricks, Trino, or PySpark, to monitor and measure control performance across distributed systems. - Experience incubating software features, establishing clear operational handoff criteria, and transitioning ownership to partner engineering teams.
Staff Security Engineer, Abuse Control
Who we are About Stripe Stripe is a financial infrastructure platform for businesses. Millions of companies—from the world’s largest enterprises to the most ambitious startups—use Stripe to accept payments, grow their revenue, and accelerate new business opportunities. Our mission is to increase the GDP of the internet, and we have a staggering amount of work ahead. That means you have an unprecedented opportunity to put the global economy within everyone’s reach while doing the most important work of your career. About the team Abuse Control Engineering (ACE) is Stripe’s rapid-response technical defense and control incubator. When urgent abuse vectors emerge, ACE uses real-world attacker telemetry to prototype, test, and deploy software safeguards before vulnerabilities can be exploited at scale. We partner closely with Fraud, Risk, Abuse Research, and Product Engineering to run rigorous experiments that balance effective risk mitigation with legitimate user activity and conversion. Operating as both a strike team and an incubator, ACE builds automated regression suites to prevent threats from recurring and transfers mature controls to long-term product owners across Stripe. What you’ll do As an Abuse Control Engineer on the ACE team, you will design, prototype, and incubate technical defenses that safeguard Stripe’s financial ecosystem against complex, cross-cutting abuse vectors. When emerging threat patterns reveal weaknesses in Stripe products, ACE rapidly builds and experiments with technical safeguards. Guided by empirical evidence and Stripe’s Fraud Taxonomy 3.0 (FT3) framework, you will translate threat intelligence into precise technical control requirements, such as API rate limits, step-up challenges, parameter validation, and pre-debit holds. You will run experiments to evaluate risk reduction against the impact on legitimate user conversion, carefully balancing security and product velocity. You will manage controls through a structured incubation lifecycle, build automated regression suites to prevent threats from recurring, and partner with product engineering teams to transfer mature, long-term defenses. Responsibilities - Rapid control prototyping: Design, prototype, and deploy technical controls across API, protocol, and product boundaries to address high-impact abuse vectors. - Evidence-based technical requirements: Translate empirical attacker evidence and FT3 threat research from Abuse Research, Fraud, and Security teams into precise technical abuse requirements and control specifications. - Control co-design: Collaborate with teams across Stripe to design resilient, secure controls across payments, onboarding, identity, and Connect surfaces. - Risk experimentation: Run rigorous experiments and A/B tests to measure risk reduction against the impact on legitimate user conversion, optimizing controls to minimize friction while neutralizing threats. - Regression testing: Build comprehensive regression test suites and automated attack simulations with Abuse Research to ensure mitigated abuse vectors do not recur. - Stakeholder management: Execute ACE’s incubation model by defining handoff criteria, operational documentation, timelines, and target dates for transferring successful controls to product teams. Who you are We’re looking for someone who meets the minimum requirements to be considered for the role. If you meet these requirements, you are encouraged to apply. The preferred qualifications are a bonus, not a requirement. Minimum requirements - 10+ years of experience in security engineering, software engineering, application security, or anti-abuse engineering in a high-scale production environment. - A bachelor’s or master’s degree in computer science, cybersecurity, software engineering, or a related technical field, or equivalent practical experience. - A strong software development background, with proficiency in Python, Go, Java, or a similar production programming language, as well as advanced SQL skills for analyzing system telemetry. - Experience using frontier AI models for software development, learning, and analysis. - Hands-on experience building API-level safeguards, rate-limiting frameworks, authentication or authorization checks, or input-validation controls. - Experience with automated testing frameworks, including writing unit, integration, and regression tests for critical backend software. - Strong cross-functional collaboration and communication skills, with a track record of partnering across security, product, and platform teams to drive technical outcomes. Preferred qualifications - A track record of designing and executing A/B tests, evaluating control efficacy, and balancing security safeguards against user conversion friction. - Expertise in threat modeling, secure systems architecture, and modern application-security design principles. - Familiarity with established threat frameworks, such as FT3 or MITRE ATT&CK, and experience applying adversary kill-chain analysis to build resilient defenses. - Knowledge of financial fraud vectors, threat-actor tactics, techniques, and procedures, and attacker infrastructure, including account takeover, card testing, and credential stuffing. - Hands-on experience with large-scale data-processing platforms, such as Databricks, Trino, or PySpark, to monitor and measure control performance across distributed systems. - Experience incubating software features, establishing clear operational handoff criteria, and transitioning ownership to partner engineering teams.
Staff Security Engineer, Abuse Control
Who we are About Stripe Stripe is a financial infrastructure platform for businesses. Millions of companies—from the world’s largest enterprises to the most ambitious startups—use Stripe to accept payments, grow their revenue, and accelerate new business opportunities. Our mission is to increase the GDP of the internet, and we have a staggering amount of work ahead. That means you have an unprecedented opportunity to put the global economy within everyone’s reach while doing the most important work of your career. About the team Abuse Control Engineering (ACE) is Stripe’s rapid-response technical defense and control incubator. When urgent abuse vectors emerge, ACE uses real-world attacker telemetry to prototype, test, and deploy software safeguards before vulnerabilities can be exploited at scale. We partner closely with Fraud, Risk, Abuse Research, and Product Engineering to run rigorous experiments that balance effective risk mitigation with legitimate user activity and conversion. Operating as both a strike team and an incubator, ACE builds automated regression suites to prevent threats from recurring and transfers mature controls to long-term product owners across Stripe. What you’ll do As an Abuse Control Engineer on the ACE team, you will design, prototype, and incubate technical defenses that safeguard Stripe’s financial ecosystem against complex, cross-cutting abuse vectors. When emerging threat patterns reveal weaknesses in Stripe products, ACE rapidly builds and experiments with technical safeguards. Guided by empirical evidence and Stripe’s Fraud Taxonomy 3.0 (FT3) framework, you will translate threat intelligence into precise technical control requirements, such as API rate limits, step-up challenges, parameter validation, and pre-debit holds. You will run experiments to evaluate risk reduction against the impact on legitimate user conversion, carefully balancing security and product velocity. You will manage controls through a structured incubation lifecycle, build automated regression suites to prevent threats from recurring, and partner with product engineering teams to transfer mature, long-term defenses. Responsibilities - Rapid control prototyping: Design, prototype, and deploy technical controls across API, protocol, and product boundaries to address high-impact abuse vectors. - Evidence-based technical requirements: Translate empirical attacker evidence and FT3 threat research from Abuse Research, Fraud, and Security teams into precise technical abuse requirements and control specifications. - Control co-design: Collaborate with teams across Stripe to design resilient, secure controls across payments, onboarding, identity, and Connect surfaces. - Risk experimentation: Run rigorous experiments and A/B tests to measure risk reduction against the impact on legitimate user conversion, optimizing controls to minimize friction while neutralizing threats. - Regression testing: Build comprehensive regression test suites and automated attack simulations with Abuse Research to ensure mitigated abuse vectors do not recur. - Stakeholder management: Execute ACE’s incubation model by defining handoff criteria, operational documentation, timelines, and target dates for transferring successful controls to product teams. Who you are We’re looking for someone who meets the minimum requirements to be considered for the role. If you meet these requirements, you are encouraged to apply. The preferred qualifications are a bonus, not a requirement. Minimum requirements - 10+ years of experience in security engineering, software engineering, application security, or anti-abuse engineering in a high-scale production environment. - A bachelor’s or master’s degree in computer science, cybersecurity, software engineering, or a related technical field, or equivalent practical experience. - A strong software development background, with proficiency in Python, Go, Java, or a similar production programming language, as well as advanced SQL skills for analyzing system telemetry. - Experience using frontier AI models for software development, learning, and analysis. - Hands-on experience building API-level safeguards, rate-limiting frameworks, authentication or authorization checks, or input-validation controls. - Experience with automated testing frameworks, including writing unit, integration, and regression tests for critical backend software. - Strong cross-functional collaboration and communication skills, with a track record of partnering across security, product, and platform teams to drive technical outcomes. Preferred qualifications - A track record of designing and executing A/B tests, evaluating control efficacy, and balancing security safeguards against user conversion friction. - Expertise in threat modeling, secure systems architecture, and modern application-security design principles. - Familiarity with established threat frameworks, such as FT3 or MITRE ATT&CK, and experience applying adversary kill-chain analysis to build resilient defenses. - Knowledge of financial fraud vectors, threat-actor tactics, techniques, and procedures, and attacker infrastructure, including account takeover, card testing, and credential stuffing. - Hands-on experience with large-scale data-processing platforms, such as Databricks, Trino, or PySpark, to monitor and measure control performance across distributed systems. - Experience incubating software features, establishing clear operational handoff criteria, and transitioning ownership to partner engineering teams.
Security Engineer, Privy
Who we are About Privy Our mission is to make privacy and user ownership the default online. To do so, we build simple, flexible APIs and tools for developers that make it easy to build new products on crypto rails. Privy owns the abstractions and infrastructure layer above wallets, integrating across chains, third-party providers, and Stripe products like Treasury and Link. We get to solve hard technical problems while leveraging Stripe's distribution to reach customers like Ramp, Klarna, Deel, Kraken, Hyperliquid, and Fomo — powering experiences for both mainstream users and crypto natives. Learn more about Privy: Privy and Stripe: Bringing crypto to everyone About the team Engineering at Privy is distinguished by: - High urgency: Shipping very small iterations, very fast, to learn very quickly. - Product taste: Our customers are developers, and to build effective products for them requires technical knowledge - you will often be "the PM". - Security mindset: A great portion of our product is trust. While we have a dedicated security team, every engineer brings security to their designs from the start. In practice, we use boring technology like Node, React, and AWS so we can focus our engineering energy entirely on pushing the boundaries of Privy's core product, e.g. through hardware enclaves, multi-region low latency APIs, and blockchain abstractions that are accessible to mainstream developers. What you’ll do As a Security Engineer at Privy, you will help keep a rapidly growing platform secure through hands-on investigation, operational ownership, and building real code to solve real problems. You’ll work across security operations, incident response, application and infrastructure security, and internal tooling. This is not a role limited to reviewing logs and designs or simply escalating findings. You will carry real ownership for the day-to-day work that protects Privy: investigating anomalies, improving security workflows, and building the automation that makes the team faster and more effective over time. You’ll work closely with engineers across Privy and alongside specialists in cryptography, application security, offensive security, and infrastructure security to turn security expertise into practical, durable outcomes. Responsibilities - Own security engineering work end to end: investigate alerts, findings, anomalies, and security requests; identify root causes; drive remediation; and clearly document outcomes. - Participate in Privy’s security on-call rotation, helping respond to incidents, triage alerts, support vulnerability workflows, complete access reviews, and handle security escalations. - Build and maintain production-quality tooling that reduces manual work, including alert enrichment, automated triage and routing, remediation workflows, access-review automation, and detection improvements. - Lead focused investigations into suspected security events or compromises, gathering evidence methodically and coordinating the appropriate response. - Proactively identify recurring sources of operational toil and engineer durable solutions that improve the team’s speed, consistency, and ability to scale. - Partner with product and engineering teams to assess security risks, review lower-complexity designs and implementation plans, and make practical security tradeoffs to deliver quickly with quality and soundness. - Contribute across Privy’s application, infrastructure, cloud, and product-security surface area, developing broad context while building deeper expertise over time. Who you are We're looking for someone who meets the minimum requirements to be considered for the role. If you meet these requirements, you are encouraged to apply. The preferred qualifications are a bonus, not a requirement. Minimum requirements - Experience as a security engineer, detection engineer, or similarly hands-on engineer in a technically demanding environment. - Strong software-engineering skills in Python, Go, Ruby, or a similar language. You can build maintainable tooling and contribute directly to production fixes, not only one-off scripts. - Experience investigating security signals, incidents, vulnerabilities, suspicious activity, or other ambiguous technical problems through to resolution. - Familiarity with security operations, incident response, vulnerability management, detection engineering, access reviews, or related operational-security workflows. - A strong understanding of web, browser, infrastructure, or cloud security, with the ability to apply that understanding across a broad range of problems. - Good judgment under pressure, a methodical approach to investigation, and comfort working independently with agency despite incomplete information. - Strong communication and collaboration skills, including the ability to explain technical findings, risks, and recommended actions clearly to clients and internal stakeholders alike. - A self-directed approach to work: you notice gaps, make progress through ambiguity, and reliably close the loop. Preferred qualifications - Experience with AWS, GCP, or other cloud-security environments. - Experience with detection engineering, security automation, incident-response tooling, or remediation pipelines. - Bug-bounty experience, offensive-security exposure, or a strong attacker-minded approach to investigation. - Experience with IAM, secrets management, secure production access, or secure CI/CD. - Background in application security, infrastructure security, cryptography, or privacy engineering. - Experience with fintech, payments, blockchain, or another diligence-forward financial product domain. - Experience helping shape security operations, incident-response practices, vulnerability-management workflows, or a bug-bounty program.
Security Engineer, Product Security
About Chainlink Labs Chainlink Labs is one of the primary contributing developers of Chainlink, the standard for onchain finance enabling high-quality data, secure cross-chain interoperability, and compliant connectivity across global markets. Chainlink powers leading tokenized assets, financial institutions, market infrastructures, and decentralized applications by providing secure access to real-world data, cross-chain messaging, and blockchain connectivity across any network. The Chainlink standard has enabled tens of trillions of dollars in transaction value and is helping unify global markets onchain. Many of the world’s largest financial services institutions have also adopted Chainlink’s standards and infrastructure, including Swift, Euroclear, Mastercard, Fidelity International, UBS, S&P Dow Jones Indices, FTSE Russell, WisdomTree, ANZ, Aave, Polymarket, Lido, and many others. Chainlink Labs is a world-class team of developers, researchers, and capital markets experts, and has ranked among Fortune's Best Workplaces in Technology , Fortune's Best Medium Workplace , and the Top 100 Global Most Loved Workplaces . Learn more at chain.link or chainlinklabs.com . About The Role As a Product Security Engineer, you will contribute to the security of Chainlink's products by building and reviewing security systems. This role combines hands-on software engineering with the identification and evaluation of security risks, enabling stronger security decisions throughout development. You will work within the Product Security team to deliver reliable security-focused engineering solutions. Your Impact Design, develop, and maintain security systems that strengthen the security of Chainlink's products. Identify security vulnerabilities and potential attack paths through systematic technical reviews of existing systems. Improve the reliability and maintainability of security-focused software through high-quality implementation and testing. Evaluate security risks and engineering tradeoffs to inform technical decisions and reduce potential vulnerabilities. Deliver security engineering solutions from implementation through deployment, incorporating findings from technical reviews. Requirements Demonstrated software development experience, including writing, debugging, and maintaining production-quality code. Hands-on programming experience in Rust or Go, with the ability to demonstrate effective implementation and problem-solving. Experience designing, building, or implementing security systems, with demonstrated understanding of security considerations in technical design. Proven experience reviewing security systems, identifying potential vulnerabilities, and evaluating technical risks. Preferred Requirements A portfolio of prior engineering work, including publicly accessible code contributions or repositories demonstrating software development capability. Demonstrated engagement with security engineering through previous technical work, research, or security-focused projects. Experience critically evaluating systems to identify security weaknesses, attack paths, and potential improvements. Previously developed and shipped security products, with the ability to explain implementation decisions and technical tradeoffs. Experience developing or reviewing systems within Web3 or blockchain environments. Previous ownership of large engineering projects or experience leading small technical teams. Hands-on experience with security engineering for AI pipelines or AI-based systems. Chainlink Labs is a remote-first organization and employment eligibility is contingent upon residing in an approved hiring jurisdiction. Team members may work outside their primary country of legal residence for a maximum of 90 days per calendar year. Please discuss your current location, legal residence, and work authorization with your recruiter during your initial conversation. Unless otherwise stated for a specific role, we require working hours that overlap with Eastern Time (ET). We carefully review all applications and aim to provide a response to every candidate within two weeks after the job posting closes. The closing date is listed on the job advert, so we encourage you to take the time to thoughtfully prepare your application. We want to fully consider your experience and skills, and you will hear from us regarding the status of your application shortly after the closing date. Commitment to Equal Opportunity Chainlink Labs is an equal opportunity employer. All qualified applicants will receive equal consideration for employment in compliance with applicable laws, regulations, or ordinances. If you need assistance or accommodation due to a disability or special need when applying for a role or in our recruitment process, please contact us via this form . Global Data Privacy Notice for Job Candidates and Applicants Information collected and processed as part of your Chainlink Labs Careers profile, and any job applications you choose to submit, is subject to our Recruiting Privacy Policy . By submitting your application, you are agreeing to our use and processing of your data as required.
Member of Technical Staff (Secure Intelligence Ins...
Perplexity is seeking energetic researchers and engineers to join our Secure Intelligence Institute (SII), Perplexity's flagship research center for advancing security, privacy, and trust in frontier intelligence. SII’s goals are to advance frontier AI security research, translate those advances into concrete improvements in Perplexity's systems, and share knowledge and resources that strengthen the broader AI ecosystem. As a member of SII, you'll conduct original and impactful research on improving the security and privacy of frontier intelligence systems. Your goal will be to conduct research that is not only rigorous in theory, but practical enough to improve the systems people rely on every day. This work will be informed by the realities of operating general-purpose AI systems used by millions of people and thousands of enterprises, and you'll be expected to translate both your own research and advances from the broader community to practical improvements that protect and defend Perplexity's users. Responsibilities - Develop threat models for emerging attack surfaces in AI-native products, including browser, search, and autonomous agents. - Identify and analyze security and privacy threats across AI systems, infrastructure, and user-facing products. - Develop novel defenses, mitigations, and detection mechanisms for security and privacy in AI-native products. - Build security evaluation frameworks, benchmarks, and datasets to measure the effectiveness of different defense mechanisms. - Partner with Perplexity’s Security Engineering team to translate state of the art research into shipped security features and hardened system architectures. - Collaborate with top-tier academic and industry researchers in SII's external research network. - Publish findings at premier venues and contribute to the broader security research community. Qualifications - Hold a PhD (or equivalent research experience) in Computer Science, Computer Engineering, or a related field, with a primary focus on security and/or privacy. - Experience publishing at top security conferences (IEEE S&P, USENIX Security, ACM CCS, NDSS) demonstrating original, impactful research contributions. - Deep expertise in one or more of: security of agentic systems, systems security, web and applications security, program analysis, and software security. - Proficiency in Python (bonus points for TypeScript, Go, and/or Rust). - Ability to operate with high independence, willing to dive in and take ownership, and comfortable in a fast-paced environment where research directly informs product. - Clear and concise communcation, translating complex attack narratives into actionable insights for engineering and leadership.
Blockchain Security Engineer, Bridge
Who we are About Stripe Stripe is a financial infrastructure platform for businesses. Millions of companies—from the world's largest enterprises to the most ambitious startups—use Stripe to accept payments, grow their revenue, and accelerate new business opportunities. Our mission is to increase the GDP of the internet, and we have a staggering amount of work ahead. That means you have an unprecedented opportunity to put the global economy within everyone's reach while doing the most important work of your career. About the team We're creating an entirely new payments platform, built with stablecoins, to simplify global money movement. Bridge enables faster, cheaper payments and borderless access to dollars via stablecoins. Through our APIs, businesses can send and receive funds across borders faster and cheaper vs. SWIFT and other fiat-only rails. Our virtual accounts enable international consumers and businesses to easily access, store, and spend US dollars. Our payouts infrastructure enables platforms to disburse USD to anyone globally. We believe many trillions of dollars will move and settle through stablecoin payment rails. Bridge is pulling this future forward. We have a small team of people who have previously built financial infrastructure at some of the world's leading companies (Coinbase, Stripe, Square, Brex, Upstart, DoorDash, Airbnb), and each and every one of them chose Bridge because they fundamentally believe that stablecoins will be a critical piece of financial infrastructure that allows for the improvement of global money movement. What you'll do We're hiring a Security Engineer to build and scale the Bridge security foundation. This is a rare opportunity to design a security program from the ground up, while also leveraging the infrastructure, best practices, and tooling of one of the most mature security organizations in the industry. Responsibilities - Design and implement the Bridge security roadmap from first principles to production. - Identify and tackle the most important Bridge security risks quickly and pragmatically. - Integrate with Stripe infrastructure where it makes sense, and find custom solutions where it doesn't. - Lead threat modeling and hardening efforts for the Bridge money movement systems in collaboration with crypto and infra teams. - Build key security capabilities, including monitoring, secrets management, incident response, access controls, and CI/CD hardening. - Reinforce engineering best practices around secure development and infrastructure. - Ensure Bridge meets compliance and audit expectations as we scale to more regulated markets. - Collaborate cross-functionally with engineering, product, and the Stripe security organization to move fast without compromising safety. Who you are Minimum requirements - 8+ years of experience in Security engineering. - Experience building or scaling security programs at a startup or in an embedded role. Preferred qualifications - Experience in fast-paced startup environments, building security practices from the ground up. - Startup mindset—scrappy, pragmatic, and quick to solve the most critical problems. - Comfort writing and debugging backend application code, with Ruby experience preferred. - Comfort with ambiguity and ability to ruthlessly prioritize. - Ability to balance security rigor with speed, especially in fast-moving environments. - Clear communication across technical and non-technical stakeholders. - Interest in the potential of crypto and stablecoins to power global financial infrastructure.
Staff + Software Security Engineer, Labs
About Anthropic Anthropic’s mission is to create reliable, interpretable, and steerable AI systems. We want AI to be safe and beneficial for our users and for society as a whole. Our team is a quickly growing group of committed researchers, engineers, policy experts, and business leaders working together to build beneficial AI systems. About the role Frontier AI is on track to be among the most consequential and most adversarially-targeted technology in the world. The capability curve is steep, the adversaries who want these systems are extremely well-resourced, and the security bar this will eventually require is well beyond where the industry operates today. Incremental hardening alone is not going to close that gap, so we need breakthroughs and a group of people to go find them. Security Labs is that team. We run a portfolio of high-risk, high-expected-value security projects: the work that seems impractical until someone optimistic and stubborn enough actually tries it. Projects run on the order of weeks rather than quarters, and each one is either handed off to the Anthropic team that will own it in production or wound down with a writeup of what we learned. We expect a meaningful fraction of our bets not to land. This team is intentionally scrappy and ambitious. We're intentionally iterating fast on high-risk research bets and we expect a meaningful fraction not to land. If a 30% project success rate sounds uncomfortable, or uncharted and chaotic territory isn’t both frightening and exciting, this probably isn't the right fit. There are other places in Anthropic Security doing important work with more structure, less risk, and more certain paths to positive outcomes. The questions we're trying to answer include: - Can our core research workflows survive extreme isolation? - Can we replace trust with cryptographic guarantees? - Can the models themselves become our most effective security control? - What would it actually take to defend against a tier-1 state adversary, and how much of that can we build now? Who we're looking for. We're hiring generalists with rare depth. You're a strong software engineer as a baseline, and on top of that you've gone deep in at least one area most engineers don't get near: firmware or hardware security, applied cryptography, OS / kernel / hypervisor internals, formal methods, reverse engineering, or high-assurance and cross-domain systems. You've built things under your own direction, you're comfortable jumping layers when the problem demands it, and you'd rather take a swing at something that might not work than ship the safe incremental thing. You think the trajectory of AI matters a great deal, you're not comfortable with how the security side of it is going by default, and you'd rather be on the inside building the answer than watching from outside. Current Project Areas The portfolio changes as we learn. The kinds of bets currently in flight or queued: - Standing up a prototype high-assurance research cluster: running real Anthropic training and research workloads under extreme isolation and physical security controls, and finding out exactly where productivity breaks and what we'd need to invent to get it back - Provable inference: cryptographic verification (zero-knowledge proofs, attestation chains) that a given output came from a specific model running specific code, replacing "trust us" with math - Build hypervisor-isolated microVM workload isolation across the fleet - Compiling an ML kernel through a formally verified pipeline where every lowering step carries a machine-checked proof of equivalence, making compilation-layer sabotage mathematically detectable - Regenerating clusters: automation that spins up a purpose-built cell, runs a workload, and tears the whole thing down on a TTL measured in hours, so attacker persistence has an expiry date - Using Claude itself to drive security work end to end: threat modeling new compute platforms, rewriting critical services to zero external dependencies, running the test equipment that validates what hardware datasheets claim Part of your job is deciding what comes next. We hire people we trust to pick good bets, and project selection is owned by the engineers doing the work. Key responsibilities - Own Security Labs projects end to end. You'll scope the bet, build the prototype, run it against real workloads, and bring it to either a hand-off or a documented exit - Stand up novel security infrastructure fast (isolated clusters, attestation chains, hypervisor and runtime work, verification tooling) optimizing for what we learn rather than for permanence - Find the receiving team early, bring them along while you build, and hand them something they actually want to own - Work embedded with research and infrastructure teams (Pretraining, RL, Inference, Compute) to test whether their workflows survive what you're proposing, and document precisely where they don't - Turn experimental results into short writeups that shape Anthropic's long-term security architecture, and into costed contingency plans we could execute on short notice - Help pick the next round of bets and influence the industry to get better along the way Minimum qualifications - Genuinely care about where AI is heading and want to work on the security problems that determine whether it goes well. This is the most important thing on this list - Have real depth in at least one area most software engineers don't touch (e.g. firmware or hardware security, applied cryptography, OS / kernel / hypervisor internals, formal methods and verification, reverse engineering and exploit development, or high-assurance / cross-domain systems) - Have built and shipped things under your own direction. Maybe you founded a company or research group, maintained an open-source project other people depend on, or shipped research that changed how people in your field work. We weight this far more than where you've worked or for how long - Have a track record of choosing the problem yourself and seeing it through, rather than only executing a plan someone else handed you - Are comfortable jumping between domains and layers of the stack when the problem calls for it, and have actually done so - Have run prototypes or experiments where the goal was answering a hard question rather than shipping a permanent system, including ones that didn't pan out - Write clearly enough to turn weeks of work into a couple of pages someone can act on - Change your mind when the evidence says to, and are fine being the least-expert person in a room full of specialists - Care about defense. Plenty of folks here come from offense and that background is valuable, but what you actually want to spend your time on now is making systems hold up - Are a strong programmer (Python plus at least one of Rust, Go, or C/C++) and can stand up real infrastructure without that being the interesting part of your week Preferred qualifications - Experience inside airgapped or high-side environments (classified networks, cross-domain solutions, ICS/SCADA, financial trading infrastructure) and the operational realities of working in them - A background in offensive security, red teaming, or vulnerability research, with calibrated intuitions for which threats actually matter - Familiarity with ML infrastructure (training pipelines, distributed schedulers, inference serving, accelerator hardware) sufficient for grounded conversations with researchers about what their workloads actually need - A history of working in environments built around rapid iteration rather than rigid change control: startups, applied research groups, independent consulting, small security shops The annual compensation range for this role is listed below. For sales roles, the range provided is the role’s On Target Earnings ("OTE") range, meaning that the range includes both the sales commissions/sales bonuses target and annual base salary for the role. Annual Salary: $320,000 - $485,000 USD Logistics Minimum education: Bachelor’s degree or an equivalent combination of education, training, and/or experience Required field of study: A field relevant to the role as demonstrated through coursework, training, or professional experience Minimum years of experience: Years of experience required will correlate with the internal job level requirements for the position Location-based hybrid policy: Currently, we expect all staff to be in one of our offices at least 25% of the time. However, some roles may require more time in our offices. Visa sponsorship: We do sponsor visas! However, we aren't able to successfully sponsor visas for every role and every candidate. But if we make you an offer, we will make every reasonable effort to get you a visa, and we retain an immigration lawyer to help with this. We encourage you to apply even if you do not believe you meet every single qualification. Not all strong candidates will meet every single qualification as listed. Research shows that people who identify as being from underrepresented groups are more prone to experiencing imposter syndrome and doubting the strength of their candidacy, so we urge you not to exclude yourself prematurely and to submit an application if you're interested in this work. We think AI systems like the ones we're building have enormous social and ethical implications. We think this makes representation even more important, and we strive to include a range of diverse perspectives on our team. Your safety matters to us. To protect yourself from potential scams, remember that Anthropic recruiters only contact you from @anthropic.com email addresses. In some cases, we may partner with vetted recruiting agencies who will identify themselves as working on behalf of Anthropic. Be cautious of emails from other domains. Legitimate Anthropic recruiters will never ask for money, fees, or banking information before your first day. If you're ever unsure about a communication, don't click any links—visit anthropic.com/careers directly for confirmed position openings. How we're different We believe that the highest-impact AI research will be big science. At Anthropic we work as a single cohesive team on just a few large-scale research efforts. And we value impact — advancing our long-term goals of steerable, trustworthy AI — rather than work on smaller and more specific puzzles. We view AI research as an empirical science, which has as much in common with physics and biology as with traditional efforts in computer science. We're an extremely collaborative group, and we host frequent research discussions to ensure that we are pursuing the highest-impact work at any given time. As such, we greatly value communication skills. The easiest way to understand our research directions is to read our recent research. This research continues many of the directions our team worked on prior to Anthropic, including: GPT-3, Circuit-Based Interpretability, Multimodal Neurons, Scaling Laws, AI & Compute, Concrete Problems in AI Safety, and Learning from Human Preferences. Come work with us! Anthropic is a public benefit corporation headquartered in San Francisco. We offer competitive compensation and benefits, optional equity donation matching, generous vacation and parental leave, flexible working hours, and a lovely office space in which to collaborate with colleagues. Guidance on Candidates' AI Usage: Learn about our policy for using AI in our application process.
Staff + Software Security Engineer, Secure Framewo...
About Anthropic Anthropic’s mission is to create reliable, interpretable, and steerable AI systems. We want AI to be safe and beneficial for our users and for society as a whole. Our team is a quickly growing group of committed researchers, engineers, policy experts, and business leaders working together to build beneficial AI systems. About the team Secure Frameworks is the team in Anthropic's Security Engineering org that builds shared security libraries and frameworks the rest of the company builds on. We collaborate closely with teams and leaders across Anthropic to own critical security foundations, including workload identity and authorization, cryptographic frameworks, and the centralized access proxy that secures traffic to internal applications. Our mission is to make the secure thing easy and the easy thing secure by helping Anthropic engineers get secure behaviour by default and preventing entire classes of vulnerabilities through careful design. We own what we ship, help customers adopt better security practices and at times we work embedded directly in research, infrastructure or product teams. About the role You will design, build and run security foundations used across Anthropic's fleet, from threat model through production, on-call and adoption. Much of the work is greenfield: our infrastructure is growing quickly and the timelines are compressed, so you will help define the architecture rather than inherit it. Depending on your strengths you will focus on one or two of the areas below and contribute across the rest. - Build critical security foundations including cryptographic frameworks, mTLS infrastructure, secure serialization, and authorization systems, designed to prevent entire classes of vulnerabilities - Partner with product, research, infrastructure, and other security teams to ensure frameworks integrate smoothly with lower-layer security controls - Scope, design and build security services and libraries end-to-end, maintain them in production, and drive through ambiguous technical problems with minimal oversight - Build and operate the zero-trust access gateway that fronts Anthropic's internal services - Design and roll out authorization frameworks so services enforce least privilege consistently instead of each inventing its own access controls - Own cryptographic frameworks and libraries - Mentor engineers, contribute to hiring, and grow security engineering culture across Anthropic Minimum qualifications - 8+ years of software engineering experience building security-relevant systems in production, including leading complex initiatives independently - Strong programming skills in Go, Rust or Python - Deep understanding of authentication and authorization systems: OAuth 2.0 / OIDC, JWTs, service-to-service auth, policy-based access control - Hands-on experience with PKI, X.509, mTLS and workload identity - Working knowledge of applied cryptography: choosing and composing primitives correctly, key management, and the ways libraries fail in practice - Experience shipping and operating high-reliability services on Kubernetes across cloud and on-prem environments, including being on call for them - A track record of bringing clarity and ownership to ambiguous technical problems and driving them to resolution across teams - A strong sense of developer experience - Clear communication across all levels of the organization - Passion for AI safety and the role security engineering plays in building trustworthy AI systems Preferred qualifications - Built security frameworks or libraries adopted across an engineering organization, and done the work to drive that adoption - Built or operated a zero-trust / BeyondCorp-style access gateway or identity-aware proxy - Migrated a fleet to mTLS at scale, including certificate issuance and staged enforcement - Maintained or contributed to open-source cryptographic libraries - Designed authorization systems using policy languages or relationship-based models - Familiarity with ML infrastructure (training, inference serving) The annual compensation range for this role is listed below. For sales roles, the range provided is the role’s On Target Earnings ("OTE") range, meaning that the range includes both the sales commissions/sales bonuses target and annual base salary for the role. Annual Salary: $32,000 - $485,000 USD Logistics Minimum education: Bachelor’s degree or an equivalent combination of education, training, and/or experience Required field of study: A field relevant to the role as demonstrated through coursework, training, or professional experience Minimum years of experience: Years of experience required will correlate with the internal job level requirements for the position Location-based hybrid policy: Currently, we expect all staff to be in one of our offices at least 25% of the time. However, some roles may require more time in our offices. Visa sponsorship: We do sponsor visas! However, we aren't able to successfully sponsor visas for every role and every candidate. But if we make you an offer, we will make every reasonable effort to get you a visa, and we retain an immigration lawyer to help with this. We encourage you to apply even if you do not believe you meet every single qualification. Not all strong candidates will meet every single qualification as listed. Research shows that people who identify as being from underrepresented groups are more prone to experiencing imposter syndrome and doubting the strength of their candidacy, so we urge you not to exclude yourself prematurely and to submit an application if you're interested in this work. We think AI systems like the ones we're building have enormous social and ethical implications. We think this makes representation even more important, and we strive to include a range of diverse perspectives on our team. Your safety matters to us. To protect yourself from potential scams, remember that Anthropic recruiters only contact you from @anthropic.com email addresses. In some cases, we may partner with vetted recruiting agencies who will identify themselves as working on behalf of Anthropic. Be cautious of emails from other domains. Legitimate Anthropic recruiters will never ask for money, fees, or banking information before your first day. If you're ever unsure about a communication, don't click any links—visit anthropic.com/careers directly for confirmed position openings. How we're different We believe that the highest-impact AI research will be big science. At Anthropic we work as a single cohesive team on just a few large-scale research efforts. And we value impact — advancing our long-term goals of steerable, trustworthy AI — rather than work on smaller and more specific puzzles. We view AI research as an empirical science, which has as much in common with physics and biology as with traditional efforts in computer science. We're an extremely collaborative group, and we host frequent research discussions to ensure that we are pursuing the highest-impact work at any given time. As such, we greatly value communication skills. The easiest way to understand our research directions is to read our recent research. This research continues many of the directions our team worked on prior to Anthropic, including: GPT-3, Circuit-Based Interpretability, Multimodal Neurons, Scaling Laws, AI & Compute, Concrete Problems in AI Safety, and Learning from Human Preferences. Come work with us! Anthropic is a public benefit corporation headquartered in San Francisco. We offer competitive compensation and benefits, optional equity donation matching, generous vacation and parental leave, flexible working hours, and a lovely office space in which to collaborate with colleagues. Guidance on Candidates' AI Usage: Learn about our policy for using AI in our application process.
Staff / Senior Software Engineer, Security Fusion...
About Anthropic Anthropic’s mission is to create reliable, interpretable, and steerable AI systems. We want AI to be safe and beneficial for our users and for society as a whole. Our team is a quickly growing group of committed researchers, engineers, policy experts, and business leaders working together to build beneficial AI systems. About the role Data Center Security Engineering (DCSE) owns physical security across Anthropic's data center footprint: the sites, the hardware inside them, and the supply chain that delivers it. The Security Fusion Platform is where physical security signals from across that footprint are correlated and put in front of the analysts who act on them. It carries continuous monitoring, audit evidence, metrics, and analyst response, along with the classification and analytics pipelines that turn sensor data into events. You'll build and own the platform analysts work from. This is a foundational role. You'll build the software platform that carries a signal from source to analyst decision, ship its first versions, and keep them running in production. The sensors and systems at each site belong to other DCSE engineers; you define the event contract their owners deliver to, and you build the classification and analytics pipelines that run over what those sources produce. Physical security systems engineers own the operations spaces; you own the software that runs in them. You'll work alongside engineers focused on the sites themselves. What you lead, you own end to end: the design, the technical approach, and the result in production. You'll work with external vendors and integrators, setting requirements and acceptance criteria for what you own and deciding what the team builds itself. We use Claude throughout our engineering workflow and expect you to as well. This role involves regular travel to data center sites. No security clearance is required. These are critical services, and you'll take part in on-call for them. Key responsibilities - Design and build the event bus and normalized event schema: source identity, sequencing, health state, and the adapter contract that owners of each sensor and system feed build to, plus adapters where needed - Build correlation and alerting: the rules and services that turn events from independent sources into alerts an analyst can act on - Build the classification and analytics pipelines: computer vision and multi-sensor fusion, with results landing on the event bus - Build analyst surfaces: the queue, escalation tooling, dashboards, camera viewers, and video wall content a 24/7 watch works from, plus video analytics integration so camera streams arrive on the bus as events - Deliver audit evidence: durable, tamper-evident event history, evidence exports, and the retention and access controls around them - Instrument metrics and self-monitoring: detection rates, nuisance ratios, alert aging, time to resolve; heartbeats and loss-of-telemetry alarms on every feed, tested fail-secure behavior, and change audit on every rule - Deploy across sites: site-local components, central services, and the sync that keeps configuration, rules, and state consistent, then commission each site and hand over to the analysts - Specify the compute the platform runs on (servers, storage, and the platform's network segment) to the team's segmentation and hardening baseline - Write requirements and acceptance criteria for what vendors and integrators deliver, review deliverables against them, and make the call on accepting or rejecting the work Minimum qualifications - Have built and run event-driven backend systems in production - Are proficient in at least one backend language such as Python, Go, or Rust, and have worked with a message bus or event streaming system such as Kafka - Have owned a system end to end: set the design, made the tradeoffs, shipped it, and answered for it in production - Have integrated with external systems you did not control (vendor APIs, on-prem appliances, video platforms, building systems) and designed for a life beyond any one vendor - Have directed vendor or integrator work: written requirements and acceptance criteria, reviewed deliverables against them, and decided what gets accepted - Design for the failure you won't see coming (a silent feed, a lost network path, a replayed event, a de-tuned rule), know how your system behaves when a source lies or goes quiet, and test for it - Build tools for people who use them under pressure and iterate with those operators Preferred qualifications - Experience building or operating a security operations platform (SOC, physical security operations, or the detection engineering behind one) - Experience building ML or computer vision inference pipelines over video and sensor streams - PSIM (physical security information management) or VMS (video management system) integration experience, or familiarity with physical access control and building systems data - Experience producing evidence for auditors or assessors: log integrity, retention, chain of custody - Experience using AI-assisted development tooling as a core part of your workflow The annual compensation range for this role is listed below. For sales roles, the range provided is the role’s On Target Earnings ("OTE") range, meaning that the range includes both the sales commissions/sales bonuses target and annual base salary for the role. Annual Salary: $320,000 - $405,000 USD Logistics Minimum education: Bachelor’s degree or an equivalent combination of education, training, and/or experience Required field of study: A field relevant to the role as demonstrated through coursework, training, or professional experience Minimum years of experience: Years of experience required will correlate with the internal job level requirements for the position Location-based hybrid policy: Currently, we expect all staff to be in one of our offices at least 25% of the time. However, some roles may require more time in our offices. Visa sponsorship: We do sponsor visas! However, we aren't able to successfully sponsor visas for every role and every candidate. But if we make you an offer, we will make every reasonable effort to get you a visa, and we retain an immigration lawyer to help with this. We encourage you to apply even if you do not believe you meet every single qualification. Not all strong candidates will meet every single qualification as listed. Research shows that people who identify as being from underrepresented groups are more prone to experiencing imposter syndrome and doubting the strength of their candidacy, so we urge you not to exclude yourself prematurely and to submit an application if you're interested in this work. We think AI systems like the ones we're building have enormous social and ethical implications. We think this makes representation even more important, and we strive to include a range of diverse perspectives on our team. Your safety matters to us. To protect yourself from potential scams, remember that Anthropic recruiters only contact you from @anthropic.com email addresses. In some cases, we may partner with vetted recruiting agencies who will identify themselves as working on behalf of Anthropic. Be cautious of emails from other domains. Legitimate Anthropic recruiters will never ask for money, fees, or banking information before your first day. If you're ever unsure about a communication, don't click any links—visit anthropic.com/careers directly for confirmed position openings. How we're different We believe that the highest-impact AI research will be big science. At Anthropic we work as a single cohesive team on just a few large-scale research efforts. And we value impact — advancing our long-term goals of steerable, trustworthy AI — rather than work on smaller and more specific puzzles. We view AI research as an empirical science, which has as much in common with physics and biology as with traditional efforts in computer science. We're an extremely collaborative group, and we host frequent research discussions to ensure that we are pursuing the highest-impact work at any given time. As such, we greatly value communication skills. The easiest way to understand our research directions is to read our recent research. This research continues many of the directions our team worked on prior to Anthropic, including: GPT-3, Circuit-Based Interpretability, Multimodal Neurons, Scaling Laws, AI & Compute, Concrete Problems in AI Safety, and Learning from Human Preferences. Come work with us! Anthropic is a public benefit corporation headquartered in San Francisco. We offer competitive compensation and benefits, optional equity donation matching, generous vacation and parental leave, flexible working hours, and a lovely office space in which to collaborate with colleagues. Guidance on Candidates' AI Usage: Learn about our policy for using AI in our application process.
PhD Intern, Security Engineer (2027)
Figma is growing our team of passionate creatives and builders on a mission to make design accessible to all. Figma’s platform helps teams bring ideas to life—whether you're brainstorming, creating a prototype, translating designs into code, or iterating with AI. From idea to product, Figma empowers teams to streamline workflows, move faster, and work together in real time from anywhere in the world. If you're excited to shape the future of design and collaboration, join us! The mission of the Figma Security team is to help Figmates ship the most secure and safe product to our users. As a PhD Intern, Security Engineer you will work on an impactful project to improve the security of Figma’s product, platform, or infrastructure, working closely with a mentor and teammates while applying your research background to drive real-world impact. You will partner closely with teams across the company, focus on systemic security improvements and risk reduction, and participate in operational security responsibilities like security reviews, consulting, vulnerability triage, and security incident response. This is a 12 or 16-week internship role that can be held from one of our US hubs (San Francisco or New York) starting in May or June of 2027. What you’ll do at Figma: - Perform technical security assessments, code audits, and design reviews - Design and develop solutions to prevent or mitigate security vulnerabilities across Figma’s products, services and infrastructure - Lead and support security investigations, developing the datasets, tooling, and analysis that help us scope incidents, understand root cause, and reduce time to detect and respond - Translate threat intelligence into action, operationalizing intel on relevant threat actors and techniques to prioritize detection coverage, harden high-risk surfaces, and guide security strategy We’d love to hear from you if you have: - Current enrollment as a 4th or 5th year senior PhD student in a Computer Science program with a focus in Security or a related field - Proficiency in at least one general-purpose coding language - A track record in applying security techniques to projects in academia or industry, with excellent domain knowledge in at least one relevant area such as AI Safety/Evaluation, Useable security, Anti-abuse, Anti-fraud, detection and response or similar - Strong knowledge of statistical methods and/or experimental design - Experience solving sophisticated problems and comparing alternative solutions, trade-offs, and diverse points of view to determine a path forward While it’s not required, it’s an added plus if you also have: - Related industry experience via a past internship or full-time role - Proven expertise in security through publications at top security conferences like USENIX Security, NDSS, CCS, IEEE S&P - Strong communication and interpersonal skills, with demonstrated experience collaborating across functions - Experience using AI tools (e.g., GitHub Copilot, ChatGPT, Claude) to write, debug, and optimize code - A good understanding of at least two of Linux/Unix/Mac-based systems security, AWS security, Cloud SaaS Security, applied cryptography, anti-abuse, or web application security At Figma, one of our values is Grow as you go. We believe in hiring smart, curious people who are excited to learn and develop their skills. If you’re excited about this role but your past experience doesn’t align perfectly with the points outlined in the job description, we encourage you to apply anyways. You may be just the right candidate for this or other roles. Pay Transparency Disclosure This internship role is based in either Figma’s San Francisco or New York hub offices, and has the hourly base pay rate stated below. Figma also offers interns a housing stipend and travel reimbursement. Figma’s compensation and benefits are subject to change and may be modified in the future. Internship $74 - $74 USD At Figma we celebrate and support our differences. We know employing a team rich in diverse thoughts, experiences, and opinions allows our employees, our product and our community to flourish. Figma is an equal opportunity workplace - we are dedicated to equal employment opportunities regardless of race, color, ancestry, religion, sex, national origin, sexual orientation, age, citizenship, marital status, disability, gender identity/expression, veteran status , or any other characteristic protected by law. We also consider qualified applicants regardless of criminal histories, consistent with legal requirements. We will work to ensure individuals with disabilities are provided reasonable accommodation to apply for a role, participate in the interview process, perform essential job functions, and receive other benefits and privileges of employment. If you require accommodation, please reach out to accommodations-ext@figma.com . These modifications enable an individual with a disability to have an equal opportunity not only to get a job, but successfully perform their job tasks to the same extent as people without disabilities. Examples of accommodations include but are not limited to: - Holding interviews in an accessible location - Enabling closed captioning on video conferencing - Ensuring all written communication be compatible with screen readers - Changing the mode or format of interviews To ensure the integrity of our hiring process and facilitate a more personal connection, we require all candidates keep their cameras on during video interviews. Additionally, if hired you will be required to attend in person onboarding. By applying for this job, the candidate acknowledges and agrees that any personal data contained in their application or supporting materials will be processed in accordance with Figma's Candidate Privacy Notice . Application limits: To help candidates focus on the opportunities most relevant to their skills and experience, Figma limits the number and frequency of applications. These limits apply to all roles: - Candidates may submit up to 5 applications during any rolling 30-day period. - Candidates may not reapply to the same role while an application is active or within 90 days of receiving a rejection. Once the applicable days has passed, candidates are welcome to apply again.
Infrastructure Security Engineer
We are building AI to simulate the world through merging art and science. We believe that world models are at the frontier of progress in artificial intelligence. Language models alone won’t solve the world’s hardest problems – robotics, disease, scientific discovery. Real progress requires models that experience the world and learn from their mistakes, the same way that humans do. And this kind of trial and error can be massively accelerated when done in simulation, rather than in the real world. World models offer the most clear path to general-purpose simulation, changing how stories are told, how scientific progress is made and how the next frontiers of humanity are reached. Our team consists of creative, open minded, caring and ambitious people who are determined to change the world. We aspire to continuously build impossible things and our ability to do so relies on building an incredible team. If you are driven to do the same, we'd love to hear from you. *Titles posted to our careers page are updated regularly to best advertise the role and expected seniority, but internally we have a flat titling system with two types of titles: one for individual contributors and one for people managers. About the role * Open to hiring remote — we also have offices in New York, San Francisco, Seattle, London, Paris, and Tel Aviv. Runway is hiring an Infrastructure Security Engineer to secure the platform our models are trained and served on. The role covers Kubernetes platform security, cloud identity and access, software supply chain, tenant isolation in the serving layer and the research infrastructure behind our models. Securing a company that trains and serves frontier video models is a different problem from securing a typical SaaS product. The environment includes research compute, large training datasets, a fast-moving build pipeline, and engineers who work inside AI-assisted tooling every day. Each of those changes what an attack looks like and what the platform has to enforce to stop it. This is a hands-on engineering role on the Security team. You'll write policy, tooling and infrastructure code, work in the platform team's repositories, and ship controls that hold up in production. What you'll do - Design and ship security controls in our Kubernetes ecosystem: admission policy, RBAC, workload identity, network policy and runtime hardening across every cluster we run - Harden the software supply chain from dependency intake through build and deploy, including package firewalling, artifact signing and provenance, and admission controls that block what doesn't pass - Own cloud IAM and identity architecture: least-privilege roles, short-lived credentials and workload federation - Secure research infrastructure and training pipelines, including access to model weights and datasets, without slowing down the people using them - Threat model new platform components before they ship and turn the findings into concrete requirements the owning team can act on - Build guardrails for AI agents and developer tooling operating inside our infrastructure - Write infrastructure as code and policy as code, and treat security configuration with the same review and rollout discipline as any other change - Give the incident response team what they need when infrastructure is involved: fast answers about how a system works and what to shut off What you'll need - Hands-on experience securing Kubernetes in production: you've written admission policies, debugged RBAC and workload identity problems and understand how a cluster gets compromised - Working knowledge of cloud IAM and networking on at least one major cloud platform, including how identity federation and short-lived credentials actually work - Experience with infrastructure as code and GitOps-style deployment, and the habit of shipping security changes through the same pipeline as everything else - Comfort writing Python, Typescript, Rust or another language to build tooling, not just scripts - An understanding of software supply chain attacks and the controls that stop them: signing, provenance, SBOMs, admission enforcement - Clear writing. Design docs, threat models and explanations to engineers who don't work in security are all part of the job - Judgment about which controls to enforce, which to recommend and how to roll out a breaking change without breaking the company Even better if you have - Experience securing GPU or HPC-style compute, training pipelines or research environments - Experience with policy engines and admission controllers (Kyverno, OPA Gatekeeper, Falco or similar) - Multi-tenant isolation design in a cloud environment: ABAC, scoped credentials, per-tenant boundaries - Experience producing security architecture evidence for SOC 2, ISO 27001 or other audits and customer assessments - Open source contributions or published work in cloud or Kubernetes security Runway strives to recruit and retain exceptional talent from diverse backgrounds while ensuring pay equity for our team. Our salary ranges are based on competitive market rates for our size, stage and industry, and salary is just one part of the overall compensation package we provide. There are many factors that go into salary determinations, including relevant experience, skill level and qualifications assessed during the interview process, and maintaining internal equity with peers on the team. The range shared below is a general expectation for the function as posted, but we are also open to considering candidates who may be more or less experienced than outlined in the job description. In this case, we will communicate any updates in the expected salary range. Lastly, the provided range is the expected salary for candidates in the U.S. Outside of those regions, there may be a change in the range, which again, will be communicated to candidates. Working at Runway Great things come from great teams. We’d love to hear from you. We’re committed to creating a space where our employees can bring their full selves to work and have equal opportunity to succeed. So regardless of race, gender identity or expression, sexual orientation, religion, origin, ability, age, veteran status, if joining this mission speaks to you, we encourage you to apply. More about Runway - Universal World Simulator - GWM-1 - Gen-4.5 - General World Models - Robotics SDK - Conversational Real-time Agents - Runway Studios We're excited to be recognized as a best place to work: Crain's | InHerSight | BuiltIn NYC | INC
Security Engineer / Research Engineer, RL Security
About Anthropic Anthropic’s mission is to create reliable, interpretable, and steerable AI systems. We want AI to be safe and beneficial for our users and for society as a whole. Our team is a quickly growing group of committed researchers, engineers, policy experts, and business leaders working together to build beneficial AI systems. About the role Reinforcement learning is how Claude learns to reason, write code, and act autonomously over long horizons. At frontier scale, an RL run is a large distributed system: training, sampling, and environment execution run concurrently across a large fleet of accelerators and hosts. As an engineer in RL Engineering, you'll work on keeping that system secure as it scales. This is a hands-on engineering role. You'll work in the RL codebase and the infrastructure underneath it, alongside the engineers and researchers who build and use it. The system is large and changes as fast as the research does, so security work here has to keep up with that pace without costing performance or velocity. We're hiring from two backgrounds: security engineers who want to work on large-scale ML systems, and ML systems or research engineers who want to work on security. Strong candidates have depth in one and real interest in the other. Key responsibilities - Design, build, and operate security controls for RL training systems and the infrastructure they run on - Work across the stack (orchestration, environments, training, inference) wherever the work is needed - Review designs and code across the RL stack, find security problems, and fix them - Build shared libraries and tooling that other RL engineers and researchers build on - Build the observability needed to understand what these systems are doing - Work with researchers and performance engineers to make sure security changes preserve training correctness and performance - Write clear design documents for what you build Minimum qualifications - Strong software engineering skills in Python and at least one systems language such as Rust, C++, or Go - Experience designing, building, and operating large-scale distributed systems or security systems in production - Strong understanding of security fundamentals - Working knowledge of Linux, containers, and cloud infrastructure - Experience debugging complex problems across many hosts and services - Ability to reason about tradeoffs between security, performance, and reliability - Strong written communication, including design documents Preferred qualifications - Experience running ML training or inference infrastructure at scale - Experience with infrastructure security, such as isolation, access control, networking, or identity - Experience with container orchestration such as Kubernetes, and with sandboxed or virtualized code execution at scale - Experience building observability for large fleets - Experience supporting research teams or other fast-moving internal users - Familiarity with reinforcement learning or large language model training workloads The annual compensation range for this role is listed below. For sales roles, the range provided is the role’s On Target Earnings ("OTE") range, meaning that the range includes both the sales commissions/sales bonuses target and annual base salary for the role. Annual Salary: $320,000 - $405,000 USD Logistics Minimum education: Bachelor’s degree or an equivalent combination of education, training, and/or experience Required field of study: A field relevant to the role as demonstrated through coursework, training, or professional experience Minimum years of experience: Years of experience required will correlate with the internal job level requirements for the position Location-based hybrid policy: Currently, we expect all staff to be in one of our offices at least 25% of the time. However, some roles may require more time in our offices. Visa sponsorship: We do sponsor visas! However, we aren't able to successfully sponsor visas for every role and every candidate. But if we make you an offer, we will make every reasonable effort to get you a visa, and we retain an immigration lawyer to help with this. We encourage you to apply even if you do not believe you meet every single qualification. Not all strong candidates will meet every single qualification as listed. Research shows that people who identify as being from underrepresented groups are more prone to experiencing imposter syndrome and doubting the strength of their candidacy, so we urge you not to exclude yourself prematurely and to submit an application if you're interested in this work. We think AI systems like the ones we're building have enormous social and ethical implications. We think this makes representation even more important, and we strive to include a range of diverse perspectives on our team. Your safety matters to us. To protect yourself from potential scams, remember that Anthropic recruiters only contact you from @anthropic.com email addresses. In some cases, we may partner with vetted recruiting agencies who will identify themselves as working on behalf of Anthropic. Be cautious of emails from other domains. Legitimate Anthropic recruiters will never ask for money, fees, or banking information before your first day. If you're ever unsure about a communication, don't click any links—visit anthropic.com/careers directly for confirmed position openings. How we're different We believe that the highest-impact AI research will be big science. At Anthropic we work as a single cohesive team on just a few large-scale research efforts. And we value impact — advancing our long-term goals of steerable, trustworthy AI — rather than work on smaller and more specific puzzles. We view AI research as an empirical science, which has as much in common with physics and biology as with traditional efforts in computer science. We're an extremely collaborative group, and we host frequent research discussions to ensure that we are pursuing the highest-impact work at any given time. As such, we greatly value communication skills. The easiest way to understand our research directions is to read our recent research. This research continues many of the directions our team worked on prior to Anthropic, including: GPT-3, Circuit-Based Interpretability, Multimodal Neurons, Scaling Laws, AI & Compute, Concrete Problems in AI Safety, and Learning from Human Preferences. Come work with us! Anthropic is a public benefit corporation headquartered in San Francisco. We offer competitive compensation and benefits, optional equity donation matching, generous vacation and parental leave, flexible working hours, and a lovely office space in which to collaborate with colleagues. Guidance on Candidates' AI Usage: Learn about our policy for using AI in our application process.
Security Engineer, Bridge
Who we are About Stripe Stripe is a financial infrastructure platform for businesses. Millions of companies—from the world's largest enterprises to the most ambitious startups—use Stripe to accept payments, grow their revenue, and accelerate new business opportunities. Our mission is to increase the GDP of the internet, and we have a staggering amount of work ahead. That means you have an unprecedented opportunity to put the global economy within everyone's reach while doing the most important work of your career. About the team We're creating an entirely new payments platform, built with stablecoins, to simplify global money movement. Bridge enables faster, cheaper payments and borderless access to dollars via stablecoins. Through our APIs, businesses can send and receive funds across borders faster and cheaper vs. SWIFT and other fiat-only rails. Our virtual accounts enable international consumers and businesses to easily access, store, and spend US dollars. Our payouts infrastructure enables platforms to disburse USD to anyone globally. We believe many trillions of dollars will move and settle through stablecoin payment rails. Bridge is pulling this future forward. We have a small team of people who have previously built financial infrastructure at some of the world's leading companies (Coinbase, Stripe, Square, Brex, Upstart, DoorDash, Airbnb), and each and every one of them chose Bridge because they fundamentally believe that stablecoins will be a critical piece of financial infrastructure that allows for the improvement of global money movement. What you'll do We're hiring a Security Engineer to build and scale the Bridge security foundation. This is a rare opportunity to design a security program from the ground up, while also leveraging the infrastructure, best practices, and tooling of one of the most mature security organizations in the industry. Responsibilities - Design and implement the Bridge security roadmap from first principles to production. - Identify and tackle the most important Bridge security risks quickly and pragmatically. - Integrate with Stripe infrastructure where it makes sense, and find custom solutions where it doesn't. - Lead threat modeling and hardening efforts for the Bridge money movement systems in collaboration with crypto and infra teams. - Build key security capabilities, including monitoring, secrets management, incident response, access controls, and CI/CD hardening. - Reinforce engineering best practices around secure development and infrastructure. - Ensure Bridge meets compliance and audit expectations as we scale to more regulated markets. - Collaborate cross-functionally with engineering, product, and the Stripe security organization to move fast without compromising safety. Who you are Minimum requirements - 8+ years of experience in Security engineering. - Experience building or scaling security programs at a startup or in an embedded role. Preferred qualifications - Experience in fast-paced startup environments, building security practices from the ground up. - Startup mindset—scrappy, pragmatic, and quick to solve the most critical problems. - Comfort writing and debugging backend application code, with Ruby experience preferred. - Comfort with ambiguity and ability to ruthlessly prioritize. - Ability to balance security rigor with speed, especially in fast-moving environments. - Clear communication across technical and non-technical stakeholders. - Interest in the potential of crypto and stablecoins to power global financial infrastructure.
Senior Software Engineer, Security Assurance | UK...
Grafana Labs is the company behind Grafana Cloud, the fully managed observability platform trusted by more than 10,000 organizations to ensure reliability, resolve incidents faster, and optimize telemetry at scale. Built on open source and open standards and designed for interoperability across any stack, Grafana Cloud brings AI to observability and observability to AI, giving teams (and their agents) unified visibility so they can see, understand, and act on all their disparate data, wherever it lives, and move at the speed of their ambitions. Customers, including Anthropic, Bloomberg, NVIDIA, Microsoft, and Salesforce, rely on Grafana Labs. We are a 100% remote company with team members across 40+ countries, backed by leading investors including Lightspeed Venture Partners, Sequoia Capital, GIC, Coatue, J.P. Morgan, CapitalG, and Lead Edge Capital. Learn more at grafana.com and follow us on LinkedIn and X . We’re scaling fast and staying true to what makes us different: an open-source legacy, a global collaborative culture, and a passion for meaningful work. Our team thrives in an innovation-driven environment where transparency, autonomy, and trust fuel everything we do. You may not meet every requirement, and that’s okay. If this role excites you, we’d love you to raise your hand for what could be a truly career-defining opportunity. This is a remote position. We are looking for candidates in the UK, Ireland, Spain, Germany or Sweden. Senior Software Engineer - Security Assurances We are looking for a Senior Software Engineer, Security Assurance to join our GRC engineering team. We are building a security system that’s automated at scale, rigorously data-driven, and built from the ground up with defense-in-depth and self-healing in mind. We support a highly autonomous, remote-first, cloud-native organization. We are a technical team that can build any tool we need, while knowing when to buy to improve velocity. To support our growth and ambitious vision, we embrace agile principles and values, share openly, apply context-driven security mechanisms, default to action, and have an OSS-first mindset. We are a 100% remote company. We believe in high-velocity but sustainable expectations and timeframes, giving people the room to do great work. The Opportunity: You will work to build out our security observability, compliance, and control management systems and tools. You will develop services and tools to proactively defend our systems, provide visibility to our security state, and give engineers and stakeholders guardrails and paved roads to behave securely. You will collaborate across your team, the security department, and wider Grafana to write and deploy security policies across all of our SDLC, applications, and infrastructure. This is a very technical, hands-on keyboard software engineering, so development experience is critical. You will ideally have some experience building, implementing and improving the maturity of security programs in Cloud-based SaaS organizations. Knowledge of security standards and frameworks (ISO, FedRAMP, PCI-DSS, GDPR, etc) is useful, but the disposition to quickly learn new things is more important than rote knowledge. You will work alongside other security engineers, full-stack developers, and customer-facing teams. Experience guiding and negotiating with peers, stakeholders, customers, and auditors is a plus. What You’ll Be Doing: - Be a technical contributor on our GRC team covering a range of areas, including certifications, application, build, cloud, and supply chain security, and internal security tooling development - Develop, implement, and maintain highly automated security assurance programs to ensure compliance with organizational and regulatory requirements (e.g., ISO 27001, SOC 2, GDPR, NIST, PCI-DSS, TISAX, whatever else our customers eventually throw at us) - Develop systems, automations, and methods of security observability to push the GRC engineering organization beyond just meeting certification requirements - Deploy security and compliance checks in an employee-enabling way (guardrails and paved roads) in their daily workflows and build pipelines - Collaborate with cross-functional teams to integrate security controls into the software development lifecycle and operational processes. - Respond to customer security issues, security alerts, and potential incidents What Makes You a Great Fit: - Experience developing in a production environment with at least one programming language. We primarily use Go, TypeScript, and Python but most languages translate well. You will take a code screen and be expected to discuss programming principles such as algorithms, data structures, and optimization - Knowledge of using and securing containerized, cloud-native applications, ideally with Kubernetes. Experience with multiple cloud providers is a strong plus - Experience in automating security and compliance processes using tools, scripts, and frameworks while enabling developer and employee workflows - Strong interpersonal skills, as this position will require communication with peers, stakeholders, auditors, and customers - Understanding of industry-recognized security frameworks, standards, and certifications, such as ISO 27001, SOC 2, PCI DSS, NIST, or GDPR, and how to apply them without added operational burden. You can gain this by reading the standards documents and audit guidance - A degree in Computer Science, Information Security, or related field (or equivalent experience) Bonus Points For: - Working knowledge of Grafana Labs OSS projects and products. Experience in using observability tooling to solve security problems. - Experience working with OSS communities - Experience in using technical automations to prove infrastructure compliance - Experience securing large-scale distributed systems running in public clouds In the UK, the base compensation range for this role is £ 91,755 - £110,106. Actual compensation may vary based on level, experience, and skillset as assessed throughout the interview process. All of our roles include Restricted Stock Units (RSUs), giving every team member ownership in Grafana Labs' success. We believe in shared outcomes—RSUs help us stay aligned and invested as we scale globally. *Compensation ranges are country specific. If you are applying for this role from a different location than listed above, your recruiter will discuss your specific market’s defined pay range & benefits at the beginning of the process. Why You’ll Thrive at Grafana Labs: - 100% Remote, Global Culture - As a remote-only company, we bring together talent from around the world, united by a culture of collaboration and shared purpose. - Scaling Organization – Tackle meaningful work in a high-growth, ever-evolving environment. - Transparent Communication – Expect open decision-making and regular company-wide updates. - Innovation-Driven – Autonomy and support to ship great work and try new things. - Open Source Roots – Built on community-driven values that shape how we work. - Empowered Teams – High trust, low ego culture that values outcomes over optics. - Career Growth Pathways – Defined opportunities to grow and develop your career. - Approachable Leadership – Transparent execs who are involved, visible, and human. - Passionate People – Join a team of smart, supportive folks who care deeply about what they do. - In-Person onboarding - We want you to thrive from day 1 with your fellow new ‘Grafanistas’ to learn all about what we do and how we do it. - Balance is Key - We operate a global annual leave policy of 30 days per annum. 3 days of your annual leave entitlement are reserved for Grafana Shutdown Days to allow the team to really disconnect. *We will comply with local legislation where applicable. Equal Opportunity Employer: Grafana Labs is an equal opportunities employer. We welcome applications from everyone regardless of race, colour, nationality, origin, caste, sex, gender reassignment identity or expression, sexual orientation, age, religion or belief, disability, veteran status, genetic information, pregnancy, maternity, marital, family or carer status, or any other characteristic which is protected by local law. We believe that equality and diversity build a strong organisation, and we work hard to ensure that is the foundation of our organisation as we grow. Grafana Labs may utilize AI tools in its recruitment process to assist in matching information provided in CVs to job postings. The recruitment team will continue to review inbound CVs manually to identify alignment with current openings. LI-Remote For information about how your personal data is used once you’ve applied to a job, check out our privacy policy .
Senior Software Engineer, Security Assurance | Swe...
Grafana Labs is the company behind Grafana Cloud, the fully managed observability platform trusted by more than 10,000 organizations to ensure reliability, resolve incidents faster, and optimize telemetry at scale. Built on open source and open standards and designed for interoperability across any stack, Grafana Cloud brings AI to observability and observability to AI, giving teams (and their agents) unified visibility so they can see, understand, and act on all their disparate data, wherever it lives, and move at the speed of their ambitions. Customers, including Anthropic, Bloomberg, NVIDIA, Microsoft, and Salesforce, rely on Grafana Labs. We are a 100% remote company with team members across 40+ countries, backed by leading investors including Lightspeed Venture Partners, Sequoia Capital, GIC, Coatue, J.P. Morgan, CapitalG, and Lead Edge Capital. Learn more at grafana.com and follow us on LinkedIn and X . We’re scaling fast and staying true to what makes us different: an open-source legacy, a global collaborative culture, and a passion for meaningful work. Our team thrives in an innovation-driven environment where transparency, autonomy, and trust fuel everything we do. You may not meet every requirement, and that’s okay. If this role excites you, we’d love you to raise your hand for what could be a truly career-defining opportunity. This is a remote position. We are looking for candidates in the UK, Ireland, Spain, Germany or Sweden. Senior Software Engineer - Security Assurances We are looking for a Senior Software Engineer, Security Assurance to join our GRC engineering team. We are building a security system that’s automated at scale, rigorously data-driven, and built from the ground up with defense-in-depth and self-healing in mind. We support a highly autonomous, remote-first, cloud-native organization. We are a technical team that can build any tool we need, while knowing when to buy to improve velocity. To support our growth and ambitious vision, we embrace agile principles and values, share openly, apply context-driven security mechanisms, default to action, and have an OSS-first mindset. We are a 100% remote company. We believe in high-velocity but sustainable expectations and timeframes, giving people the room to do great work. The Opportunity: You will work to build out our security observability, compliance, and control management systems and tools. You will develop services and tools to proactively defend our systems, provide visibility to our security state, and give engineers and stakeholders guardrails and paved roads to behave securely. You will collaborate across your team, the security department, and wider Grafana to write and deploy security policies across all of our SDLC, applications, and infrastructure. This is a very technical, hands-on keyboard software engineering, so development experience is critical. You will ideally have some experience building, implementing and improving the maturity of security programs in Cloud-based SaaS organizations. Knowledge of security standards and frameworks (ISO, FedRAMP, PCI-DSS, GDPR, etc) is useful, but the disposition to quickly learn new things is more important than rote knowledge. You will work alongside other security engineers, full-stack developers, and customer-facing teams. Experience guiding and negotiating with peers, stakeholders, customers, and auditors is a plus. What You’ll Be Doing: - Be a technical contributor on our GRC team covering a range of areas, including certifications, application, build, cloud, and supply chain security, and internal security tooling development - Develop, implement, and maintain highly automated security assurance programs to ensure compliance with organizational and regulatory requirements (e.g., ISO 27001, SOC 2, GDPR, NIST, PCI-DSS, TISAX, whatever else our customers eventually throw at us) - Develop systems, automations, and methods of security observability to push the GRC engineering organization beyond just meeting certification requirements - Deploy security and compliance checks in an employee-enabling way (guardrails and paved roads) in their daily workflows and build pipelines - Collaborate with cross-functional teams to integrate security controls into the software development lifecycle and operational processes. - Respond to customer security issues, security alerts, and potential incidents What Makes You a Great Fit: - Experience developing in a production environment with at least one programming language. We primarily use Go, TypeScript, and Python but most languages translate well. You will take a code screen and be expected to discuss programming principles such as algorithms, data structures, and optimization - Knowledge of using and securing containerized, cloud-native applications, ideally with Kubernetes. Experience with multiple cloud providers is a strong plus - Experience in automating security and compliance processes using tools, scripts, and frameworks while enabling developer and employee workflows - Strong interpersonal skills, as this position will require communication with peers, stakeholders, auditors, and customers - Understanding of industry-recognized security frameworks, standards, and certifications, such as ISO 27001, SOC 2, PCI DSS, NIST, or GDPR, and how to apply them without added operational burden. You can gain this by reading the standards documents and audit guidance - A degree in Computer Science, Information Security, or related field (or equivalent experience) Bonus Points For: - Working knowledge of Grafana Labs OSS projects and products. Experience in using observability tooling to solve security problems. - Experience working with OSS communities - Experience in using technical automations to prove infrastructure compliance - Experience securing large-scale distributed systems running in public clouds In Sweden, the base compensation range for this role is SEK 775,444 - SEK 930,533 . Actual compensation may vary based on level, experience, and skillset as assessed throughout the interview process. All of our roles include Restricted Stock Units (RSUs), giving every team member ownership in Grafana Labs' success. We believe in shared outcomes—RSUs help us stay aligned and invested as we scale globally. *Compensation ranges are country specific. If you are applying for this role from a different location than listed above, your recruiter will discuss your specific market’s defined pay range & benefits at the beginning of the process. Why You’ll Thrive at Grafana Labs: - 100% Remote, Global Culture - As a remote-only company, we bring together talent from around the world, united by a culture of collaboration and shared purpose. - Scaling Organization – Tackle meaningful work in a high-growth, ever-evolving environment. - Transparent Communication – Expect open decision-making and regular company-wide updates. - Innovation-Driven – Autonomy and support to ship great work and try new things. - Open Source Roots – Built on community-driven values that shape how we work. - Empowered Teams – High trust, low ego culture that values outcomes over optics. - Career Growth Pathways – Defined opportunities to grow and develop your career. - Approachable Leadership – Transparent execs who are involved, visible, and human. - Passionate People – Join a team of smart, supportive folks who care deeply about what they do. - In-Person onboarding - We want you to thrive from day 1 with your fellow new ‘Grafanistas’ to learn all about what we do and how we do it. - Balance is Key - We operate a global annual leave policy of 30 days per annum. 3 days of your annual leave entitlement are reserved for Grafana Shutdown Days to allow the team to really disconnect. *We will comply with local legislation where applicable. Equal Opportunity Employer: Grafana Labs is an equal opportunities employer. We welcome applications from everyone regardless of race, colour, nationality, origin, caste, sex, gender reassignment identity or expression, sexual orientation, age, religion or belief, disability, veteran status, genetic information, pregnancy, maternity, marital, family or carer status, or any other characteristic which is protected by local law. We believe that equality and diversity build a strong organisation, and we work hard to ensure that is the foundation of our organisation as we grow. Grafana Labs may utilize AI tools in its recruitment process to assist in matching information provided in CVs to job postings. The recruitment team will continue to review inbound CVs manually to identify alignment with current openings. LI-Remote For information about how your personal data is used once you’ve applied to a job, check out our privacy policy .
Senior Software Engineer, Security Assurance | Spa...
Grafana Labs is the company behind Grafana Cloud, the fully managed observability platform trusted by more than 10,000 organizations to ensure reliability, resolve incidents faster, and optimize telemetry at scale. Built on open source and open standards and designed for interoperability across any stack, Grafana Cloud brings AI to observability and observability to AI, giving teams (and their agents) unified visibility so they can see, understand, and act on all their disparate data, wherever it lives, and move at the speed of their ambitions. Customers, including Anthropic, Bloomberg, NVIDIA, Microsoft, and Salesforce, rely on Grafana Labs. We are a 100% remote company with team members across 40+ countries, backed by leading investors including Lightspeed Venture Partners, Sequoia Capital, GIC, Coatue, J.P. Morgan, CapitalG, and Lead Edge Capital. Learn more at grafana.com and follow us on LinkedIn and X . We’re scaling fast and staying true to what makes us different: an open-source legacy, a global collaborative culture, and a passion for meaningful work. Our team thrives in an innovation-driven environment where transparency, autonomy, and trust fuel everything we do. You may not meet every requirement, and that’s okay. If this role excites you, we’d love you to raise your hand for what could be a truly career-defining opportunity. This is a remote position. We are looking for candidates in the UK, Ireland, Spain, Germany or Sweden. Senior Software Engineer - Security Assurances We are looking for a Senior Software Engineer, Security Assurance to join our GRC engineering team. We are building a security system that’s automated at scale, rigorously data-driven, and built from the ground up with defense-in-depth and self-healing in mind. We support a highly autonomous, remote-first, cloud-native organization. We are a technical team that can build any tool we need, while knowing when to buy to improve velocity. To support our growth and ambitious vision, we embrace agile principles and values, share openly, apply context-driven security mechanisms, default to action, and have an OSS-first mindset. We are a 100% remote company. We believe in high-velocity but sustainable expectations and timeframes, giving people the room to do great work. The Opportunity: You will work to build out our security observability, compliance, and control management systems and tools. You will develop services and tools to proactively defend our systems, provide visibility to our security state, and give engineers and stakeholders guardrails and paved roads to behave securely. You will collaborate across your team, the security department, and wider Grafana to write and deploy security policies across all of our SDLC, applications, and infrastructure. This is a very technical, hands-on keyboard software engineering, so development experience is critical. You will ideally have some experience building, implementing and improving the maturity of security programs in Cloud-based SaaS organizations. Knowledge of security standards and frameworks (ISO, FedRAMP, PCI-DSS, GDPR, etc) is useful, but the disposition to quickly learn new things is more important than rote knowledge. You will work alongside other security engineers, full-stack developers, and customer-facing teams. Experience guiding and negotiating with peers, stakeholders, customers, and auditors is a plus. What You’ll Be Doing: - Be a technical contributor on our GRC team covering a range of areas, including certifications, application, build, cloud, and supply chain security, and internal security tooling development - Develop, implement, and maintain highly automated security assurance programs to ensure compliance with organizational and regulatory requirements (e.g., ISO 27001, SOC 2, GDPR, NIST, PCI-DSS, TISAX, whatever else our customers eventually throw at us) - Develop systems, automations, and methods of security observability to push the GRC engineering organization beyond just meeting certification requirements - Deploy security and compliance checks in an employee-enabling way (guardrails and paved roads) in their daily workflows and build pipelines - Collaborate with cross-functional teams to integrate security controls into the software development lifecycle and operational processes. - Respond to customer security issues, security alerts, and potential incidents What Makes You a Great Fit: - Experience developing in a production environment with at least one programming language. We primarily use Go, TypeScript, and Python but most languages translate well. You will take a code screen and be expected to discuss programming principles such as algorithms, data structures, and optimization - Knowledge of using and securing containerized, cloud-native applications, ideally with Kubernetes. Experience with multiple cloud providers is a strong plus - Experience in automating security and compliance processes using tools, scripts, and frameworks while enabling developer and employee workflows - Strong interpersonal skills, as this position will require communication with peers, stakeholders, auditors, and customers - Understanding of industry-recognized security frameworks, standards, and certifications, such as ISO 27001, SOC 2, PCI DSS, NIST, or GDPR, and how to apply them without added operational burden. You can gain this by reading the standards documents and audit guidance - A degree in Computer Science, Information Security, or related field (or equivalent experience) Bonus Points For: - Working knowledge of Grafana Labs OSS projects and products. Experience in using observability tooling to solve security problems. - Experience working with OSS communities - Experience in using technical automations to prove infrastructure compliance - Experience securing large-scale distributed systems running in public clouds In Ireland, the base compensation range for this role is € 82,988 - €99,586 . Actual compensation may vary based on level, experience, and skillset as assessed throughout the interview process. All of our roles include Restricted Stock Units (RSUs), giving every team member ownership in Grafana Labs' success. We believe in shared outcomes—RSUs help us stay aligned and invested as we scale globally. *Compensation ranges are country specific. If you are applying for this role from a different location than listed above, your recruiter will discuss your specific market’s defined pay range & benefits at the beginning of the process. Why You’ll Thrive at Grafana Labs: - 100% Remote, Global Culture - As a remote-only company, we bring together talent from around the world, united by a culture of collaboration and shared purpose. - Scaling Organization – Tackle meaningful work in a high-growth, ever-evolving environment. - Transparent Communication – Expect open decision-making and regular company-wide updates. - Innovation-Driven – Autonomy and support to ship great work and try new things. - Open Source Roots – Built on community-driven values that shape how we work. - Empowered Teams – High trust, low ego culture that values outcomes over optics. - Career Growth Pathways – Defined opportunities to grow and develop your career. - Approachable Leadership – Transparent execs who are involved, visible, and human. - Passionate People – Join a team of smart, supportive folks who care deeply about what they do. - In-Person onboarding - We want you to thrive from day 1 with your fellow new ‘Grafanistas’ to learn all about what we do and how we do it. - Balance is Key - We operate a global annual leave policy of 30 days per annum. 3 days of your annual leave entitlement are reserved for Grafana Shutdown Days to allow the team to really disconnect. *We will comply with local legislation where applicable. Equal Opportunity Employer: Grafana Labs is an equal opportunities employer. We welcome applications from everyone regardless of race, colour, nationality, origin, caste, sex, gender reassignment identity or expression, sexual orientation, age, religion or belief, disability, veteran status, genetic information, pregnancy, maternity, marital, family or carer status, or any other characteristic which is protected by local law. We believe that equality and diversity build a strong organisation, and we work hard to ensure that is the foundation of our organisation as we grow. Grafana Labs may utilize AI tools in its recruitment process to assist in matching information provided in CVs to job postings. The recruitment team will continue to review inbound CVs manually to identify alignment with current openings. LI-Remote For information about how your personal data is used once you’ve applied to a job, check out our privacy policy .
Senior Software Engineer, Security Assurance | Ire...
Grafana Labs is the company behind Grafana Cloud, the fully managed observability platform trusted by more than 10,000 organizations to ensure reliability, resolve incidents faster, and optimize telemetry at scale. Built on open source and open standards and designed for interoperability across any stack, Grafana Cloud brings AI to observability and observability to AI, giving teams (and their agents) unified visibility so they can see, understand, and act on all their disparate data, wherever it lives, and move at the speed of their ambitions. Customers, including Anthropic, Bloomberg, NVIDIA, Microsoft, and Salesforce, rely on Grafana Labs. We are a 100% remote company with team members across 40+ countries, backed by leading investors including Lightspeed Venture Partners, Sequoia Capital, GIC, Coatue, J.P. Morgan, CapitalG, and Lead Edge Capital. Learn more at grafana.com and follow us on LinkedIn and X . We’re scaling fast and staying true to what makes us different: an open-source legacy, a global collaborative culture, and a passion for meaningful work. Our team thrives in an innovation-driven environment where transparency, autonomy, and trust fuel everything we do. You may not meet every requirement, and that’s okay. If this role excites you, we’d love you to raise your hand for what could be a truly career-defining opportunity. This is a remote position. We are looking for candidates in the UK, Ireland, Spain, Germany or Sweden. Senior Software Engineer - Security Assurances We are looking for a Senior Software Engineer, Security Assurance to join our GRC engineering team. We are building a security system that’s automated at scale, rigorously data-driven, and built from the ground up with defense-in-depth and self-healing in mind. We support a highly autonomous, remote-first, cloud-native organization. We are a technical team that can build any tool we need, while knowing when to buy to improve velocity. To support our growth and ambitious vision, we embrace agile principles and values, share openly, apply context-driven security mechanisms, default to action, and have an OSS-first mindset. We are a 100% remote company. We believe in high-velocity but sustainable expectations and timeframes, giving people the room to do great work. The Opportunity: You will work to build out our security observability, compliance, and control management systems and tools. You will develop services and tools to proactively defend our systems, provide visibility to our security state, and give engineers and stakeholders guardrails and paved roads to behave securely. You will collaborate across your team, the security department, and wider Grafana to write and deploy security policies across all of our SDLC, applications, and infrastructure. This is a very technical, hands-on keyboard software engineering, so development experience is critical. You will ideally have some experience building, implementing and improving the maturity of security programs in Cloud-based SaaS organizations. Knowledge of security standards and frameworks (ISO, FedRAMP, PCI-DSS, GDPR, etc) is useful, but the disposition to quickly learn new things is more important than rote knowledge. You will work alongside other security engineers, full-stack developers, and customer-facing teams. Experience guiding and negotiating with peers, stakeholders, customers, and auditors is a plus. What You’ll Be Doing: - Be a technical contributor on our GRC team covering a range of areas, including certifications, application, build, cloud, and supply chain security, and internal security tooling development - Develop, implement, and maintain highly automated security assurance programs to ensure compliance with organizational and regulatory requirements (e.g., ISO 27001, SOC 2, GDPR, NIST, PCI-DSS, TISAX, whatever else our customers eventually throw at us) - Develop systems, automations, and methods of security observability to push the GRC engineering organization beyond just meeting certification requirements - Deploy security and compliance checks in an employee-enabling way (guardrails and paved roads) in their daily workflows and build pipelines - Collaborate with cross-functional teams to integrate security controls into the software development lifecycle and operational processes. - Respond to customer security issues, security alerts, and potential incidents What Makes You a Great Fit: - Experience developing in a production environment with at least one programming language. We primarily use Go, TypeScript, and Python but most languages translate well. You will take a code screen and be expected to discuss programming principles such as algorithms, data structures, and optimization - Knowledge of using and securing containerized, cloud-native applications, ideally with Kubernetes. Experience with multiple cloud providers is a strong plus - Experience in automating security and compliance processes using tools, scripts, and frameworks while enabling developer and employee workflows - Strong interpersonal skills, as this position will require communication with peers, stakeholders, auditors, and customers - Understanding of industry-recognized security frameworks, standards, and certifications, such as ISO 27001, SOC 2, PCI DSS, NIST, or GDPR, and how to apply them without added operational burden. You can gain this by reading the standards documents and audit guidance - A degree in Computer Science, Information Security, or related field (or equivalent experience) Bonus Points For: - Working knowledge of Grafana Labs OSS projects and products. Experience in using observability tooling to solve security problems. - Experience working with OSS communities - Experience in using technical automations to prove infrastructure compliance - Experience securing large-scale distributed systems running in public clouds In Ireland, the base compensation range for this role is € 104,000 - €124,800. Actual compensation may vary based on level, experience, and skillset as assessed throughout the interview process. All of our roles include Restricted Stock Units (RSUs), giving every team member ownership in Grafana Labs' success. We believe in shared outcomes—RSUs help us stay aligned and invested as we scale globally. *Compensation ranges are country specific. If you are applying for this role from a different location than listed above, your recruiter will discuss your specific market’s defined pay range & benefits at the beginning of the process. Why You’ll Thrive at Grafana Labs: - 100% Remote, Global Culture - As a remote-only company, we bring together talent from around the world, united by a culture of collaboration and shared purpose. - Scaling Organization – Tackle meaningful work in a high-growth, ever-evolving environment. - Transparent Communication – Expect open decision-making and regular company-wide updates. - Innovation-Driven – Autonomy and support to ship great work and try new things. - Open Source Roots – Built on community-driven values that shape how we work. - Empowered Teams – High trust, low ego culture that values outcomes over optics. - Career Growth Pathways – Defined opportunities to grow and develop your career. - Approachable Leadership – Transparent execs who are involved, visible, and human. - Passionate People – Join a team of smart, supportive folks who care deeply about what they do. - In-Person onboarding - We want you to thrive from day 1 with your fellow new ‘Grafanistas’ to learn all about what we do and how we do it. - Balance is Key - We operate a global annual leave policy of 30 days per annum. 3 days of your annual leave entitlement are reserved for Grafana Shutdown Days to allow the team to really disconnect. *We will comply with local legislation where applicable. Equal Opportunity Employer: Grafana Labs is an equal opportunities employer. We welcome applications from everyone regardless of race, colour, nationality, origin, caste, sex, gender reassignment identity or expression, sexual orientation, age, religion or belief, disability, veteran status, genetic information, pregnancy, maternity, marital, family or carer status, or any other characteristic which is protected by local law. We believe that equality and diversity build a strong organisation, and we work hard to ensure that is the foundation of our organisation as we grow. Grafana Labs may utilize AI tools in its recruitment process to assist in matching information provided in CVs to job postings. The recruitment team will continue to review inbound CVs manually to identify alignment with current openings. LI-Remote For information about how your personal data is used once you’ve applied to a job, check out our privacy policy .
Senior Software Engineer, Security Assurance | Ger...
Grafana Labs is the company behind Grafana Cloud, the fully managed observability platform trusted by more than 10,000 organizations to ensure reliability, resolve incidents faster, and optimize telemetry at scale. Built on open source and open standards and designed for interoperability across any stack, Grafana Cloud brings AI to observability and observability to AI, giving teams (and their agents) unified visibility so they can see, understand, and act on all their disparate data, wherever it lives, and move at the speed of their ambitions. Customers, including Anthropic, Bloomberg, NVIDIA, Microsoft, and Salesforce, rely on Grafana Labs. We are a 100% remote company with team members across 40+ countries, backed by leading investors including Lightspeed Venture Partners, Sequoia Capital, GIC, Coatue, J.P. Morgan, CapitalG, and Lead Edge Capital. Learn more at grafana.com and follow us on LinkedIn and X . We’re scaling fast and staying true to what makes us different: an open-source legacy, a global collaborative culture, and a passion for meaningful work. Our team thrives in an innovation-driven environment where transparency, autonomy, and trust fuel everything we do. You may not meet every requirement, and that’s okay. If this role excites you, we’d love you to raise your hand for what could be a truly career-defining opportunity. This is a remote position. We are looking for candidates in the UK, Ireland, Spain, Germany or Sweden. Senior Software Engineer - Security Assurances We are looking for a Senior Software Engineer, Security Assurance to join our GRC engineering team. We are building a security system that’s automated at scale, rigorously data-driven, and built from the ground up with defense-in-depth and self-healing in mind. We support a highly autonomous, remote-first, cloud-native organization. We are a technical team that can build any tool we need, while knowing when to buy to improve velocity. To support our growth and ambitious vision, we embrace agile principles and values, share openly, apply context-driven security mechanisms, default to action, and have an OSS-first mindset. We are a 100% remote company. We believe in high-velocity but sustainable expectations and timeframes, giving people the room to do great work. The Opportunity: You will work to build out our security observability, compliance, and control management systems and tools. You will develop services and tools to proactively defend our systems, provide visibility to our security state, and give engineers and stakeholders guardrails and paved roads to behave securely. You will collaborate across your team, the security department, and wider Grafana to write and deploy security policies across all of our SDLC, applications, and infrastructure. This is a very technical, hands-on keyboard software engineering, so development experience is critical. You will ideally have some experience building, implementing and improving the maturity of security programs in Cloud-based SaaS organizations. Knowledge of security standards and frameworks (ISO, FedRAMP, PCI-DSS, GDPR, etc) is useful, but the disposition to quickly learn new things is more important than rote knowledge. You will work alongside other security engineers, full-stack developers, and customer-facing teams. Experience guiding and negotiating with peers, stakeholders, customers, and auditors is a plus. What You’ll Be Doing: - Be a technical contributor on our GRC team covering a range of areas, including certifications, application, build, cloud, and supply chain security, and internal security tooling development - Develop, implement, and maintain highly automated security assurance programs to ensure compliance with organizational and regulatory requirements (e.g., ISO 27001, SOC 2, GDPR, NIST, PCI-DSS, TISAX, whatever else our customers eventually throw at us) - Develop systems, automations, and methods of security observability to push the GRC engineering organization beyond just meeting certification requirements - Deploy security and compliance checks in an employee-enabling way (guardrails and paved roads) in their daily workflows and build pipelines - Collaborate with cross-functional teams to integrate security controls into the software development lifecycle and operational processes. - Respond to customer security issues, security alerts, and potential incidents What Makes You a Great Fit: - Experience developing in a production environment with at least one programming language. We primarily use Go, TypeScript, and Python but most languages translate well. You will take a code screen and be expected to discuss programming principles such as algorithms, data structures, and optimization - Knowledge of using and securing containerized, cloud-native applications, ideally with Kubernetes. Experience with multiple cloud providers is a strong plus - Experience in automating security and compliance processes using tools, scripts, and frameworks while enabling developer and employee workflows - Strong interpersonal skills, as this position will require communication with peers, stakeholders, auditors, and customers - Understanding of industry-recognized security frameworks, standards, and certifications, such as ISO 27001, SOC 2, PCI DSS, NIST, or GDPR, and how to apply them without added operational burden. You can gain this by reading the standards documents and audit guidance - A degree in Computer Science, Information Security, or related field (or equivalent experience) Bonus Points For: - Working knowledge of Grafana Labs OSS projects and products. Experience in using observability tooling to solve security problems. - Experience working with OSS communities - Experience in using technical automations to prove infrastructure compliance - Experience securing large-scale distributed systems running in public clouds In Germany, the base compensation range for this role is € 97,034 - €116,441 . Actual compensation may vary based on level, experience, and skillset as assessed throughout the interview process. All of our roles include Restricted Stock Units (RSUs), giving every team member ownership in Grafana Labs' success. We believe in shared outcomes—RSUs help us stay aligned and invested as we scale globally. *Compensation ranges are country specific. If you are applying for this role from a different location than listed above, your recruiter will discuss your specific market’s defined pay range & benefits at the beginning of the process. Why You’ll Thrive at Grafana Labs: - 100% Remote, Global Culture - As a remote-only company, we bring together talent from around the world, united by a culture of collaboration and shared purpose. - Scaling Organization – Tackle meaningful work in a high-growth, ever-evolving environment. - Transparent Communication – Expect open decision-making and regular company-wide updates. - Innovation-Driven – Autonomy and support to ship great work and try new things. - Open Source Roots – Built on community-driven values that shape how we work. - Empowered Teams – High trust, low ego culture that values outcomes over optics. - Career Growth Pathways – Defined opportunities to grow and develop your career. - Approachable Leadership – Transparent execs who are involved, visible, and human. - Passionate People – Join a team of smart, supportive folks who care deeply about what they do. - In-Person onboarding - We want you to thrive from day 1 with your fellow new ‘Grafanistas’ to learn all about what we do and how we do it. - Balance is Key - We operate a global annual leave policy of 30 days per annum. 3 days of your annual leave entitlement are reserved for Grafana Shutdown Days to allow the team to really disconnect. *We will comply with local legislation where applicable. Equal Opportunity Employer: Grafana Labs is an equal opportunities employer. We welcome applications from everyone regardless of race, colour, nationality, origin, caste, sex, gender reassignment identity or expression, sexual orientation, age, religion or belief, disability, veteran status, genetic information, pregnancy, maternity, marital, family or carer status, or any other characteristic which is protected by local law. We believe that equality and diversity build a strong organisation, and we work hard to ensure that is the foundation of our organisation as we grow. Grafana Labs may utilize AI tools in its recruitment process to assist in matching information provided in CVs to job postings. The recruitment team will continue to review inbound CVs manually to identify alignment with current openings. LI-Remote For information about how your personal data is used once you’ve applied to a job, check out our privacy policy .
Senior Security Engineer - Platform Trust & Safety
About Datadog We're on a mission to build the best platform in the world for engineers to understand and scale their systems, applications, and teams. We operate at a high scale - trillions of data points per day — providing always-on alerting, metrics visualization, logs, and application tracing for tens of thousands of companies. Our engineering culture values pragmatism, honesty, and simplicity to solve hard problems the right way. The Opportunity User safety and platform integrity is critical to our business. Our customer’s success is our success. We’re looking for a Senior Security Engineer to join us in taking a proactive, highly scalable, and data-centric approach to enabling a safe and trustworthy experience for the users of our rapidly growing and increasingly interactive platform. You’ll fight against threats to our users, platform abuse, and other potentially risky and unwanted behaviors on our platform. Our team covers a broad range of trust and safety related topics including software engineering, data science, user engagement, privacy, threat detection, incident response, and bridging gaps between security and the broader Datadog business. You will bring expertise in a few of these areas. You’ll join a growing security team at an ideal time for making a big impact. Datadog is growing rapidly, and AI-assisted development is increasing both the pace of software delivery and the amount of activity generated by AI agents. The product is seeing very high growth, with the platform becoming more interactive and new products and features developed regularly. At Datadog, we place value in our office culture - the relationships and collaboration it builds, and the creativity it brings to the table. We operate as a hybrid workplace to ensure our Datadogs can create a work-life harmony that best fits them. What You’ll Do: - Have a direct impact on customers and their overall trust of our platform. - Drive the technical roadmap in collaboration with your team, product management, and other engineering teams to align our work with company-wide security objectives. - Mentor a team of 3+ software and security engineers, emphasizing engineering quality, resiliency, and delivery. - Develop user-friendly UI components that enable users to strengthen the security of their account. - Create metrics and measurements to better understand how users are interacting with our security-related features and controls. - Have an opportunity to work across the stack, implementing both front-end and back-end code. - Develop risk scoring algorithms to classify potentially risky behavior or activity on our platform. - Work in a highly collaborative role, often engaging with engineering teams beyond security. - Contribute to security operations efforts including threat detection and response. - Participate in Datadog’s incident response efforts. Who You Are: - Have 5+ years of software security engineering experience, especially on teams building platform and user security features. - An excellent communicator and collaborator, able to work effectively through complex technical problems with a diverse group of stakeholders. - Prior experience working with product and design teams to deliver front-end features. - Fluent in one or more modern coding languages (Python, Go, TypeScript, etc.). - Comfortable working in a fast paced, high growth environment. - Knowledgeable of abuse techniques in modern SaaS applications. Datadog values people from all walks of life. We understand not everyone will meet all the above qualifications on day one. That's okay. If you’re passionate about technology and want to grow your skills, we encourage you to apply. Benefits and Growth: - New hire stock equity (RSUs) and employee stock purchase plan (ESPP) - Continuous professional development, product training, and career pathing - Intradepartmental mentor and buddy program for in-house networking - An inclusive company culture, ability to join our Community Guilds (Datadog employee resource groups) - Free, global mental health benefits for employees and dependents age 6 Benefits and Growth listed above may vary based on the country of your employment and the nature of your employment with Datadog. Datadog offers a competitive salary and equity package, and may include variable compensation. Actual compensation is based on factors such as the candidate's skills, qualifications, and experience. In addition, Datadog offers a wide range of best in class, comprehensive and inclusive employee benefits for this role including healthcare, dental, parental planning, and mental health benefits, a 401(k) plan and match, paid time off, fitness reimbursements, and a discounted employee stock purchase plan. The reasonably estimated yearly salary for this role at Datadog is: $192,000 - $240,000 USD About Datadog: Datadog is the leading observability and security platform for the AI era, providing businesses with unified visibility across the technology stack to manage complexity at scale. It brings applications, infrastructure, data, models, and security into one place, using AI to detect and resolve issues before they impact customers. Trusted globally by Fortune 500 companies and high-growth AI leaders, Datadog enables businesses to move faster with clarity and confidence. Learn more about #DatadogLife on Instagram , LinkedIn, and Datadog Learning Center. Equal Opportunity at Datadog: Datadog is proud to offer equal employment opportunity to everyone regardless of race, color, ancestry, religion, sex, national origin, sexual orientation, age, citizenship, marital status, disability, gender identity, veteran status, and other characteristics protected by law. We also consider qualified applicants regardless of criminal histories, consistent with legal requirements. Here are our Candidate Legal Notices for your reference. Datadog endeavors to make our Careers Page accessible to all users. If you would like to contact us regarding the accessibility of our website or need assistance completing the application process, please complete this form . This form is for accommodation requests only and cannot be used to inquire about the status of applications. Privacy and AI Guidelines: Any information you submit to Datadog as part of your application will be processed in accordance with Datadog’s Applicant and Candidate Privacy Notice . For information on our AI policy, please visit Interviewing at Datadog AI Guidelines .
Senior Security Engineer, Security Incident Respon...
The Security Incident Response Team (SIRT) plays a vital role in keeping Datadog safe from cybersecurity threats, defending the organization against threat actors, and maintaining the trust of our customers by ensuring their data remains protected. In this role, you will work closely with teams across Datadog to identify, triage, and respond to a wide range of threats, ensuring that we can contain any incidents as quickly as possible. You will also contribute to the tools and systems that make us more effective in our mission, and help ensure we have cross-functional learning from incidents to improve our defensive posture going forward. At Datadog, we place value in our office culture - the relationships and collaboration it builds, and the creativity it brings to the table. We operate as a hybrid workplace to ensure our Datadogs can create a work-life harmony that best fits them. What You’ll Do: - Partner with our Cyber Threat Intelligence and Detection Engineering teams to identify threats to Datadog and ensure we have appropriate, accurate, high-signal detections for those threats. - Triage escalated alerts to determine whether a security incident is occurring or may occur imminently. - Respond to security incidents, whether as an incident commander or as an incident responder - Make us more efficient through building tools and automations that eliminate repetitive processes - Help us improve our overall security posture through post-incident reviews, tabletop and purple team exercises, and process/runbook improvements. - Participate in a light on-call rotation. Who You Are: - You have at least 5 years of experience in security incident response, threat hunting, security operations, cloud security, or other operational security domains. - You’ve worked with at least one public cloud platform (AWS, GCP, or Azure) and cloud-native technologies like Kubernetes, Docker, or Terraform. - You have a strong understanding of cloud-native threat actor TTPs and corresponding defensive controls and actively stay up to date with the threat landscape from various blogs, whitepapers, and conference talks. - You’ve used a wide range of technologies and datasets to detect threats in cloud and enterprise environments - You have experience building and supporting tools for incident response and forensic use cases using Python, Go, or similar programming languages. Datadog values people from all walks of life. We understand not everyone will meet all the above qualifications on day one. That's okay. If you’re passionate about technology and want to grow your skills, we encourage you to apply. Benefits and Growth: - Generous and competitive benefits package - New hire stock equity (RSUs) and employee stock purchase plan - Continuous career development and pathing opportunities - Employee-focused best in class onboarding - Internal mentor and cross-departmental buddy program - Friendly and inclusive workplace culture Benefits and Growth listed above may vary based on the country of your employment and the nature of your employment with Datadog. LI-Hybrid Datadog offers a competitive salary and equity package, and may include variable compensation. Actual compensation is based on factors such as the candidate's skills, qualifications, and experience. In addition, Datadog offers a wide range of best in class, comprehensive and inclusive employee benefits for this role including healthcare, dental, parental planning, and mental health benefits, a 401(k) plan and match, paid time off, fitness reimbursements, and a discounted employee stock purchase plan. The reasonably estimated yearly salary for this role at Datadog is: $192,000 - $240,000 USD About Datadog: Datadog is the leading observability and security platform for the AI era, providing businesses with unified visibility across the technology stack to manage complexity at scale. It brings applications, infrastructure, data, models, and security into one place, using AI to detect and resolve issues before they impact customers. Trusted globally by Fortune 500 companies and high-growth AI leaders, Datadog enables businesses to move faster with clarity and confidence. Learn more about #DatadogLife on Instagram , LinkedIn, and Datadog Learning Center. Equal Opportunity at Datadog: Datadog is proud to offer equal employment opportunity to everyone regardless of race, color, ancestry, religion, sex, national origin, sexual orientation, age, citizenship, marital status, disability, gender identity, veteran status, and other characteristics protected by law. We also consider qualified applicants regardless of criminal histories, consistent with legal requirements. Here are our Candidate Legal Notices for your reference. Datadog endeavors to make our Careers Page accessible to all users. If you would like to contact us regarding the accessibility of our website or need assistance completing the application process, please complete this form . This form is for accommodation requests only and cannot be used to inquire about the status of applications. Privacy and AI Guidelines: Any information you submit to Datadog as part of your application will be processed in accordance with Datadog’s Applicant and Candidate Privacy Notice . For information on our AI policy, please visit Interviewing at Datadog AI Guidelines .
Senior Security Engineer - SecOps
To learn the Hiring Ranges for this position, please select your location from the Apply Now dropdown menu. To learn more about our Hiring Range System, please click this link. Why Mozilla? Mozilla Corporation is the non-profit-backed technology company that has shaped the internet for the better over the last 25 years. We make pioneering brands like Firefox, the privacy-minded web browser. Now, with more than 225 million people around the world using our products each month, we’re shaping the next 25 years of technology and helping to reclaim an internet built for people, not companies. Our work focuses on diverse areas including AI, social media, security and more. And we’re doing this while never losing our focus on our core mission – to make the internet better for people. The Mozilla Corporation is wholly owned by the non-profit 501(c) Mozilla Foundation. This means we aren’t beholden to any shareholders — only to our mission. Along with thousands of volunteer contributors and collaborators all over the world, Mozillians design, build and distribute open-source software that enables people to enjoy the internet on their terms. About this team and role: Mozilla is looking for an Incident Responder to monitor and mitigate attacks across Mozilla’s products and services. In this position, you will be a part of a flexible team responsible for handling security incidents. As such, you’ll need to have years of practical security experience and knowledge of the state of the art for detecting and responding to attacks. You’ll be someone Mozillians across the company depend on and trust to respond quickly and effectively in a crunch, with the outstanding communication and collaboration skills needed to work in partnership with diverse stakeholders. Most importantly, you will become a critical member of the team responsible for ensuring the integrity of Mozilla’s products and for keeping Mozilla’s users safe, within a company dedicated to building a more secure internet. What you'll do: - Identify and respond to security incidents on a global scale. - Act as an incident commander to drive incidents through the entire response lifecycle. - Design and maintain a portfolio of security alerts, automated actions, playbooks and escalation workflows in support of a high-performing 24/7 incident response capability. - Conduct threat hunting activities, anticipate future threats, and maintain forward-thinking strategies for tools/technology/processes that combat sophisticated threat actors. - Research threat intelligence reports, triage and manage resulting workflows. - Partner with key stakeholders and communicate effectively to maintain a continuously improving feedback loop of preparation, identification, analysis, containment, and post mortem activities. - Participate in on-call rotation. What you'll bring: - 5+ years of demonstrated ability managing security incidents at a global scale and/or experience working in Security Operations Centers (SOC), Product Security Incident Response Teams (PSIRT), and Computer Security Incident Response Teams (CSIRT). - Expertise with security information and event management (SIEM) systems (eg. ELK, Google BigQuery, Splunk, etc.). Splunk proficiency is preferred. - Expertise with endpoint detection and investigation. Hands-on experience with leading EDR tools and demonstrated ability to leverage endpoint telemetry to find root cause. - Expertise with security orchestration and automation (SOAR) platforms such as Tines or Splunk SOAR. - Superb communication and leadership capacity; ability to partner effectively with diverse company stakeholders. - Real-world experience in software development and/or engineering operations for consumer products and services; B.S. in a technology-focused field is helpful. - Practical experience working with cloud technologies (eg. Google Cloud Platform, Amazon Web Services, Heroku, Microsoft Azure, etc.). Competencies: - Ownership and Accountability - Autonomy - High Level of Integrity - Clear Communication - Creative Problem Solver - Passionate about Security What you’ll get: - Generous performance-based bonus plans to all eligible employees - we share in our success as one team - Rich medical, dental, and vision coverage - Generous retirement contributions with 100% immediate vesting (regardless of whether you contribute) - Quarterly all-company wellness days where everyone takes a pause together - Country specific holidays plus a day off for your birthday - One-time home office stipend - Annual professional development budget - Quarterly well-being stipend - Considerable paid parental leave - Employee referral bonus program - Other benefits (life/AD&D, disability, EAP, etc. - varies by country) About Mozilla Mozilla exists to build the Internet as a public resource accessible to all because we believe that open and free is better than closed and controlled. When you work at Mozilla, you give yourself a chance to make a difference in the lives of Web users everywhere. And you give us a chance to make a difference in your life every single day. Join us to work on the Web as the platform and help create more opportunity and innovation for everyone online. Commitment to diversity, equity, inclusion, and belonging Mozilla understands that valuing diverse creative practices and forms of knowledge are crucial to and enrich the company’s core mission. We encourage applications from everyone, including members of all equity-seeking communities, such as (but certainly not limited to) women, racialized and Indigenous persons, persons with disabilities, persons of all sexual orientation s, gender identities, and expressions. We will ensure that qualified individuals with disabilities are provided reasonable accommodations to participate in the job application or interview process, to perform essential job functions, and to receive other benefits and privileges of employment, as appropriate. Please contact us at hiringaccommodation@mozilla.com to request accommodation. We are an equal opportunity employer. We do not discriminate on the basis of race (including hairstyle and texture), religion (including religious grooming and dress practices), gender, gender identity, gender expression, color, national origin, pregnancy, ancestry, domestic partner status, disability, sexual orientation, age, genetic predisposition, medical condition, marital status, citizenship status, military or veteran status, or any other basis covered by applicable laws. Mozilla will not tolerate discrimination or harassment based on any of these characteristics or any other unlawful behavior, conduct, or purpose. Group: D LI-DNI Req ID: R3224
Security Engineer, Applied Research & Labs
About Us At Cloudflare, we are on a mission to help build a better Internet. Today the company runs one of the world’s largest networks that powers millions of websites and other Internet properties for customers ranging from individual bloggers to SMBs to Fortune 500 companies. Cloudflare protects and accelerates any Internet application online without adding hardware, installing software, or changing a line of code. Internet properties powered by Cloudflare all have web traffic routed through its intelligent global network, which gets smarter with every request. As a result, they see significant improvement in performance and a decrease in spam and other attacks. Cloudflare was named to Entrepreneur Magazine’s Top Company Cultures list and ranked among the World’s Most Innovative Companies by Fast Company. At Cloudflare, we’re not looking for people who wait for a polished roadmap; we’re looking for the builders who see the cracks in the Internet that everyone else has simply learned to live with. We value candidates who have the instinct to spot a "normalized" problem and the AI-native curiosity to create a solution using the latest tools. Our culture is built on iteration, leveraging AI to ship faster today to make it better tomorrow, while ensuring that every improvement, no matter how small, is shared across the team to lift everyone up. If you’re the type of person who values curiosity over bureaucracy, and that AI is a partner in solving tough problems to keep the Internet moving forward, you’ll fit right in. Available Locations: Austin, TX What You'll Do Cloudflare is seeking a Security Engineer to design and build agentic security tooling for Cloudflare Security, and to release that work as open-source reference implementations, interactive labs, and technical workshops for customers and partners. This role sits in the Applied Research & Labs function within the Office of the CSO. You will work embedded with Cloudflare's security teams, build on Cloudflare's Developer Platform, and represent the team's security & engineering work externally. Security Tooling & Reference Implementations - Design and build agentic security workflows and tooling for Cloudflare Security, including multi-agent orchestration, tool integration, and evaluation harnesses - Release internal harnesses, skill definitions, and orchestration workflows as documented open-source reference implementations - Implement on Cloudflare Workers, Durable Objects, Workflows, Workers AI, AI Gateway, and the Agents SDK Labs & Workshops - Define the technical scope and sequencing of each lab, including the failure modes participants will hit and the scaffolding they need - Build and operate the lab infrastructure: per-participant isolation, automated provisioning, state reset, and teardown - Run hands-on workshops where customers and partners build and deploy the tooling themselves - Document and package workshop formats so other Cloudflare engineers can deliver them External Engagement - Present Cloudflare's agentic security architecture through customer briefings and conference talks - Author technical deep dives and architecture write-ups that establish Cloudflare Security as a recognized voice in the security community - Partner with Product and Engineering to align external technical content with the roadmap Required Qualifications - 4+ years in software engineering, shipping and operating production systems - Demonstrated experience building interactive labs, hands-on learning platforms, or developer training environments, including the infrastructure behind them - Strong design judgment for technical learning experiences, including scope, sequencing, and knowing what to leave out - Proficiency in TypeScript, Python, or a comparable language, with production experience in distributed or event-driven systems - Hands-on experience building LLM-based systems, including agent orchestration, tool use, context engineering, and evaluation - Experience with Cloudflare Workers, Durable Objects, Workflows, Workers AI, AI Gateway, and Vectorize, or an equivalent serverless stack - Working knowledge of application and infrastructure security, including common vulnerability classes and secure development practices - Published technical writing, conference talks, or open-source contributions Bonus Points - Hands-on security background in any domain - Experience with the Cloudflare Agents SDK - Experience with developer education, technical certification programs, or developer relations - Maintainer or significant contributor to an open-source security or developer tooling project - Experience speaking at security or developer conferences Location & Travel - Based in Austin, TX - 15-25% travel for customer workshops, conferences, and other Cloudflare offices - Occasional work outside standard hours to support sessions across EMEA and APAC time zones What Makes Cloudflare Special? We’re not just a highly ambitious, large-scale technology company. We’re a highly ambitious, large-scale technology company with a soul. Fundamental to our mission to help build a better Internet is protecting the free and open Internet. Project Galileo : Since 2014, we've equipped more than 2,400 journalism and civil society organizations in 111 countries with powerful tools to defend themselves against attacks that would otherwise censor their work, technology already used by Cloudflare’s enterprise customers--at no cost. Athenian Project : In 2017, we created the Athenian Project to ensure that state and local governments have the highest level of protection and reliability for free, so that their constituents have access to election information and voter registration. Since the project, we've provided services to more than 425 local government election websites in 33 states. 1.1.1.1 : We released 1.1.1.1 to help fix the foundation of the Internet by building a faster, more secure and privacy-centric public DNS resolver. This is available publicly for everyone to use - it is the first consumer-focused service Cloudflare has ever released. Here’s the deal - we don’t store client IP addresses never, ever. We will continue to abide by our privacy commitment and ensure that no user data is sold to advertisers or used to target consumers. Sound like something you’d like to be a part of? We’d love to hear from you! Please note that applicants who progress to the offer stage of the interview process may be asked to attend an in-person interview within one of the Cloudflare Offices or Cloudflare Hubs. More details about this will be available at that stage of the interview process. This position may require access to information protected under U.S. export control laws, including the U.S. Export Administration Regulations. Please note that any offer of employment may be conditioned on your authorization to receive software or technology controlled under these U.S. export laws without sponsorship for an export license. Cloudflare is proud to be an equal opportunity employer. We are committed to providing equal employment opportunity for all people and place great value in both diversity and inclusiveness. All qualified applicants will be considered for employment without regard to their, or any other person's, perceived or actual race, color, religion, sex, gender, gender identity, gender expression, sexual orientation, national origin, ancestry, citizenship, age, physical or mental disability, medical condition, family care status, or any other basis protected by law. We are an AA/Veterans/Disabled Employer. Cloudflare provides reasonable accommodations to qualified individuals with disabilities. Please tell us if you require a reasonable accommodation to apply for a job. Examples of reasonable accommodations include, but are not limited to, changing the application process, providing documents in an alternate format, using a sign language interpreter, or using specialized equipment. If you require a reasonable accommodation to apply for a job, please contact us via e-mail at hr@cloudflare.com or via mail at 101 Townsend St. San Francisco, CA 94107.
Senior Security Engineer - SecOps
Why Mozilla? Mozilla Corporation is the non-profit-backed technology company that has shaped the internet for the better over the last 25 years. We make pioneering brands like Firefox, the privacy-minded web browser. Now, with more than 225 million people around the world using our products each month, we’re shaping the next 25 years of technology and helping to reclaim an internet built for people, not companies. Our work focuses on diverse areas including AI, social media, security and more. And we’re doing this while never losing our focus on our core mission – to make the internet better for people. The Mozilla Corporation is wholly owned by the non-profit 501(c) Mozilla Foundation. This means we aren’t beholden to any shareholders — only to our mission. Along with thousands of volunteer contributors and collaborators all over the world, Mozillians design, build and distribute open-source software that enables people to enjoy the internet on their terms. About this team and role: Mozilla is looking for an Incident Responder to monitor and mitigate attacks across Mozilla’s products and services. In this position, you will be a part of a flexible team responsible for handling security incidents. As such, you’ll need to have years of practical security experience and knowledge of the state of the art for detecting and responding to attacks. You’ll be someone Mozillians across the company depend on and trust to respond quickly and effectively in a crunch, with the outstanding communication and collaboration skills needed to work in partnership with diverse stakeholders. Most importantly, you will become a critical member of the team responsible for ensuring the integrity of Mozilla’s products and for keeping Mozilla’s users safe, within a company dedicated to building a more secure internet. What you'll do: - Identify and respond to security incidents on a global scale. - Act as an incident commander to drive incidents through the entire response lifecycle. - Design and maintain a portfolio of security alerts, automated actions, playbooks and escalation workflows in support of a high-performing 24/7 incident response capability. - Conduct threat hunting activities, anticipate future threats, and maintain forward-thinking strategies for tools/technology/processes that combat sophisticated threat actors. - Research threat intelligence reports, triage and manage resulting workflows. - Partner with key stakeholders and communicate effectively to maintain a continuously improving feedback loop of preparation, identification, analysis, containment, and post mortem activities. - Participate in on-call rotation. What you'll bring: - 5+ years of demonstrated ability managing security incidents at a global scale and/or experience working in Security Operations Centers (SOC), Product Security Incident Response Teams (PSIRT), and Computer Security Incident Response Teams (CSIRT). - Expertise with security information and event management (SIEM) systems (eg. ELK, Google BigQuery, Splunk, etc.). Splunk proficiency is preferred. - Expertise with endpoint detection and investigation. Hands-on experience with leading EDR tools and demonstrated ability to leverage endpoint telemetry to find root cause. - Expertise with security orchestration and automation (SOAR) platforms such as Tines or Splunk SOAR. - Superb communication and leadership capacity; ability to partner effectively with diverse company stakeholders. - Real-world experience in software development and/or engineering operations for consumer products and services; B.S. in a technology-focused field is helpful. - Practical experience working with cloud technologies (eg. Google Cloud Platform, Amazon Web Services, Heroku, Microsoft Azure, etc.). Competencies: - Ownership and Accountability - Autonomy - High Level of Integrity - Clear Communication - Creative Problem Solver - Passionate about Security What you’ll get: - Generous performance-based bonus plans to all eligible employees - we share in our success as one team - Rich medical, dental, and vision coverage - Generous retirement contributions with 100% immediate vesting (regardless of whether you contribute) - Quarterly all-company wellness days where everyone takes a pause together - Country specific holidays plus a day off for your birthday - One-time home office stipend - Annual professional development budget - Quarterly well-being stipend - Considerable paid parental leave - Employee referral bonus program - Other benefits (life/AD&D, disability, EAP, etc. - varies by country) About Mozilla Mozilla exists to build the Internet as a public resource accessible to all because we believe that open and free is better than closed and controlled. When you work at Mozilla, you give yourself a chance to make a difference in the lives of Web users everywhere. And you give us a chance to make a difference in your life every single day. Join us to work on the Web as the platform and help create more opportunity and innovation for everyone online. Commitment to diversity, equity, inclusion, and belonging Mozilla understands that valuing diverse creative practices and forms of knowledge are crucial to and enrich the company’s core mission. We encourage applications from everyone, including members of all equity-seeking communities, such as (but certainly not limited to) women, racialized and Indigenous persons, persons with disabilities, persons of all sexual orientation s, gender identities, and expressions. We will ensure that qualified individuals with disabilities are provided reasonable accommodations to participate in the job application or interview process, to perform essential job functions, and to receive other benefits and privileges of employment, as appropriate. Please contact us at hiringaccommodation@mozilla.com to request accommodation. We are an equal opportunity employer. We do not discriminate on the basis of race (including hairstyle and texture), religion (including religious grooming and dress practices), gender, gender identity, gender expression, color, national origin, pregnancy, ancestry, domestic partner status, disability, sexual orientation, age, genetic predisposition, medical condition, marital status, citizenship status, military or veteran status, or any other basis covered by applicable laws. Mozilla will not tolerate discrimination or harassment based on any of these characteristics or any other unlawful behavior, conduct, or purpose. Group: D LI-REMOTE Req ID: R3224 Hiring Ranges: Remote Finland €45.000 - €60.000 EUR
Senior Certificate Authority Architect
About Us At Cloudflare, we are on a mission to help build a better Internet. Today the company runs one of the world’s largest networks that powers millions of websites and other Internet properties for customers ranging from individual bloggers to SMBs to Fortune 500 companies. Cloudflare protects and accelerates any Internet application online without adding hardware, installing software, or changing a line of code. Internet properties powered by Cloudflare all have web traffic routed through its intelligent global network, which gets smarter with every request. As a result, they see significant improvement in performance and a decrease in spam and other attacks. Cloudflare was named to Entrepreneur Magazine’s Top Company Cultures list and ranked among the World’s Most Innovative Companies by Fast Company. At Cloudflare, we’re not looking for people who wait for a polished roadmap; we’re looking for the builders who see the cracks in the Internet that everyone else has simply learned to live with. We value candidates who have the instinct to spot a "normalized" problem and the AI-native curiosity to create a solution using the latest tools. Our culture is built on iteration, leveraging AI to ship faster today to make it better tomorrow, while ensuring that every improvement, no matter how small, is shared across the team to lift everyone up. If you’re the type of person who values curiosity over bureaucracy, and that AI is a partner in solving tough problems to keep the Internet moving forward, you’ll fit right in. Cloudflare is building a new public Certificate Authority for the Internet. We are looking for a senior technical architect to help define the systems, protocols, and security architecture behind it. This role spans applied cryptography, Web PKI, distributed systems, security engineering, compliance, and Internet standards. It will help Cloudflare build a CA that operates safely at Internet scale while establishing a credible path from today's X.509 ecosystem toward post-quantum authentication using Merkle Tree Certificates (MTCs). Mission Define and guide the end-to-end architecture of Cloudflare's public Certificate Authority: a high-assurance, highly available system capable of issuing conventional publicly trusted certificates at Cloudflare scale while supporting Merkle Tree Certificates (MTCs) and the evolution toward a post-quantum Web PKI. You will help determine not only how the CA is implemented, but also its trust boundaries, key hierarchy, issuance architecture, auditability, failure modes, incident response mechanisms, and long-term cryptographic evolution. Key Responsibilities - Define and maintain the end-to-end technical architecture of Cloudflare's public CA across certificate issuance, key management, transparency, revocation, renewal, and relying-party integration. - Design root and intermediate CA trust hierarchies, signing systems, HSM integration, key ceremonies, key rotation, backup, recovery, migration, and key-compromise response. - Architect secure, resilient, and highly available issuance services capable of operating at Internet scale and across multiple geographic and failure domains. - Design certificate lifecycle systems around ACME, domain and IP validation, CAA, Certificate Transparency, pre-issuance linting, revocation, renewal, and large-scale certificate replacement. - Integrate Cloudflare’s MTC infrastructure, including CA logs, landmarks,, cosigning or mirroring, and interactions with relying parties. - Develop practical architectures for coexistence and migration between classical X.509 certificates and post-quantum authentication mechanisms. - Define trust boundaries, security properties, and threat models covering key compromise, unauthorized issuance, software supply-chain compromise, operator error, malicious insiders, infrastructure failure, split views, and cryptographic migration. - Design systems that make CA behavior observable and independently verifiable through transparency mechanisms, reproducible builds, cryptographic attestations, public operational telemetry, tamper-evident evidence, and audit controls. - Design failure containment and recovery mechanisms that support safe certificate replacement, revocation, key rotation, and incident response without creating avoidable Internet availability failures. - Translate CA/Browser Forum requirements, browser and operating-system root-program policies, audit criteria, and certification requirements into concrete technical and operational controls. - Review protocols, architecture, and implementations with an adversarial mindset, identifying assumptions and failure modes that do not hold at Internet scale. - Work closely with Cloudflare's cryptography, TLS, security, networking, infrastructure, compliance, product, and operations teams. - Provide architectural direction, design review, and technical mentorship to engineers implementing and operating the CA platform. - Represent Cloudflare in relevant standards and industry work, collaborating with browser vendors, root programs, researchers, auditors, CA operators, and the wider Web PKI community. What You'll Bring - Substantial experience designing or operating security-critical systems, with deep expertise in at least one of: public Certificate Authorities, Web PKI, applied cryptography, TLS and Internet security protocols, Certificate Transparency, hardware-backed key management, or large-scale distributed security systems. - Strong knowledge of certificate trust chains, issuance and validation, revocation, key lifecycle management, and the security and availability implications of CA design decisions. - Experience defining system trust boundaries, threat models, security invariants, and failure-handling strategies. - Ability to reason about systems in which a subtle architectural or operational mistake can affect a significant fraction of the Internet. - Experience leading architecture across multiple engineering teams without relying solely on organizational authority. - Strong written and verbal communication, including the ability to explain cryptographic and architectural tradeoffs to engineers, auditors, standards participants, and senior stakeholders. - Comfort operating with substantial autonomy in an evolving technical and policy environment. What Makes Cloudflare Special? We’re not just a highly ambitious, large-scale technology company. We’re a highly ambitious, large-scale technology company with a soul. Fundamental to our mission to help build a better Internet is protecting the free and open Internet. Project Galileo : Since 2014, we've equipped more than 2,400 journalism and civil society organizations in 111 countries with powerful tools to defend themselves against attacks that would otherwise censor their work, technology already used by Cloudflare’s enterprise customers--at no cost. Athenian Project : In 2017, we created the Athenian Project to ensure that state and local governments have the highest level of protection and reliability for free, so that their constituents have access to election information and voter registration. Since the project, we've provided services to more than 425 local government election websites in 33 states. 1.1.1.1 : We released 1.1.1.1 to help fix the foundation of the Internet by building a faster, more secure and privacy-centric public DNS resolver. This is available publicly for everyone to use - it is the first consumer-focused service Cloudflare has ever released. Here’s the deal - we don’t store client IP addresses never, ever. We will continue to abide by our privacy commitment and ensure that no user data is sold to advertisers or used to target consumers. Sound like something you’d like to be a part of? We’d love to hear from you! Please note that applicants who progress to the offer stage of the interview process may be asked to attend an in-person interview within one of the Cloudflare Offices or Cloudflare Hubs. More details about this will be available at that stage of the interview process. This position may require access to information protected under U.S. export control laws, including the U.S. Export Administration Regulations. Please note that any offer of employment may be conditioned on your authorization to receive software or technology controlled under these U.S. export laws without sponsorship for an export license. Cloudflare is proud to be an equal opportunity employer. We are committed to providing equal employment opportunity for all people and place great value in both diversity and inclusiveness. All qualified applicants will be considered for employment without regard to their, or any other person's, perceived or actual race, color, religion, sex, gender, gender identity, gender expression, sexual orientation, national origin, ancestry, citizenship, age, physical or mental disability, medical condition, family care status, or any other basis protected by law. We are an AA/Veterans/Disabled Employer. Cloudflare provides reasonable accommodations to qualified individuals with disabilities. Please tell us if you require a reasonable accommodation to apply for a job. Examples of reasonable accommodations include, but are not limited to, changing the application process, providing documents in an alternate format, using a sign language interpreter, or using specialized equipment. If you require a reasonable accommodation to apply for a job, please contact us via e-mail at hr@cloudflare.com or via mail at 101 Townsend St. San Francisco, CA 94107.
Senior Security Engineer - SecOps
Why Mozilla? Mozilla Corporation is the non-profit-backed technology company that has shaped the internet for the better over the last 25 years. We make pioneering brands like Firefox, the privacy-minded web browser. Now, with more than 225 million people around the world using our products each month, we’re shaping the next 25 years of technology and helping to reclaim an internet built for people, not companies. Our work focuses on diverse areas including AI, social media, security and more. And we’re doing this while never losing our focus on our core mission – to make the internet better for people. The Mozilla Corporation is wholly owned by the non-profit 501(c) Mozilla Foundation. This means we aren’t beholden to any shareholders — only to our mission. Along with thousands of volunteer contributors and collaborators all over the world, Mozillians design, build and distribute open-source software that enables people to enjoy the internet on their terms. About this team and role: Mozilla is looking for an Incident Responder to monitor and mitigate attacks across Mozilla’s products and services. In this position, you will be a part of a flexible team responsible for handling security incidents. As such, you’ll need to have years of practical security experience and knowledge of the state of the art for detecting and responding to attacks. You’ll be someone Mozillians across the company depend on and trust to respond quickly and effectively in a crunch, with the outstanding communication and collaboration skills needed to work in partnership with diverse stakeholders. Most importantly, you will become a critical member of the team responsible for ensuring the integrity of Mozilla’s products and for keeping Mozilla’s users safe, within a company dedicated to building a more secure internet. What you'll do: - Identify and respond to security incidents on a global scale. - Act as an incident commander to drive incidents through the entire response lifecycle. - Design and maintain a portfolio of security alerts, automated actions, playbooks and escalation workflows in support of a high-performing 24/7 incident response capability. - Conduct threat hunting activities, anticipate future threats, and maintain forward-thinking strategies for tools/technology/processes that combat sophisticated threat actors. - Research threat intelligence reports, triage and manage resulting workflows. - Partner with key stakeholders and communicate effectively to maintain a continuously improving feedback loop of preparation, identification, analysis, containment, and post mortem activities. - Participate in on-call rotation. What you'll bring: - 5+ years of demonstrated ability managing security incidents at a global scale and/or experience working in Security Operations Centers (SOC), Product Security Incident Response Teams (PSIRT), and Computer Security Incident Response Teams (CSIRT). - Expertise with security information and event management (SIEM) systems (eg. ELK, Google BigQuery, Splunk, etc.). Splunk proficiency is preferred. - Expertise with endpoint detection and investigation. Hands-on experience with leading EDR tools and demonstrated ability to leverage endpoint telemetry to find root cause. - Expertise with security orchestration and automation (SOAR) platforms such as Tines or Splunk SOAR. - Superb communication and leadership capacity; ability to partner effectively with diverse company stakeholders. - Real-world experience in software development and/or engineering operations for consumer products and services; B.S. in a technology-focused field is helpful. - Practical experience working with cloud technologies (eg. Google Cloud Platform, Amazon Web Services, Heroku, Microsoft Azure, etc.). Competencies: - Ownership and Accountability - Autonomy - High Level of Integrity - Clear Communication - Creative Problem Solver - Passionate about Security What you’ll get: - Generous performance-based bonus plans to all eligible employees - we share in our success as one team - Rich medical, dental, and vision coverage - Generous retirement contributions with 100% immediate vesting (regardless of whether you contribute) - Quarterly all-company wellness days where everyone takes a pause together - Country specific holidays plus a day off for your birthday - One-time home office stipend - Annual professional development budget - Quarterly well-being stipend - Considerable paid parental leave - Employee referral bonus program - Other benefits (life/AD&D, disability, EAP, etc. - varies by country) About Mozilla Mozilla exists to build the Internet as a public resource accessible to all because we believe that open and free is better than closed and controlled. When you work at Mozilla, you give yourself a chance to make a difference in the lives of Web users everywhere. And you give us a chance to make a difference in your life every single day. Join us to work on the Web as the platform and help create more opportunity and innovation for everyone online. Commitment to diversity, equity, inclusion, and belonging Mozilla understands that valuing diverse creative practices and forms of knowledge are crucial to and enrich the company’s core mission. We encourage applications from everyone, including members of all equity-seeking communities, such as (but certainly not limited to) women, racialized and Indigenous persons, persons with disabilities, persons of all sexual orientation s, gender identities, and expressions. We will ensure that qualified individuals with disabilities are provided reasonable accommodations to participate in the job application or interview process, to perform essential job functions, and to receive other benefits and privileges of employment, as appropriate. Please contact us at hiringaccommodation@mozilla.com to request accommodation. We are an equal opportunity employer. We do not discriminate on the basis of race (including hairstyle and texture), religion (including religious grooming and dress practices), gender, gender identity, gender expression, color, national origin, pregnancy, ancestry, domestic partner status, disability, sexual orientation, age, genetic predisposition, medical condition, marital status, citizenship status, military or veteran status, or any other basis covered by applicable laws. Mozilla will not tolerate discrimination or harassment based on any of these characteristics or any other unlawful behavior, conduct, or purpose. Group: D LI-REMOTE Req ID: R3224 Hiring Ranges: Remote Sweden 512 925 kr - 683 900 kr SEK
Security Engineer, New Grad
Who we are: About Stripe Stripe is a financial infrastructure platform for businesses. Millions of companies - from the world’s largest enterprises to the most ambitious startups - use Stripe to accept payments, grow their revenue, and accelerate new business opportunities. Our mission is to increase the GDP of the internet, and we have a staggering amount of work ahead. That means you have an unprecedented opportunity to put the global economy within everyone's reach while doing the most important work of your career. About the team Stripe offers an interesting middle ground between joining a small startup and going to work for a multinational company. We have systems and processes optimized for early-career professionals. You will be in an environment that prizes rigor, discipline, and reliability—from our products, from our ways of working, and from our colleagues. You will learn how the best teams put together extremely reliable systems, and you will be responsible for operating these systems, with adequate backup when things get tough. The Security organization is dedicated to building and maintaining a secure financial infrastructure platform. By joining this team, you will be on the front lines, engineering solutions that protect the sensitive data and systems underpinning a huge portion of the world's economy. You will contribute to core security functions like threat detection and rapid incident response, building and scaling the platforms that manage vulnerabilities, and proactively performing offensive security assessments to identify weaknesses before they can be exploited. This is a chance to apply software engineering principles and new technologies such as AI to solve complex, high-stakes security challenges, ultimately ensuring that Stripe's mission to increase the GDP of the internet is achieved securely. What you’ll do As a Security Engineer New Grad you will have the opportunity to work across various security disciplines and own projects from start to finish. Your work will focus on securing Stripe's complex environment by applying software engineering principles to security challenges. - You will learn and apply the principles of secure-by-default design by working closely with product and infrastructure engineering teams. - You'll develop a foundational understanding of various security domains, such as t hreat detection, incident response, vulnerability management, or offensive security. - You'll learn to act as a security subject matter exper t , tailoring answers to both engineers and non-engineers. - You'll contribute to the development of internal tools and automation to scale security efforts across Stripe. - You will participate in threat modeling discussions, learning to balance security requirements with product advancement and user experience. Responsibilities - Work on cross-functional projects, directly collaborating with other engineers - Give meaningful feedback on code reviews and technical designs - Contribute to our overall security posture by continuously improving security processes, tooling, and defenses. - Develop a deep understanding of Stripe’s security primitives, frameworks, and invariants. - Provide actionable insights to help identify, prevent, detect, and respond to anomalous or potentially malicious activity. Who you are: We’re looking for someone who meets the minimum requirements to be considered for the role. If you meet these requirements, you are encouraged to apply. The preferred qualifications are a bonus, not a requirement. Minimum requirements - Currently enrolled in a Bachelor’s or Master’s program in Computer Science or related field (graduating by Summer 2026) - Some experience and familiarity with programming, either through side projects or classwork. We work mostly in Java, Ruby, Python, JavaScript, Scala, and Go. We believe new programming languages can be learned if the fundamentals and general knowledge are present - Experience from either previous internships or working collaboratively on multi-person coding projects (in a university or professional setting) - Ability to learn unfamiliar systems and form an understanding of those systems, through independent research and working with a mentor and subject matter experts - Aptitude to think like an attacker and reason through different approaches to reducing security risk. Preferred qualifications - Experience in code review practices, and an understanding of how to safely update production systems - Familiarity with navigating and managing work in large code bases - Prior experience or course work in cyber security, digital forensics, or incident response (e.g., through log analysis or capture-the-flag events). - Familiarity with foundational security concepts such as the OWASP Top 10 web application vulnerabilities. - Basic knowledge of SQL or experience analyzing medium to large data sets. - Exposure to cloud computing platforms such as AWS, Azure, or Google Cloud Platform. - An adversarial mindset, understanding the goals, behaviors, and TTPs (tactics, techniques, and procedures) of threat actors.
Senior Security Engineer - SecOps
Why Mozilla? Mozilla Corporation is the non-profit-backed technology company that has shaped the internet for the better over the last 25 years. We make pioneering brands like Firefox, the privacy-minded web browser. Now, with more than 225 million people around the world using our products each month, we’re shaping the next 25 years of technology and helping to reclaim an internet built for people, not companies. Our work focuses on diverse areas including AI, social media, security and more. And we’re doing this while never losing our focus on our core mission – to make the internet better for people. The Mozilla Corporation is wholly owned by the non-profit 501(c) Mozilla Foundation. This means we aren’t beholden to any shareholders — only to our mission. Along with thousands of volunteer contributors and collaborators all over the world, Mozillians design, build and distribute open-source software that enables people to enjoy the internet on their terms. About this team and role: Mozilla is looking for an Incident Responder to monitor and mitigate attacks across Mozilla’s products and services. In this position, you will be a part of a flexible team responsible for handling security incidents. As such, you’ll need to have years of practical security experience and knowledge of the state of the art for detecting and responding to attacks. You’ll be someone Mozillians across the company depend on and trust to respond quickly and effectively in a crunch, with the outstanding communication and collaboration skills needed to work in partnership with diverse stakeholders. Most importantly, you will become a critical member of the team responsible for ensuring the integrity of Mozilla’s products and for keeping Mozilla’s users safe, within a company dedicated to building a more secure internet. What you'll do: - Identify and respond to security incidents on a global scale. - Act as an incident commander to drive incidents through the entire response lifecycle. - Design and maintain a portfolio of security alerts, automated actions, playbooks and escalation workflows in support of a high-performing 24/7 incident response capability. - Conduct threat hunting activities, anticipate future threats, and maintain forward-thinking strategies for tools/technology/processes that combat sophisticated threat actors. - Research threat intelligence reports, triage and manage resulting workflows. - Partner with key stakeholders and communicate effectively to maintain a continuously improving feedback loop of preparation, identification, analysis, containment, and post mortem activities. - Participate in on-call rotation. What you'll bring: - 5+ years of demonstrated ability managing security incidents at a global scale and/or experience working in Security Operations Centers (SOC), Product Security Incident Response Teams (PSIRT), and Computer Security Incident Response Teams (CSIRT). - Expertise with security information and event management (SIEM) systems (eg. ELK, Google BigQuery, Splunk, etc.). Splunk proficiency is preferred. - Expertise with endpoint detection and investigation. Hands-on experience with leading EDR tools and demonstrated ability to leverage endpoint telemetry to find root cause. - Expertise with security orchestration and automation (SOAR) platforms such as Tines or Splunk SOAR. - Superb communication and leadership capacity; ability to partner effectively with diverse company stakeholders. - Real-world experience in software development and/or engineering operations for consumer products and services; B.S. in a technology-focused field is helpful. - Practical experience working with cloud technologies (eg. Google Cloud Platform, Amazon Web Services, Heroku, Microsoft Azure, etc.). Competencies: - Ownership and Accountability - Autonomy - High Level of Integrity - Clear Communication - Creative Problem Solver - Passionate about Security What you’ll get: - Generous performance-based bonus plans to all eligible employees - we share in our success as one team - Rich medical, dental, and vision coverage - Generous retirement contributions with 100% immediate vesting (regardless of whether you contribute) - Quarterly all-company wellness days where everyone takes a pause together - Country specific holidays plus a day off for your birthday - One-time home office stipend - Annual professional development budget - Quarterly well-being stipend - Considerable paid parental leave - Employee referral bonus program - Other benefits (life/AD&D, disability, EAP, etc. - varies by country) About Mozilla Mozilla exists to build the Internet as a public resource accessible to all because we believe that open and free is better than closed and controlled. When you work at Mozilla, you give yourself a chance to make a difference in the lives of Web users everywhere. And you give us a chance to make a difference in your life every single day. Join us to work on the Web as the platform and help create more opportunity and innovation for everyone online. Commitment to diversity, equity, inclusion, and belonging Mozilla understands that valuing diverse creative practices and forms of knowledge are crucial to and enrich the company’s core mission. We encourage applications from everyone, including members of all equity-seeking communities, such as (but certainly not limited to) women, racialized and Indigenous persons, persons with disabilities, persons of all sexual orientation s, gender identities, and expressions. We will ensure that qualified individuals with disabilities are provided reasonable accommodations to participate in the job application or interview process, to perform essential job functions, and to receive other benefits and privileges of employment, as appropriate. Please contact us at hiringaccommodation@mozilla.com to request accommodation. We are an equal opportunity employer. We do not discriminate on the basis of race (including hairstyle and texture), religion (including religious grooming and dress practices), gender, gender identity, gender expression, color, national origin, pregnancy, ancestry, domestic partner status, disability, sexual orientation, age, genetic predisposition, medical condition, marital status, citizenship status, military or veteran status, or any other basis covered by applicable laws. Mozilla will not tolerate discrimination or harassment based on any of these characteristics or any other unlawful behavior, conduct, or purpose. Group: D LI-REMOTE Req ID: R3224 Hiring Ranges: Remote UK £66,000 - £87,000 GBP
Senior Security Engineer - Detection Engineering
Fastly helps people stay better connected with the things they love. Fastly’s edge cloud platform enables customers to create great digital experiences quickly, securely, and reliably by processing, serving, and securing our customers’ applications as close to their end-users as possible — at the edge of the Internet. The platform is designed to take advantage of the modern internet, to be programmable, and to support agile software development. Fastly’s customers include many of the world’s most prominent companies, including GitHub, Yelp, Paramount, and JetBlue. We're building a more trustworthy Internet. Come join us. Posting Open Date: October 6, 2026 Anticipated Posting Close Date*: December 6, 2026 *Job posting may close early due to the volume of applicants. Senior Security Engineer, Detection Engineering As a Senior Security Engineer on our Detection Engineering team, you will build the detections that catch malicious activity across the Fastly environment and drive the investigations that follow. We are looking for a teammate with a strong security engineering foundation and hands-on experience in security incident response, detection development, and applying AI to security operations. In this role, you will design and build AI agents and automations to support detection and response, develop advanced detections, perform threat hunts, and lead security investigations. What You'll Do: - Develop detections and other analytics to identify threats across cloud, container, corporate, and edge environments. - Lead security investigations, analyzing complex log sources and telemetry to determine root cause. - Build AI agents and automations that speed up detection development, triage, and incident response. - Research, evaluate, implement, and maintain a variety of custom and commercial security tools, such as EDR, SOAR, and SIEM. - Conduct threat hunts to discover unknown malicious activity across our environment. - Participate in our on-call rotations. What We're Looking For: - Direct experience integrating AI tools, LLMs, and automated agents into security operations workflows to accelerate alert triage, contextualize telemetry, and speed up incident response. - Experience developing, testing, and tuning detections using a detections-as-code approach, including version control and CI/CD. - Proven track record of leading complex security incident investigations, with deep expertise in log analysis, real-time containment, and collecting forensic artifacts. - Strong coding skills in Python or another general-purpose language, with experience building automations for detection and response. - In-depth knowledge of major public cloud platforms (e.g., AWS or GCP) and Linux environments, including containers (e.g., Kubernetes), along with their native logging and security tooling. - Solid grasp of attacker tactics and techniques, with experience in threat hunting or threat modeling to guide detection priorities. We’ll be super impressed if you have experience in any of these: - Familiarity with content delivery networks (CDN), edge cloud platforms, or Fastly products and services. - Experience designing and maintaining scalable ETL processes and data pipelines to ingest, transform, and normalize security telemetry for large-scale analysis. - Experience deploying AI agents in production to detect threats, enrich alerts, and automate response. Work Hours: - This position will require you to be available during core business hours and support an on-call rotation. Work Location(s) & Travel Requirements: The preferred locations for this position are: - New York, NY - San Francisco, CA - Denver, CO Fastly currently embraces a largely hybrid model for most roles which allows employees flexibility to split their time between the office and home. There is a strong preference for Hybrid near a local office. However, we may be willing to consider remote candidates within the US. This position may require travel as required by your role or requested by your manager. SF / LA Fair Chance Ordinance Statement Pursuant to the San Francisco Fair Chance Ordinance and the Los Angeles Fair Chance Initiative for Hiring Ordinance, we will consider for employment qualified applicants with arrest and conviction records. Salary: The estimated salary range for this position is $167,790 to $201,348. Starting salary may vary based on permissible, non-discriminatory factors such as experience, skills, qualifications, and location. This role may be eligible to participate in Fastly’s equity and discretionary bonus programs. Benefits: We care about you. Fastly works hard to create a positive environment for our employees, and we think your life outside of work is important too. We support our teams with great benefits that start on the first day of your employment with Fastly. Curious about our offerings? We offer a comprehensive benefits package including medical, dental, and vision insurance. Family planning, mental health support along with Employee Assistance Program, Insurance (Life, Disability, and Accident), a Flexible Vacation policy and up to 18 days of accrued paid sick leave are there to help support our employees. We also offer 401(k) (including company match) and an Employee Stock Purchase Program. For 2026, we offer 12 paid local holidays, 12 paid company wellness days. Why Fastly? - We have a huge impact. Fastly is a small company with a big reach. Not only do our customers have a tremendous user base, but we also support a growing number of open source projects and initiatives . Outside of code, employees are encouraged to share causes close to their heart with others so we can help lend a supportive hand. - We value diversity. Growing and maintaining our inclusive and diverse team matters to us. We are committed to being a company where our employees feel comfortable bringing their authentic selves to work and have the ability to be successful -- every day. - We are passionate. Fastly is chock full of passionate people and we’re not ‘one size fits all’. Fastly employs authors, pilots, skiers, parents (of humans and animals), makeup geeks, coffee connoisseurs, and more. We love employees for who they are and what they are passionate about. We’re always looking for humble, sharp, and creative folks to join the Fastly team. If you think you might be a fit please apply! A fully completed application and resume or CV are required when applying. All job applications must be submitted through our official careers site at www.fastly.com/about/careers . We will never request sensitive information, such as your Social Security number, bank account or credit card information during the application process. All official communication will come from an @ fastly.com or @ recruiting.fastly.com email address. Fastly is committed to ensuring equal employment opportunity and to providing employees with a safe and welcoming work environment free of discrimination and harassment. Our employment decisions are based on business needs, job requirements and individual qualifications. All qualified applicants will receive consideration for employment without regard to age, ancestry, color, family or medical care leave, gender identity or expression, genetic information, marital status, medical condition, national origin, family or parental status, physical or mental disability, political affiliation, protected veteran status, race, religion, sex (including pregnancy), sexual orientation, or any other characteristic protected by applicable laws, regulations and ordinances. Consistent with the Americans with Disabilities Act (ADA) and federal or state disability laws, Fastly will provide reasonable accommodations for applicants and employees with disabilities. If reasonable accommodation is needed to participate in the job application or interview process, to perform essential job functions, and/or to receive other benefits and privileges of employment, please contact your Recruiter, or the Fastly Employee Relations team at candidateaccommodations@fastly.com or 501-287-4901. Fastly collects and processes personal data submitted by job applicants in accordance with our Privacy Policy . Please see our privacy notice for job applicants .
Senior Staff Security Engineer, Security Operation...
Join us in building the future of finance. Our mission is to democratize finance for all. An estimated $124 trillion of assets will be inherited by younger generations in the next two decades. The largest transfer of wealth in human history. If you’re ready to be at the epicenter of this historic cultural and financial shift, keep reading. About the team + role At Robinhood, we believe in the power of in-person work to accelerate progress, spark innovation, and strengthen community. Our office experience is intentional, energizing, and designed to fully support high-performing teams. We are building an elite team, applying frontier technologies to the world's biggest financial problems. We're looking for bold thinkers. Sharp problem-solvers. Builders who are wired to make an impact. Robinhood isn't a place for complacency, it's where ambitious people do the best work of their careers. We're a high-performing, fast-moving team with ethics at the center of everything we do. Expectations are high, and so are the rewards. Robinhood's Security Operations team operates across two distinct disciplines: proactive security — finding threats and vulnerabilities before attackers do — and reactive security — detecting, investigating, and evicting threat actors in real time. Together, these functions form a complete picture of what it takes to protect one of the most active financial platforms in the world. The team operates in an environment of genuine complexity: high-volume security events, sophisticated threat actors, and a constant arms race against adversaries who are increasingly leveraging AI to move faster and go deeper. The threat landscape is changing. AI-powered attackers don't move like traditional adversaries — they are faster, more adaptive, and harder to track with static defenses. Robinhood's approach to this isn't passive. We are building dynamic, intelligent defensive systems designed to detect, deceive, and outmaneuver agentic attackers — and we need a Senior Staff Security Engineer to help us build them. As a Senior Staff Security Engineer, Security Operations , you will operate at the intersection of operational security tradecraft and cutting-edge AI-driven defense. You will bring deep expertise across both the offensive and defensive sides of security operations and you will push the boundaries of what's possible when those disciplines are combined with modern AI tooling. This is a 0→1 technical leadership role for someone who doesn't just follow the security playbook, but looks to rewrite it. This role is based in our Menlo Park, New York City, or Bellevue office, with in-person attendance expected at least 3 days per week. At Robinhood, we believe in the power of in-person work to accelerate progress, spark innovation, and strengthen community. Our office experience is intentional, energizing, and designed to fully support high-performing teams. What you’ll do - Serve as the Security Operations AI Tech Lead for Robinhood's offensive and defensive security functions — Owning the technical creation and execution of Robinhood’s Security OperationsAI roadmap for defensive and offensive operations - Lead offensive security research— applying deep red team, penetration testing, and application security expertise to proactively identify and close critical attack surfaces before adversaries find them - Architect and build next-generation defensive capabilities that go beyond static detection — designing intelligent systems that actively engage, deceive, and track sophisticated threat actors including AI-powered attackers - Drive Robinhood's AI-forward security strategy — not just using AI as a productivity tool, but as a core architectural component of how we build a synthetic workforce to scale against agentic and automated adversaries - Identify emerging threat actor motivations and attack patterns especially in the AI space, translating intelligence into proactive defensive architectures that stay ahead of the threat curve - Set technical standards and mentor security engineers within Security Operations, elevating the overall capability of the org What you bring - 12+ years of security engineering experience with demonstrated depth across both offensive security (red team, penetration testing, application security, vulnerability management) and defensive security (incident response, detection engineering, threat intelligence) - Demonstrate impact by innovating with AI in Security Operations — You’ve moved orgs well beyond the chatbot experience and implemented measurable success in uplifting Security Operations with AI. - Proven track record of technical leadership at the Senior Staff, Principal, or Distinguished level — you've set org-wide or company-wide security direction, not just executed within a team - Deep expertise in application security — you understand how modern software is built and where it breaks, and you can operate equally well as a security engineer and a software engineer - Strong background in threat detection and security operations — you understand how attackers operate and how to build systems that catch them faster - A genuine, informed point of view on AI in the security domain — you're not using AI to write scripts, you're thinking about how AI fundamentally changes both the attack surface and the defensive toolkit - Proficiency with cloud infrastructure security (AWS preferred), telemetry and observability tooling, and the technical underpinnings of large-scale detection pipelines - Exceptional technical communication skills — you can write, brief, and influence at the executive level as well as go deep with engineers on implementation details - Security certifications (OSCP, GREM, GXPN, or equivalent) are a plus — but demonstrated capability will always outweigh paper credentials here What we offer - Challenging, high-impact work to grow your career. - Performance driven compensation with multipliers for outsized impact, bonus programs, equity ownership, and 401(k) matching. - Top Tier benefits to fuel your work, including 100% paid health insurance for employees with 90% coverage for dependents. - Access to the Robinhood Employee Fund that gives eligible US employees the opportunity to invest in a private employee fund that provides exposure to Robinhood Ventures funds. - Access to the best AI tools on the market and continuous AI skill-building for every employee, technical or not. - Lifestyle wallet - a highly flexible benefits spending account for wellness, learning, and more. - Employer-paid life & disability insurance, fertility benefits, and mental health benefits. - Time off to recharge including company holidays, paid time off, sick time, parental leave, and more! - Exceptional office experience with catered meals, events, and comfortable workspaces. In addition to the base pay range listed below, this role is also eligible for bonus opportunities + equity + benefits. Base pay for the successful applicant will depend on a variety of job-related factors, which may include education, training, experience, location, business needs, or market demands. The expected base pay range for this role is based on the location where the work will be performed and is aligned to one of 3 compensation zones. For other locations not listed, compensation can be discussed with your recruiter during the interview process. Base Pay Range: Zone 1 (Menlo Park, CA; New York, NY; Bellevue, WA; Washington, DC) $247,000 - $290,000 USD Zone 2 (Denver, CO; Westlake, TX; Chicago, IL) $247,000 - $290,000 USD Zone 3 (Lake Mary, FL; Clearwater, FL; Gainesville, FL) $247,000 - $290,000 USD Click here to learn more about our Total Rewards, which vary by region and entity. If our mission energizes you and you’re ready to build the future of finance, we look forward to seeing your application. AI Usage Disclosure: Robinhood uses artificial intelligence (AI) tools to support parts of our recruiting process. These tools enhance the efficiency and consistency of our hiring process; however, all hiring decisions are made by our hiring teams. Robinhood provides equal opportunity for all applicants, offers reasonable accommodations upon request, and complies with applicable equal employment and privacy laws. Inclusion is built into how we hire and work—welcoming different backgrounds, perspectives, and experiences so everyone can do their best. Please review the Privacy Policy for your country of application.
Senior Security Engineer - SecOps
Why Mozilla? Mozilla Corporation is the non-profit-backed technology company that has shaped the internet for the better over the last 25 years. We make pioneering brands like Firefox, the privacy-minded web browser. Now, with more than 225 million people around the world using our products each month, we’re shaping the next 25 years of technology and helping to reclaim an internet built for people, not companies. Our work focuses on diverse areas including AI, social media, security and more. And we’re doing this while never losing our focus on our core mission – to make the internet better for people. The Mozilla Corporation is wholly owned by the non-profit 501(c) Mozilla Foundation. This means we aren’t beholden to any shareholders — only to our mission. Along with thousands of volunteer contributors and collaborators all over the world, Mozillians design, build and distribute open-source software that enables people to enjoy the internet on their terms. About this team and role: Mozilla is looking for an Incident Responder to monitor and mitigate attacks across Mozilla’s products and services. In this position, you will be a part of a flexible team responsible for handling security incidents. As such, you’ll need to have years of practical security experience and knowledge of the state of the art for detecting and responding to attacks. You’ll be someone Mozillians across the company depend on and trust to respond quickly and effectively in a crunch, with the outstanding communication and collaboration skills needed to work in partnership with diverse stakeholders. Most importantly, you will become a critical member of the team responsible for ensuring the integrity of Mozilla’s products and for keeping Mozilla’s users safe, within a company dedicated to building a more secure internet. What you'll do: - Identify and respond to security incidents on a global scale. - Act as an incident commander to drive incidents through the entire response lifecycle. - Design and maintain a portfolio of security alerts, automated actions, playbooks and escalation workflows in support of a high-performing 24/7 incident response capability. - Conduct threat hunting activities, anticipate future threats, and maintain forward-thinking strategies for tools/technology/processes that combat sophisticated threat actors. - Research threat intelligence reports, triage and manage resulting workflows. - Partner with key stakeholders and communicate effectively to maintain a continuously improving feedback loop of preparation, identification, analysis, containment, and post mortem activities. - Participate in on-call rotation. What you'll bring: - 5+ years of demonstrated ability managing security incidents at a global scale and/or experience working in Security Operations Centers (SOC), Product Security Incident Response Teams (PSIRT), and Computer Security Incident Response Teams (CSIRT). - Expertise with security information and event management (SIEM) systems (eg. ELK, Google BigQuery, Splunk, etc.). Splunk proficiency is preferred. - Expertise with endpoint detection and investigation. Hands-on experience with leading EDR tools and demonstrated ability to leverage endpoint telemetry to find root cause. - Expertise with security orchestration and automation (SOAR) platforms such as Tines or Splunk SOAR. - Superb communication and leadership capacity; ability to partner effectively with diverse company stakeholders. - Real-world experience in software development and/or engineering operations for consumer products and services; B.S. in a technology-focused field is helpful. - Practical experience working with cloud technologies (eg. Google Cloud Platform, Amazon Web Services, Heroku, Microsoft Azure, etc.). Competencies: - Ownership and Accountability - Autonomy - High Level of Integrity - Clear Communication - Creative Problem Solver - Passionate about Security What you’ll get: - Generous performance-based bonus plans to all eligible employees - we share in our success as one team - Rich medical, dental, and vision coverage - Generous retirement contributions with 100% immediate vesting (regardless of whether you contribute) - Quarterly all-company wellness days where everyone takes a pause together - Country specific holidays plus a day off for your birthday - One-time home office stipend - Annual professional development budget - Quarterly well-being stipend - Considerable paid parental leave - Employee referral bonus program - Other benefits (life/AD&D, disability, EAP, etc. - varies by country) About Mozilla Mozilla exists to build the Internet as a public resource accessible to all because we believe that open and free is better than closed and controlled. When you work at Mozilla, you give yourself a chance to make a difference in the lives of Web users everywhere. And you give us a chance to make a difference in your life every single day. Join us to work on the Web as the platform and help create more opportunity and innovation for everyone online. Commitment to diversity, equity, inclusion, and belonging Mozilla understands that valuing diverse creative practices and forms of knowledge are crucial to and enrich the company’s core mission. We encourage applications from everyone, including members of all equity-seeking communities, such as (but certainly not limited to) women, racialized and Indigenous persons, persons with disabilities, persons of all sexual orientation s, gender identities, and expressions. We will ensure that qualified individuals with disabilities are provided reasonable accommodations to participate in the job application or interview process, to perform essential job functions, and to receive other benefits and privileges of employment, as appropriate. Please contact us at hiringaccommodation@mozilla.com to request accommodation. We are an equal opportunity employer. We do not discriminate on the basis of race (including hairstyle and texture), religion (including religious grooming and dress practices), gender, gender identity, gender expression, color, national origin, pregnancy, ancestry, domestic partner status, disability, sexual orientation, age, genetic predisposition, medical condition, marital status, citizenship status, military or veteran status, or any other basis covered by applicable laws. Mozilla will not tolerate discrimination or harassment based on any of these characteristics or any other unlawful behavior, conduct, or purpose. Group: D LI-REMOTE Req ID: R3224 Hiring Ranges: Remote Germany €68.000 - €91.000 EUR
Staff + Software Security Engineer, Secure Framewo...
About Anthropic Anthropic’s mission is to create reliable, interpretable, and steerable AI systems. We want AI to be safe and beneficial for our users and for society as a whole. Our team is a quickly growing group of committed researchers, engineers, policy experts, and business leaders working together to build beneficial AI systems. About the team Secure Frameworks is the team in Anthropic's Security Engineering org that builds shared security libraries and frameworks the rest of the company builds on. We collaborate closely with teams and leaders across Anthropic to own critical security foundations, including workload identity and authorization, cryptographic frameworks, and the centralized access proxy that secures traffic to internal applications. Our mission is to make the secure thing easy and the easy thing secure by helping Anthropic engineers get secure behaviour by default and preventing entire classes of vulnerabilities through careful design. We own what we ship, help customers adopt better security practices and at times we work embedded directly in research, infrastructure or product teams. About the role You will design, build and run security foundations used across Anthropic's fleet, from threat model through production, on-call and adoption. Much of the work is greenfield: our infrastructure is growing quickly and the timelines are compressed, so you will help define the architecture rather than inherit it. Depending on your strengths you will focus on one or two of the areas below and contribute across the rest. - Build critical security foundations including cryptographic frameworks, mTLS infrastructure, secure serialization, and authorization systems, designed to prevent entire classes of vulnerabilities - Partner with product, research, infrastructure, and other security teams to ensure frameworks integrate smoothly with lower-layer security controls - Scope, design and build security services and libraries end-to-end, maintain them in production, and drive through ambiguous technical problems with minimal oversight - Build and operate the zero-trust access gateway that fronts Anthropic's internal services - Design and roll out authorization frameworks so services enforce least privilege consistently instead of each inventing its own access controls - Own cryptographic frameworks and libraries - Mentor engineers, contribute to hiring, and grow security engineering culture across Anthropic Minimum qualifications - 8+ years of software engineering experience building security-relevant systems in production, including leading complex initiatives independently - Strong programming skills in Go, Rust or Python - Deep understanding of authentication and authorization systems: OAuth 2.0 / OIDC, JWTs, service-to-service auth, policy-based access control - Hands-on experience with PKI, X.509, mTLS and workload identity - Working knowledge of applied cryptography: choosing and composing primitives correctly, key management, and the ways libraries fail in practice - Experience shipping and operating high-reliability services on Kubernetes across cloud and on-prem environments, including being on call for them - A track record of bringing clarity and ownership to ambiguous technical problems and driving them to resolution across teams - A strong sense of developer experience - Clear communication across all levels of the organization - Passion for AI safety and the role security engineering plays in building trustworthy AI systems Preferred qualifications - Built security frameworks or libraries adopted across an engineering organization, and done the work to drive that adoption - Built or operated a zero-trust / BeyondCorp-style access gateway or identity-aware proxy - Migrated a fleet to mTLS at scale, including certificate issuance and staged enforcement - Maintained or contributed to open-source cryptographic libraries - Designed authorization systems using policy languages or relationship-based models - Familiarity with ML infrastructure (training, inference serving) The annual compensation range for this role is listed below. For sales roles, the range provided is the role’s On Target Earnings ("OTE") range, meaning that the range includes both the sales commissions/sales bonuses target and annual base salary for the role. Annual Salary: $32,000 - $485,000 USD Logistics Minimum education: Bachelor’s degree or an equivalent combination of education, training, and/or experience Required field of study: A field relevant to the role as demonstrated through coursework, training, or professional experience Minimum years of experience: Years of experience required will correlate with the internal job level requirements for the position Location-based hybrid policy: Currently, we expect all staff to be in one of our offices at least 25% of the time. However, some roles may require more time in our offices. Visa sponsorship: We do sponsor visas! However, we aren't able to successfully sponsor visas for every role and every candidate. But if we make you an offer, we will make every reasonable effort to get you a visa, and we retain an immigration lawyer to help with this. We encourage you to apply even if you do not believe you meet every single qualification. Not all strong candidates will meet every single qualification as listed. Research shows that people who identify as being from underrepresented groups are more prone to experiencing imposter syndrome and doubting the strength of their candidacy, so we urge you not to exclude yourself prematurely and to submit an application if you're interested in this work. We think AI systems like the ones we're building have enormous social and ethical implications. We think this makes representation even more important, and we strive to include a range of diverse perspectives on our team. Your safety matters to us. To protect yourself from potential scams, remember that Anthropic recruiters only contact you from @anthropic.com email addresses. In some cases, we may partner with vetted recruiting agencies who will identify themselves as working on behalf of Anthropic. Be cautious of emails from other domains. Legitimate Anthropic recruiters will never ask for money, fees, or banking information before your first day. If you're ever unsure about a communication, don't click any links—visit anthropic.com/careers directly for confirmed position openings. How we're different We believe that the highest-impact AI research will be big science. At Anthropic we work as a single cohesive team on just a few large-scale research efforts. And we value impact — advancing our long-term goals of steerable, trustworthy AI — rather than work on smaller and more specific puzzles. We view AI research as an empirical science, which has as much in common with physics and biology as with traditional efforts in computer science. We're an extremely collaborative group, and we host frequent research discussions to ensure that we are pursuing the highest-impact work at any given time. As such, we greatly value communication skills. The easiest way to understand our research directions is to read our recent research. This research continues many of the directions our team worked on prior to Anthropic, including: GPT-3, Circuit-Based Interpretability, Multimodal Neurons, Scaling Laws, AI & Compute, Concrete Problems in AI Safety, and Learning from Human Preferences. Come work with us! Anthropic is a public benefit corporation headquartered in San Francisco. We offer competitive compensation and benefits, optional equity donation matching, generous vacation and parental leave, flexible working hours, and a lovely office space in which to collaborate with colleagues. Guidance on Candidates' AI Usage: Learn about our policy for using AI in our application process.
Staff + Software Security Engineer, Labs
About Anthropic Anthropic’s mission is to create reliable, interpretable, and steerable AI systems. We want AI to be safe and beneficial for our users and for society as a whole. Our team is a quickly growing group of committed researchers, engineers, policy experts, and business leaders working together to build beneficial AI systems. About the role Frontier AI is on track to be among the most consequential and most adversarially-targeted technology in the world. The capability curve is steep, the adversaries who want these systems are extremely well-resourced, and the security bar this will eventually require is well beyond where the industry operates today. Incremental hardening alone is not going to close that gap, so we need breakthroughs and a group of people to go find them. Security Labs is that team. We run a portfolio of high-risk, high-expected-value security projects: the work that seems impractical until someone optimistic and stubborn enough actually tries it. Projects run on the order of weeks rather than quarters, and each one is either handed off to the Anthropic team that will own it in production or wound down with a writeup of what we learned. We expect a meaningful fraction of our bets not to land. This team is intentionally scrappy and ambitious. We're intentionally iterating fast on high-risk research bets and we expect a meaningful fraction not to land. If a 30% project success rate sounds uncomfortable, or uncharted and chaotic territory isn’t both frightening and exciting, this probably isn't the right fit. There are other places in Anthropic Security doing important work with more structure, less risk, and more certain paths to positive outcomes. The questions we're trying to answer include: - Can our core research workflows survive extreme isolation? - Can we replace trust with cryptographic guarantees? - Can the models themselves become our most effective security control? - What would it actually take to defend against a tier-1 state adversary, and how much of that can we build now? Who we're looking for. We're hiring generalists with rare depth. You're a strong software engineer as a baseline, and on top of that you've gone deep in at least one area most engineers don't get near: firmware or hardware security, applied cryptography, OS / kernel / hypervisor internals, formal methods, reverse engineering, or high-assurance and cross-domain systems. You've built things under your own direction, you're comfortable jumping layers when the problem demands it, and you'd rather take a swing at something that might not work than ship the safe incremental thing. You think the trajectory of AI matters a great deal, you're not comfortable with how the security side of it is going by default, and you'd rather be on the inside building the answer than watching from outside. Current Project Areas The portfolio changes as we learn. The kinds of bets currently in flight or queued: - Standing up a prototype high-assurance research cluster: running real Anthropic training and research workloads under extreme isolation and physical security controls, and finding out exactly where productivity breaks and what we'd need to invent to get it back - Provable inference: cryptographic verification (zero-knowledge proofs, attestation chains) that a given output came from a specific model running specific code, replacing "trust us" with math - Build hypervisor-isolated microVM workload isolation across the fleet - Compiling an ML kernel through a formally verified pipeline where every lowering step carries a machine-checked proof of equivalence, making compilation-layer sabotage mathematically detectable - Regenerating clusters: automation that spins up a purpose-built cell, runs a workload, and tears the whole thing down on a TTL measured in hours, so attacker persistence has an expiry date - Using Claude itself to drive security work end to end: threat modeling new compute platforms, rewriting critical services to zero external dependencies, running the test equipment that validates what hardware datasheets claim Part of your job is deciding what comes next. We hire people we trust to pick good bets, and project selection is owned by the engineers doing the work. Key responsibilities - Own Security Labs projects end to end. You'll scope the bet, build the prototype, run it against real workloads, and bring it to either a hand-off or a documented exit - Stand up novel security infrastructure fast (isolated clusters, attestation chains, hypervisor and runtime work, verification tooling) optimizing for what we learn rather than for permanence - Find the receiving team early, bring them along while you build, and hand them something they actually want to own - Work embedded with research and infrastructure teams (Pretraining, RL, Inference, Compute) to test whether their workflows survive what you're proposing, and document precisely where they don't - Turn experimental results into short writeups that shape Anthropic's long-term security architecture, and into costed contingency plans we could execute on short notice - Help pick the next round of bets and influence the industry to get better along the way Minimum qualifications - Genuinely care about where AI is heading and want to work on the security problems that determine whether it goes well. This is the most important thing on this list - Have real depth in at least one area most software engineers don't touch (e.g. firmware or hardware security, applied cryptography, OS / kernel / hypervisor internals, formal methods and verification, reverse engineering and exploit development, or high-assurance / cross-domain systems) - Have built and shipped things under your own direction. Maybe you founded a company or research group, maintained an open-source project other people depend on, or shipped research that changed how people in your field work. We weight this far more than where you've worked or for how long - Have a track record of choosing the problem yourself and seeing it through, rather than only executing a plan someone else handed you - Are comfortable jumping between domains and layers of the stack when the problem calls for it, and have actually done so - Have run prototypes or experiments where the goal was answering a hard question rather than shipping a permanent system, including ones that didn't pan out - Write clearly enough to turn weeks of work into a couple of pages someone can act on - Change your mind when the evidence says to, and are fine being the least-expert person in a room full of specialists - Care about defense. Plenty of folks here come from offense and that background is valuable, but what you actually want to spend your time on now is making systems hold up - Are a strong programmer (Python plus at least one of Rust, Go, or C/C++) and can stand up real infrastructure without that being the interesting part of your week Preferred qualifications - Experience inside airgapped or high-side environments (classified networks, cross-domain solutions, ICS/SCADA, financial trading infrastructure) and the operational realities of working in them - A background in offensive security, red teaming, or vulnerability research, with calibrated intuitions for which threats actually matter - Familiarity with ML infrastructure (training pipelines, distributed schedulers, inference serving, accelerator hardware) sufficient for grounded conversations with researchers about what their workloads actually need - A history of working in environments built around rapid iteration rather than rigid change control: startups, applied research groups, independent consulting, small security shops The annual compensation range for this role is listed below. For sales roles, the range provided is the role’s On Target Earnings ("OTE") range, meaning that the range includes both the sales commissions/sales bonuses target and annual base salary for the role. Annual Salary: $320,000 - $485,000 USD Logistics Minimum education: Bachelor’s degree or an equivalent combination of education, training, and/or experience Required field of study: A field relevant to the role as demonstrated through coursework, training, or professional experience Minimum years of experience: Years of experience required will correlate with the internal job level requirements for the position Location-based hybrid policy: Currently, we expect all staff to be in one of our offices at least 25% of the time. However, some roles may require more time in our offices. Visa sponsorship: We do sponsor visas! However, we aren't able to successfully sponsor visas for every role and every candidate. But if we make you an offer, we will make every reasonable effort to get you a visa, and we retain an immigration lawyer to help with this. We encourage you to apply even if you do not believe you meet every single qualification. Not all strong candidates will meet every single qualification as listed. Research shows that people who identify as being from underrepresented groups are more prone to experiencing imposter syndrome and doubting the strength of their candidacy, so we urge you not to exclude yourself prematurely and to submit an application if you're interested in this work. We think AI systems like the ones we're building have enormous social and ethical implications. We think this makes representation even more important, and we strive to include a range of diverse perspectives on our team. Your safety matters to us. To protect yourself from potential scams, remember that Anthropic recruiters only contact you from @anthropic.com email addresses. In some cases, we may partner with vetted recruiting agencies who will identify themselves as working on behalf of Anthropic. Be cautious of emails from other domains. Legitimate Anthropic recruiters will never ask for money, fees, or banking information before your first day. If you're ever unsure about a communication, don't click any links—visit anthropic.com/careers directly for confirmed position openings. How we're different We believe that the highest-impact AI research will be big science. At Anthropic we work as a single cohesive team on just a few large-scale research efforts. And we value impact — advancing our long-term goals of steerable, trustworthy AI — rather than work on smaller and more specific puzzles. We view AI research as an empirical science, which has as much in common with physics and biology as with traditional efforts in computer science. We're an extremely collaborative group, and we host frequent research discussions to ensure that we are pursuing the highest-impact work at any given time. As such, we greatly value communication skills. The easiest way to understand our research directions is to read our recent research. This research continues many of the directions our team worked on prior to Anthropic, including: GPT-3, Circuit-Based Interpretability, Multimodal Neurons, Scaling Laws, AI & Compute, Concrete Problems in AI Safety, and Learning from Human Preferences. Come work with us! Anthropic is a public benefit corporation headquartered in San Francisco. We offer competitive compensation and benefits, optional equity donation matching, generous vacation and parental leave, flexible working hours, and a lovely office space in which to collaborate with colleagues. Guidance on Candidates' AI Usage: Learn about our policy for using AI in our application process.
Member of Technical Staff - Security
OWN YOUR INTELLIGENCE Prime Intellect is building the open superintelligence stack: the infrastructure frontier AI labs build internally, made available to every ambitious AI team. Our platform, Lab, unifies compute, environments, evaluations, secure sandboxes, high-performance training, and deployment into one full-stack system for post-training at frontier scale - from SFT and RL to tool use, agent workflows, and continuously improving production models. We are building open frontier AI: open-source models trained end to end for long-horizon tasks like autonomous research, and the full-stack platform our own research team uses to build them. The next generation of AI companies, enterprises, and research teams do not just need more GPUs. They need the ability to turn their own workflows, tools, data, and feedback loops into superintelligence they own. Prime Intellect has raised $150M in total funding from Founders Fund, Radical Ventures, NVIDIA, and exceptional AI, infrastructure, and enterprise operators — including Andrej Karpathy, Dwarkesh Patel, and leaders and founders from Ramp, Perplexity, Harvey, Mercor, Zapier, Datadog, Cognition, OpenAI, Thinking Machines, Together AI, SemiAnalysis, LangChain, Browserbase, Cloudflare, Sierra, Databricks, Airbnb, OpenRouter, Standard Intelligence, Fleet, Core Auto, and more. We are looking for people who want to build at the intersection of frontier research, real infrastructure, and go-to-market for a category that does not fully exist yet. ROLE IMPACT Security is the single highest-stakes function at Prime Intellect. Our customers — from frontier AI labs to enterprises — trust us with their most valuable assets: proprietary models, training data, and the compute that powers them. This role owns the security posture of everything we ship: the hosted RL training platform, distributed GPU infrastructure, liquid compute marketplace, and all customer-facing surfaces. You'll be the first dedicated security hire and will define how we think about security as a company — from threat modeling and secure architecture to incident response and compliance. You'll work directly with engineering, research, and leadership to embed security into every layer of the stack, and you'll manage relationships with external penetration testers and security auditors to continuously validate our defenses. CORE TECHNICAL RESPONSIBILITIES PREVENTIVE SECURITY & SECURE ARCHITECTURE - Own threat modeling across our entire surface area: multi-tenant training infrastructure, sandboxed execution environments, API surfaces, and internal tooling - Design and implement zero-trust networking, identity, and access control across distributed GPU clusters and cloud infrastructure - Build secure-by-default patterns for our platform engineers — auth, secrets management, supply chain integrity, container hardening - Architect tenant isolation and data boundary enforcement for hosted RL training workloads (customers run arbitrary code in our environments) AI-NATIVE SECURITY - Develop security frameworks specific to AI infrastructure: model weight protection, training data isolation, checkpoint integrity, gradient privacy - Secure the RL training loop end-to-end — from environment execution in sandboxes to reward signal verification and model artifact storage - Build detection and prevention for AI-specific attack vectors: prompt injection across agentic pipelines, model exfiltration, adversarial environment manipulation OFFENSIVE SECURITY & EXTERNAL ENGAGEMENTS - Scope, manage, and run point on external penetration tests across our platform, hosted training infrastructure, and liquid compute layer - Build and maintain an internal red-teaming practice — automated and manual — targeting our most critical systems - Drive vulnerability management: triage, remediation SLAs, and root cause analysis DETECTION, RESPONSE & OBSERVABILITY - Build security monitoring and alerting across infrastructure (distributed clusters, Kubernetes, cloud) and application layers - Implement runtime security for containerized training workloads and sandboxed environments - Own incident response — build the playbooks, run the drills, lead the post-mortems - Design audit logging and forensic capability across all customer-facing systems COMPLIANCE & CUSTOMER TRUST - Drive SOC 2 Type II readiness and other compliance frameworks required by enterprise customers - Own the security narrative for customer-facing materials — questionnaires, architecture reviews, trust documentation - Partner with GTM to unblock enterprise deals that depend on security posture TECHNICAL REQUIREMENTS - 5+ years in security engineering, infrastructure security, or offensive security roles — ideally at companies operating multi-tenant cloud or compute infrastructure - Deep experience with cloud security (GCP preferred), Kubernetes security, and container runtime hardening - Hands-on ability to read, write, and audit code in Python and Rust (or strong systems-level language) - Experience with network security in distributed systems — service mesh, mTLS, network segmentation across heterogeneous hardware - Proven track record managing external penetration tests and translating findings into engineering action - Strong fundamentals in cryptography, identity/access management, and secure software development lifecycle NICE TO HAVE - Experience securing GPU infrastructure or ML training pipelines - Background in offensive security — CTFs, bug bounties, red team engagements - Familiarity with AI-specific threat models (model extraction, training data poisoning, sandbox escape) - Experience building security programs from scratch at a high-growth startup - SOC 2, ISO 27001, or FedRAMP compliance experience - Open-source security tooling contributions - Familiarity with eBPF, Falco, or similar runtime security tools WHAT WE OFFER - Cash Compensation Range of $180-350k+ with significant equity incentives - Flexible work arrangement (remote or San Francisco office) - Full visa sponsorship and relocation support - Professional development budget for courses and conferences - Regular team off-sites and conference attendance - Opportunity to shape the future of decentralized AI development GROWTH OPPORTUNITY You'll be the foundational security hire at a company where security is existential — not a checkbox. As we scale to support frontier AI labs and enterprises running their most critical training workloads on our platform, you'll build the security org from the ground up and have direct influence on company strategy. We value intensity and ownership over credentials. If you've built security programs at infrastructure companies, broken into systems professionally, or have deep conviction about how AI infrastructure should be secured — we want to talk. Ready to help shape the future of AI? Apply now and join us in our mission to make powerful AI models accessible to everyone.
Staff Software Engineer, Secure Execution
WHY HARVEY At Harvey, we’re transforming how legal and professional services operate. By combining frontier agentic AI, an enterprise-grade platform, and deep domain expertise, we’re reshaping how critical knowledge work gets done for decades to come. This is a rare chance to help build a generational company at a true inflection point. We have strong product-market fit and world-class investor support. We’re scaling fast and defining a new category in real time. The work is ambitious, the bar is high, and the opportunity for growth — personal, professional, and financial — is unmatched. Our team moves fast, takes ownership, and is deeply committed to the mission — operating with intensity, staying close to our customers, and pushing each other for excellence. We live by three values: Decisiveness, Simplicity, and Job's Not Finished. We act quickly on clear judgment over perfect information, we believe simplicity is what scales, and we're never satisfied with where we are. If you want to do the best work of your career alongside people who share that drive, we'd love to build with you. At Harvey, the future of professional services is being written today — and we’re just getting started. ROLE OVERVIEW As a Staff Software Engineer on the Security Engineering team, you will join as a founding team member and build the security foundations that let Harvey put increasingly capable AI agents to work. You'll lead development of a platform for agents to perform security work, while shaping how agents are sandboxed across our product and internal platforms. One of the central challenges is enabling models with advanced cybersecurity capabilities to discover and validate vulnerabilities automatically, including through authorized penetration testing, while protecting sensitive data and systems. You'll build the execution environments, orchestration, and controls that make this possible, and help enable the internal use of open-source models with appropriate protections around inference, tool use, and data access. You'll work closely with the teams building Harvey's product sandbox and internal AI agent platform, shaping architecture and contributing production code to strengthen execution boundaries. Your impact will come from shipping systems, establishing a shared technical direction, and making security capabilities reusable across teams. You'll own work from design through rollout and operation, balancing containment with the reliability, performance, and flexibility that useful agents need. WHAT YOU'LL DO - Set the technical direction for secure agent execution, working across Security, Infrastructure, and Product Engineering to turn emerging capabilities and risks into a concrete roadmap. - Design, build, and operate a platform for security agents to discover and validate vulnerabilities within authorized targets and execution boundaries, producing reproducible evidence that engineers can act on. - Build reusable controls for agent tool use, code execution, network and filesystem access, resource consumption, and workload lifecycle. Integrate with identity and secrets platforms to limit access to the data and credentials each task needs. - Partner with the owners of Harvey's product sandbox and internal agent platform to make architectural decisions, implement protections, and integrate shared security capabilities into their execution environments. - Enable internal use of open-source models alongside infrastructure teams, building protections around model serving, agent execution, and sensitive-data handling. - Develop adversarial tests, evaluations, and telemetry that verify containment and expose failures. Build mechanisms to scope, observe, interrupt, and safely terminate agent activity. - Lead delivery and adoption across teams, mentor engineers, and remain hands-on through implementation and production operation, making clear tradeoffs across security, reliability, latency, and cost. WHAT YOU HAVE - 10+ years developing and running production software, including technical leadership on initiatives spanning multiple engineering teams. - Strong software engineering skills in languages such as Go, Rust, Python, or C++, with practical experience in Linux systems, networking, and containerized infrastructure. - Deep expertise in one or more areas of execution security, such as sandboxing, operating-system isolation, container or virtual-machine security, or platforms that execute untrusted code. You can translate threats into enforceable boundaries and test how those boundaries fail. - Experience building shared platforms, services, or libraries and helping other teams adopt them through clear interfaces, documentation, and safe migrations. - Experience with cloud infrastructure and distributed systems, including observability, failure handling, capacity management, and dependable production operation. - Fluency with AI-assisted engineering and agentic workflows: you use models to accelerate development, validate their output, and reason about the risks introduced when agents use tools, execute code, or access sensitive data. - Strong communication and technical judgment, with a record of bringing teams to agreement on ambiguous problems and carrying decisions through to delivery. NICE TO HAVE - Experience with microVMs, hypervisors, or sandbox runtimes such as Firecracker, gVisor, or Kata Containers, or Linux isolation mechanisms such as namespaces, seccomp, and Landlock. - Experience building agent runtimes, tool-execution frameworks, or automated security-testing platforms. - Experience with vulnerability research, penetration testing, or adversarial evaluation of agent systems, including turning findings into reproducible tests and effective controls. - Experience deploying or securing self-hosted inference and open-source models, including isolation of model-serving workloads and protection of sensitive inputs and outputs. COMPENSATION $231,000 - $346,400 USD DEPENDING ON YOUR LOCATION, AN APPLICANT PRIVACY NOTICE MAY APPLY TO YOU. YOU CAN FIND ALL OF OUR APPLICANT PRIVACY NOTICES [HERE https://www.notion.so/harveyai/Harvey-Candidate-Privacy-Policies-319ac3fcdd7a803bb807d5094f249922]. #LI-NP1 Harvey is an equal opportunity employer and does not discriminate on the basis of race, gender, sexual orientation, gender identity/expression, national origin, disability, age, genetic information, veteran status, marital status, pregnancy or related condition, or any other basis protected by law. We are committed to providing reasonable accommodations to applicants with disabilities, and requests can be made by emailing accommodations@harvey.ai
Systems Security Engineer, Programs
Anduril Industries is a defense technology company with a mission to transform U.S. and allied military capabilities with advanced technology. By bringing the expertise, technology, and business model of the 21st century’s most innovative companies to the defense industry, Anduril is changing how military systems are designed, built and sold. Anduril’s family of systems is powered by Lattice OS, an AI-powered operating system that turns thousands of data streams into a realtime, 3D command and control center. As the world enters an era of strategic competition, Anduril is committed to bringing cutting-edge autonomy, AI, computer vision, sensor fusion, and networking technology to the military in months, not years. ABOUT THE TEAM We're seeking a systems security engineer to will drive security engineering principles into design and integration with other systems internal and external to Anduril to ultimately secure our suite of advanced technologies including artificial intelligence systems, command and control platforms, aerospace vehicles, and long range sensors. The ideal candidate has a background in systems of systems, systems, electrical and/or software engineering with deep expertise in embedded systems security. They will perform in-depth security architecture assessments, identify and mitigate vulnerabilities and exploits, and work cross-functionally to bake security into Anduril products. ABOUT THE JOB WHAT YOU’LL DO - This is not an ISSO or ISSM role. - Own security end-to-end for assigned products—derive and decompose security requirements from customer needs and threat intelligence, design security architectures, and manage security through the full product lifecycle - Implement security features and capabilities, develop and execute comprehensive security test strategies at multiple integration levels, and support major milestone deliveries (SRR, PDR, CDR, TRR, PRR) - Brief security architectures and approaches to government customers and program leadership, translating complex security concepts for diverse audiences - Collaborates and builds solutions with engineering teams to meet and exceed industry-standard security goals - Collaborate with security assessment teams to assess Anduril’s products and integrated components to uncover potential weaknesses - Collaborate cross-functionally with engineering teams to translate architectural requirements into implementations, and coordinate with security teams on threat modeling, validation, and testing REQUIRED QUALIFICATIONS - Experience in one or more of the following fields: Systems Security Engineering, Cybersecurity, Systems Engineering, Electrical Engineering, Software Engineering, Computer Engineering, Computer Science - Familiarity with security-relevant features on embedded hardware / FPGAs (e.g., secure boot, key management, etc.) - Previous work on security engineering and architecture for defense / national security systems and/or complex embedded commercial systems - Ability to effectively brief and interact regularly with highly technical government customers - Strong understanding of the “why” behind the product, systems, and security design - A sincere commitment to a positive, inclusive, and collaborative culture - Excellent verbal & written communication skills - Currently possesses and is able to maintain at least a final active US Secret security clearance with SAP eligibility - Must be able to obtain a Top Secret security clearance. PREFERRED QUALIFICATIONS - Excels at the above listed Requirements - Possesses and able to maintain a U.S. TS Security clearance with SCI and/or SAP eligibility - Strong skills in one or more programming languages (e.g., Python, Rust, Go, C/C++). - Experience assessing security of firmware, applications, network, IoT, or embedded systems - Fluency in modern USG cyber methodologies, including Cyber Survivability guidance and related policy (JSIG, ICD 503, CSEIG, SSECG, NIST SP 800-160, Cyber T&E Guidebook, CMMC, etc.) - Experience developing cyber documentation for USG customers - Proven track record of excelling across the broader Systems Security Engineering domain, encompassing embedded Systems Engineering, Cybersecurity, Cyber Resiliency, Software Security - Experience creating and integrating with system design documentation in MBSE tools - Experience integrating with Software Assurance, Supply Chain Risk Management, Configuration Management, and System Test - Experience executing the Anti-Tamper process and authoring associated documentation - Experience with security testing on DoD systems (e.g. penetration testing, red teaming, vulnerability assessments) - Experience working with unmanned aircraft Group 3 class and above - Experience working with government or national security space systems US Salary Range $164,000 - $194,000 USD The salary range for this role is an estimate based on a wide range of compensation factors, inclusive of base salary only. Actual salary offer may vary based on (but not limited to) work experience, education and/or training, critical skills, and/or business considerations. Highly competitive equity grants are included in the majority of full time offers; and are considered part of Anduril's total compensation package. Additionally, Anduril offers top-tier benefits for full-time employees, including: Benefits At Anduril, we invest in our people. Our comprehensive, competitive benefits package (available at little to no cost to employees) ensures you’re supported in health, recovery, and whatever comes next. For more information, Explore Our Benefits . Protecting Yourself from Recruitment Scams Anduril is committed to maintaining the integrity of our Talent acquisition process and the security of our candidates. We've observed a rise in sophisticated phishing and fraudulent schemes where individuals impersonate Anduril representatives, luring job seekers with false interviews or job offers. These scammers often attempt to extract payment or sensitive personal information. To ensure your safety and help you navigate your job search with confidence, please keep the following critical points in mind: - No Financial Requests: Anduril will never solicit payment or demand personal financial details (such as banking information, credit card numbers, or social security numbers) at any stage of our hiring process. Our legitimate recruitment is entirely free for candidates. - Please always verify communications: - Direct from Anduril: If you receive an email from one of our recruiters, it will only come from an @anduril.com address. - Via Agency Partner: If contacted by a recruiting agency for an Anduril role, their email will clearly identify their agency. If you suspect any suspicious activity, please verify the agency's authenticity by reaching out to contact@anduril.com . - Exercise Caution with Unsolicited Outreach: If you receive any communication that appears suspicious, contains grammatical errors, or makes unusual requests, do not engage. Always confirm the sender's email domain is @anduril.com before providing any personal information or clicking on links. - What to Do If You Suspect Fraud: Should you encounter any questionable or fraudulent outreach claiming to be from Anduril, please report it immediately to contact@anduril.com . Your proactive caution is invaluable in protecting your personal information and upholding the security and trustworthiness of our recruitment efforts. Data Privacy To view Anduril's candidate data privacy policy, please visit https://anduril.com/applicant-privacy-notice/ . By submitting your application, you consent to Anduril Industries using a third-party service provider to conduct pre-employment risk, integrity, and due diligence screening and assessing potential risks as part of your application process. This third-party service provider provides risk-intelligence services that may include analysis of sanctions and watchlists, adverse media, public-record information, and other lawful open-source or commercial data sources. This third-party service provider does not act as a consumer reporting agency. Use of this provider helps to ensure compliance with applicable laws and protect technology, intellectual property, and organizational security.
Staff Systems Security Engineer, Programs
Anduril Industries is a defense technology company with a mission to transform U.S. and allied military capabilities with advanced technology. By bringing the expertise, technology, and business model of the 21st century’s most innovative companies to the defense industry, Anduril is changing how military systems are designed, built and sold. Anduril’s family of systems is powered by Lattice OS, an AI-powered operating system that turns thousands of data streams into a realtime, 3D command and control center. As the world enters an era of strategic competition, Anduril is committed to bringing cutting-edge autonomy, AI, computer vision, sensor fusion, and networking technology to the military in months, not years. ABOUT THE TEAM We're seeking a staff systems security engineer to will drive security engineering principles into design and integration with other systems internal and external to Anduril to ultimately secure our suite of advanced technologies including artificial intelligence systems, command and control platforms, aerospace vehicles, and long range sensors. The ideal candidate has a background in systems of systems, systems, electrical and/or software engineering with deep expertise in embedded systems security. They will perform in-depth security architecture assessments, identify and mitigate vulnerabilities and exploits, and work cross-functionally to bake security into Anduril products. ABOUT THE JOB WHAT YOU’LL DO - This is not an ISSO or ISSM role. - Own security end-to-end for assigned products—derive and decompose security requirements from customer needs and threat intelligence, design security architectures, and manage security through the full product lifecycle - Implement security features and capabilities, develop and execute comprehensive security test strategies at multiple integration levels, and support major milestone deliveries (SRR, PDR, CDR, TRR, PRR) - Brief security architectures and approaches to government customers and program leadership, translating complex security concepts for diverse audiences - Collaborates and builds solutions with engineering teams to meet and exceed industry-standard security goals - Collaborate with security assessment teams to assess Anduril’s products and integrated components to uncover potential weaknesses - Collaborate cross-functionally with engineering teams to translate architectural requirements into implementations, and coordinate with security teams on threat modeling, validation, and testing REQUIRED QUALIFICATIONS - Typically 12+ years of experience and a Bachelors degree or equivalent education/work experience. - Demonstrable ability to address complex, high-stakes security engineering challenges across multiple programs within a major area of business. - Evidence of recognized expertise contributing to risk resolution on cross-functional initiatives. - Experience in one or more of the following fields: Systems Security Engineering, Cybersecurity, Systems Engineering, Electrical Engineering, Software Engineering, Computer Engineering, Computer Science. - Familiarity with security-relevant features on embedded hardware / FPGAs (e.g., secure boot, key management, etc.) - Previous work on security engineering and architecture for defense / national security systems and/or complex embedded commercial systems. - Ability to effectively brief and interact regularly with highly technical government customers. - Strong understanding of the “why” behind the product, systems, and security design. - A sincere commitment to a positive, inclusive, and collaborative culture. - Excellent verbal & written communication skills. - Currently possesses and is able to maintain at least a final active US Secret security clearance with SAP eligibility. - Must be able to obtain a Top Secret security clearance. PREFERRED QUALIFICATIONS - Excels at the above listed Requirements. - Possesses and able to maintain a U.S. TS Security clearance with SCI and/or SAP eligibility. - Strong skills in one or more programming languages (e.g., Python, Rust, Go, C/C++). - Experience assessing security of firmware, applications, network, IoT, or embedded systems. - Fluency in modern USG cyber methodologies, including Cyber Survivability guidance and related policy (JSIG, ICD 503, CSEIG, SSECG, NIST SP 800-160, Cyber T&E Guidebook, CMMC, etc.) - Experience developing cyber documentation for USG customers. - Proven track record of excelling across the broader Systems Security Engineering domain, encompassing embedded Systems Engineering, Cybersecurity, Cyber Resiliency, Software Security. - Experience creating and integrating with system design documentation in MBSE tools. - Experience integrating with Software Assurance, Supply Chain Risk Management, Configuration Management, and System Test. - Experience executing the Anti-Tamper process and authoring associated documentation. - Experience with security testing on DoD systems (e.g. penetration testing, red teaming, vulnerability assessments) - Experience working with unmanned aircraft Group 3 class and above. - Experience working with government or national security space systems. US Salary Range $191,000 - $253,000 USD The salary range for this role is an estimate based on a wide range of compensation factors, inclusive of base salary only. Actual salary offer may vary based on (but not limited to) work experience, education and/or training, critical skills, and/or business considerations. Highly competitive equity grants are included in the majority of full time offers; and are considered part of Anduril's total compensation package. Additionally, Anduril offers top-tier benefits for full-time employees, including: Benefits At Anduril, we invest in our people. Our comprehensive, competitive benefits package (available at little to no cost to employees) ensures you’re supported in health, recovery, and whatever comes next. For more information, Explore Our Benefits . Protecting Yourself from Recruitment Scams Anduril is committed to maintaining the integrity of our Talent acquisition process and the security of our candidates. We've observed a rise in sophisticated phishing and fraudulent schemes where individuals impersonate Anduril representatives, luring job seekers with false interviews or job offers. These scammers often attempt to extract payment or sensitive personal information. To ensure your safety and help you navigate your job search with confidence, please keep the following critical points in mind: - No Financial Requests: Anduril will never solicit payment or demand personal financial details (such as banking information, credit card numbers, or social security numbers) at any stage of our hiring process. Our legitimate recruitment is entirely free for candidates. - Please always verify communications: - Direct from Anduril: If you receive an email from one of our recruiters, it will only come from an @anduril.com address. - Via Agency Partner: If contacted by a recruiting agency for an Anduril role, their email will clearly identify their agency. If you suspect any suspicious activity, please verify the agency's authenticity by reaching out to contact@anduril.com . - Exercise Caution with Unsolicited Outreach: If you receive any communication that appears suspicious, contains grammatical errors, or makes unusual requests, do not engage. Always confirm the sender's email domain is @anduril.com before providing any personal information or clicking on links. - What to Do If You Suspect Fraud: Should you encounter any questionable or fraudulent outreach claiming to be from Anduril, please report it immediately to contact@anduril.com . Your proactive caution is invaluable in protecting your personal information and upholding the security and trustworthiness of our recruitment efforts. Data Privacy To view Anduril's candidate data privacy policy, please visit https://anduril.com/applicant-privacy-notice/ . By submitting your application, you consent to Anduril Industries using a third-party service provider to conduct pre-employment risk, integrity, and due diligence screening and assessing potential risks as part of your application process. This third-party service provider provides risk-intelligence services that may include analysis of sanctions and watchlists, adverse media, public-record information, and other lawful open-source or commercial data sources. This third-party service provider does not act as a consumer reporting agency. Use of this provider helps to ensure compliance with applicable laws and protect technology, intellectual property, and organizational security.
Senior Systems Security Engineer, Programs
Anduril Industries is a defense technology company with a mission to transform U.S. and allied military capabilities with advanced technology. By bringing the expertise, technology, and business model of the 21st century’s most innovative companies to the defense industry, Anduril is changing how military systems are designed, built and sold. Anduril’s family of systems is powered by Lattice OS, an AI-powered operating system that turns thousands of data streams into a realtime, 3D command and control center. As the world enters an era of strategic competition, Anduril is committed to bringing cutting-edge autonomy, AI, computer vision, sensor fusion, and networking technology to the military in months, not years. ABOUT THE TEAM We're seeking a senior systems security engineer to will drive security engineering principles into design and integration with other systems internal and external to Anduril to ultimately secure our suite of advanced technologies including artificial intelligence systems, command and control platforms, aerospace vehicles, and long range sensors. The ideal candidate has a background in systems of systems, systems, electrical and/or software engineering with deep expertise in embedded systems security. They will perform in-depth security architecture assessments, identify and mitigate vulnerabilities and exploits, and work cross-functionally to bake security into Anduril products. ABOUT THE JOB WHAT YOU’LL DO - This is not an ISSO or ISSM role. - Own security end-to-end for assigned products—derive and decompose security requirements from customer needs and threat intelligence, design security architectures, and manage security through the full product lifecycle - Implement security features and capabilities, develop and execute comprehensive security test strategies at multiple integration levels, and support major milestone deliveries (SRR, PDR, CDR, TRR, PRR) - Brief security architectures and approaches to government customers and program leadership, translating complex security concepts for diverse audiences - Collaborates and builds solutions with engineering teams to meet and exceed industry-standard security goals - Collaborate with security assessment teams to assess Anduril’s products and integrated components to uncover potential weaknesses - Collaborate cross-functionally with engineering teams to translate architectural requirements into implementations, and coordinate with security teams on threat modeling, validation, and testing REQUIRED QUALIFICATIONS - 8+ years of experience and a Bachelor's degree or equivalent education/work experience. - Evidence of leading a team to solve complex security engineering challenges. - Able to evaluate trade spaces and offer optimal security solutions against program risks using advanced knowledge and sound judgement. - Experience in one or more of the following fields: Systems Security Engineering, Cybersecurity, Systems Engineering, Electrical Engineering, Software Engineering, Computer Engineering, Computer Science. - Familiarity with security-relevant features on embedded hardware / FPGAs (e.g., secure boot, key management, etc.) - Previous work on security engineering and architecture for defense / national security systems and/or complex embedded commercial systems. - Ability to effectively brief and interact regularly with highly technical government customers. - Strong understanding of the “why” behind the product, systems, and security design. - A sincere commitment to a positive, inclusive, and collaborative culture. - Excellent verbal & written communication skills. - Currently possesses and is able to maintain at least a final active US Secret security clearance with SAP eligibility. - Must be able to obtain a Top Secret security clearance. PREFERRED QUALIFICATIONS - Excels at the above listed Requirements - Possesses and able to maintain a U.S. TS Security clearance with SCI and/or SAP eligibility - Strong skills in one or more programming languages (e.g., Python, Rust, Go, C/C++). - Experience assessing security of firmware, applications, network, IoT, or embedded systems - Fluency in modern USG cyber methodologies, including Cyber Survivability guidance and related policy (JSIG, ICD 503, CSEIG, SSECG, NIST SP 800-160, Cyber T&E Guidebook, CMMC, etc.) - Experience developing cyber documentation for USG customers - Proven track record of excelling across the broader Systems Security Engineering domain, encompassing embedded Systems Engineering, Cybersecurity, Cyber Resiliency, Software Security - Experience creating and integrating with system design documentation in MBSE tools - Experience integrating with Software Assurance, Supply Chain Risk Management, Configuration Management, and System Test - Experience executing the Anti-Tamper process and authoring associated documentation - Experience with security testing on DoD systems (e.g. penetration testing, red teaming, vulnerability assessments) - Experience working with unmanned aircraft Group 3 class and above - Experience working with government or national security space systems US Salary Range $166,000 - $220,000 USD The salary range for this role is an estimate based on a wide range of compensation factors, inclusive of base salary only. Actual salary offer may vary based on (but not limited to) work experience, education and/or training, critical skills, and/or business considerations. Highly competitive equity grants are included in the majority of full time offers; and are considered part of Anduril's total compensation package. Additionally, Anduril offers top-tier benefits for full-time employees, including: Benefits At Anduril, we invest in our people. Our comprehensive, competitive benefits package (available at little to no cost to employees) ensures you’re supported in health, recovery, and whatever comes next. For more information, Explore Our Benefits . Protecting Yourself from Recruitment Scams Anduril is committed to maintaining the integrity of our Talent acquisition process and the security of our candidates. We've observed a rise in sophisticated phishing and fraudulent schemes where individuals impersonate Anduril representatives, luring job seekers with false interviews or job offers. These scammers often attempt to extract payment or sensitive personal information. To ensure your safety and help you navigate your job search with confidence, please keep the following critical points in mind: - No Financial Requests: Anduril will never solicit payment or demand personal financial details (such as banking information, credit card numbers, or social security numbers) at any stage of our hiring process. Our legitimate recruitment is entirely free for candidates. - Please always verify communications: - Direct from Anduril: If you receive an email from one of our recruiters, it will only come from an @anduril.com address. - Via Agency Partner: If contacted by a recruiting agency for an Anduril role, their email will clearly identify their agency. If you suspect any suspicious activity, please verify the agency's authenticity by reaching out to contact@anduril.com . - Exercise Caution with Unsolicited Outreach: If you receive any communication that appears suspicious, contains grammatical errors, or makes unusual requests, do not engage. Always confirm the sender's email domain is @anduril.com before providing any personal information or clicking on links. - What to Do If You Suspect Fraud: Should you encounter any questionable or fraudulent outreach claiming to be from Anduril, please report it immediately to contact@anduril.com . Your proactive caution is invaluable in protecting your personal information and upholding the security and trustworthiness of our recruitment efforts. Data Privacy To view Anduril's candidate data privacy policy, please visit https://anduril.com/applicant-privacy-notice/ . By submitting your application, you consent to Anduril Industries using a third-party service provider to conduct pre-employment risk, integrity, and due diligence screening and assessing potential risks as part of your application process. This third-party service provider provides risk-intelligence services that may include analysis of sanctions and watchlists, adverse media, public-record information, and other lawful open-source or commercial data sources. This third-party service provider does not act as a consumer reporting agency. Use of this provider helps to ensure compliance with applicable laws and protect technology, intellectual property, and organizational security.
Senior Product Security Engineer
Anduril Industries is a defense technology company with a mission to transform U.S. and allied military capabilities with advanced technology. By bringing the expertise, technology, and business model of the 21st century’s most innovative companies to the defense industry, Anduril is changing how military systems are designed, built and sold. Anduril’s family of systems is powered by Lattice OS, an AI-powered operating system that turns thousands of data streams into a realtime, 3D command and control center. As the world enters an era of strategic competition, Anduril is committed to bringing cutting-edge autonomy, AI, computer vision, sensor fusion, and networking technology to the military in months, not years. We're seeking a Senior Product Security engineer to develop novel security tooling, discover vulnerabilities, and ultimately secure our suite of advanced technologies including artificial intelligence systems, command and control platforms, aerospace vehicles, and long range sensors. The ideal candidate has a background in electrical or software engineering, with a focus on platform security, or has pivoted to a product or application security role. They will be able to conduct complex security architecture reviews, research and mitigate exploits against hardware and software, and work with other engineering teams to build resiliency into our products. Responsibilities: - Owns the development and maturation of security features for Anduril’s products - Authors and maintains security documentation including System Security Plans, Threat Analysis and Risk Assessments, and compliance evidence - Collaborates and builds solutions with engineering teams to meet and exceed industry-standard security goals - Collaborates with manufacturing and operations teams to develop secure handling and operational processes - Engages with teams to remediate uncovered weakness in designs, implementations, integrations, and processes - Integrates and matures Product Securitys suite of tooling thought Anduril’s products. - Conducts security assessments including architecture review, source code analysis, configuration auditing, and adversarial testing Requirements: - Proficient with one or more programming languages (e.g. C/C++, Golang, Rust, Python) - Experience assessing security of firmware, applications, network, IoT, or embedded systems - Experience developing features for and improving security of firmware, applications, network, or embedded systems - Experience building, testing, and delivering production-ready systems, especially for embedded and/or Linux systems - Experience with structured threat modelling and risk assessment methodologies - Experience in building and security autonomous systems and their unique threat model - Experience in any previous military or defence domain; land, air, sea desirable but not mandatory - Familiarity with anti-tamper and reverse engineering hardware and software mechanisms - Strong and professional communication skills (written and verbal) - Must be eligible to obtain and maintain a UK Security Clearance to a minimum of SC level - Must be a UK citizen Preferred Qualifications: - Excels at the above listed Requirements - Experience with UK Ministry of Defence Cyber Security Model, including - UK Government Security Classifications - DefStans (05-138 at a minimum) - Cyber Secure by Design (including JSP 440’s Cyber Secure by Design guidance and/or JSPs 453 and 604) - Defence Information Protection Notices (DIPNs) - Industry Security Notices (ISNs) - Familiarity with aviation cyber security standards such as DO-326A/ED-202A - Experience with SORA or CAA Type Certification cyber requirements - Experience engaging with certification bodies like the CAA or MAA/DE&S - Familiarity with RF Emanation Protection (including TEMPEST) - Experience of Network Security Devices (including Inter-Domain Gateways and Cross Domain Solutions) - Familiarity with security architectures of embedded, aerospace, or cyber-physical systems - Experience with programmable logic devices and their development tools - Regularly builds, tests, and delivers production-ready systems, especially for embedded and/or Linux systems - Ideally a sole UK National (i.e. hold no other citizenships) Anduril is an equal-opportunity employer, and we encourage candidates from all backgrounds to apply. If you are someone passionate to work on problems that matter, we’d love to hear from you! The salary range for this role is an estimate based on a wide range of compensation factors, inclusive of base salary only. Actual salary offer may vary based on (but not limited to) work experience, education and/or training, critical skills, and/or business considerations. Highly competitive equity grants are included in the majority of full time offers; and are considered part of Anduril's total compensation package. Additionally, Anduril offers top-tier benefits for full-time employees, including: Benefits At Anduril, we invest in our people. Our comprehensive, competitive benefits package (available at little to no cost to employees) ensures you’re supported in health, recovery, and whatever comes next. For more information, Explore Our Benefits . Protecting Yourself from Recruitment Scams Anduril is committed to maintaining the integrity of our Talent acquisition process and the security of our candidates. We've observed a rise in sophisticated phishing and fraudulent schemes where individuals impersonate Anduril representatives, luring job seekers with false interviews or job offers. These scammers often attempt to extract payment or sensitive personal information. To ensure your safety and help you navigate your job search with confidence, please keep the following critical points in mind: - No Financial Requests: Anduril will never solicit payment or demand personal financial details (such as banking information, credit card numbers, or social security numbers) at any stage of our hiring process. Our legitimate recruitment is entirely free for candidates. - Please always verify communications: - Direct from Anduril: If you receive an email from one of our recruiters, it will only come from an @anduril.com address. - Via Agency Partner: If contacted by a recruiting agency for an Anduril role, their email will clearly identify their agency. If you suspect any suspicious activity, please verify the agency's authenticity by reaching out to contact@anduril.com . - Exercise Caution with Unsolicited Outreach: If you receive any communication that appears suspicious, contains grammatical errors, or makes unusual requests, do not engage. Always confirm the sender's email domain is @anduril.com before providing any personal information or clicking on links. - What to Do If You Suspect Fraud: Should you encounter any questionable or fraudulent outreach claiming to be from Anduril, please report it immediately to contact@anduril.com . Your proactive caution is invaluable in protecting your personal information and upholding the security and trustworthiness of our recruitment efforts. Data Privacy To view Anduril's candidate data privacy policy, please visit https://anduril.com/applicant-privacy-notice/ . By submitting your application, you consent to Anduril Industries using a third-party service provider to conduct pre-employment risk, integrity, and due diligence screening and assessing potential risks as part of your application process. This third-party service provider provides risk-intelligence services that may include analysis of sanctions and watchlists, adverse media, public-record information, and other lawful open-source or commercial data sources. This third-party service provider does not act as a consumer reporting agency. Use of this provider helps to ensure compliance with applicable laws and protect technology, intellectual property, and organizational security.
Senior Director, Product Security
Anduril Industries is a defense technology company with a mission to transform U.S. and allied military capabilities with advanced technology. By bringing the expertise, technology, and business model of the 21st century’s most innovative companies to the defense industry, Anduril is changing how military systems are designed, built and sold. Anduril’s family of systems is powered by Lattice OS, an AI-powered operating system that turns thousands of data streams into a realtime, 3D command and control center. As the world enters an era of strategic competition, Anduril is committed to bringing cutting-edge autonomy, AI, computer vision, sensor fusion, and networking technology to the military in months, not years. ABOUT THE JOB We're seeking a Director of Product Security to lead the architecture and implementation of critical features within our products, and adjacent to our products, to ultimately secure our suite of advanced technologies including artificial intelligence systems, command and control platforms, aerospace vehicles, and long range sensors. You will be responsible for leading the technical security strategy and implementation across integrated software and robotics platforms, ensuring mission assurance through hands-on security architecture and engineering leadership. We take security seriously - this team is responsible for delivering secure products to our warfighters. This is not a typical AppSec role—Anduril’s Product Security team enables the business to secure autonomous systems, AI models running on edge hardware, and robotic platforms that operate in contested environments. The ideal candidate has a background in electrical or software engineering, with a focus on platform security. They will be able to conduct complex security architecture reviews, research and mitigate exploits against hardware and software, and implement critical features in collaboration with other engineering teams to build resiliency into our products. WHAT YOU'LL DO - Own the development and maturation of the security roadmap across the spectrum of Anduril business lines and products - Lead teams within the Product Security org and partner teams to ensure Anduril products are resilient enough to survive against modern cyber threats - Collaborate and build solutions with engineering teams to meet and exceed industry-standard security goals and further the commercial state of the art. - Build a strong partnership with Anduril’s engineering teams to develop and execute against a well aligned roadmap that covers Anduril’s portfolio globally - Engage with teams to remediate uncovered weakness in designs, implementations, integrations, and processes - Serve as a subject matter expert and trusted advisor for Anduril executives and our partners on the security of Anduril products and security - Own processes that includes both pre-market and post-market processes engineering teams leverage throughout the product development lifecycle REQUIRED QUALIFICATIONS - Experience securing embedded/cyber-physical systems, leading security engineering teams, and operating in environments where security failures have real-world consequences - Possesses both strategic vision and technical depth, maintaining active involvement in security architecture and implementation - Proficient with one or more programming languages (e.g. C/C++, Golang, Rust, Python) - Experience assessing security of firmware, applications, network, IoT, or embedded systems - Experience developing features for and improving security of firmware, applications, network, or embedded systems - Familiarity with anti-tamper and reverse engineering mechanisms - Experience in platform security engineering and secure SDLC implementation - Strong and professional communication skills (written and verbal) - Demonstrated commitment to practical, mission-enabling security solutions - Must be eligible to obtain and maintain a U.S. TS clearance PREFERRED QUALIFICATIONS - Familiarity with security architectures of embedded, aerospace, or cyber-physical systems - Experience building, testing, and delivering production-ready systems, especially for embedded and/or Linux systems - Experience with programmable logic devices and their development tools - Knowledge of cyber threat actors, their TTPs, and their implications for weapon and space system operations - Regularly builds, tests, and delivers production-ready systems, especially for embedded and/or Linux systems - Experience securing complex, AI-native systems - Experience conducting incident response in cloud systems and embedded systems U.S. Person status is required as this position needs to access export controlled data. US Salary Range $253,000 - $336,000 USD The salary range for this role is an estimate based on a wide range of compensation factors, inclusive of base salary only. Actual salary offer may vary based on (but not limited to) work experience, education and/or training, critical skills, and/or business considerations. Highly competitive equity grants are included in the majority of full time offers; and are considered part of Anduril's total compensation package. Additionally, Anduril offers top-tier benefits for full-time employees, including: Benefits At Anduril, we invest in our people. Our comprehensive, competitive benefits package (available at little to no cost to employees) ensures you’re supported in health, recovery, and whatever comes next. For more information, Explore Our Benefits . Protecting Yourself from Recruitment Scams Anduril is committed to maintaining the integrity of our Talent acquisition process and the security of our candidates. We've observed a rise in sophisticated phishing and fraudulent schemes where individuals impersonate Anduril representatives, luring job seekers with false interviews or job offers. These scammers often attempt to extract payment or sensitive personal information. To ensure your safety and help you navigate your job search with confidence, please keep the following critical points in mind: - No Financial Requests: Anduril will never solicit payment or demand personal financial details (such as banking information, credit card numbers, or social security numbers) at any stage of our hiring process. Our legitimate recruitment is entirely free for candidates. - Please always verify communications: - Direct from Anduril: If you receive an email from one of our recruiters, it will only come from an @anduril.com address. - Via Agency Partner: If contacted by a recruiting agency for an Anduril role, their email will clearly identify their agency. If you suspect any suspicious activity, please verify the agency's authenticity by reaching out to contact@anduril.com . - Exercise Caution with Unsolicited Outreach: If you receive any communication that appears suspicious, contains grammatical errors, or makes unusual requests, do not engage. Always confirm the sender's email domain is @anduril.com before providing any personal information or clicking on links. - What to Do If You Suspect Fraud: Should you encounter any questionable or fraudulent outreach claiming to be from Anduril, please report it immediately to contact@anduril.com . Your proactive caution is invaluable in protecting your personal information and upholding the security and trustworthiness of our recruitment efforts. Data Privacy To view Anduril's candidate data privacy policy, please visit https://anduril.com/applicant-privacy-notice/ . By submitting your application, you consent to Anduril Industries using a third-party service provider to conduct pre-employment risk, integrity, and due diligence screening and assessing potential risks as part of your application process. This third-party service provider provides risk-intelligence services that may include analysis of sanctions and watchlists, adverse media, public-record information, and other lawful open-source or commercial data sources. This third-party service provider does not act as a consumer reporting agency. Use of this provider helps to ensure compliance with applicable laws and protect technology, intellectual property, and organizational security.
Product Security Engineer, Programs
Anduril Industries is a defense technology company with a mission to transform U.S. and allied military capabilities with advanced technology. By bringing the expertise, technology, and business model of the 21st century’s most innovative companies to the defense industry, Anduril is changing how military systems are designed, built and sold. Anduril’s family of systems is powered by Lattice OS, an AI-powered operating system that turns thousands of data streams into a realtime, 3D command and control center. As the world enters an era of strategic competition, Anduril is committed to bringing cutting-edge autonomy, AI, computer vision, sensor fusion, and networking technology to the military in months, not years. ABOUT THE TEAM We're seeking a mid-senior level product security engineer to own security for assigned products in your technical domain, provide expert consultation on security architectures, guide implementation of security features, develop solutions engineering for complex security challenges, and ultimately secure our suite of advanced technologies including artificial intelligence systems, command and control platforms, aerospace vehicles, and long range sensors. The ideal candidate has a background in electrical or software engineering, with a focus on platform security, or has pivoted to a product or application security role. They will be able to conduct complex security architecture reviews, research and mitigate exploits against hardware and software, and work with other engineering teams to build resiliency into our products. ABOUT THE JOB WHAT YOU’LL DO - Owns the development and maturation of security features for Anduril’s products - Collaborates and builds solutions with engineering teams to meet and exceed industry-standard security goals - Collaborate with security assessment teams to assess Anduril’s products and integrated components to uncover potential weaknesses - Collaborates with manufacturing and operations teams to develop secure handling and operational processes - Engages with teams to remediate uncovered weakness in designs, implementations, integrations, and processes REQUIRED QUALIFICATIONS - Experience with one or more programming languages (e.g. C/C++, Golang, Rust, Python) - Experience assessing security of firmware, applications, network, IoT, or embedded systems - Experience developing features for and improving security of firmware, applications, network, or embedded systems - Experience building, testing, and delivering production-ready systems, especially for embedded and/or Linux systems - Familiarity with anti-tamper and reverse engineering mechanisms - Strong and professional communication skills (written and verbal) - Strong understanding of the "why" behind product, systems, and security design - A sincere commitment to a positive, inclusive, and collaborative culture - Must be eligible to obtain and maintain a U.S. TS clearance PREFERRED QUALIFICATIONS - Excels at the above listed Requirements - Possesses and able to maintain an active U.S. TS Security clearance with SCI and/or SAP eligibility - Familiarity with security architectures of embedded, aerospace, or cyber-physical systems - Fluency in modern USG cyber methodologies, including Cyber Survivability guidance and related policy (JSIG, ICD 503, CSEIG, SSECG, NIST SP 800-160, Cyber T&E Guidebook, CMMC, etc.) - Experience with programmable logic devices and their development tools - Regularly builds, tests, and delivers production-ready systems, especially for embedded and/or Linux systems US Salary Range $156,000 - $253,000 USD The salary range for this role is an estimate based on a wide range of compensation factors, inclusive of base salary only. Actual salary offer may vary based on (but not limited to) work experience, education and/or training, critical skills, and/or business considerations. Highly competitive equity grants are included in the majority of full time offers; and are considered part of Anduril's total compensation package. Additionally, Anduril offers top-tier benefits for full-time employees, including: Benefits At Anduril, we invest in our people. Our comprehensive, competitive benefits package (available at little to no cost to employees) ensures you’re supported in health, recovery, and whatever comes next. For more information, Explore Our Benefits . Protecting Yourself from Recruitment Scams Anduril is committed to maintaining the integrity of our Talent acquisition process and the security of our candidates. We've observed a rise in sophisticated phishing and fraudulent schemes where individuals impersonate Anduril representatives, luring job seekers with false interviews or job offers. These scammers often attempt to extract payment or sensitive personal information. To ensure your safety and help you navigate your job search with confidence, please keep the following critical points in mind: - No Financial Requests: Anduril will never solicit payment or demand personal financial details (such as banking information, credit card numbers, or social security numbers) at any stage of our hiring process. Our legitimate recruitment is entirely free for candidates. - Please always verify communications: - Direct from Anduril: If you receive an email from one of our recruiters, it will only come from an @anduril.com address. - Via Agency Partner: If contacted by a recruiting agency for an Anduril role, their email will clearly identify their agency. If you suspect any suspicious activity, please verify the agency's authenticity by reaching out to contact@anduril.com . - Exercise Caution with Unsolicited Outreach: If you receive any communication that appears suspicious, contains grammatical errors, or makes unusual requests, do not engage. Always confirm the sender's email domain is @anduril.com before providing any personal information or clicking on links. - What to Do If You Suspect Fraud: Should you encounter any questionable or fraudulent outreach claiming to be from Anduril, please report it immediately to contact@anduril.com . Your proactive caution is invaluable in protecting your personal information and upholding the security and trustworthiness of our recruitment efforts. Data Privacy To view Anduril's candidate data privacy policy, please visit https://anduril.com/applicant-privacy-notice/ . By submitting your application, you consent to Anduril Industries using a third-party service provider to conduct pre-employment risk, integrity, and due diligence screening and assessing potential risks as part of your application process. This third-party service provider provides risk-intelligence services that may include analysis of sanctions and watchlists, adverse media, public-record information, and other lawful open-source or commercial data sources. This third-party service provider does not act as a consumer reporting agency. Use of this provider helps to ensure compliance with applicable laws and protect technology, intellectual property, and organizational security.
Embedded Software Engineer, Anti-Tamper
Anduril Industries is a defense technology company with a mission to transform U.S. and allied military capabilities with advanced technology. By bringing the expertise, technology, and business model of the 21st century’s most innovative companies to the defense industry, Anduril is changing how military systems are designed, built and sold. Anduril’s family of systems is powered by Lattice OS, an AI-powered operating system that turns thousands of data streams into a realtime, 3D command and control center. As the world enters an era of strategic competition, Anduril is committed to bringing cutting-edge autonomy, AI, computer vision, sensor fusion, and networking technology to the military in months, not years. ABOUT THE TEAM At Anduril we are developing cutting-edge artificial intelligence systems, command and control platforms, and autonomous systems across air, land, maritime, and space domains. We are looking for Embedded Software Anti-Tamper Engineers to drive a mission-focused, threat-informed approach to Program Protection Engineering for the next generation of Anduril’s embedded and autonomous systems. In order to be successful at Anduril, an Embedded Software Anti-Tamper Engineer must be fluent in secure design and implementation, with a hands-on, contribution-focused mindset. This role will work side-by-side with Systems Security and Product Software Engineers to actualize program protection requirements into tamper-resistant embedded systems across the Anduril portfolio. WHAT YOU'LL DO - Develop software and firmware for security-sensitive systems on embedded platforms. - Implement boot and run-time Anti-Tamper functionality. - Apply cryptographic mechanisms for authentication, encryption, integrity, and key handling. - Support board bring-up, hardware-software integration, and low-level debugging across boot, initialization, peripheral interfaces, and device communication. - Work with Hardware, FPGA, Systems, and Security engineers to integrate trusted platform features across SoCs, FPGA-based devices, and related components. - Design, document, implement, and validate security-critical features. REQUIRED QUALIFICATIONS - Experience with safety and security-critical embedded software and/or firmware engineering. - Understanding and application of cryptography. - Experience working with embedded platforms that may include SoCs, FPGAs, and hardware security-relevant components. - Experience in one or more of the following languages: C/C++, Rust. - Current U.S. Secret or Top Secret security clearance. PREFERRED QUALIFICATIONS - Experience with Real-Time Operating Systems. - Experience with Nix and NixOS. - Experience with Industry-standard embedded software toolchains. - Experience with Linux as a development environment. - Embedded security and Anti-Tamper architecture, design and implementation. - Experience reviewing chain of trust systems, key lifecycle management designs, isolation architectures, or tamper resistant platform designs. - Experience in defense, aerospace, robotics, autonomous systems, industrial control, or other mission-critical embedded environments. US Salary Range $166,000 - $292,000 USD The salary range for this role is an estimate based on a wide range of compensation factors, inclusive of base salary only. Actual salary offer may vary based on (but not limited to) work experience, education and/or training, critical skills, and/or business considerations. Highly competitive equity grants are included in the majority of full time offers; and are considered part of Anduril's total compensation package. Additionally, Anduril offers top-tier benefits for full-time employees, including: Benefits At Anduril, we invest in our people. Our comprehensive, competitive benefits package (available at little to no cost to employees) ensures you’re supported in health, recovery, and whatever comes next. For more information, Explore Our Benefits . Protecting Yourself from Recruitment Scams Anduril is committed to maintaining the integrity of our Talent acquisition process and the security of our candidates. We've observed a rise in sophisticated phishing and fraudulent schemes where individuals impersonate Anduril representatives, luring job seekers with false interviews or job offers. These scammers often attempt to extract payment or sensitive personal information. To ensure your safety and help you navigate your job search with confidence, please keep the following critical points in mind: - No Financial Requests: Anduril will never solicit payment or demand personal financial details (such as banking information, credit card numbers, or social security numbers) at any stage of our hiring process. Our legitimate recruitment is entirely free for candidates. - Please always verify communications: - Direct from Anduril: If you receive an email from one of our recruiters, it will only come from an @anduril.com address. - Via Agency Partner: If contacted by a recruiting agency for an Anduril role, their email will clearly identify their agency. If you suspect any suspicious activity, please verify the agency's authenticity by reaching out to contact@anduril.com . - Exercise Caution with Unsolicited Outreach: If you receive any communication that appears suspicious, contains grammatical errors, or makes unusual requests, do not engage. Always confirm the sender's email domain is @anduril.com before providing any personal information or clicking on links. - What to Do If You Suspect Fraud: Should you encounter any questionable or fraudulent outreach claiming to be from Anduril, please report it immediately to contact@anduril.com . Your proactive caution is invaluable in protecting your personal information and upholding the security and trustworthiness of our recruitment efforts. Data Privacy To view Anduril's candidate data privacy policy, please visit https://anduril.com/applicant-privacy-notice/ . By submitting your application, you consent to Anduril Industries using a third-party service provider to conduct pre-employment risk, integrity, and due diligence screening and assessing potential risks as part of your application process. This third-party service provider provides risk-intelligence services that may include analysis of sanctions and watchlists, adverse media, public-record information, and other lawful open-source or commercial data sources. This third-party service provider does not act as a consumer reporting agency. Use of this provider helps to ensure compliance with applicable laws and protect technology, intellectual property, and organizational security.
Member of Technical Staff, Security Engineer
Magic’s mission is to build safe AGI that accelerates humanity’s progress on the world’s most important problems. We believe the most promising path to safe AGI lies in automating research and code generation to improve models and solve alignment more reliably than humans can alone. Our approach combines frontier-scale pre-training, domain-specific RL, ultra-long context, and inference-time compute to achieve this goal. ABOUT THE ROLE: As a Security Engineer at Magic, you will build the software, automation, and infrastructure that protect our models, systems, and engineering organization from both traditional and frontier AI cyber threats. You will respond to security threats, help us build good practices around security incident/threat response. The role sits at the intersection of software engineering, infrastructure, and security. You will work closely with researchers, infrastructure engineers, and platform teams to reduce risk while considering the productivity impact. You will help us make the secure path the easy, productive path. The threat landscape is changing, supply chain attacks are a major concern, prompt injections and other LLM-native attack vectors are worrying. As frontier AI systems become increasingly capable, security is evolving beyond defending infrastructure alone. Modern models can autonomously discover vulnerabilities, chain exploits across multiple systems, manipulate agents through prompt injection, and escape “secure” containment. AI safety is extremely important to us at Magic. You will collaborate with our alignment team on whatever they might need to ensure that Magic's models are a safe net-benefit to the world. WHAT YOU MIGHT WORK ON: - Design, build, and maintain security tooling and automation used by Magic's engineering teams - Secure developer infrastructure, CI/CD pipelines, build systems, and production services and make the platform tools easy to use - Support our sandboxes team with building secure sandboxing and isolation for untrusted code, agent and model execution - Build guardrails against emerging AI attack vectors, including prompt injection, tool abuse, exploit chaining, and autonomous model behavior - Protect model weights, research artifacts, datasets, and production infrastructure from unauthorized access, lateral movement, and exfiltration - Respond to security incidents and live threats WHAT WE’RE LOOKING FOR: - Software engineering skills with experience building production systems in Rust, Go, Python, C++, Kotlin, TypeScript, or similar languages - A very good understanding of modern MITRE att&ck techniques - Actively engaged in the role of LLMs in securing and attacking software systems - On-call readiness 24/7, assisted by our team - Experience securing distributed systems, cloud infrastructure, or large-scale production environments - Ability to develop high-complexity cloud Linux-based exploits - Deep understanding of UNIX or other operating systems, networking, authentication, authorization, and modern security architecture - Experience building automation and tooling to secure fast paced organizations - Track record of exceptional personal integrity, accountability and trustworthiness in high autonomy environments OUR CULTURE - Integrity. Words and actions should be aligned - Hands-on. At Magic, everyone is building - Teamwork. We move as one team, not N individuals - Focus. Safely deploy AGI. Everything else is noise - Quality. Magic should feel like magic Magic strives to be the place where high-potential individuals can do their best work. We value quick learning and grit just as much as skill and experience. COMPENSATION, BENEFITS, AND PERKS (US): - Annual salary ranges between $225K - $550K based on experience - Equity is a significant part of total compensation, in addition to salary - 401(k) plan with 6% salary matching - Generous health, dental and vision insurance for you and your dependents - Unlimited paid time off - Visa sponsorship and relocation stipend to bring you to SF, if possible - A small, fast-paced, highly focused team
Software Engineer - Physical AI Security
Applied Intuition, Inc. is powering the future of physical AI. Founded in 2017 and now valued at $15 billion, the Silicon Valley company is creating the digital infrastructure needed to bring intelligence to every moving machine on the planet. Applied Intuition services the automotive, defense, trucking, construction, mining and agriculture industries in three core areas: tools and infrastructure, operating systems, and autonomy. Eighteen of the top 20 global automakers, as well as the United States military and its allies, trust the company’s solutions to deliver physical intelligence. Applied Intuition is headquartered in Sunnyvale, California, with offices in Washington, D.C.; San Diego; Ft. Walton Beach, Florida; Ann Arbor, Michigan; London; Stuttgart; Munich; Stockholm; Bangalore; Seoul; and Tokyo. Learn more at applied.co http://applied.co. We are an in-office company, and our expectation is that full-time employees primarily work from their Applied Intuition office 5 days a week. However, we also recognize the importance of flexibility and trust our employees to manage their schedules responsibly. This may include occasional remote work, starting the day with morning meetings from home before heading to the office, or leaving earlier when needed to accommodate family commitments. This in-office expectation does not apply to contractor positions ABOUT THE ROLE We're building a Physical AI security platform – a system powered by AI agents that supports in building secure Physical AI and Vehicle Intelligence platforms. It spans the full product lifecycle, and everything it produces has to hold up under external scrutiny. You'll be an early engineer on the team with real latitude over what gets built and how it gets done. AT APPLIED INTUITION, YOU WILL: - Build agentic security workflows to support threat modeling, cyber risk analysis, threat detection, and investigation capabilities on the platform - Build AI risk engines, intelligent intrusion detection engines, security testing engines, and security testing simulation engines which make up the physical AI security platform - Architect the agentless integration with web applications, AI agents, and devices under testing like software-defined vehicles and mining trucks - Deploy LLM-powered or agentic features to production using structured output, tool use, multi-step workflows, and human-in-the-loop review - Own full-stack development end-to-end from database schema design to frontend UI interfaces - Model complex, highly relational domains featuring versioned entities, traceability, and long-running asynchronous workflows with durable state. WE'RE LOOKING FOR SOMEONE WHO HAS: - B.S. in Computer Science or a related field, or equivalent practical experience with 5+ years building and shipping production software - Experience across the stack using TypeScript and React - Proficiency with a typed backend server language (Go, Rust, Python, or similar) owning features from schema to UI - Experience building information-dense interfaces for expert users, including large tables, live-updating views, structured authoring, and keyboard-driven navigation NICE TO HAVE: - Background in security engineering or building security web applications, tools, or a security platform - Experience in the cybersecurity domain as a software engineer Compensation at Applied Intuition for eligible roles includes base salary, equity, and benefits. Base salary is a single component of the total compensation package, which may also include equity in the form of options and/or restricted stock units, comprehensive health, dental, vision, life and disability insurance coverage, 401k retirement benefits with employer match, learning and wellness stipends, and paid time off. Note that benefits are subject to change and may vary based on jurisdiction of employment. Applied Intuition pay ranges reflect the minimum and maximum intended target base salary for new hire salaries for the position. The actual base salary offered to a successful candidate will additionally be influenced by a variety of factors including experience, credentials & certifications, educational attainment, skill level requirements, interview performance, and the level and scope of the position. Please reference the job posting's subtitle for where this position will be located. For pay transparency purposes, the base salary range for this full-time position in the location listed is: Compensation range not provided—request from comp team. Don't meet every single requirement? If you're excited about this role but your past experience doesn't align perfectly with every qualification in the job description, we encourage you to apply anyway. You may be just the right candidate for this or other roles. Applied Intuition is an equal opportunity employer and federal contractor or subcontractor. Consequently, the parties agree that, as applicable, they will abide by the requirements of 41 CFR 60-1.4(a), 41 CFR 60-300.5(a) and 41 CFR 60-741.5(a) and that these laws are incorporated herein by reference. These regulations prohibit discrimination against qualified individuals based on their status as protected veterans or individuals with disabilities, and prohibit discrimination against all individuals based on their race, color, religion, sex, sexual orientation, gender identity or national origin. These regulations require that covered prime contractors and subcontractors take affirmative action to employ and advance in employment individuals without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, protected veteran status or disability. The parties also agree that, as applicable, they will abide by the requirements of Executive Order 13496 (29 CFR Part 471, Appendix A to Subpart A), relating to the notice of employee rights under federal labor laws. Don’t meet every single requirement? If you’re excited about this role but your past experience doesn’t align perfectly with every qualification in the job description, we encourage you to apply anyway. You may be just the right candidate for this or other roles. Applied Intuition is an equal opportunity employer and federal contractor or subcontractor. Consequently, the parties agree that, as applicable, they will abide by the requirements of 41 CFR 60-1.4(a), 41 CFR 60-300.5(a) and 41 CFR 60-741.5(a) and that these laws are incorporated herein by reference. These regulations prohibit discrimination against qualified individuals based on their status as protected veterans or individuals with disabilities, and prohibit discrimination against all individuals based on their race, color, religion, sex, sexual orientation, gender identity or national origin. These regulations require that covered prime contractors and subcontractors take affirmative action to employ and advance in employment individuals without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, protected veteran status or disability. The parties also agree that, as applicable, they will abide by the requirements of Executive Order 13496 (29 CFR Part 471, Appendix A to Subpart A), relating to the notice of employee rights under federal labor laws. FOR US-BASED ROLES: Applied Intuition is committed to providing an accessible and inclusive application and interview experience to applicants who are disabled veterans and other applicants with disabilities or medical conditions. Reasonable accommodations are available, requesting an accommodation will not affect your candidacy in any way, and you are not required to disclose the nature of your disability or medical condition in order to make a request. If you require an accommodation please contact careers@applied.co. We will work with you!
Senior Security Engineer - SecOps
Why Mozilla? Mozilla Corporation is the non-profit-backed technology company that has shaped the internet for the better over the last 25 years. We make pioneering brands like Firefox, the privacy-minded web browser. Now, with more than 225 million people around the world using our products each month, we’re shaping the next 25 years of technology and helping to reclaim an internet built for people, not companies. Our work focuses on diverse areas including AI, social media, security and more. And we’re doing this while never losing our focus on our core mission – to make the internet better for people. The Mozilla Corporation is wholly owned by the non-profit 501(c) Mozilla Foundation. This means we aren’t beholden to any shareholders — only to our mission. Along with thousands of volunteer contributors and collaborators all over the world, Mozillians design, build and distribute open-source software that enables people to enjoy the internet on their terms. About this team and role: Mozilla is looking for an Incident Responder to monitor and mitigate attacks across Mozilla’s products and services. In this position, you will be a part of a flexible team responsible for handling security incidents. As such, you’ll need to have years of practical security experience and knowledge of the state of the art for detecting and responding to attacks. You’ll be someone Mozillians across the company depend on and trust to respond quickly and effectively in a crunch, with the outstanding communication and collaboration skills needed to work in partnership with diverse stakeholders. Most importantly, you will become a critical member of the team responsible for ensuring the integrity of Mozilla’s products and for keeping Mozilla’s users safe, within a company dedicated to building a more secure internet. What you'll do: - Identify and respond to security incidents on a global scale. - Act as an incident commander to drive incidents through the entire response lifecycle. - Design and maintain a portfolio of security alerts, automated actions, playbooks and escalation workflows in support of a high-performing 24/7 incident response capability. - Conduct threat hunting activities, anticipate future threats, and maintain forward-thinking strategies for tools/technology/processes that combat sophisticated threat actors. - Research threat intelligence reports, triage and manage resulting workflows. - Partner with key stakeholders and communicate effectively to maintain a continuously improving feedback loop of preparation, identification, analysis, containment, and post mortem activities. - Participate in on-call rotation. What you'll bring: - 5+ years of demonstrated ability managing security incidents at a global scale and/or experience working in Security Operations Centers (SOC), Product Security Incident Response Teams (PSIRT), and Computer Security Incident Response Teams (CSIRT). - Expertise with security information and event management (SIEM) systems (eg. ELK, Google BigQuery, Splunk, etc.). Splunk proficiency is preferred. - Expertise with endpoint detection and investigation. Hands-on experience with leading EDR tools and demonstrated ability to leverage endpoint telemetry to find root cause. - Expertise with security orchestration and automation (SOAR) platforms such as Tines or Splunk SOAR. - Superb communication and leadership capacity; ability to partner effectively with diverse company stakeholders. - Real-world experience in software development and/or engineering operations for consumer products and services; B.S. in a technology-focused field is helpful. - Practical experience working with cloud technologies (eg. Google Cloud Platform, Amazon Web Services, Heroku, Microsoft Azure, etc.). Competencies: - Ownership and Accountability - Autonomy - High Level of Integrity - Clear Communication - Creative Problem Solver - Passionate about Security What you’ll get: - Generous performance-based bonus plans to all eligible employees - we share in our success as one team - Rich medical, dental, and vision coverage - Generous retirement contributions with 100% immediate vesting (regardless of whether you contribute) - Quarterly all-company wellness days where everyone takes a pause together - Country specific holidays plus a day off for your birthday - One-time home office stipend - Annual professional development budget - Quarterly well-being stipend - Considerable paid parental leave - Employee referral bonus program - Other benefits (life/AD&D, disability, EAP, etc. - varies by country) About Mozilla Mozilla exists to build the Internet as a public resource accessible to all because we believe that open and free is better than closed and controlled. When you work at Mozilla, you give yourself a chance to make a difference in the lives of Web users everywhere. And you give us a chance to make a difference in your life every single day. Join us to work on the Web as the platform and help create more opportunity and innovation for everyone online. Commitment to diversity, equity, inclusion, and belonging Mozilla understands that valuing diverse creative practices and forms of knowledge are crucial to and enrich the company’s core mission. We encourage applications from everyone, including members of all equity-seeking communities, such as (but certainly not limited to) women, racialized and Indigenous persons, persons with disabilities, persons of all sexual orientation s, gender identities, and expressions. We will ensure that qualified individuals with disabilities are provided reasonable accommodations to participate in the job application or interview process, to perform essential job functions, and to receive other benefits and privileges of employment, as appropriate. Please contact us at hiringaccommodation@mozilla.com to request accommodation. We are an equal opportunity employer. We do not discriminate on the basis of race (including hairstyle and texture), religion (including religious grooming and dress practices), gender, gender identity, gender expression, color, national origin, pregnancy, ancestry, domestic partner status, disability, sexual orientation, age, genetic predisposition, medical condition, marital status, citizenship status, military or veteran status, or any other basis covered by applicable laws. Mozilla will not tolerate discrimination or harassment based on any of these characteristics or any other unlawful behavior, conduct, or purpose. Group: D LI-REMOTE Req ID: R3224 Hiring Ranges: Remote Spain €58.000 - €77.000 EUR
AI Agent Security Architect
Replit is the agentic software creation platform that enables anyone to build applications using natural language. With millions of users worldwide, Replit is democratizing software development by removing traditional barriers to application creation. About the Role We are looking for an AI Agent Security Architect to function as the primary technical authority for Replit’s autonomous and AI agent security blueprint. In this critical role, you will design, implement, and maintain the runtime defense systems, guardrail frameworks, and sandboxing architectures that govern AI agents executing code, invoking tools, and reasoning across our platform. You will be a key technical contributor—leading high-impact AI security initiatives and bridging the gap between non-deterministic AI behavior and rigorous cybersecurity controls for both engineering and executive leadership. What You'll Do - AI Agent Security Strategy & Technical Execution - AI Agent Security Blueprint: Define the long-term vision and architectural patterns for securing autonomous agent workflows, Model Context Protocol (MCP) integrations, multi-turn reasoning loops, and multi-agent coordination. - Runtime Guardrails & Policy Enforcement: Architect and deploy dynamic input/output guardrail systems, semantic firewalls, and real-time intent verification filters to prevent goal hijacking, system prompt leaks, and indirect prompt injections. - Agent Execution & Tool Sandboxing: Partner with Infrastructure and AppSec teams to design secure, short-lived, micro-isolated environments (e.g., microVMs, WebAssembly, container sandboxes) where agents can dynamically execute code, run shell commands, and interact with host operating systems safely. - Agentic Threat Modeling & Red Teaming: Conduct specialized threat modeling against non-deterministic systems. Lead automated and manual AI red-teaming initiatives to uncover vulnerabilities in RAG context pipelines, vector stores, and tool-calling interfaces. - Identity, Delegation & Least Privilege: Architect fine-grained permission models and step-up Human-in-the-Loop (HITL) authorization patterns for agents acting on behalf of users—ensuring agents never exceed the delegated privileges of the end user or misuse API keys. - Context & Memory Boundary Security: Design strict data isolation and poisoning prevention controls for vector databases, retrieval-augmented generation (RAG) pipelines, and long-term conversation memories across multi-tenant workloads. - Risk Management & Cross-Functional Enablement - Maintain the AI Security Source of Truth: Define, document, and maintain authoritative secure design patterns and SDKs for engineering teams building internal or customer-facing AI agent capabilities. - Contribution to Risk Register: Identify, quantify, and document non-deterministic and agentic security risks (e.g., OWASP Top 10 for LLMs & AI Agents, MITRE ATLAS), ensuring they are accurately represented in the Cybersecurity Risk Register. - Auditability & Observability: Design tamper-evident logging and telemetry standards for agent reasoning chains, tool execution history, and context assembly to support incident response, forensics, and GRC requirements. - Compliance & Sales Enablement: Partner with GRC to translate complex AI security controls into enterprise-ready audit documentation (e.g., ISO 42001, NIST AI RMF, EU AI Act readiness) and support Sales on complex enterprise security inquiries regarding AI safety. Required Skills & Experience - 6+ years of experience in security engineering or security architecture, with at least 2+ years dedicated specifically to AI/ML security, LLM application security, or securing agentic frameworks. - Deep understanding of agentic architectures and protocols (e.g., Model Context. Protocol (MCP), LangChain, AutoGen, CrewAI, ReAct frameworks, and vector database technologies). - Hands-on expertise with threat vectors unique to agentic AI: Indirect Prompt - Injection, Goal Hijacking, Tool Parameter Tampering, Data Poisoning, and Context Contamination. - Strong background in applying safety standards and risk frameworks such as OWASP Top 10 for LLMs & AI Agents, NIST AI RMF, and MITRE ATLAS. - Proficiency in Python, Go, or TypeScript/JavaScript with a proven track record of reviewing code and building functional security tooling or guardrails. - Experience authoring, maintaining, and evangelizing technical security architecture documentation. - Exceptional ability to communicate complex non-deterministic AI risks to both deep technical engineers and executive stakeholders. - Proven track record of contributing to an enterprise Cybersecurity Risk Register. Bonus Qualifications - Experience designing runtime sandboxing and isolation technologies (e.g., Firecracker, gVisor, Docker, WebAssembly) for dynamic code execution environments. Full-Time Employee Benefits Include: 💰 Competitive Salary & Equity 💹 401(k) Program with a 4% match (US Only) ⚕️ Health, Dental, Vision and Life Insurance 🩼 Short Term and Long Term Disability 🚼 Paid Parental, Medical, Caregiver Leave 🏝 Flexible Time Off (FTO) + Holidays 🚗 Commuter Benefits (In-Office & US Only) 📱 Monthly Wellness Stipend 🧑💻 Autonomous Work Environment 🖥 In Office Set-Up Reimbursement (In-Office Only) 🚀 Quarterly Team Gatherings ☕ In Office Amenities (In-Office Only) Want to learn more about what we are up to? - Self-driving Company https://replit.com/blog/self-driving-company - Replit Agent at Scale https://replit.com/blog/evaluating-and-improving-agent-at-scale - AI Adoption https://replit.com/blog/ai-adoption - Build Open-Source Apps https://replit.com/build/open-source-app-builder Interviewing + Culture at Replit - Operating Principles https://blog.replit.com/operating-principles - Reasons not to work at Replit https://blog.replit.com/reasons-not-to-join-replit To achieve our mission of making programming more accessible around the world, we need our team to be representative of the world. We welcome your unique perspective and experiences in shaping this product. We encourage people from all kinds of backgrounds to apply, including and especially candidates from underrepresented and non-traditional backgrounds.
Staff Product Security Engineer (Security)
Phantom https://phantom.com is on a mission to connect the world to the freedom of open markets. Tens of millions of people all over the world use Phantom to access global markets that never close, including perpetuals, prediction markets, tokenized assets, stablecoins and memes. Phantom users are able to discover the markets that matter and the cultural moments that shape them, building conviction through real-time data and the verified performance of top traders. With self-custody and access to open networks at its core, Phantom lets them control their financial moves in the same app they use to safely store or spend money worldwide. Phantom has reached #1 in Google Play's finance category and consistently ranks in the top 50 apps across all categories. Phantom partners with many of the most trusted and influential names in finance like Hyperliquid, Stripe, Kalshi and Visa, to make the most popular and innovative financial products accessible to everyone. We are around 180 people, fully remote, backed by a $150M Series C investment from a16z, Sequoia Capital and Paradigm. Security is core to Phantom’s product and the trust millions of users place in us. We’re building an AI-native security team that aggressively uses AI to expand the speed, depth, and reach of our work—from code review and threat modeling to vulnerability discovery and security automation. We’re looking for strong security engineers with high agency who can identify the risks that matter, build practical solutions, and take ownership from initial discovery through verified remediation. This is a hands-on, high-impact role spanning architecture, source code, testing, and production systems across Phantom’s mobile, web, and backend products. You’ll work directly with engineering and product teams, lead complex security initiatives, and build capabilities that scale across the company. At the Staff level, you’ll set technical direction and raise the bar for how Phantom designs, builds, and ships secure products. This role is fully remote and open to candidates based in the US, UK and Canada. RESPONSIBILITIES - Product Security Ownership: Partner with engineering teams to identify and address security risks across Phantom’s mobile applications, web products, APIs, and backend services. - Architecture and Threat Modeling: Lead security reviews for new products and major architectural changes, with particular attention to authorization boundaries, sensitive data, transaction integrity, key material, and third-party integrations. - Secure Product Development: Embed practical security controls into the software development lifecycle, from design and implementation through testing, release, and production operation. - Code Review and Security Testing: Perform AI assisted security code reviews and targeted testing of high-risk features. Build repeatable approaches that help find vulnerabilities before they reach production. - Security Tooling: Develop and improve tooling that gives engineers fast, actionable security feedback without creating unnecessary friction. Use automation and AI-assisted workflows where they materially improve coverage or speed. - Software Supply Chain Security: Harden CI/CD, build, and release systems against supply chain threats, including dependency risk, secrets exposure, build provenance, artifact integrity, and compromised developer or automation workflows. - Vulnerability Management: Triage findings from internal testing, researchers, bug bounty submissions, and third-party assessments. Work with owners to determine real-world impact and drive issues through verified remediation. - Incident Response: Support the investigation of product security incidents and suspicious activity. Turn lessons from incidents into durable improvements to product architecture, detection, and engineering standards. - Technical Leadership: Establish product security patterns and expectations across engineering. At the Staff level, lead ambiguous, cross-functional initiatives and influence architecture beyond any single product team. QUALIFICATIONS - 5+ years of experience in product security, application security, security engineering, or software engineering, including experience operating at a senior or staff level. - Strong understanding of web, mobile, API, and distributed-system security, including authentication, authorization, session management, cryptography, and common vulnerability classes. - Hands-on experience building or applying AI-assisted security tooling to test applications and APIs, combining automated analysis with source-code review and manual validation. - Demonstrated ability to review production code in one or more languages such as TypeScript, JavaScript, Rust, Python and Go. - Experience securing software supply chains and CI/CD systems, including dependencies, build infrastructure, secrets, artifacts, signing, and release integrity. - Experience threat modeling complex products and translating security risks into concrete engineering requirements. - Strong judgment when evaluating exploitability, business impact, and appropriate remediation. - Track record of partnering effectively with engineering and product teams while maintaining a high security bar. - Clear written and verbal communication, including the ability to explain technical risk to both engineers and non-security stakeholders. NICE TO HAVES - Experience securing consumer financial products, wallets, payments, or other systems where client integrity and transaction safety are critical. - Familiarity with blockchain systems, smart-contract interactions, transaction simulation, signing workflows, or self-custodial wallet architecture. - Experience securing browser extensions or native mobile applications. - Experience building and integrating application-security tooling, static or dynamic analysis, security test infrastructure, or policy-as-code controls. - Familiarity with AWS, Kubernetes, CI/CD systems, and cloud-native service architectures. - Experience working with bug bounty programs or coordinating external security assessments. WHY WORK WITH US Phantom is built by a team of experienced product and engineering leaders working to make crypto-powered finance safer and easier to use. Our products serve a large and rapidly growing global community, which makes security engineering here both technically challenging and directly consequential. This role offers the opportunity to: - Protect products used by tens of millions of people. - Work on security problems spanning mobile, browser, backend, cloud, and blockchain systems. - Shape product architecture early rather than reviewing security only at the end. - Build durable security capabilities while the company and product surface continue to grow. - Work with engineers who care deeply about product quality, user experience, and security. BENEFITS - Competitive salary and equity - Eligibility to participate in the company’s performance bonus program - Comprehensive medical, dental, and vision insurance with 100% coverage - Stipend for your ideal remote setup - Flexible hours and a supportive remote environment - Unlimited vacation—take time when you need it - 401(k) retirement plan - Monthly wellness benefit - Weekly meal benefit - Global off-sites The target base salary for this role will range between $200,000 to $250,000 with the addition of equity and benefits. This is determined by a few factors including your skillset, prior relevant experience, quality of interviews and market factors (such as location) at the point in time of offer. We strongly encourage candidates of all backgrounds to apply. We believe that our work is stronger with a variety of perspectives, and we’re eager to further diversify our company. If you have a background that you feel would make an impact at Phantom, please consider applying. We’re committed to building an inclusive, supportive place for you to do the best work of your career. By submitting your resume and application materials, you acknowledge and agree that Phantom Technologies, Inc. ("Phantom") collects and processes your personal information (including application materials, interview records, and related data) to evaluate your candidacy. Phantom may use AI-powered tools and third-party service providers for transcription, note-taking, scheduling, and other administrative tasks. Phantom does not sell your information and your materials will be handled securely and in accordance with applicable data protection laws.
Get tailored job alerts, not another account to manage
Start with your email. We’ll send the newest roles for this site each day; unsubscribe in one click.
Coming soon: automatic applications. You’ll be able to define your criteria and let Jobs in Rust apply to matching roles. This is a preview only—applications are not automated today.