Chainguard seeks a Staff-level product security engineer with 7+ years of experience to design, build, and maintain secure CI/CD pipelines and harden cloud-native products. Responsibilities include implementing supply chain controls (SBOMs, Sigstore, SLSA), Kubernetes hardening, cloud IAM and secrets management, threat modeling, and evaluating CNAPP/CSPM tooling. Strong coding skills in Go or Python and hands-on experience with Kubernetes, GCP/AWS, and container security are required.

Individual contributor Principal Engineer responsible for owning DHI platform architecture, driving multi-quarter roadmaps, setting standards for image and Helm chart hardening (SBOM, SLSA, Sigstore), aligning cross-functional stakeholders, mentoring senior engineers, and participating in on-call incident response. Requires 10+ years backend/distributed systems experience and strong Go and container/Kubernetes ecosystem expertise.

Remote role (US or Canada) responsible for designing and delivering GRC automation and integrations (e.g., Drata), building AI-assisted evidence-collection and control-testing workflows, and owning delivery from scoping through go-live. Requires ~5+ years in security engineering, DevSecOps, solutions engineering, or GRC automation and hands-on scripting/integration experience (Python/JavaScript/APIs).

NerdWallet is hiring a Security Software Engineer (AI & Automation) to design and build AI-driven security solutions — including LLM-based systems, RAG pipelines, automated code review, integrations, and secure backend services — to improve security reviews, reduce risk, and scale SSDLC practices. Requires 3+ years in software or security engineering and experience with Python or Go, backend services, application security concepts, LLM APIs, and cloud/distributed systems (e.g., AWS, containers, Kubernetes/ECS).

Senior engineering role focused on shaping architecture, reliability, scalability, and security of 1Password's identity systems underpinning authentication, authorization, session management, device trust, federation, and integrations. Requires deep Go expertise, extensive experience in identity and access management, leadership in technical strategy, and collaboration across cross-functional teams. Remote within the United States and Canada; travel for in-person engagement is expected.

Join 1Password's Product Security team to implement next-generation security features for macOS, iOS, Android, Windows, Linux and Web apps. Role emphasizes iOS and Apple security (Secure Enclave, biometrics), Rust development and FFI, secure libraries, vulnerability remediation, secure coding guidance, cross-team collaboration, mentoring, and involvement with AI-related security workflows.

Kraken is hiring a Staff (Senior) Security Architect within Kraken Security Labs to design, review, and verify security architecture across a heterogeneous environment. Responsibilities include conducting security assessments and audits, advising blockchain teams, and working hands-on on topics spanning infrastructure security, cryptography, web3, Rust projects, and AI security. Familiarity with OWASP/NIST and strong collaboration and communication skills are expected.

Work on detection and corporate security for Quora and Poe: build and maintain SIEM, write detections, deploy canary tokens, investigate incidents (malware analysis, exfiltration, timelines), create runbooks, and partner with IT on endpoint and identity controls. Requires 5+ years in security/detection engineering, hands-on SIEM experience, endpoint/EDR experience, strong Python skills, and incident response experience. Remote-first role available in the United States and Canada; US and Canada salary ranges provided in the posting.

Work involves maintaining image definition files, adapting upstream Helm charts to security and Kubernetes constraints, tracking upstream releases, writing Go-based integration tests, triaging CVEs, and reviewing peers' work. Requires 6+ years backend engineering experience and strong familiarity with containers, Kubernetes, Helm, YAML, and container/supply-chain security concepts.

Udacity (an Accenture company) seeks external contractors to serve as Cybersecurity Technical Mentors delivering 1:1 sessions, technical deep-dives, and group Q&A. Requires 5+ years relevant experience and strong cybersecurity skills (network, application, system security; threat detection; incident response; familiarity with SIEM/IDS/IPS and security frameworks). Role is remote and targets candidates across US, Canada, Europe, MENA, India and APAC timezones.

Role for a backend engineer to design and build AI security frameworks and primitives integrated with Stripe's AI infrastructure. Responsibilities include creating defenses against AI-specific threats (prompt injection, jailbreaks, tool misuse), partnering with engineering teams to integrate security, and contributing to systems and infrastructure. Minimum requirement: 5+ years software development experience.

Deliver large and complex strategic advisory engagements to assess and mature customers’ cybersecurity and incident response programs. Responsibilities include developing exercise scenarios, producing reports and recommendations, contributing thought leadership, and engaging with management-level stakeholders. Role is Canadian-based (must be legally entitled to work in Canada), may require up to 30% travel, and lists a salary range of CAD 90,000–135,000 per year.

Hands-on senior security engineer embedded in the Docker Desktop team owning security posture across a cross-platform product. Responsibilities include threat modeling, security design and code reviews (Go), CVE triage and coordinated disclosure, partnering with central security, and improving container/runtime and identity-related security (namespaces, cgroups, seccomp, AppArmor/SELinux, OCI runtimes). Role may include on-call duties.

CrowdStrike is hiring a Principal Consultant for Incident Response (Canada, remote). Responsibilities include leading IR engagements, host and network forensics across Windows/Mac/Linux, basic malware analysis, threat hunting, producing written and verbal reports for stakeholders, and contributing thought leadership. Role may require up to 30% travel. Base salary range in Canada: 135,000–200,000 CAD/year.

Join Docker's IAM team to own and evolve the identity backbone used by millions. Responsibilities include building Go services for auth and authorization, extending OIDC/SSO/SAML/SCIM, improving observability, performance, and security, designing for multi-region operation, and participating in on-call rotation. Requires 6+ years backend experience, strong Go proficiency, Postgres, gRPC, event-driven systems (Kafka), AWS, and solid understanding of OAuth2/OIDC/SAML/JWT and authorization models (RBAC/ReBAC).

Security Engineer, Cloud responsible for reviewing cloud deployments, designing and building security-focused infrastructure primitives, leading remediation across the stack, and partnering with infrastructure, data, and DevOps teams. Requires minimum 5 years building software and at least 3 years building in AWS with Terraform. Locations include New York (HQ), Miami, and remote in the US and Canada; relocation support to NYC or SF is noted.

Senior Backend Engineer on the Pipeline Security team responsible for designing and implementing backend architecture, RBAC, GraphQL APIs, and Kubernetes/Helm deployments for GitLab's native Secrets Manager. Work primarily in Ruby on Rails with some Go, own features end-to-end (design through production), collaborate cross-functionally, and focus on CI/CD and software supply-chain security (SLSA).

Join 1Password’s Product Security team as a Senior Developer (Windows) to implement next-generation security features across platforms, develop secure shared libraries, resolve vulnerabilities, and promote secure coding. The role emphasizes Windows security (TPM/HSM, Windows Hello, BitLocker, Secure Boot, Credential Guard), Rust and FFI development, familiarity with cryptography and authentication protocols, cross-team collaboration, mentoring, and participation in occasional in-person events. USA and Canada compensation ranges are listed in the posting.

Lead and manage SOC 1 and SOC 2 examinations and support end-to-end SOX (ICFR) planning and execution. Own IT control assessments (ITGC/ITAC), control design and operating effectiveness testing, remediation, audit evidence collection, and documentation for cloud and hybrid environments while partnering with cross-functional teams and external auditors. Role requires 5+ years of external IT audit or technology risk experience and experience with cloud security controls and large-audit environments.

The Security Risk Lead will run targeted risk assessments, analyze risk data, own systems that track risk decisions and mitigations, oversee risk committees, design metrics/reporting for senior leadership, maintain core security policies/standards, and support third-party/vendor risk assessment. The role requests 6+ years of relevant experience and familiarity with frameworks such as NIST CSF, ISO 27001, PCI DSS, and OWASP. Preferred locations include San Francisco, New York, Denver, or remote within the United States or Canada.