Lead development, execution, and maintenance of FedRAMP certification and compliance plans for cloud and SaaS products. Coordinate cross-functional teams (product, security, cloud, engineering), manage milestones and risks, provide technical guidance on federal security requirements, and leverage AI tools to accelerate compliance processes. Requires a bachelor’s/master’s (or equivalent), 5+ years in cloud/SaaS program management for certification/compliance, and proven FedRAMP authorization experience.

Lead and conduct advanced security research and penetration testing across GitLab's platform and AI/agent surfaces, develop testing methodologies and tooling, validate vulnerabilities with proof-of-concept exploits, drive class-level remediations, mentor others, and coordinate cross-functional remediation. Role expects 10+ years' relevant experience and proficiency in two or more of Ruby, Go, Python, TypeScript, or Rust. US base salary range listed: $203,200–$275,000 USD (for US residents).

Twilio is hiring a Staff Security Engineer on the Threat Detection and Response team to design and build detection tooling, automate response (SIEM/SOAR), perform threat hunting (including AI-related threats per MITRE ATLAS), participate in incident response and on-call rotations, and work with cloud platforms (AWS/GCP) and infrastructure-as-code (Terraform/CloudFormation). The role is remote within the US (some states excluded) and requires 3+ years of security engineering experience in production cloud environments.

Join Point's security team to build and run detection & response capabilities: own SIEM detections, on-call incident response, vulnerability management, and automation (detection-as-code/SOAR). Requires 5+ years in security operations or detection engineering, hands-on SIEM and cloud (AWS, Google Workspace) experience, and U.S. work authorization.

As a Threat Intelligence Platform Engineer you will own the production Vertex Synapse instance, manage platform health and data hygiene, build/feed integrations and enrichments, ship intelligence into detections, blocklists and data pipelines, and partner with Security and Product to translate intelligence needs into production capabilities. Role requires 2+ years building/operating threat intelligence platforms or security data pipelines and software development experience in Python, Go, and/or Storm.

Lead the Device Infrastructure Services team as the technical owner of endpoint tooling, standards and roadmap. Require 7+ years IT/endpoint management experience (including 2+ years at senior/staff IC level), strong scripting and IaC skills (Bash, Python, Terraform), experience with GitOps, enterprise security fundamentals (encryption, patching, EDR, least-privilege, compliance), and practical use of AI to accelerate IT operations. Remote role for candidates in the United States or Canada; responsibilities include incident escalation, piloting tooling, partnering with Security and Product, and defining AI guardrails for device operations.

Join Reddit's Site Defense team within Infrastructure to design, build, and operate ingress-level defenses across CDN, edge, and internal layers. Responsibilities include real-time detection, scoring, and mitigation of malicious traffic, collaborating with Security and Safety teams, contributing to ML-at-Ingress initiatives, owning services end-to-end, and participating in incident response. Requires 7+ years experience with production distributed systems and proficiency in one or more general-purpose languages (Python, Go, Rust, Java, C++); strong networking fundamentals are expected.

Lead the design and implementation of Replit's AI agent security blueprint, including runtime guardrails, sandboxed execution environments, threat modeling/red teaming, fine-grained delegation and least-privilege models, and tamper-evident logging for auditability. Requires 6+ years in security engineering or architecture with at least 2+ years focused on AI/ML or LLM/agent security, and hands-on experience with Python, Go, or TypeScript/JavaScript.

Manage and grow a team delivering second-line advisory GRC coverage for technology and security domains (e.g., DR/resiliency, SDLC, AI, IAM, supply chain). Responsibilities include assessing risk and control effectiveness, partnering with engineering and security teams, driving remediation and governance improvements, coordinating with audit and policy teams, and enabling leadership decision-making. Base salary range: $193,970–$228,200 USD/year.

Join Discord as a Staff Software Engineer on the Safety Processing team to design and implement scalable backend systems (primarily Python) that process safety signals, improve content moderation via ML/AI and automation, mentor engineers, and collaborate across teams. Role is US-based in the San Francisco Bay Area or Los Angeles Area (LA remote possible; SF hybrid). Salary range provided: $279,000–$341,000 USD base.

Technical staff-level role on the Enterprise Security team driving technical strategy and engineering for securing the enterprise AI ecosystem. Responsibilities include designing secure reference architectures for AI platforms, building decision infrastructure and guardrails, AI vetting frameworks, agentic AI identity/posture management, coding and IaC (Python/Go/Java), and mentoring engineers. Requires 7+ years in security engineering and 2+ years in technical leadership; cloud (AWS/GCP) and Kubernetes experience required. Role is remote in the US (not eligible in certain Bay Area cities) and may require occasional travel.

Lead two engineering teams owning Docker Build Cloud, Docker Hub Automated Builds, and SCS Services powering Docker Scout and Hardened Images. Requires demonstrated engineering leadership (5+ years managing teams, 8+ years professional engineering), strong backend and distributed-systems judgement, experience with CI/build systems and container workflows, and focus on software supply-chain security. Remote-first role (East Coast preferred) with hiring locations including Canada and the United States (England listed as a location in the posting).

Elastic is hiring a Senior Security Research Engineer to research attacker techniques, build endpoint visibility and protections, reverse engineer malware, develop high-performance C/C++ production code, and lead technical initiatives. The role requires 6+ years of experience in TTP analysis and detection, development in C/C++/Python, deep OS internals knowledge (Windows prioritized), and malware/reverse-engineering expertise. Compensation is provided as base salary (USD range listed).

Remote (US only) Senior Security Analyst responsible for leading security assurance initiatives (initial focus on FedRAMP 20x and CMMC Level 2), translating regulatory requirements into practical controls, assessing security effectiveness, driving automated and scalable assurance approaches, and collaborating with Engineering and Product Security to improve posture and evidence generation.

Role leads internal and external compliance audits and assessments, assures compliance with frameworks (SOC 2, ISO standards listed), and builds scalable automation and integrations across systems. Requires scripting and workflow automation skills, experience with AI technologies, and several years of related experience. Position is remote for U.S. candidates with a listed U.S. salary range.

GitLab seeks a Staff Corporate Security Engineer to architect and automate endpoint security across macOS, iOS, Windows, and Linux in a fully remote environment. The role emphasizes macOS endpoint hardening, Terraform and Infrastructure-as-Code practices, GitOps workflows, scripting for automation, and collaboration with IT, Security Operations, and detection teams to improve telemetry, detections, and auditability.

Responsible for end-to-end design, implementation, and operation of authentication and authorization capabilities (OAuth, sessions, tokens, 2FA, passkeys) across Coinbase products. Requires 5+ years backend engineering experience, strong proficiency in Go or similar, experience with gRPC/Protocol Buffers, data stores like Redis or DynamoDB, and operating production distributed services with observability and SLOs.

CrowdStrike is hiring a Principal Consultant for Incident Response (remote, US). Role leads IR engagements and teams, performs host and network forensics across Windows/macOS/Linux, conducts malware static/dynamic analysis and reverse engineering, threat hunting, cloud incident response (AWS/Azure/GCP), produces written and verbal reports for stakeholders, and may travel up to 30%. Education degree preferred; equivalent experience considered. US salary range $140,000–$200,000 per year.

Join Stripe's Security Incident Response team to analyze and respond to security notifications and incidents. Responsibilities include initial triage via log and data analysis, assessing impact and severity, containing threats with pre-approved measures, escalating to investigators, tuning and creating detection use cases, enriching data feeds, and automating triage and response processes. Role requires experience with endpoints (Mac/Linux/Windows), cloud (AWS/Azure/GCP), SIEMs, SQL, and scripting/programming.

Lead design and implementation of Customer Identity & Access Management services (authentication, authorization, identity lifecycle). Requires technical leadership, production experience with identity standards (OIDC, OAuth, SAML, SCIM, JWT), system design for scalability and security, and participation in on-call rotation. Preferred experience with Go, Java, Ruby, Keycloak, and role/attribute-based access control.