Twilio is hiring a Staff Offensive Security Engineer to perform manual and automated penetration testing (web, API, mobile), conduct network and cloud assessments (AWS/Azure/K8s), validate vulnerabilities, design adversary emulation/red team operations, develop custom exploits and payloads, and build automated AI/LLM testing frameworks. Requires 7+ years in offensive security/pen testing/bug bounty, proficiency with tools like Burp Suite, Nmap, Metasploit, familiarity with MITRE ATT&CK and OWASP Top 10, scripting in Python/Bash/C++, and experience with C2 frameworks and AI security tooling.

Hands-on role responsible for scoping, planning, and executing collaboration-platform migrations during acquisitions, owning email and domain security, designing DLP and access controls, supporting legal/eDiscovery workflows, and building automation and governance for multi-entity environments. Requires experience administering Google Workspace and Slack at scale and leading M&A or systems-consolidation migrations.

Responsible for scoping, planning, executing, and closing M&A-driven migrations of collaboration platforms and domains into the parent environment. Own platform architecture, governance, email and domain security, eDiscovery and archiving workflows, DLP and access controls, tooling/automation, and vendor management across multiple brands and entities.

Senior role owning endpoint security posture across macOS, Windows, and BYOD mobile devices. Responsibilities include writing MDM configuration as code, building patch automation and software distribution, mining fleet telemetry for detections and automation, enforcing managed browser/extension policy, and partnering with IT, SecOps, and engineering teams. Role is based in New York, NY (HQ).

Lead Sysdig's security engineering function reporting to the CISO: build and grow a senior security engineering team, own the security-engineering roadmap, standards, and budget, drive AI-first and agentic security capabilities, secure AI workloads, partner with product and engineering, and advance continuous assurance for compliance frameworks (ISO 27001/27701, SOC 2). Requires 8+ years in security/software engineering and 4+ years managing engineers. U.S. salary range listed: 186,000–256,000 USD/year.

CrowdStrike seeks a Senior Software Engineer focused on vendor semantics and developer experience. The role owns a vendor schema registry and semantic validation pipeline that ingests OpenAPI/Swagger/Smithy and related specs, detects schema evolution and breaking/semantic changes, and maintains a canonical ontology-backed knowledge graph. Requires proficiency with Go, Rust and/or Python, API specification formats, graph data models, and building internal SDKs and tooling. Base salary range for U.S. candidates: $145,000–$220,000 per year.

Twilio seeks a Staff Engineer, Security Engineering Partners (remote, based in Ontario, British Columbia or Alberta, Canada) with 8+ years in security engineering to design and implement scalable security capabilities, lead security reviews, drive risk reduction, mentor engineering teams, and partner with product and engineering groups. Required skills include Python, threat modeling, CI/CD, and experience with application/cloud/product security; experience with LLMs, IaC, containerization, and AWS is desired.

Manage four language-focused teams (~18 engineers) responsible for CVE analysis, vulnerability assessment, and patch backporting across Java, JavaScript/Go, Python, and PHP ecosystems. Set technical direction, enforce security and release processes, drive CI/CD and tooling consistency, and own SLA compliance and cross-team coordination. Requires 6+ years hands-on development experience and 3+ years engineering leadership, with strong Java experience and security research familiarity.

100% remote (Europe) contract role delivering hands-on platform and security engineering for Form3's cloud-native payments systems. Responsibilities include designing and building distributed, production-ready capabilities across API security, cryptographic controls, AI governance, software supply chain security and automated security tooling using Go and cloud/container technologies (AWS/GCP/Azure, Kubernetes). Contractors must be based in one of the listed European countries and will start their first day in a local office to collect equipment.

Lead architecture and implementation of the identity stack including Okta, Workday-driven provisioning, SSO (SAML/OIDC/OAuth), SCIM, AWS identity patterns, OPA/Rego policy-based authorization, and machine identity lifecycle. Role includes securing AI agent identities, integrating device posture via MDM and device certificates, enforcing zero-trust controls, maintaining documentation/runbooks, and mentoring junior engineers. Position is remote within the US with location-based pay zones.

Reddit is hiring a Senior Backend Engineer on the Identity and Access Management team to design, build, and maintain high-performance, highly scalable authentication, authorization, and identity services. Responsibilities include selecting and driving high-leverage projects, improving architecture for performance and scalability, mentoring teammates, and collaborating with product, security, and engineering teams. Requirements include 5+ years designing and developing large-scale distributed backend systems, 2+ years in security-sensitive domains (IAM, security, privacy, or anti-abuse), technical knowledge of identity concepts and auth protocols (OAuth2, OIDC, SAML), proficiency in a general-purpose language (preferably Go), and experience or interest in cloud infrastructure (Kubernetes, CI/CD, AWS, GCP). Base salary range listed: $190,800–$267,100 USD per year.

The GRC Manager will own Mattermost's compliance posture end-to-end (federal readiness and commercial certifications), lead certification and surveillance cycles (CMMC, NIST, ISO 27001, SOC 2), operate risk and third-party vendor risk programs, apply GRC engineering and AI for continuous controls monitoring and automation, coordinate external audits, maintain compliance artifacts, manage customer security assurance, and grow the GRC team. Role requires U.S. citizenship and location in the United States.

Manage AI information security operations and engineering with emphasis on securing LLMs and generative AI. Responsibilities include incident response, playbook development, tooling maintenance, AI governance, threat analysis, and post-incident review. Requires 5+ years in information security operations and 2+ years in AI/ML security. Employer cannot sponsor visas.

The Director of Engineering, Security Factory will set the engineering vision and roadmap across nine distributed teams building proprietary security scanners, AI/ML detection engines, agentic remediation flows, and supporting security foundations. The role includes leading managers and engineers, driving architecture and delivery decisions, partnering with product management, and representing the group in cross-functional and customer-facing contexts within a remote, async-first organization.

Pindrop seeks a Senior Security Researcher (Red Team) to design and execute red team operations and adversarial ML attacks against GenAI/LLM pipelines, SaaS products, APIs, and cloud environments (AWS/GCP). Responsibilities include deepfake and voice synthesis testing, penetration testing, threat modeling, security code reviews, developing automation for offensive workflows (Python preferred), and partnering with SecOps and product teams to improve detections and remediation.

Join STRIKE as an engineering counterpart to threat researchers to own the pipeline from findings to production artifacts (detection rules, feeds, APIs). Requires 5+ years engineering experience with threat intelligence, production systems that consume/emit threat intel, strong Python and TypeScript/Node skills, working knowledge of STIX/TAXII/MISP/MITRE ATT&CK, hands-on YARA and Sigma experience, and experience shipping systems using language models. Remote role tied to Pittsburgh, PA; company states it does not provide immigration sponsorship for this position.

Join STRIKE to own the research-to-production pipeline: build and maintain platform components (distribution servers, sandbox orchestration, ingestion, agent runtimes), produce detection content (YARA, Sigma, STIX), drive STIX/TAXII adoption, and ship model-driven and traditional workflows. Requires 5+ years of engineering experience with threat intelligence or detection engineering, production-level Python and TypeScript, cloud and CI/CD experience, and hands-on experience with threat intel standards and detection tooling.

Remote role (listed with Colorado Springs, CO) on SecurityScorecard's STRIKE team. Owns the research-to-production pipeline: building platform components, detection content (YARA, Sigma, STIX), feed distribution, and model-assisted research workflows. Requires 5+ years engineering experience with prior production systems consuming or emitting threat intel; production experience with language models, Python and TypeScript/Node, cloud infrastructure (AWS), containers, CI/CD, and familiarity with STIX/TAXII/MISP/MITRE ATT&CK. No immigration sponsorship provided. Estimated total compensation range listed: USD 140000–180000 per year.

Join STRIKE as the engineering counterpart to threat research: own the research-to-production pipeline for detections and feeds, build and maintain platform components (distribution servers, sandbox orchestration, ingestion pipelines, agent runtimes, rules engines), drive STIX/TAXII schema adoption, and ship production systems that leverage language models with retrieval, schema validation, and eval harnesses. Requires hands-on experience with threat intel data, detection tooling (YARA, Sigma, STIX), Python and TypeScript/Node, cloud (AWS), containers, and CI/CD.

Join STRIKE as the engineering counterpart to threat research, owning delivery from research outputs (malware findings, indicators, behavioral patterns) to production artifacts (detection rules, feeds, APIs). The role requires production experience with threat intel data, detection tooling (YARA, Sigma, STIX), cloud and CI/CD infrastructure, and shipping systems that use language models with retrieval, schema validation, and eval harnesses.