Senior individual contributor in CrowdStrike's GRC organization to own ServiceNow as the TPRM platform of record, design and optimize vendor risk workflows, lead automation and AI-driven enhancements, manage day-to-day assessment operations and SLAs, and support audits and controls. Requires 10+ years in TPRM/GRC/information security risk, hands-on ServiceNow TPRM experience, and experience integrating AI/ML and cross-functional risk controls.

Work as a Senior Offensive Security Engineer on the Product Red Team to design and execute adversary simulations across web apps, APIs, identity, multi-tenant isolation, and integration planes. Own end-to-end engagements (charters, threat modeling, hypothesis backlogs, technical reporting), collaborate with detection and incident teams to validate visibility, and apply AI-driven and manual offensive techniques to drive systemic remediation.

Senior engineering role within Reddit's Security, Privacy, Assurance, and Corporate Engineering (SPACE) org focusing on Identity & Access Management. Responsibilities include building and operating core IAM platforms and API integrations, improving observability, supporting compliance and audits, troubleshooting production incidents, and mentoring cross-functional teams. Requires 10+ years backend experience and familiarity with IAM tools/protocols (e.g., Okta, SailPoint, OAuth/OIDC/SAML) and technologies such as Go, Python, Java, TypeScript, Postgres, Docker, Kubernetes, and AWS.

Lead assessment and mitigation of security risks in the virtualization stack (hypervisor, KVM/QEMU). Build systematic threat models, shared impact/likelihood rubrics, and propose defense-in-depth mitigations; collaborate with product and kernel teams to implement remediations. Required: deep familiarity with at least one kernel security feature, experience with virtualization performance trade-offs, and strong communication with engineering teams. Preferred: 5+ years systems-level coding, experience with threat models, side-channel mitigations, and languages such as Go, Rust, or C.

Quora seeks a Senior Software Engineer for its Security Engineering team to secure cloud infrastructure and compute platforms. Responsibilities include threat modeling, building and integrating security tooling (IaC, CI/CD, monitoring), hardening OS and cloud environments (AWS, Kubernetes), and participating in incident response. Role is remote-first and requires availability during Quora coordination hours (Mon-Fri 9am-3pm Pacific Time).

Role on the Secure Design team partnering with product and engineering teams to threat model applications, assess and reduce security risk, provide remediation guidance, run vulnerability management, mentor engineers, and build automation and tooling to scale product security practices.

Join the Secure Design team as a Staff Product Security Engineer owning the security risk posture of the virtualization stack. Responsibilities include building systematic threat models and rubrics, proposing and implementing defense-in-depth mitigations, collaborating with kernel/virtualization/provisioning teams, mentoring engineers, and helping run vulnerability management. Role reports to the Manager of Secure Design and is a hybrid position. Compensation range listed: $175,000–$190,000.

Own the security risk posture for the virtualization stack by creating systematic threat models, shared rubrics for impact/likelihood, and proposing defense-in-depth mitigations. Collaborate with kernel, virtualization, provisioning, and product teams to implement remediations, mentor engineers, and help run vulnerability management. Required familiarity with kernel security features, QEMU/KVM performance considerations, and modern virtualized/containerized development workflows.

Lead architecture and execution of critical cryptographic infrastructure (including MPC, KMS, HSM) for Coinbase's Tier-0 custody systems. Build highly available, low-latency distributed services, define multi-quarter technical strategy, own secure implementation of cryptographic protocols in a zero-trust environment, and drive cross-functional alignment. Requires 8+ years software engineering experience and deep applied cryptography expertise; experience with Golang, Java, C++, or Rust is expected.

Join Coinbase's Security Platform Engineering team to lead architecture and execution of critical cryptographic infrastructure (including KMS/HSM and MPC) that secures customer assets and ensures global regulatory compliance. Role requires 5+ years building highly available distributed systems, deep domain expertise in applied cryptography or KMS/HSM, strong systems programming experience (Golang, Java, C++, or Rust), and experience operating Tier-0 critical infrastructure. Position is remote-first (USA) with quarterly in-person sessions; annual base salary range $186,065–$218,900 USD.

Seeking a Senior Software Engineer to design, develop, deploy, and operate cloud-native authentication and identity services (Go/Python) for Pindrop’s Passport platform. Role involves working with AWS and GCP managed services, building data pipelines for ML/risk models, owning CI/CD and infrastructure-as-code, using observability tooling, collaborating with cross-functional teams, and participating in on-call rotation. Compensation range listed: $130,000–$170,000 USD base per year.

Contract Senior DevOps Engineer responsible for HashiCorp Vault administration (secrets, PKI, dynamic credentials, policies), building cloud architecture on AWS/Azure, managing Linux/UNIX systems, and creating automated CI/CD pipelines. Requires 5+ years experience with Vault, cloud migrations, scripting (Python/Ansible), and leading small technical teams.

NVIDIA Cloud Engineering & Services seeks a Principal Software Engineer to mature the APF v0 into a production core platform. Responsibilities include implementing the Runtime Policy Verifier and signed-policy verification, designing deterministic policy projection to runtimes, building conformance and verification suites, collaborating with runtime owners, and driving architecture, versioning, and security specifications. Requires 15+ years experience and strong systems, security, and distributed-systems engineering skills.

Responsible for implementing and maintaining mobile app hardening (RASP, code obfuscation, root/jailbreak detection), enforcing certificate pinning and secure TLS, preventing leaks of sensitive data, securing use of Android Keystore and iOS Keychain, delivering reusable mobile security components (biometric login, secure storage, device attestation), and performing regular pentesting and reverse-engineering using tools like Frida, Ghidra, and MobSF. Requires deep knowledge of Android (Kotlin/Java) and iOS (Swift/Obj-C) internals and familiarity with OWASP MASVS.

Lead API security efforts including detection and exploitation of business-logic vulnerabilities (BOLA/IDOR, mass assignment), design and validation of OAuth2/OIDC/JWT authentication and authorization schemes, scripting automated attacks against API gateways to test rate limiting and fraud rules, and working with platform teams to harden gateways (Kong, Azure API Gateway). Requires strong Python scripting and experience with REST and GraphQL security and tools such as Postman, Burp Suite, and 42Crunch.

Senior (principal) role to architect security for APIs, API gateways, microservices (mTLS/service auth), CIAM (OAuth2/OIDC/FAPI, MFA, biometrics), supply-chain integrations, threat modeling and secure SDLC, field-level encryption and privacy engineering (GDPR/CCPA), and mobile/cloud/container/AI security. Requires 8+ years, ability to read code (Java/Kotlin/React/Node.js), and strong banking/fintech experience (payment gateways, ledgers, wallets).

Lead the application security function for banking/fintech features including threat modeling, manual code audits, and architecting SAST/DAST/SCA in CI/CD. Requires 5+ years in application security, proficiency in at least one core language (Java/Spring Boot, Node.js, or Go), strong knowledge of OWASP Top 10 and SANS Top 25, and experience integrating security tools (e.g., Jenkins, GitHub Actions).

SearchApi seeks an experienced engineer to own the browser stack: patch browser engines (Chromium/Firefox) in C++, maintain per-OS fingerprint profiles, eliminate automation-detection signals (navigator, WebGL, canvas, audio, fonts, Client Hints, CDP leaks), and build tooling and tests to prevent regressions. The role requires deep reverse-engineering skills, familiarity with large browser build systems, and proven contributions to browser-engine patches or stealth tooling.

Join DuckDuckGo's Privacy Functional Team to lead and own major components of privacy technology, design systems to protect user privacy, build features for Tracker Radar, and participate in privacy reviews and audits. Role is remote (many listed countries), includes mentoring responsibilities, requires occasional travel (~2 times/year), and offers $178,500 USD annual compensation plus stock options.

Lead solutions architect role focused on designing and implementing SIEM and Elastic Security-based solutions, improving incident response, delivering proof-of-value projects, and guiding SOC workflows. Requires 15+ years of enterprise SIEM experience, familiarity with AI/ML in analytics, forensic analysis, consultative selling, and strong presentation and content-creation skills. Position based in Brazil with travel of 30–50%.