Jobs Security

Product company is now looking for a Security Engineer for remote work.

This is a FinTech company with 10 years of experience, where users anywhere in the world can buy or sell cryptocurrency in just a few clicks.
Everything is fully legal, thanks to the relevant licenses in the EU and in 48 U.S. states.
The platform supports over 150 currencies, operates with $2+ billion in turnover, and is a trusted partner for millions of people who value speed and transparency in digital finance.

Primary focus: suspicious transaction analysis, attack prevention, threat modeling, and vulnerability remediation in collaboration with the engineering team. Moving forward, the scope of responsibility will expand to include Application Security across other products and Security Operations.

Requirements: 

• experience in Application Security, attack prevention,
• working with SIEM systems.

• Hands-on purple team experience will be a plus.

   

  What the company offers:
  • 20 working days of paid vacation and paid sick leave;
  • Health insurance and corporate English lessons;
  • Full equipment package, including a laptop and monitors;
  • Salary reviews twice a year based on performance reviews.

Position Summary

We have an exciting opportunity to join our team as a Middle SOC Security Engineer.

UnderDefense is looking for a motivated and proactive engineer to join our MDR Engineering team. This role focuses on configuring, maintaining, and improving security monitoring infrastructure across multiple client environments.

The ideal candidate has hands-on experience with at least one SIEM platform, a solid understanding of security technologies, and a willingness to learn new tools and approaches.

We value engineers who take ownership of technical challenges, work independently, and collaborate with the team to deliver effective solutions for our clients.

Job Responsibilities

• Configure, maintain, and troubleshoot SIEM platforms, including Elastic Security, Splunk, Microsoft Sentinel, and other solutions depending on client environments.
• Integrate log sources from Windows, Linux, network devices, cloud services, Microsoft 365, and EDR/XDR solutions.
• Configure and maintain log collection through agents, connectors, APIs, and Syslog.
• Troubleshoot log ingestion, parsing, indexing, and integration issues.
• Develop and maintain parsers for different log sources.
• Create, test, and optimize detection and correlation rules to improve threat detection and reduce false positives.
• Configure SIEM indexes, retention policies, and manage log ingestion volumes.
• Maintain integrations between SIEM/EDR/XDR solutions and the MAXI platform.
• Support technical onboarding of new clients and ensure proper integration into SOC monitoring.
• Monitor the health and performance of existing security solutions.
• Investigate technical issues, identify root causes, and implement effective solutions.
• Communicate directly with clients' IT and security teams to understand technical requirements, discuss challenges, and provide solutions.
• Prepare technical documentation, configuration guides, and troubleshooting instructions.

• Collaborate with other engineers to improve existing processes, automate repetitive tasks, and support the scalability of MDR services.

   

Minimum Qualifications

• Hands-on experience with at least one SIEM platform, preferably Elastic Security, Splunk, Microsoft Sentinel, or a similar solution.
• Practical experience with log collection, processing, analysis, or security integrations.
• Understanding of Windows, Linux, networking fundamentals, and common network protocols.
• Familiarity with Syslog, APIs, JSON, and log formats.
• Experience writing SIEM queries and working with detection or correlation rules.
• Understanding of EDR/XDR technologies and their role in security monitoring.
• Strong troubleshooting and analytical problem-solving skills.
• Basic scripting skills in Bash, Python, or PowerShell.
• Ability to independently investigate technical issues, take ownership of tasks, and deliver results.
• Willingness to learn new technologies and adapt to different security platforms and client environments.

• English communication skills sufficient to discuss technical issues and solutions directly with clients.

   

Nice to Have

• Previous experience in a SOC, MDR, or MSSP environment.
• Hands-on experience with Elastic Stack (Elasticsearch, Logstash, Kibana, Elastic Agent).
• Experience with CrowdStrike, SentinelOne, or Microsoft Defender.
• Familiarity with AWS, Azure, or GCP.
• Experience configuring SIEM environments or integrating log sources from scratch.
• Experience with Git and automating repetitive engineering tasks.

• Experience supporting multiple client environments.

   

The UnderDefense Mission Is Rooted in Values That Drive Us

• We believe that success lies in execution, not credentials.
• We act like owners, not just employees.
• We work to find answers on our own, not wait for them to be given to us.
• We optimize for mission, not ego.
• We take responsibility for solving problems, even when they involve unfamiliar technologies.
• We have growth mindsets, not fixed ones.

Ready to build MOJAM’s IT & Security processes from scratch? Join us as a Senior IT Engineer and take over day-to-day access operations and work directly with the CISO to design a complete identity and access management process from the ground up. You will handle real employee requests while improving how access is requested, approved, provisioned, changed and removed.

We need someone who has operated these services, understands common failure modes and can turn that experience into a reliable process with less manual work. The role will also expand into managing a small device fleet, endpoint hardening and security tooling. Sounds just like you? Check out the job description below! 
 

📍What to Do:
 

• Access Operations. Own the operational queue for access requests, changes and removals across corporate systems
• Employee Lifecycle. Handle the technical side of onboarding, role changes and offboarding in coordination with HR, managers and application owners; keep account and entitlement records accurate
• IAM Process Design. Work with the CISO and business stakeholders to map systems, access needs, ownership and approvals, then design and implement a consistent, highly automated end-to-end process
• Automation & Integrations. Identify manual steps worth automating, configure IAM capabilities and connectors, and identify the integration work needed to support the process
• Service Improvement. Investigate access and SSO issues, resolve recurring problems and maintain the practical instructions needed to operate and support the service
• Endpoint Management. As device management is introduced, support a small fleet, maintain inventory and configure and operate MDM and EDR tooling
• Endpoint Hardening. Help implement, validate and maintain device security configurations and support employees affected by those changes

🦸Your Superpowers:

Required Experience

At least 2 years of relevant hands-on experience in corporate IT, IAM or endpoint administration, with evidence of independently owning services and improving processes.

Required Hard Skills

• Access Administration. Hands-on experience administering accounts, groups, roles and permissions in corporate applications and identity platforms
• IAM Tools & Concepts. Experience working with IAM or identity administration tools; understanding of SSO, MFA, provisioning and employee lifecycle workflows
• Process Design. Ability to translate access needs into workable approval, provisioning and revocation processes, including exceptions and failure handling
• Automation Understanding. Ability to assess how connectors, APIs and workflow tools can reduce manual work, configure supported capabilities and describe integration requirements
• Endpoint Fundamentals. Basic understanding of device administration, inventory, endpoint security and hardening principles.
• AI-Assisted Work. Proactive use of AI tools for research, troubleshooting and day-to-day work

Required Soft Skills

• Independence. Work effectively with broad goals, investigate unfamiliar problems and keep work moving without constant supervision
• Ownership. Follow requests and dependencies through to closure; raise blockers early with a proposed next step
• Stakeholder Collaboration. Clarify requirements and agree practical solutions with employees, managers, HR and technical teams
• Planning & Execution. Balance daily service requests with implementation work and communicate progress and trade-offs clearly

🤘Bonus Points:

• Experience building or migrating IAM and Joiner/Mover/Leaver processes
• Hands-on implementation of automated provisioning, SSO integrations or access workflows
• Scripting or programming skills and experience developing custom integrations
• Hands-on experience with macOS administration, endpoint hardening, and deploying or managing MDM/EDR solutions

🍪Team Perks:

• PRO&BRO team you’ll love creating new gaming universes with 
• Totally remote work from wherever you grind
• An equipment budget to upgrade your home office
• Flexible schedule with no time trackers since we just focus on results
• A performance-based bonus twice a year for every mojamer as a nod to our shared achievements 
• Wellness Bonus for the gym, yoga, dance, massage, therapy, or anything that keeps your energy up
• Level up your skills with our internal knowledge-sharing project Yoda. We also cover training, certifications, English & Ukrainian classes
• Days off and gifts for milestones of your choice (birthday, anniversary, baby arrival, or wedding) 
• JAM Activities: workations twice a year in different corners of the world, epic offline teambuilding events, CS2 and Dota tournaments, quizzes, lectures, and plenty of other hangouts for the team
• Plus relocation support, a Maternity/Paternity Leave Policy, a referral bonus, and a whole bunch of other cool perks you can check out on our website

Join us if this is all about you. We are waiting for your CV!

Let’s Add More Jam Together 

The Defense Procurement Agency (DOT) is a national agency responsible for procuring ammunition, UAVs, military equipment, fuel, food, clothing, and other critical supplies for the Armed Forces of Ukraine and the Defense Forces.

Our mission: Strengthening Ukraine by ensuring reliable support for the Defense Forces while fostering the development of the national defense industry.

Our vision: To become the driving force behind the transformation of Ukraine's defense procurement ecosystem—not only operating the system, but continuously improving it.

We are currently looking for an Application Security Engineer who will be responsible for developing and implementing application security practices, building Secure Software Development Lifecycle (SSDLC) processes, integrating automated security controls into CI/CD pipelines, and ensuring security across infrastructure and software development processes.

Responsibilities

• Work on Application Security / DevSecOps initiatives and contribute to the development of application security practices.
• Design, implement and improve Secure Software Development Lifecycle (SSDLC) processes.
• Automate security controls and integrate them into CI/CD pipelines.
• Conduct security reviews of infrastructure, CI/CD pipelines and Infrastructure as Code (Terraform).
• Collaborate with Infrastructure, DevOps and Software Engineering teams to integrate security requirements into system architecture and software development processes.
• Work with Web Application Firewall (WAF) solutions.
• Conduct Security Code Reviews and manual code analysis to identify potential security vulnerabilities.

Requirements

• Bachelor's or Master's degree in Cybersecurity, Information Technology, Computer Science or a related field.
• 3+ years of experience in cybersecurity, specifically in Application Security roles.
• Hands-on experience in Application Security / DevSecOps and a solid understanding of SSDLC principles.
• Knowledge of secure software development practices and standards, including OWASP ASVS, OWASP SAMM and NIST SSDF.
• Practical experience with SAST, DAST, SCA and Secrets Scanning tools, as well as integrating security controls into CI/CD pipelines.
• Understanding of Cloud Security, containerization, and Docker/Kubernetes security.
• Experience writing Python and Bash scripts for automation.
• Understanding of network security fundamentals, HTTP/HTTPS, APIs and common web vulnerabilities.
• Understanding of microservices architecture and its security principles.
• Knowledge of common web application and API vulnerabilities, including OWASP Top 10.
• Experience working with GitLab.
• Strong analytical and systems thinking skills, proactivity and ability to make and justify decisions.
• High level of responsibility, result orientation and ability to work effectively in a team.

What We Offer

• Meaningful work that directly contributes to strengthening Ukraine's defense capabilities.
• Сompetitive salary and benefits.
• Professional development, learning opportunities, and career growth.
• Structured onboarding and dedicated mentorship.
• A collaborative, supportive, and mission-driven team.

By joining our team, you will contribute to one of Ukraine's largest digital transformation initiatives in the defense sector and help build the future of defense procurement.

Ready to make a real impact? We'd love to hear from you. Apply today!

* By submitting your CV, you consent to the processing of your personal data in accordance with applicable legislation.

** Due to the high volume of applications, only candidates whose qualifications best match the position will be contacted.

We are looking for an experienced DevSecOps Lead to take ownership of our information and infrastructure security, build robust DevSecOps practices, and elevate the security of our On-prem infrastructure to the next level.
 

If you have deep expertise in Security Engineering, hands-on experience with Linux hardening, CI/CD security, and a passion for building secure, scalable systems — we’d love to connect with you!
 

💻 What You Will Do:

On-prem Infrastructure & Systems:

• Perform Linux server hardening, manage patch management, and enforce strict access controls.
• Manage secrets, certificates, PAM, backups, and Disaster Recovery (DR) strategies.

Network Security & Scanning:

• Configure and manage network segmentation, Firewalls, VPNs, IDS/IPS, and WAF.
• Conduct regular network and vulnerability scans, ensuring timely remediation.

Pentesting & Internal Audits:

• Coordinate external pentesting: define scope, select vendors, oversee testing, and manage re-testing.
• Perform hands-on internal security checks using Burp Suite, ZAP, and Metasploit.

Secure SDLC & Code Security:

• Implement SAST, DAST, SCA, and secrets detection directly into CI/CD pipelines.
• Conduct secure code reviews and train developers on OWASP security standards.

Monitoring, Incidents & Compliance:

• Build and maintain SIEM solutions, log management, alerting, and incident response processes.
• Prepare infrastructure and operational processes for annual PCI DSS audits; maintain security policies and documentation.
   

🎯 What We Are Looking For (Must-have):

• 3+ years of experience in DevSecOps, SecOps, or Security Engineering (or DevOps with a strong security focus).
• Deep experience with On-prem Linux servers (this is our core stack).
• Strong Networking expertise: TCP/IP, DNS, routing, firewalls, VPNs, and network segmentation.
• Hands-on experience with network and vulnerability scanning tools (Nmap, Nessus / OpenVAS).
• Experience organizing or conducting penetration tests.
• Integration of code security tools into CI/CD pipelines (SonarQube, Semgrep, Snyk, Trivy, Gitleaks, etc.).
• Scripting proficiency in Bash / Python.
• Upper-Intermediate English or higher (for documentation and communicating with external auditors).

➕ Nice to Have:

• Familiarity with PCI DSS, ISO 27001, or SOC 2 compliance frameworks.
• Industry certifications (OSCP, CEH, CISSP, Security+).
• Hands-on experience with Docker, Kubernetes, Ansible, Terraform, and SIEM tools (Wazuh, ELK, Splunk).
• Experience in Fintech, Payments, E-commerce, or Travel domains.
   

🚀 What We Offer:

• Responsible and high-impact tasks with the opportunity to shape the security architecture of a high-load product.
• Flexible working hours and comfortable working conditions.
• Professional growth support.
• A supportive, tech-driven team without unnecessary bureaucracy.
   

📩 Ready to take on the challenge? Send over your CV, and let’s get in touch!

The company secures the AI-driven SDLC from prompt to production, unifying development and cloud context to stop vulnerabilities at the source. The Security Research group is hiring a senior, hands-on Application Security Researcher to push modern AppSec forward — working with engineers, researchers and AI/data scientists on next-generation detection, including autonomous, agentic pen-testing capabilities. This is a build-and-break role, not a typical AppSec position.

Must-have skills:

• 5+ years hands-on in offensive security, vulnerability research, or application security
• Deep understanding of web application and API vulnerabilities, including business-logic flaws and multi-step attack chains
• Strong coding in Python, Go, or similar, with production-quality code shipped
• Experience building or tuning detection logic (**SAST, DAST, SCA, secrets, or custom rule engines) and reducing false positives
• Solid grasp of modern stacks: CI/CD pipelines, containers, Kubernetes, and at least one major cloud provider
• Hands-on use of LLMs / AI models for security tasks, with the judgment to measure where they help and where they fail
• Comfort with large datasets (SQL, BigQuery, or similar)
• Takes research ideas from prototype to production with minimal guidance
• M.Sc. in Computer Science, Cyber Security, or a related field

Nice to have:

• Published research, CVEs, conference talks, or a bug bounty track record
• Experience building AI agents or evaluation frameworks for LLMs
• Background in exploit development, red teaming, or penetration testing
• Code analysis techniques (taint analysis, call graphs, reachability)
• Contributions to open-source security tools

Key tasks:

• Own and manage Vanta - keeping controls, evidence, and policies up to date
• Maintain certification program across SOC 2, ISO 27001, GDPR, HIPAA, CCPA, and DORA
• Support audit readiness and coordinate with auditors
• Keep security policies and procedures documentation
• Fill up security questionnaires from clients
• Collaborate with the sales team and support team regarding any security-related questions from clients
• Work with engineering on secure processes and issues

Your background:

• 3 years in security operations, GRC, or IT compliance
• Hands-on experience with Vanta, Drata, Secureframe, or similar compliance automation tool
• Practical knowledge of SOC 2, ISO 27001, GDPR
• Strong documentation and organizational skills

Will be a plus:

• Hands-on experience with Vanta specifically
• Prior experience working with any of our certification frameworks: SOC 2, ISO 27001, GDPR, HIPAA, CCPA, or DORA
• Experience implementing and managing an MDM solution

Who We Are:

An international iGaming company specializing in identifying and fostering the growth of high-potential entertainment markets. With 1000+ professionals in 20+ locations, we operate in 10 countries, serving over 300,000 customers.
 

Requirements:

• Proven hands-on experience in SOC operations, security incident detection, analysis, and response;
• Strong experience identifying and mitigating various DoS/DDoS attack vectors, including SYN floods, UDP amplification, HTTP/HTTP2 floods, DNS reflection, and slow-and-low attacks;
• Practical experience with DDoS mitigation solutions such as Cloudflare, Akamai Prolexic, AWS Shield, Radware, Imperva, Arbor Networks, or similar WAF/Anti-DDoS technologies;
• Hands-on experience with SIEM platforms, including detection rule creation, configuration, tuning, and optimization;
• Practical experience working with EDR and DLP solutions, including security alert monitoring, investigation, and incident response;
• Experience securing cloud environments and investigating security incidents across AWS, Azure, and Google Workspace;
• Strong scripting and automation skills using Python, Bash, or PowerShell to improve SOC operations;
• Proven experience reducing False Positives and optimizing detection logic to improve alerting accuracy and operational efficiency;
• Solid understanding of network and system security, including TCP/IP, UDP, DNS, SSH, SSL/TLS, HTTP protocols, and common cyberattack techniques;
• Experience working with Windows and Linux/Unix operating systems;
• Practical Threat Hunting experience, including proactive identification of suspicious activities and potential security threats;
• Strong analytical and problem-solving skills, with a data-driven approach to security incident investigation.

Responsibilities:

• Manage and support daily SOC operations, including security incident analysis, triage, investigation, and response;
• Monitor security alerts, conduct proactive Threat Hunting, and determine appropriate incident response, mitigation, and recovery actions;
• Detect, analyze, and mitigate DoS/DDoS attacks across network, transport, and application layers (L3/L4/L7);
• Configure, maintain, and optimize SIEM, EDR, DLP, and DDoS protection solutions, including detection rules, alerting policies, and rate-limiting configurations;
• Continuously improve detection accuracy by reducing False Positives and optimizing security monitoring processes;
• Monitor cloud environments, including AWS, Azure, and Google Workspace, to identify, investigate, and respond to security threats;
• Develop and implement automation scripts and workflows to streamline SOC operations, incident response, and routine security tasks;
• Investigate security incidents, document findings, prepare reports, and provide recommendations to prevent recurring threats;
• Conduct security assessments of newly introduced systems, applications, and cloud/on-premises infrastructure to ensure compliance with security standards and internal policies;
• Collaborate with IT, Infrastructure, and Security teams to improve threat detection, strengthen security controls, and enhance the organization's overall security posture.

Our Benefit Cafeteria is Packed with Goodies:

• Children Allowance
• Mental Health Support
• Sport Activities
• Language Courses
• Automotive Services
• Veterinary Services
• Home Office Setup Assistance
• Dental Services
• Books and Stationery
• Training Compensation
• And yes, even Massage!

Ajax Systems is an international technology company and the largest security systems manufacturer in Europe. Ajax products are trusted by more than 4.5 million end users and 330,000 PRO users across over 180 countries. The company offers comprehensive solutions for protecting residential and commercial properties of various sizes. Today, the Ajax portfolio includes 280 devices for intrusion protection, video surveillance, fire safety, and comfort and automation. Every year, we demonstrate exponential growth both in the size of our team and in the number of users worldwide.

Ajax Systems operates a full-cycle production model, from idea generation and prototyping to mass production and global sales. Each department fully covers a specific operational need of the business. The company’s specialists are involved at every stage — from the production line in Ukraine to the logistics center in Poland, from where products are shipped to distributors worldwide.

Now we are looking for a hands-on Cyber Security Specialist to strengthen our security posture and operational resilience. You will be at the forefront of our cybersecurity defense, responsible for incident monitoring and investigation, the deployment and improvement of security solutions, and ensuring our corporate processes and infrastructure meets compliance standards. If you are passionate about building secure systems, incidents investigation and translating technical findings into efficient mitigation actions, this role is for you.

Key Responsibilities:

• Security systems support and improvements: Participate in security architecture improvement, provide support for the full lifecycle of security systems — from design and deployment to enhancement and technical support.
• Security Monitoring & Incident Response: Improve security monitoring processes and practices, participate in security events monitoring and triaging detected events. Develop and refine SIEM detection rules, investigate anomalies and identify root-cause of incidents, develop and execute mitigation plans to neutralize threats.
• Conduction Security Assessments: Conduct technical security assessments of corporate IT systems to identify compliance deviations and vulnerabilities. Participate in risks assessments, mitigation measures design and implementation.
• Compliance & Governance: Participate in improvement of security procedures, policies, and operational instructions. Collaborate with stakeholders on security processes implementation and improvement to ensure readiness for external security audits (e.g., ISO 27001, SOC2).
• Consultancy & Support: Partner with internal teams to define security requirements for new systems and solutions, provide expert guidance on implementing security controls. Participate in security requests processing, security awareness trainings preparation and conduction.
• Reporting & Strategy: Participate in preparation of reports for management, definition and description of security strategy.

Required Technical Skills & Qualifications:

• Experience: 5+ years in CyberSecurity with a strong focus on SOC operations and security systems implementation.
• Core Proficiency: Hands-on experience with SIEM systems (Splunk/QRadar/Logsign/Wazuh), MDM solutions (Jamf/Crowdstrike/JumpCloud/Zoho), EDR/XDR solutions (SentinelOne/ESET/Defender), Cloud security monitoring (M365, GWS, AWS), and Firewall/WAF technologies (Cisco/PaloAlto/Fortinet/Ubiquiti).
• Domain Knowledge: Strong understanding of On-Premise and Cloud architectures, network security protocols, endpoint and application security. Practical experience in industry security best practices implementation (CIS, OWASP, NIST).
• Security assessment: Practical experience performing IT systems and application security assessments and reports preparation.
• Security governance: Experience in preparation of security reports, procedures and instructions for reporting. Practical knowledge of ISO 27001 technological controls implementation.
• Language Proficiency: Intermediate (B1-B2) English level required for working with technical documentation, cross-regional communication with colleagues and partners.

Preferred Skills & Certifications:

• Certifications: Vendor-specific security certifications (e.g., Google, MIcrosoft, Cisco, Palo Alto PCNSE, Fortinet NSE) are highly valued.
• Frameworks: Practical knowledge of ISO 27001 organizational controls implementation.

Why Join Us:

• Impact: Take ownership of security projects from concept to deployment.
• Culture: Work in a “zero bullshit” environment that values technical excellence and autonomy.
• Growth: Access to corporate English training and professional development/certification support.
• Health care: medical insurance.
• Beta Access: Get hands-on experience with new Ajax security systems before they reach the market.
• Innovation: Help shape the future of “Made in Ukraine” reliability.

We’re running the software that runs the world – and we want you along for the ride. We are a special place with a unique combination of brilliance, spirit, and great people. Here, if you’re willing to do more, your career can take off. And since software plays a central role in everyone’s lives, you’ll be part of a critical mission. Thousands of customers, including the majority of Fortune 100 companies, trust us to manage, accelerate, and secure their software delivery from code to production – a concept we call “liquid software.” Wouldn't it be amazing if you could join us on our journey? 
In this role, you will work with a team of researchers and ethical hackers focused on offensive security testing, automated exploit discovery, and advanced application security research. Your work will directly influence the security posture of our products and help scale secure-by-design principles.
 

This is a hands-on technical role with a strong emphasis on offensive security, code exploitation, automation, and innovation.

Responsibilities:

• Help to reshape JFrog Product Security
• Plan and execute advanced penetration testing campaigns.
• Develop tools and frameworks for scalable security testing and fuzzing.
• Lead Security innovation by building and managing penetration testing tools \ AI Agents
• Analyze vulnerabilities, perform root cause analysis, and develop proofs of concept.
• Identify systemic product weaknesses and help define long-term mitigations.
• Collaborate with engineering teams to reproduce, triage, and fix vulnerabilities.
• Contribute to security research publications, CVE submissions, and industry knowledge sharing.
• Continuously evolve internal testing capabilities using modern tooling and AI-assisted approaches.

Requirements

• 5+ years of experience in Research and penetration testing.
• Strong coding skills and deep technical understanding of web, API, cloud-native, and backend technologies.
• AI and LLM Penetration testing knowledge and Experience
• Experience with penetration testing tools (Burp Suite, Metasploit, etc.) and custom security tool development.
• Familiarity with modern architectures (e.g., Cloud, microservices, containers, Kubernetes).
• Familiarity with secure software architecture and typical attack vectors.
• Demonstrated ability to lead security testing engagements and report technical findings effectively.
• Experience building or integrating automated PT or fuzzing pipelines is a strong advantage.
• Knowledge and hands-on experience with SSDLC tools and  CI/CD pipelines,
• Publications or open-source contributions in the security domain are a plus.

RedCore is an international business group that creates technological solutions for digital markets. Our products and services cover fintech, marketing, e-commerce, customer service, communications, and regulatory technologies. 

We are looking for a Security Engineer!

Requirements:

- 3+ years of experience in security coordination, product security, project management, technical delivery, GRC, compliance, or similar roles
- Experience working with software development teams
- Understanding of SDLC, release management, product delivery, and engineering workflows
- Basic understanding of application security, penetration testing, vulnerability management and secure development practices
- Experience working with regulated products, preferably in fintech, payments, banking, crypto, cards or PSP environments
- Ability to coordinate multiple stakeholders across product, engineering, security, and compliance teams
- Experience with Jira, Confluence, or similar task management and documentation tools
- Ability to turn unclear security needs into structured tasks, owners, deadlines, and next steps
- Good understanding of risk-based prioritization

Will be a plus:

- Experience with PCI DSS, ISO 27001, SOC 2 or other security/compliance frameworks
- Experience with card payments, issuing, acquiring, crypto payments, wallets, payment gateways or transaction monitoring
- Basic knowledge of cloud security, API security, authentication, authorization and data protection
 

Responsibilities:

- Act as the main security point of contact for the FinTech department
- Work as a bridge between FinTech product and engineering teams and the central Cybersecurity team
- Understand FinTech products, payment flows, crypto-related features, card payment solutions, integrations, APIs, and release plans
- Participate in product, engineering and delivery meetings to identify security needs early
- Coordinate security activities required for new features, releases, integrations, and product changes
- Create and manage requests to internal security teams, including Application Security, Penetration Testing, Cloud Security, GRC and Compliance
- Track security tasks from request creation to closure
- Ensure that security reviews, threat modeling, code reviews, penetration tests, and compliance checks are planned and completed on time
- Help prioritize security requests based on product risk, business impact, regulatory requirements and release timelines
- Coordinate remediation of security findings with product and engineering teams
- Maintain visibility of open security risks, blockers, dependencies, and deadlines
- Support preparation for audits, partner due diligence, compliance reviews and regulatory assessments
- Help translate security requirements into clear and practical actions for product and engineering teams
- Improve the security request process between FinTech and Cybersecurity teams
- Maintain dashboards, trackers, or reports for security delivery status
Escalate delays, ownership issues, and critical risks when needed
- Support the central Cybersecurity team with operational, coordination, or documentation tasks when capacity allows

Our benefits to you:
• Paid annual leave.
• Paid days off.
• RedCore TEAM corporate gamification system.
• Annual corporate events for employees.
• Reimbursement of business travel expenses.
• Flexible working format and start time.
• Employee learning and development system.
• Mentoring program.
• Overtime compensation.
• Referral program with a cash bonus.
• Corporate psychologist.
• Cafeteria benefit system: sports, insurance, language learning (depends on region).

Project Description:
We’re looking for a Security Operations Engineer to protect our cloud environments, systems, and the data our clients trust us with. You’ll own cloud security monitoring, drive vulnerability management, lead incident response, and keep access across our platforms tight and well governed

Client Description:
Our client is an international Result-as-a-Service ecosystem for customer support outsourcing. The company brings together the right people, processes, and technology to help its clients reach their goals. The services cover customer support operations, omnichannel support, an AI support platform, help desk and technical support, Zendesk implementation, migration and audits, startup support, and back-office support.

Requirements:
 

• 3+ years of experience in security operations, cloud security, or a related role
• Hands-on experience securing AWS and/or GCP environments
• Practical experience with AWS Security Hub, GuardDuty, CloudTrail, and related services
• Proven experience with vulnerability management tools and processes
• Experience handling security incidents from detection through resolution
• Strong understanding of IAM concepts, roles, policies, and least-privilege access
• Solid knowledge of logging, monitoring, and alerting practices
• Strong analytical and troubleshooting skills
• Clear written and verbal communication in English
  
  Responsibilities
   
• Monitor and secure our AWS and GCP environments using AWS Security Hub, GuardDuty, and GCP’s native security tooling (such as Security Command Center)
• Triage, investigate, and respond to security alerts and findings; tune detections to reduce noise
• Run the vulnerability management program end to end: scanning, prioritization, remediation tracking with engineering teams, and reporting
• Lead incident response: detection, containment, investigation, recovery, and post-incident reviews
• Build and maintain incident response playbooks and runbooks
• Conduct regular IAM reviews across cloud and SaaS platforms, enforcing least privilege and removing excess or stale access
• Improve security monitoring, logging, and alerting coverage across infrastructure and applications
• Support security compliance efforts and audits, providing evidence and documentation
• Recommend and implement improvements to our overall security posture
   

The Defense Procurement Agency (DOT) is a national agency responsible for procuring ammunition, UAVs, military equipment, fuel, food, clothing, and other critical supplies for the Armed Forces of Ukraine and the Defense Forces.

Our mission: Strengthening Ukraine by ensuring reliable support for the Defense Forces while fostering the development of the national defense industry.

Our vision: To become the driving force behind the transformation of Ukraine's defense procurement ecosystem—not only operating the system, but continuously improving it.

We are currently looking for a Junior Security Engineer who will be responsible for supporting and administering Microsoft Azure security services, maintaining SIEM/SOAR infrastructure, supporting network security solutions, and contributing to the implementation of new information security mechanisms.

Responsibilities

• Participate in the administration and maintenance of Microsoft Azure security services.
• Support and develop SIEM/SOAR infrastructure based on Microsoft Sentinel.
• Participate in maintaining Infrastructure as Code (Terraform).
• Maintain network security solutions, including firewalls and network traffic control services.
• Participate in implementing new information security services and protection mechanisms.
• Collaborate with Infrastructure and Software Development teams.

Requirements

• Higher education in Cybersecurity, Information Technology, Computer Science, or a related field.
• Basic knowledge of Microsoft Azure.
• Hands-on experience with Microsoft Sentinel.
• Basic knowledge of networking technologies (TCP/IP, DNS, HTTP/HTTPS).
• Understanding of modern CI/CD practices and Infrastructure as Code (Terraform).
• Understanding of information security fundamentals.

Will be a plus

• Knowledge of Microsoft Purview.
• Experience with Palo Alto Networks.
• Knowledge of Microsoft Defender XDR.
• Knowledge of Defender for Cloud.
• Knowledge of Microsoft Entra ID.
• Experience with PowerShell.
• Experience with Terraform.
• Experience with Azure DevOps / GitHub.

What We Offer

• Meaningful work that directly contributes to strengthening Ukraine's defense capabilities.
• Сompetitive salary and benefits.
• Professional development, learning opportunities, and career growth.
• Structured onboarding and dedicated mentorship.
• A collaborative, supportive, and mission-driven team.

By joining our team, you will contribute to one of Ukraine's largest digital transformation initiatives in the defense sector and help build the future of defense procurement.

Ready to make a real impact? We'd love to hear from you. Apply today!

* By submitting your CV, you consent to the processing of your personal data in accordance with applicable legislation.

** Due to the high volume of applications, only candidates whose qualifications best match the position will be contacted.

About Come Back Agency & Client Position

Come Back Agency supports US software and technology companies by running their hiring process. We work with delivery and leadership teams to define roles, screen candidates, and manage interviews. Successful candidates are hired directly by the company and become part of its team.

This position is with a US-based software company providing custom development and AI implementation for North American clients. The team builds and maintains production software, including AI-enabled systems, and works in long-term client engagements. Team members operate as part of an internal, distributed team and collaborate directly with client stakeholders.

About the Role

As we scale our operations and infrastructure, we are looking for a hands-on DevOps / Platform Engineer who can design robust cloud environments, standardize infrastructure templates, and support our compliance readiness.

In this role, you will build automated end-to-end cloud infrastructure, manage multi-account AWS environments, support Kubernetes clusters, and collaborate on security hardening. You will also play a key role in supporting upcoming enterprise vendor reviews and compliance readiness (SOC 2 / ISO 27001) by gathering evidence, addressing security gaps, and utilizing cloud security mechanisms.

What You Will Do

• Cloud Architecture & Multi-Account Setup: Design, build, and maintain AWS infrastructure from scratch; standardize multi-account environments (AWS Organizations) and repeatable landing zones.
• Infrastructure & CI/CD: Manage Infrastructure as Code using Terraform and maintain scalable automated CI/CD pipelines (primarily GitHub Actions).
• Container Orchestration: Support and maintain production Kubernetes clusters (Amazon EKS).
• System Migration: Assist with migrating internal and client services/applications to AWS in alignment with security best practices.
• Security Hardening & Access Control: Implement least privilege access (IAM), secrets management, network isolation, and standard security practices across cloud environments.
• Compliance Readiness & Evidence Gathering: Support SOC 2 and/or ISO 27001 readiness by identifying security gaps, collecting audit evidence, and providing technical artifacts (using AWS Artifact, Security Hub, or integrated compliance tools).
• Observability & Incident Support: Standardize logging, monitoring, and alerting across environments to ensure full auditability and infrastructure reliability.
   

Requirements

• Experience: 2.5+ years of practical DevOps / Platform / Cloud Engineering experience managing cloud infrastructure.
• AWS & Infrastructure Design: Strong experience with AWS (IAM, VPC networking, compute, logging) and hands-on experience or familiarity with AWS Organizations and multi-account structures.
• Containers & Kubernetes: Hands-on experience managing and supporting production Kubernetes clusters (Amazon EKS).
• Infrastructure as Code (IaC): Solid experience writing and maintaining Terraform scripts.
• CI/CD: Practical experience configuring deployment pipelines from scratch (GitHub Actions preferred, or GitLab CI / Bitbucket Pipelines).
• Practical Security & Compliance: Familiarity with cloud security controls (IAM, encryption, vulnerability scanning) and practical experience with evidence collection and gap remediation for SOC 2 or ISO 27001 audits.
• Communication: B2+ English level (upper-intermediate or higher) for effective daily communication with US-based stakeholders and auditors.

Nice to Have

• Experience or familiarity with compliance automation platforms (e.g., Vanta, Drata, Secureframe, or AWS Security Hub).
• AWS Certifications (e.g., AWS Certified Solutions Architect, SysOps Administrator, or AWS Certified Security - Specialty).
• Experience with cloud application migrations.
   

What We Offer

• Working hours aligned with US time zones, typically 16:00–23:59 Kyiv time.
• Company-sponsored English lessons to support clear and confident communication.
• Paid vacation and sick days.
• Fully remote work model.
• Opportunities for professional growth and support with professional certifications.
• Structured, personalized onboarding to help you ramp up effectively.

Apply with your resume and a short note outlining your relevant experience. You can also submit it through our website at comeback.ua. Selected candidates will be contacted by Come Back Agency.

About us 

ARRISE is a global leader in software development and services for the iGaming industry, bringing together more than 2,500 professionals operating across more than 12 locations worldwide. 
 

From concept through to delivery, we combine technical expertise, creativity and industry knowledge to develop products, platforms and services that shape player experiences and support some of the industry's leading brands. 
 

We are best known for the work we deliver for Pragmatic Play, creating and supporting technology, products and specialists services enjoyed by millions of players worldwide. 

About the role 

Hands-on engineer to carry real load across the full AppSec surface: offensive testing, white-box code review, secure design reviews, Kubernetes/cloud security, AI/agentic security, and the app-layer side of live incidents. Fast SDLC, real-money platform under regulatory scrutiny. Builder/operator, not a scanner-driver or a report-forwarder.

What you will do 

• Offensive security & pentest (core)

  Authorized full-stack offensive testing of web, API (REST/GraphQL), and mobile — chained past PoC to real business impact, not OWASP checklist runs.
  Real exploitation craft: authentication and session abuse, authz/IDOR, OAuth2/OIDC and SSO/SAML flaws, token handling and JWT abuse, SSRF, business-logic abuse, anti-tamper and sandbox/runtime escape.
  Network/AD and cloud attack-path testing where engagements call for it.

   

• Code review, CI/CD security & shift-left (white-box)
  Manual source audit across Java, .NET/C#, Node.js, Python — finds the flaw class and the exploitable path, not just the scanner hit.
  Own SAST/SCA/DAST + SBOM in CI/CD: triage, tune out false positives, and gate releases without strangling delivery.
  Drive shift-left in practice — secure coding standards, pre-commit/PR guardrails, secrets scanning, policy-as-code, and getting developers to fix at the source.

   

• Secure architecture & design review
  Threat modeling (STRIDE/PASTA) and design-time reviews on new features and changes — set security conditions before code ships, not after.
  Review identity and trust boundaries: OAuth2/OIDC, SSO/SAML, session and key management, service-to-service auth, tenancy isolation.

   

• Cloud, container & Kubernetes security
  AWS security to real depth (IAM, CloudTrail, WAF, ALB/CloudFront, secrets, metadata abuse, cross-tenant isolation).
  Container and Kubernetes/EKS security — pod/workload hardening, escape paths, supply chain.

   

• AI / agentic security
  AppSec review and red teaming of LLM/agentic systems in production: prompt injection, jailbreaks, agent hijacking and tool-chain abuse, RAG poisoning, data leakage, guardrail and trust-boundary design.
  Comfortable with AI-assisted security tooling (agentic SAST / mass-scanning pipelines) as both builder and reviewer.

   

• IR from an AppSec standpoint (required)
  Owns the application layer of a live incident end to end: correlate app logs with CloudTrail / VPC flow / WAF, reconstruct the attack path, pinpoint the vulnerable code or config, confirm blast radius, drive the fix with the owning team.
  Recognizes real attack shapes fast - compromised container/host with a reverse shell, exposed internal APIs, credential/API-key exposure and rotation - and acts, rather than only escalating.

What you bring 

• 8+ yrs AppSec with genuine offensive and code-review depth; reads all four of Java/.NET/Node/Python, strong in two.
• Has taken findings to business impact and driven remediation to closure.
• AWS + Kubernetes security fundamentals, hands-on CI/CD security tooling

What sets you apart 

• Strongly preferred: OSWE (web code review) and OSCP.
• Offensive depth, any of: OSEP, OSED, CRTO, CRTP, Burp Suite Certified Practitioner, GWAPT.
• Cloud / container / IR, any of: AWS Security Specialty, CCSP, a Kubernetes security cert (e.g. CCNSE), GCIH, GCFA.
• AI security, any of: COAE (Certified Offensive AI Expert), OSAI, CAISP or equivalent.

 
What we offer 

• Competitive compensation 
• A competitive salary that reflects your skills and experience. 
• Annual leave 
• In accordance with the applicable legislation (20 or 26 days of annual leave). 
• Private medical cover 
• Private medical insurance to help you look after your health and wellbeing, available after successfully passing the probation period. 
• Learning Hub 
• Access to our online learning platform, with courses and resources to help you build your skills and grow your career. 
• Gym & fitness membership 
• Multisport membership, after successfully passing probation.