Jobs Security

Important: after confirming your application on this platform, you’ll receive an email with the next step: completing your application on our internal site, LaunchPod. So keep an eye on your inbox and don’t miss this step — without it, the process can’t move forward.

Why join us

If you're looking for a place to grow, make an impact, and work with people who care, we'd love to meet you! :)

About the role

We are looking for a Senior Application Security Engineer to architect and build automated security layers within the SDLC, engineering AI-enabled secure code scanning, hardened baseline automation, and CI/CD security tooling integration across a large-scale financial services program. You will work in Python and Java to deploy and tune SAST, DAST, and SCA tools, provide code-level remediation guidance to development teams, and operate with full autonomy building automated security runbooks. The role requires 6+ years of software engineering experience with a strong AppSec and DevSecOps focus.

What you will do

• Engineer and deploy AI-enabled secure code scanning capabilities and Golden Images to drive secure-from-the-start adoption;
• Automate the development of secure coding patterns and integrate them with traditional and Agentic SDLC workflows;
• Architect the integration of continuous security scanning tools into enterprise CI/CD pipelines and tune them to eliminate noise;
• Act as a senior technical SME by reading and reviewing complex application code and providing software engineers with code-level remediation guidance.

Must haves

• 6+ years of software engineering experience with a strong subsequent focus on Application Security and DevSecOps;
• Strong coding and architectural proficiency in Python for security automation and scripting;
• Strong coding and architectural proficiency in Java for reviewing and securing enterprise source code;
• Deep, hands-on expertise deploying and tuning SAST, DAST, and SCA tools;
• Experience integrating application security testing tools into complex CI/CD orchestration ecosystems;
• Fully autonomous execution capability, requiring no daily supervision to map out and build automated security runbooks;
• Upper-intermediate English level.

Nice to haves

• Experience integrating LLMs, AI agents, or automated coding assistants to streamline vulnerability triaging or secure code generation;
• Advanced application threat modeling experience.

The benefits of joining us

• Professional growth: Accelerate your professional journey with mentorship, TechTalks, and personalized growth roadmaps
• Competitive compensation: We match your ever-growing skills, talent, and contributions with competitive USD-based compensation and budgets for education, fitness, and team activities
• A selection of exciting projects: Join projects with modern solutions development and top-tier clients that include Fortune 500 enterprises and leading product brands
• Flextime: Tailor your schedule for an optimal work-life balance, by having the options of working from home and going to the office – whatever makes you the happiest and most productive.

Meet Our Recruitment Process

Asynchronous stage – An automated, self-paced track that helps us move faster and give you quicker feedback:

• Short online form to confirm basic requirements
• 30–60 minute skills assessment via Codility – a platform founded in Poland that helps us provide quicker feedback and streamline this stage of the process.
• 5-minute introduction video

Synchronous stage – Live interviews

• Technical interview with our engineering team (scheduled at your convenience)
• Final interview with your future teammates

If it’s a match — you’ll get an offer!

Cloudfresh ⛅️ is a Global Google Cloud Premier Partner, Zendesk Premier Partner, Asana Solutions Partner, GitLab Select Partner, Hubspot Platinum Partner, Okta Activate Partner, and Microsoft Partner.

Since 2017, we’ve been specializing in the implementation, migration, integration, audit, administration, support, and training for top-tier cloud solutions. Our products focus on cutting-edge cloud computing, advanced location and mapping, seamless collaboration from anywhere, unparalleled customer service, and innovative DevSecOps.

We’re looking for a Google Cloud Security Engineer to harden client environments across GCP. You’ll implement and help design security controls, automate guardrails, improve detection & response, and guide stakeholders through pragmatic, risk-based decisions across EMEA.

Requirements:

• 3+ years proven, hands-on experience in a Security Engineer, SecOps (or similar) role.
• Strong knowledge of building and operating Security Porture, Edge protection, WAF, Endpoint security.
• Technical certifications related to CyberSecurity Google Cloud Solutions, Cloudflare and JumpCloud are an advantage.
• Experience of presentation, documentation.
• Excellent communication and strategic planning abilities, able to explain trade-offs, influence remediation, and drive adoption of guardrails.
• Basic scripting experience (e.g., Python, Bash, or gcloud CLI).
• Fluency in English.

Responsibilities:

• Design, implement, and operate security controls for internal needs and clients across.
• Perform cybersecurity audits.
• Configure and monitor Security Command Center, audit logs, and threat protection.
• Establish logging, detection and incident response.
• Assist clients with implementation of Cybersecurity products (Google Cloud Security Center, Google Workspace Security, Cloudflare, JumpCloud) and compliance controls.
• Generate security assessment reports and provide actionable recommendations.
• Continuously assess the landscape: track new Vendors features and update baselines to improve posture, reliability, and cost efficiency.

Work conditions:

• Competitive Salary & Transparent Motivation: Receive a competitive base salary with performance-based bonuses, providing clear financial rewards for your success.
• Flexible Work Format: Work remotely with flexible hours, allowing you to balance your professional and personal life efficiently.
• Training with Leading Cloud Products: Access in-depth training on cutting-edge cloud solutions, enhancing your expertise and equipping you with the tools to succeed in an ever-evolving industry.
• International Collaboration: Work alongside A-players and seasoned professionals in the cloud industry. Expand your expertise by engaging with international markets across the EMEA and CEE regions.
• Vibrant Team Environment: Be part of an innovative, dynamic team that fosters both personal and professional growth, creating opportunities for you to advance in your career.

When applying to this position, you consent to the processing of your personal data by CLOUDFRESH for the purposes necessary to conduct the recruitment process, in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 (GDPR).
Additionally, you agree that CLOUDFRESH may process your personal data for future recruitment processes. You can withdraw this consetn at any time.

Important: after confirming your application on this platform, you’ll receive an email with the next step: completing your application on our internal site, LaunchPod. So keep an eye on your inbox and don’t miss this step — without it, the process can’t move forward.

Why join us

If you're looking for a place to grow, make an impact, and work with people who care, we'd love to meet you! :)

About the role

We are looking for a Middle Application Security Engineer to execute hands-on DevSecOps work across CI/CD pipeline security integration, vulnerability management tooling, and automated hardened baseline deployment within a large-scale financial services security program. You will write Python scripts to integrate SAST, DAST, and SCA gates into CI/CD pipelines, tune scanning tools to reduce false positives, and provide code-level remediation guidance to Java and Python development teams. The role requires 3–5 years of combined software engineering and AppSec experience.

What you will do

• Write and maintain the scripts necessary to integrate security gates (SAST, DAST, SCA) seamlessly into the CI/CD pipeline;
• Continuously tune and configure existing security scanning tools to eliminate false positives and deliver high-confidence alerts;
• Assist in coding and deploying automated hardened baselines and secure coding patterns;
• Work directly with product development teams to provide actionable, code-level remediation guidance in Java and Python.

Must haves

• 3–5 years of commercial experience blending software engineering and DevSecOps/AppSec;
• Solid coding proficiency in Python (for automation/scripting), with the ability to comfortably read and navigate Java source code;
• Working knowledge of modern CI/CD orchestration tools and practical experience interacting with vulnerability scoring frameworks;
• Ability to operate with minimal supervision on day-to-day execution, reliably completing complex scripting and integration tasks;
• Upper-intermediate English level.

Nice to haves

• Hands-on experience with specific CNAPP or ASPM platforms (e.g., Wiz);
• Basic understanding of application threat modeling.

The benefits of joining us

• Professional growth: Accelerate your professional journey with mentorship, TechTalks, and personalized growth roadmaps
• Competitive compensation: We match your ever-growing skills, talent, and contributions with competitive USD-based compensation and budgets for education, fitness, and team activities
• A selection of exciting projects: Join projects with modern solutions development and top-tier clients that include Fortune 500 enterprises and leading product brands
• Flextime: Tailor your schedule for an optimal work-life balance, by having the options of working from home and going to the office – whatever makes you the happiest and most productive.

Meet Our Recruitment Process

Asynchronous stage – An automated, self-paced track that helps us move faster and give you quicker feedback:

• Short online form to confirm basic requirements
• 30–60 minute skills assessment via Codility – a platform founded in Poland that helps us provide quicker feedback and streamline this stage of the process.
• 5-minute introduction video

Synchronous stage – Live interviews

• Technical interview with our engineering team (scheduled at your convenience)
• Final interview with your future teammates

If it’s a match — you’ll get an offer!

Who We Are 
 

At Digital Shelf by NIQ, we’re passionate about technological innovation and excellence in cybersecurity. Our cutting-edge solutions enable us to scrape data for 12 billion products and manage over 20 billion data points. In a market where anti‑bot technologies represent a $10B industry in constant evolution and consolidation, our dedicated teams tackle real‑world challenges with precision and creativity. 
 

What You’ll Do 
 

• Reverse Engineering & Decompilation: 
  Analyze web and mobile applications (APK/IPA) to uncover hidden mechanisms. Disassemble code to understand its inner workings, with a focus on cryptographic functions that secure our systems. 
• Overcoming Anti‑Bot Mechanisms: 
  Evaluate and bypass advanced security protocols such as TLS, HTTP/2, HTTP/3, WebSockets, DoH, and session management. Identify vulnerabilities to enhance our data extraction methods. 
• Developing Custom Tools: 
  Build robust Python scripts and frameworks that automate bypass procedures and dynamically adjust security measures, whether by modifying TLS stacks or patching JavaScript on the fly. 
• Implementing Stealthy Scraping Techniques: 
  Engineer sophisticated methods such as browser patching, headless browser evasion, proxy tunneling, and human‑behavior emulation to keep our operations discreet. 
• Continuous Innovation: 
  Regularly test, disrupt, and improve our tools to stay ahead of ever‑evolving defenses. 

Your Profile 
 

• P45510n4t3 C0d3 W4rr10r: 
  You thrive on pushing systems to their limits while upholding the highest ethical standards. R3v3rs3 3ng1n33r1ng isn’t just a skill it’s your creative playground. 
• R3v3rs3 3ng1n33r1ng Expertise: 
  Whether using tools like IDA Pro, Ghidra, or your own custom-built solutions, you excel at dissecting both binary and web code to uncover core functionalities. 
• W3b & N3tw0rk Pr0t0c0l Savant: 
  You possess deep expertise in pr0t0c0ls such as TLS, HTTP/2, WebSockets, DoH, and more, leveraging that knowledge to find innovative solutions. 
• Advanced Python Developer: 
  Your coding abilities go far beyond basic scripting. We're looking for a coder, someone who can design and implement robust, efficient solutions for complex challenges. 
• Collaborative Innovator: 
  While you excel as an independent problem-solver, you also thrive in a dynamic team environment that values open communication and continuous learning. 

How to Apply 
 

If you’re a dedicated code warrior with a passion for dissecting and rebuilding intricate systems and you consistently deliver high‑quality, efficient code, send us your resume.

What we offer

Direct contract with the USA
Flexible work hours and remote work

20 business days of paid vacation
Flexible days off

Maternity/Paternity leaves

Medical insurance 

Join Digital Shelf by NIQ and help us reshape the digital frontier. 

Important: after confirming your application on this platform, you’ll receive an email with the next step: completing your application on our internal site, LaunchPod. So keep an eye on your inbox and don’t miss this step — without it, the process can’t move forward.

Why join us

If you're looking for a place to grow, make an impact, and work with people who care, we'd love to meet you! :)

About the role

We are looking for a Middle Application Security Engineer to execute hands-on DevSecOps work across CI/CD pipeline security integration, vulnerability management tooling, and automated hardened baseline deployment within a large-scale financial services security program. You will write Python scripts to integrate SAST, DAST, and SCA gates into CI/CD pipelines, tune scanning tools to reduce false positives, and provide code-level remediation guidance to Java and Python development teams. The role requires 3–5 years of combined software engineering and AppSec experience.

What you will do

• Write and maintain the scripts necessary to integrate security gates (SAST, DAST, SCA) seamlessly into the CI/CD pipeline;
• Continuously tune and configure existing security scanning tools to eliminate false positives and deliver high-confidence alerts;
• Assist in coding and deploying automated hardened baselines and secure coding patterns;
• Work directly with product development teams to provide actionable, code-level remediation guidance in Java and Python.

Must haves

• 3–5 years of commercial experience blending software engineering and DevSecOps/AppSec;
• Solid coding proficiency in Python (for automation/scripting), with the ability to comfortably read and navigate Java source code;
• Working knowledge of modern CI/CD orchestration tools and practical experience interacting with vulnerability scoring frameworks;
• Ability to operate with minimal supervision on day-to-day execution, reliably completing complex scripting and integration tasks;
• Upper-intermediate English level.

Nice to haves

• Hands-on experience with specific CNAPP or ASPM platforms (e.g., Wiz);
• Basic understanding of application threat modeling.

The benefits of joining us

• Professional growth

Accelerate your professional journey with mentorship, TechTalks, and personalized growth roadmaps

• Competitive compensation

We match your ever-growing skills, talent, and contributions with competitive USD-based compensation and budgets for education, fitness, and team activities

• A selection of exciting projects

Join projects with modern solutions development and top-tier clients that include Fortune 500 enterprises and leading product brands

• Flextime

Tailor your schedule for an optimal work-life balance, by having the options of working from home and going to the office – whatever makes you the happiest and most productive.

Meet Our Recruitment Process

Asynchronous stage – An automated, self-paced track that helps us move faster and give you quicker feedback:

• Short online form to confirm basic requirements
• 30–60 minute skills assessment via Codility – a platform founded in Poland that helps us provide quicker feedback and streamline this stage of the process.
• 5-minute introduction video

Synchronous stage – Live interviews

• Technical interview with our engineering team (scheduled at your convenience)
• Final interview with your future teammates

If it’s a match — you’ll get an offer!

DevSecOps Engineer  

The DevSecOps Engineer is a foundational role in our client’s project, responsible for architecting and maintaining the high-security infrastructure required for an enterprise-grade Agent Development Platform (ADP). You will be tasked with building the secure "sandbox" where autonomous agents live, ensuring zero-trust connectivity and managing the specialized data stores that power agentic reasoning. 

About the Role 

You will lead the setup of the AWS production environment and the implementation of Firecracker MicroVMs to provide isolated, ephemeral runtimes for agents. You are the guardian of the platform's "Egress Controls," ensuring that while agents can reason over proprietary data, they can never exfiltrate it. 

Key Responsibilities 

Agent Sandboxing & Isolation: Implement and manage Firecracker MicroVMs (or restricted Kubernetes/Docker environments) to ensure agents execute in strictly isolated, secure runtimes. 

Secure Data Infrastructure: Provision and optimize the platform's multi-layered data stack, including PostgreSQL (OLTP), ChromaDB/PGVector (VectorStore), and GraphDB (Neo4j) for relational knowledge mapping. 

Event Orchestration: Build and manage high-performance Event Streams (AWS SQS, Event Bridge, or Kafka) to handle agent-to-agent communication and Human-in-the-Loop (HITL) escalation triggers. 

Infrastructure as Code (IaC): Automate the provisioning of AWS cloud infrastructure and Kubernetes clusters using industry-standard tools. 

Security & Identity Integration: Implement WorkOS for B2B identity management and multi-tenancy, ensuring strict logical separation of tenant data and configurations. 

Network Hardening: Design and enforce strict egress firewalls and proxy-only outbound routing to prevent data exfiltration by autonomous agents. 

Required Skills & Experience 

Cloud & Containers: Deep expertise in AWS, Kubernetes, and container security; proven experience with Firecracker MicroVMs is highly desirable. 

Database Management: Hands-on experience managing and scaling Vector Databases (Chroma, PGVector) and Graph Databases for AI applications. 

Security First Mindset: Strong understanding of zero-trust architecture, OWASP principles, and secure design for AI systems. 

Messaging & Events: Proficiency in managing event-driven architectures and streaming platforms for real-time data processing. 

Automation: Advanced scripting skills (Python, Bash) and a track record of implementing automated security gates in CI/CD pipelines. 

Workflow Orchestration: Experience with Temporal for managing long-running, multi-stage agentic workflows. 

Desirable 

Compliance: Experience preparing infrastructure for SOC 2, ISO 27001, or GDPR readiness. 

Agentic Frameworks: Familiarity with LangSmith or Langfuse for observability and tracing of agent workloads.

About the Role

We are looking for a highly skilled and strategic Senior DevSecOps Engineer to lead our security operations and infrastructure automation initiatives. In this role, you will bridge the gap between development, security, and operations, ensuring our on-premise environment remains secure, resilient, and efficient.
You will act as a subject matter expert, leveraging cutting-edge tools like CrowdStrike to automate threat detection and response, while maintaining robust perimeter security via Cloudflare.

Key Responsibilities
Implementation and automation of security tools in the CI/CD process (SAST, DAST, SCA).
Analysis of vulnerabilities in code, infrastructure and containers.
Development and configuration of security monitoring systems, incident response.
Monitoring and improving the security level of on-prem infrastructures.
Interaction with developers, DevOps and security teams to implement secure practices.
Active participation in the processes of IAM configuration, management of certificates, secrets and access policies.
Conducting internal security audits, participation in external (e.g. penetration) tests.

Requirements

Must-have:
Experience: 5+ years of experience in DevSecOps, Security Engineering, or a related field, with at least 2 years in a Senior role.
Tooling Expertise: Deep hands-on experience with the following specific tools:
Baremetal/on-premise infrastructure
Docker (Docker Swarm is a strong plus)
Gitlab CI 
CrowdStrike
Cloudflare
ELK.
SIEM Proficiency: Proven experience deploying and tuning SIEM solutions (e.g., Splunk, Elastic Security, Datadog, or similar).
Infrastructure: Strong background in managing on-premise infrastructure (physical servers, data centers, virtualization, networking).
Scripting: Proficiency in Python, Go, or Bash for automation and tooling.

Nice-to-have:
Experience with Kubernetes and such tools as Wiz.io and Torq.
Previous involvement in high-load, regulated, or 24/7 production environments (e.g., iGaming, FinTech, telecom or similar).

We offer
Fully remote work opportunity
Enhanced leave benefits:
20 days of paid vacation
5 paid days off
14 paid sick leaves
Company clubs & communities
Celebration gifts for personal milestones
Corporate online events, raffles & challenges
Corporate English program
Corporate yoga classes
Team-building activities
Coworking compensation
Training and development programs (internal & external).

Our client is a global leader in AI-powered IT Service Management (ITSM), developing intelligent platforms that automate IT support processes and help organizations operate more efficiently. Their solutions are trusted by thousands of companies worldwide, simplifying complex IT operations and enabling teams to focus on strategic initiatives.

We are looking for a Senior Application Security Engineer with a strong software engineering background who has designed, developed, deployed, and maintained production systems before transitioning into application security. This role will serve as the security backbone of the R&D organization, ensuring security is embedded throughout the software development lifecycle and partnering closely with Engineering, DevOps, Architecture, and Product teams.

This is a highly visible, hands-on position reporting directly to the CISO, offering a clear growth path toward an Application Security Lead role and exposure to cloud security, AI security, and governance initiatives.

Who We're Looking For

• 5+ years of hands-on experience as a Software Developer, Backend Developer, Full-Stack Developer, or similar engineering role, with a proven track record of designing, building, shipping, debugging, and maintaining production software.
• Strong understanding of software development processes, engineering best practices, architecture, and SDLC methodologies.
• 2+ years of experience in Application Security, Product Security, or Secure SDLC, with a demonstrated transition from software engineering into security.
• Experience partnering closely with R&D and development teams, acting as a trusted security advisor who enables innovation while improving security posture.
• Hands-on experience implementing Secure SDLC practices within modern CI/CD environments (GitHub, GitLab, Jenkins, ArgoCD, or similar).
• Solid understanding of common application vulnerabilities, secure coding principles, OWASP Top 10, CWE/SANS Top 25, threat modeling methodologies (e.g., STRIDE, PASTA), and security architecture reviews.
• Experience with application security tools and practices, including SAST, DAST, SCA, secret scanning, and secure code review.
• Strong knowledge of API security and experience securing and testing REST and/or GraphQL APIs.
• Understanding of software supply chain security, including third-party dependency risks, SBOM concepts, open-source risk management, dependency confusion, and related attack vectors.
• Knowledge of cloud security fundamentals, preferably AWS, including IAM, containers/Kubernetes security, and Infrastructure as Code (Terraform or similar).
• Familiarity with SaaS and product company environments and the security challenges associated with cloud-native applications.
• Understanding of AI/LLM security risks, including prompt injection, data leakage, model abuse, agentic risks, and secure adoption of AI assistants within engineering and security workflows.
• Experience performing security-focused design, architecture, and threat modeling reviews.
• Excellent communication and stakeholder management skills, with the ability to influence teams without direct authority.
• Strong written and verbal English communication skills.

• Bachelor’s degree in Computer Science, Information Security, or a related field (or equivalent practical experience).

   

Role Focus

The primary focus of this role is the application security of the product.

Key responsibilities:

• Working closely with R&D teams on a daily basis.
• Helping developers build more secure products and adopt security best practices.
• Reviewing application designs and architectures from a security perspective.
• Identifying security risks in APIs, integrations, third-party libraries, and development processes.
• Managing vulnerabilities by analyzing, prioritizing, and supporting remediation efforts.
• Promoting and maintaining secure development practices across CI/CD pipelines.

• Applying and advocating security standards, frameworks, and industry best practices.

   

Nice to Have

• Penetration testing experience.
• Experience with bug bounty programs and vulnerability management.
• Strong knowledge of OWASP frameworks and methodologies.
• Hands-on experience with SAST, DAST, IAST, SCA, and secret-scanning tools.
• Cloud security experience (AWS, Azure, or GCP).
• AI / LLM security knowledge and practical experience.
• Security certifications such as CISSP, CSSLP, OSCP, OSWE, GWAPT, GPEN, CEH, GIAC certifications, or similar.

We’re hiring a DevSecOps Engineer who thrives in fast-moving environments, understands
technical depth, and can independently own security across multiple areas — from architecture and infrastructure to monitoring and investigations.

The role is ideal for someone who prefers deep thinking over surface-level “best practices”.
You’ll play a key role in securing our systems and eventually take ownership of technical implementation and decision-making.

The project is a high-load financial platform that acts as a payment processor for cryptocurrency and fiat transactions. The system utilizes integrations with blockchain networks and processes a high volume of requests within the cloud infrastructure.

Requirements

• Solid hands-on experience with Kubernetes
• Strong understanding of networking principles and ability to troubleshoot/configure network layers
• Familiarity with bare-metal infrastructure
• Proactive mindset, ability to identify and resolve potential issues before they escalate
• Understanding of base-level security policies and practices

Would be a plus

• Interest or background in Web3 technologies
• Knowledge of cryptographic principles
• Experience in defining and managing security policies
• Ability to independently audit infrastructure
• Familiarity with DevSecOps methodologies
• In-depth knowledge of networking principles

Responsibilities

• Build and maintain secure development and delivery pipelines
• Define and enforce access boundaries, response processes, and security policies
• Detect and prevent data leaks, monitor logs, and investigate anomalies
• Contribute to architecture and infrastructure decisions with a security-first mindset
• Analyze incidents, model threats, and assess risks end-to-end
• Context-switch rapidly while maintaining focus and ownership

We are looking for a Threat Intelligence Analyst to join our cybersecurity team and strengthen the company’s proactive defense capabilities.

This role combines cyber threat intelligence, proactive investigations, and risk-oriented analysis. We are looking for a specialist who can identify emerging threats, analyze attacker behavior and TTPs, assess their relevance to the business environment, and help improve the organization’s detection and response capabilities.

You will work closely with SOC, IT, and Risk Management teams to transform threat intelligence into actionable security insights and recommendations.
 

Responsibilities

• Collect, analyze, enrich, and contextualize cyber threat intelligence from multiple sources, including OSINT, CERTs, vendors, and industry feeds
• Monitor emerging threats, attacker activity, vulnerabilities, and adversary TTPs relevant to the organization
• Conduct proactive threat hunting activities across SIEM, EDR/XDR, cloud environments, and other telemetry sources
• Develop and validate hypotheses based on threat intelligence and behavioral patterns
• Support investigations related to incidents, suspicious activity, and threat intelligence findings
• Identify gaps in detection and response capabilities and provide recommendations for improvement
• Assess potential business impact and risk associated with identified threats
• Prepare analytical reports, threat assessments, and actionable recommendations for technical and non-technical stakeholders
• Collaborate with SOC and IT teams to improve detection logic, monitoring, and security processes
   

Requirements

• 2+ years of experience in Threat Intelligence, Threat Hunting, SOC L2/L3, DFIR, or Incident Response
• Strong understanding of MITRE ATT&CK framework
• Hands-on experience with SIEM platforms (Microsoft Sentinel, Splunk, QRadar, etc.)
• Experience working with EDR/XDR solutions
• Understanding of cyber threat intelligence processes and proactive threat hunting methodologies
• Strong analytical and investigative skills
• Ability to work with incomplete or ambiguous information
• Understanding of security risks and attack vectors
• Strong communication skills and ability to explain technical findings clearly
   

Nice to have

• Experience with Purple Team activities
• Understanding of cloud security (Azure / AWS / GCP)
• Experience with KQL, Python, Sigma, or detection engineering
• Experience with threat modeling or risk management processes
• Familiarity with automation and detection-as-code approaches

We are looking for an Application Security Engineer to help build security into the software development lifecycle across our products and platforms.

In this role, you will work closely with Engineering, DevOps, Architecture, and Security teams to integrate security controls into development processes, identify risks early, and help teams build secure solutions without unnecessary bureaucracy.
 

Responsibilities

• Define and validate security requirements for applications, APIs, integrations, and new services.
• Participate in architecture and design reviews to identify security risks at early stages.
• Build and improve Secure Software Development Lifecycle (SSDLC) practices.
• Integrate security controls into CI/CD pipelines, including SAST, DAST, SCA, Secret Scanning, Container and IaC Scanning.
• Perform security assessments of web applications, APIs, backend services, and AI-driven solutions.
• Support development teams with remediation activities, secure coding practices, and security best practices.
• Develop security standards, baselines, templates, and engineering guidelines.
   

Requirements

• 2+ years of experience in Application Security, DevSecOps, Security Engineering, or a similar role.
• Strong understanding of SSDLC and secure development practices.
• Hands-on experience with SAST, DAST, SCA, threat modeling, and security reviews.
• Good knowledge of OWASP Top 10, OWASP ASVS, API Security, Authentication, Authorization, and Secure Design principles.
• Experience integrating security controls into CI/CD pipelines.
• Familiarity with container security and Kubernetes environments.
• Experience with Infrastructure as Code security (Terraform is a plus).
• Scripting skills in Python and/or PowerShell.
• Understanding of software supply chain security and dependency management.
• Strong communication skills and ability to work effectively with engineering teams.
   

Nice to Have

• Experience with Bug Bounty programs or CTFs.
• Experience securing AI/ML systems and services.
• Experience with Azure, AKS, GitHub Enterprise, Checkmarx, Trivy, or similar tooling.

About the Role

We are looking for an experienced Lead DevSecOps / Application Security professional to drive secure software development practices, strengthen application security posture, and lead security initiatives across modern cloud-native environments. This role combines hands-on technical leadership with strategic ownership of security processes, risk management, and compliance initiatives.

Responsibilities

• Lead and mentor a team of security professionals, fostering a strong security culture across engineering and operational teams.
• Build, enhance, and continuously refine security systems, processes, and governance frameworks.
• Drive the implementation of technical, operational, people, and audit controls to mitigate organizational risk.
• Manage security initiatives, prioritize activities based on business impact and risk exposure, and define measurable objectives.
• Develop, maintain, and evolve the organization's cybersecurity strategy.
• Oversee the implementation and enforcement of security policies, standards, and guidelines.
• Partner closely with engineering teams to integrate security throughout the Software Development Lifecycle (SSDLC) and promote shift-left security practices.
• Conduct threat modeling, security design reviews, vulnerability assessments, and remediation planning.
• Establish and improve vulnerability management processes, ensuring timely identification and resolution of security issues.
• Ensure compliance with applicable regulatory and industry frameworks, including PCI, SOX, and security controls aligned with ISO and ITIL practices.
• Guide the development, testing, and maintenance of incident response and disaster recovery plans.
• Monitor emerging security threats, trends, and technologies, applying relevant improvements to security controls and processes.
• Support secure cloud-native delivery practices, including containerized environments, Infrastructure as Code (IaC), CI/CD pipelines, and software supply chain security.

Requirements (Must-Have)

• 8+ years of hands-on experience in Application Security, Product Security, DevSecOps, or related security engineering roles.
• Proven experience collaborating directly with software engineering teams to improve application security posture.
• Strong practical experience with AppSec tooling, including:
  • SAST (Static Application Security Testing)
  • SCA (Software Composition Analysis)
  • Code scanning solutions
  • GitHub and GitHub Advanced Security
  • SonarQube
  • Dependabot
  • CI/CD security integrations
• Ability to review source code, assess real-world risk, and drive practical, business-oriented remediation efforts.
• Strong understanding of SSDLC and shift-left security methodologies.
• Experience conducting threat modeling, security architecture reviews, and vulnerability management activities.
• Deep knowledge of application and API security, including:
  • Authentication and Authorization (AuthN/AuthZ)
  • Secrets management
  • Dependency and third-party risk management
  • Injection vulnerabilities
  • Data protection principles
• Experience with cloud-native development and delivery environments, including containers, Infrastructure as Code, Git-based workflows, automation, and technical documentation.
• Strong communication and stakeholder management skills, with the ability to influence technical and business audiences.

Nice to Have

• Experience with Infrastructure as Code (IaC) security scanning.
• Container and container image security expertise.
• Software supply chain security experience.
• Advanced secrets management knowledge.
• AWS cloud security experience.
• Experience working within regulated, compliance-driven, audit-sensitive, or business-critical environments.
• Familiarity with PCI DSS, SOX, ISO 27001, ITIL, and related governance frameworks.

What AppRecode offers

• 20 days of paid annual leave plus public holidays.
• 5 paid sick days per year.
• Remote-first work environment.
• Friendly and supportive team culture.
• Personal development plans and access to experienced mentors and technical leaders.
• Reimbursement for sports activities and professional certifications (after probation).
• Ongoing learning opportunities: internal trainings and knowledge-sharing sessions.
• Free English classes if you want to further improve your communication skills.

Playson is a leading iGaming supplier operating in multiple regulated markets, delivering engaging casino content and advanced technology. We’re a fast-growing, tech-driven company that values innovation, autonomy, and ownership. At Playson, we welcome people who are curious, proactive, and passionate about solving complex challenges at scale.

We are ISO/IEC 27001 certified and committed to maintaining a robust security and compliance posture across all our operations.

About the Role

We are looking for a Security Lead to strengthen Playson’s information security framework and drive continuous improvement of our security culture. This role combines technical expertise, investigative focus, and process leadership - ensuring that our systems, data, and people remain secure, compliant, and resilient.

What will you be doing?

Information Security & Compliance

• Maintain and continuously improve the ISO/IEC 27001:2022 Information Security Management System (ISMS).
• Foster a strong Security-First mindset across the organization.
• Work closely with the CTO, Head of IT, and DevOps to enhance internal security controls.
• Conduct internal audits, risk assessments, and coordinate certification renewals.
• Update security policies and controls in line with ISO 27001, GDPR, and relevant international frameworks (e.g., NIST CSF and NIS2 principles where applicable).
  Manage integrations and alerting within Datadog SIEM, CrowdStrike, Cloudflare, and Google Workspace.
• Support DLP implementation and maintain central tracking of security events.
• Document risks, incidents, and corrective actions to ensure continuous compliance.

Incident Response & Investigation

• Lead investigations into security incidents such as phishing, data leakage, or unauthorized access.
• Collect and analyze digital evidence across systems (CrowdStrike, Cloudflare, Google, Slack).
• Maintain and enhance incident response playbooks and escalation workflows.
• Collaborate with HR, Legal, and IT teams during internal investigations.
• Produce post-incident reports and recommend remediation measures.

Endpoint & Access Security

• Manage MDM systems (Zoho MDM, Endpoint Central) and ensure full compliance for macOS endpoints.
• Maintain CrowdStrike Falcon configurations and endpoint posture enforcement.
• Oversee SSO, MFA, and 2FA enforcement across services (Google SSO, DUO Mobile, 1Password).
• Implement Just-in-Time (JIT) privilege elevation and regular admin access reviews.
• Perform Quarterly RAS Access Management Reviews.

• Maintain a consistent audit trail for access management throughout the year.

   

To succeed in the role, you will have:

• 3+ years of experience in information security, IT audit, or digital investigations.
• Solid understanding of ISO 27001, GDPR, and modern security frameworks (NIST CSF / NIS2).
• Hands-on experience with SIEM / EDR systems
• Proven ability to manage SSO, MFA, DLP, and MDM environments.
• Strong communication skills in English (B2 or higher).
• Analytical mindset, integrity, and attention to detail.

Preferred additional qualifications:

• Certifications: CISSP, CISM, CEH, ISO 27001 Lead Auditor, AWS Security Specialty.
• Experience with Zero Trust, PAM, DLP/CASB, or SOAR platforms.
• Forensics experience.
• Experience in designing awareness programs or running phishing simulations.

What you get in return:

• Competitive Salary: We offer a competitive salary in EUR, subject to annual performance reviews
• Quarterly Bonuses: Benefit from a transparent and systematic quarterly bonus system
• Flexible Schedule: We offer a flexible work schedule to accommodate your needs
• Remote Work Option: Choose to work remotely, providing greater flexibility and comfort
• Medical Insurance: Receive comprehensive medical insurance for both you and a significant other
• Financial Support for Life Events: We provide financial support during special life events
• Unlimited Paid Vacation: Enjoy unlimited paid vacation leave
• Unlimited Paid Sick Leave: Take unlimited paid sick leave whenever necessary
• Professional Development: Get reimbursement for professional development courses and training

The recruitment process includes the following steps:

1. HR Interview (30-45 mins)

2. Technical interview with Service Desk & Security Lead (60 mins)

3. Final Interview with CTO and People Business Partner (60 mins)

Project Description

We’re looking for a Senior Software Developer who understands Windows at a deep level and enjoys solving hard identity-security problems in elegant ways. We value clear thinking, clean code, and people who build things that last. You will have broad autonomy, minimal bureaucracy, and direct influence on the product architecture.

Client Description

Our client is a cybersecurity company from Germany which redefines authentication: removing passwords, unifying token types, and building a new foundation for enterprise identity. You will be shaping the platform that CIOs, CISOs, and engineers trust for critical access control. 
 

Position Requirements:

- Expert-level knowledge of Windows system architecture (Win32 APIs, security subsystems, identity stack)

- Strong experience in both C++ and in C#/.NET

- Solid understanding of cryptography, especially Windows crypto implementations (CNG, DPAPI, smartcard/PCSC, certificate handling)

- Ability to work on complex features independently and drive them from concept to stable production code

- Curiosity, creativity, and a willingness to challenge old assumptions

Nice to Have

- Experience with authentication technologies, identity protocols, SAML, FIDO, smart cards, secure design

- Background in building system-level security products or middleware

- Familiarity with cryptographic key management, or hardware-backed cryptography

Candidate Responsibilities

You will design and build native and managed Windows applications and services that form the backbone of a passwordless multifactor authentication platform. This includes secure desktop components, system-level integrations, and high-performance server modules that interact closely with Windows internals.

Location: Germany (Hybrid)

Engagement model: Near-shoring with limited onsite presence (~5–10% for onboarding and recurring alignment meetings) 

Languages: German (working proficiency required) = B1 · English Seniority: Open to mid-level through senior consultants

About the project

We are staffing a consulting engagement set in a German public-sector / governmental environment. Because of the official context, working German language skills are mandatory. The engagement runs primarily as a near-shore delivery model, with approximately 5–10% onsite work reserved for onboarding and regular coordination meetings.

Your role

As a network consultant, you will support the full delivery lifecycle — from requirements management through design, implementation support, and testing — operating across network, enterprise, and software architecture contexts.

Core skill (must-have)

• IPv6 networking expertise — hands-on experience with design, addressing and planning, migration, and operations.

Additional skills (highly valued)

• Cisco networking technologies
• NetBox — IPAM / DCIM, network source of truth
• NetBird — WireGuard-based overlay / zero-trust networking
• Ability to bridge network, enterprise, and software architecture

Responsibilities across the lifecycle

• Requirements engineering and management
• Network / enterprise / software architecture design and consulting
• Implementation support
• Testing and validation

Your profile

• Proven track record as a network / IT consultant in complex environments
• Comfortable operating in German-language, public-sector settings

• Combines deep network expertise with a broader enterprise and software architecture understanding

   

Availability

Immediate availability is not required. We welcome consultants who are available now, as well as those who can become fully or partially available in the foreseeable future.