Jobs Security

Cloudfresh ⛅️ is a Global Google Cloud Premier Partner, Zendesk Premier Partner, Asana Solutions Partner, GitLab Select Partner, Hubspot Platinum Partner, Okta Activate Partner, and Microsoft Partner.

Since 2017, we’ve been specializing in the implementation, migration, integration, audit, administration, support, and training for top-tier cloud solutions. Our products focus on cutting-edge cloud computing, advanced location and mapping, seamless collaboration from anywhere, unparalleled customer service, and innovative DevSecOps.

We’re looking for a Google Cloud Security Engineer to harden client environments across GCP. You’ll implement and help design security controls, automate guardrails, improve detection & response, and guide stakeholders through pragmatic, risk-based decisions across EMEA.

Requirements:

• 3+ years proven, hands-on experience in a Security Engineer, SecOps (or similar) role.
• Strong knowledge of building and operating Security Porture, Edge protection, WAF, Endpoint security.
• Technical certifications related to CyberSecurity Google Cloud Solutions, Cloudflare and JumpCloud are an advantage.
• Experience of presentation, documentation.
• Excellent communication and strategic planning abilities, able to explain trade-offs, influence remediation, and drive adoption of guardrails.
• Basic scripting experience (e.g., Python, Bash, or gcloud CLI).
• Fluency in English.

Responsibilities:

• Design, implement, and operate security controls for internal needs and clients across.
• Perform cybersecurity audits.
• Configure and monitor Security Command Center, audit logs, and threat protection.
• Establish logging, detection and incident response.
• Assist clients with implementation of Cybersecurity products (Google Cloud Security Center, Google Workspace Security, Cloudflare, JumpCloud) and compliance controls.
• Generate security assessment reports and provide actionable recommendations.
• Continuously assess the landscape: track new Vendors features and update baselines to improve posture, reliability, and cost efficiency.

Work conditions:

• Competitive Salary & Transparent Motivation: Receive a competitive base salary with performance-based bonuses, providing clear financial rewards for your success.
• Flexible Work Format: Work remotely with flexible hours, allowing you to balance your professional and personal life efficiently.
• Training with Leading Cloud Products: Access in-depth training on cutting-edge cloud solutions, enhancing your expertise and equipping you with the tools to succeed in an ever-evolving industry.
• International Collaboration: Work alongside A-players and seasoned professionals in the cloud industry. Expand your expertise by engaging with international markets across the EMEA and CEE regions.
• Vibrant Team Environment: Be part of an innovative, dynamic team that fosters both personal and professional growth, creating opportunities for you to advance in your career.

When applying to this position, you consent to the processing of your personal data by CLOUDFRESH for the purposes necessary to conduct the recruitment process, in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 (GDPR).
Additionally, you agree that CLOUDFRESH may process your personal data for future recruitment processes. You can withdraw this consetn at any time.

Come Back Agency supports US software and technology companies by running their hiring process. We work with delivery and leadership teams to define roles, screen candidates, and manage interviews. Successful candidates are hired directly by the company and become part of its team.

This position is with a US-based software company providing custom development and AI implementation for North American clients. The team builds and maintains production software, including AI-enabled systems, and works in long-term client engagements. Team members operate as part of an internal, distributed team and collaborate directly with client stakeholders.

About the role

The company is moving deeper into enterprise work. We need a DevOps engineer who can help harden our infrastructure, implement security best practices, and drive compliance readiness so we can pass enterprise vendor reviews and pursue certifications like SOC 2 and ISO 27001. You will work closely with engineering and leadership across infrastructure, security, and compliance.

What you will do:

• Build and maintain secure cloud infrastructure and CI/CD pipelines
• Implement access control, least privilege, and secrets management across environments
• Standardize logging, monitoring, alerting, and audit trails
• Create and maintain secure SDLC practices, including code scanning, dependency scanning, and change control
• Set up incident response basics, including runbooks, on-call expectations, and post-incident process
• Compliance readiness for SOC 2 and ISO 27001 by implementing required technical controls and gathering evidence
• Vulnerability management and patching routines for infrastructure and dependencies
• Improve backup, disaster recovery, and business continuity practices
• Support client security questionnaires with clear technical answers and evidence

Requirements:

• Up to 2 years of DevOps experience with cloud infrastructure and deployment pipelines
• Hands-on experience with AWS, including IAM, networking, compute, and logging services
• Experience with Infrastructure as Code such as Terraform
• Experience with containerization and orchestration, Docker and Kubernetes preferred
• Comfort setting up security tooling, SAST, DAST, dependency scanning, secret scanning
• Ability to document systems clearly and work with auditors or compliance tools when needed
• English at B2 level or higher - you will collaborate directly with US client stakeholders

Nice to have:

• SOC 2 or ISO 27001 experience, even if you were the technical owner not the compliance PM
• Experience with Vanta, Drata, Secureframe, or similar evidence automation tools
• Experience working with HIPAA or other regulated client environments
• AWS certifications such as Solutions Architect or Security Specialty

What We Offer:

• Working hours aligned with US time zones, typically 16:00-23:59 Kyiv time
• English lessons to support clear and confident communication
• Paid vacation and sick days
• Fully remote work
• Opportunities for professional growth within the team
• Structured, personalized onboarding to help you ramp up effectively

Apply with your resume and a short note outlining your relevant experience. You can also submit it through our website at comeback.ua. Selected candidates will be contacted by Come Back Agency.

Наш клієнт, Growe, провідна консалтингова компанія та група сервісів у сфері iGaming і розваг. Вони створюють стратегії, що працюють, та рішення, які масштабуються. 

Ідеально для тих, хто прагне:

• Сортувати, перевіряти та визначати пріоритети результатів перевірки безпеки, отриманих за допомогою інструментів сканування SAST, SCA та Secret, фільтрація хибнопозитивних результатів, оцінка ризиків та відстеження проблем до їх усунення;
• Проводити ручні та інструментальні перевірки коду для виявлення вразливостей безпеки та небезпечних варіантів реалізації до того, як код потрапить у Production;
• Проводити практичне тестування безпеки вебзастосунків, мікросервісів та API для виявлення вразливостей безпеки та недоліків у бізнес-логіці;
• Проводити аудит REST та GraphQL API та веб-додатків з акцентом на основні ризики безпеки додатків, аутентифікацію, авторизацію та бізнес-логіку.

Досвід, який стане твоєю перевагою:

• 2-4 роки досвіду роботи в Application Security, Product Security, or Penetration Testing;
• Практичний досвід сортування та аналізу результатів, отриманих за допомогою Semgrep/OpenGrep, Gitleaks, Trivy та OSV-Scanner;
• Досвід роботи з Burp Suite (Pro), Nuclei, Subfinder, SQLmap, Metasploit та NetExec;
• Розуміння класичних вразливостей OWASP Top 10, включаючи недоліки ін'єкцій (SQLi, Command Injection), підробку запитів на стороні сервера (SSRF), міжсайтовий скриптинг (XSS), підробку міжсайтових запитів (CSRF), порушений контроль доступу / незахищені прямі посилання на об'єкти (IDOR / BOLA), неправильні конфігурації безпеки, криптографічні збої, незахищену десеріалізацію та масове призначення;
• Знання OWASP API Security Top 10 для архітектур REST та GraphQL;
• Розуміння протоколів ідентифікації та механіки контролю доступу (OAuth 2.0, OIDC, JWT, SAML, RBAC/ABAC);
• Здатність виявляти складні обходи авторизації, недоліки управління сеансами та помилки бізнес-логіки;
• Середній рівень англійської мови (розмовний та письмовий).
• Здатність читати та аналізувати сучасний код додатків для виявлення недоліків безпеки (буде плюсом);
• Базове розуміння принципів хмарної безпеки в середовищах AWS та основ безпеки Kubernetes (K8s) (буде плюсом);
• Сертифікації BSCP, CWES, OSCP, CPTS (будуть плюсом).

Ми цінуємо:

• Сильні комунікативні навички для ефективної співпраці з командами інженерів, розробників продуктів та DevOps;
• Навички спрямованості на результат;
• Відкритість до навчання.

Наші клієнти пропонують конкурентні переваги для підтримки вашого професійного та особистого зростання, зокрема:

• Орієнтація на здоров’я та добробут;
• Глобальне медичне страхування;
• Можливості для зростання;
• Програми бенефітів (компенсація спорту / стоматології / психолога тощо);
• Бонуси за досягнення результатів;
• Динамічне робоче середовище.

English version:

Our client, Growe, is a leading business advisory and services group in iGaming and Entertainment. Сreators of strategies that work and solutions that scale. 

Perfect for those who aim to:

• Triage, validate, and prioritize security findings from SAST, SCA, and Secret scanning tools, filter out false positives, assess risks, and track issues through to remediation;
• Conduct manual and tool-assisted code reviews to identify security vulnerabilities, logic flaws, and insecure implementation choices before code reaches production;
• Perform hands-on penetration testing of web applications, microservices, and APIs to uncover security vulnerabilities and business logic flaws; 
• Audit REST and GraphQL APIs and web applications with a strong focus on core application security risks, authentication, authorization, and business logic.

Experience you’ll need to bring:

• 2-4 years of experience in Application Security, Product Security, or Penetration Testing; 
• Hands-on experience triaging and analyzing findings from Semgrep / OpenGrep, Gitleaks, Trivy, and OSV-Scanner;
• Experience with Burp Suite (Pro), Nuclei, Subfinder, SQLmap, Metasploit, and NetExec; 
• Deep understanding of classic OWASP Top 10 vulnerabilities, including Injection flaws (SQLi, Command Injection), Server-Side Request Forgery (SSRF), Cross-Site Scripting (XSS), Cross-Site Request Forgery (CSRF), Broken Access Control / Insecure Direct Object References (IDOR / BOLA), Security Misconfigurations, Cryptographic Failures, Insecure Deserialization, and Mass Assignment;
• Solid knowledge of OWASP API Security Top 10 for REST and GraphQL architectures; 
• Deep understanding of identity protocols and access control mechanics (OAuth 2.0, OIDC, JWT, SAML, RBAC/ABAC);
• Ability to identify complex authorization bypasses, session management flaws, and business logic bugs;
• Ability to read and analyze modern application code to spot security flaws (will be a plus); 
• Basic understanding of cloud security principles in AWS environments and Kubernetes (K8s) security fundamentals (will be a plus);
• Intermediate level of English (spoken and written);
• BSCP, CWES, OSCP, CPTS certifications (will be a plus).

It's a perfect match if you have those personal features:

• Strong communication skills to effectively collaborate with engineering, product, and DevOps teams;
• Result-oriented mindset;
• Openness to learning.

Our clients offer competitive benefits to support your professional and personal growth, including: 

• Health & Wellness Focus;
• Global Medical Coverage;
• Growth Opportunities;
• Benefits Programs (compensation for the gym/stomatology/psychological service & etc.);
• Performance-Driven Rewards;
• Dynamic Work Environment.

We’re hiring a DevSecOps Engineer who thrives in fast-moving environments, understands
technical depth, and can independently own security across multiple areas — from architecture and infrastructure to monitoring and investigations.

The role is ideal for someone who prefers deep thinking over surface-level “best practices”.
You’ll play a key role in securing our systems and eventually take ownership of technical implementation and decision-making.

The project is a high-load financial platform that acts as a payment processor for cryptocurrency and fiat transactions. The system utilizes integrations with blockchain networks and processes a high volume of requests within the cloud infrastructure.

Must-Have Skills:

• General Security Engineering: Multipurpose security engineer with broad security knowledge.
• Network Security: Understanding of network principles and network security.
• Cloud Security: Knowledge of cloud providers and cloud security.
• Kubernetes Security: Experience with Kubernetes, specifically how to secure Kubernetes, including knowledge of security policies, admission tasks, securing pods, and tools like Kyverno.
• DevOps Basics: Some basic DevOps knowledge, including CI/CD pipelines.
• Infrastructure as Code: Familiarity with tools like Terraform.
• Audit Infrastructure: Ability to implement audit infrastructure.
• DevSecOps: Familiarity with DevSecOps practices.
• Cryptographic Principles: Strong knowledge of cryptographic principles.
• Proactive Mindset: Proactive approach to security and problem-solving.
• Experience in FinTech or Web3: Experience in either FinTech or Web3 is acceptable; both are considered relevant backgrounds.

Nice-to-Have / Plus:

• Web3/Blockchain Security: Some knowledge of blockchain security, consensus protocols, or smart contract security (but not required).

We offer:

• Competitive compensation
• Social package (24 working days of annual leave, 5 paid sick days)
• Flexible working hours
• Challenging projects in diverse business domains and a variety of tech stacks
• Personal development and professional growth opportunities
• Work with talented, ambitious and family-feel teams
• Educational possibilities: corporate courses, knowledge hubs, and in-house English classes
• Compensation for your professional certification & support for your learning activities
• Opportunity to choose IT equipment you like
• Corporate social responsibility

About Playtech                             

Founded in 1999, the company has a premium listing on the Main Market of the London Stock Exchange and is focused on regulated and regulating markets across its B2B business. By leveraging its proprietary technology, Playtech delivers innovative products and services to ensure a safe, engaging and entertaining gaming experience.

As the gaming industry's leading technology company, it combines business intelligence-driven software, services, content, and platform technology to drive excellence and innovation across the sector. Read more about who we are and what we do here: www.playtechpeople.com and www.playtech.com
 
Here at Playtech, we genuinely believe that people are our biggest asset. Diverse thoughts, experiences, and individual characteristics enrich our work environment and lead to better business decisions. Embracing differences and maintaining transparency in our processes is the core of Playtech's overall commitment to responsible business practices.

Ready to level up your career?

We are seeking an enthusiastic and experienced Cloud Security Engineer to help drive the security posture of Playtech and its subsidiaries.

This position ensures the proper security design and operation of cloud environments in Azure or GCP (primarily IaaS and PaaS) for different types of services and applications. The Cloud Security Engineer will work closely with product teams in the company to assist and audit in building and maintaining secure cloud environments

Your influential mission. You will...

• Oversee cloud security governance and monitoring
• Maintain a Cloud Security Posture Management (CSPM) solution
• Collaborate with DevOps, IT, development and GRC teams to provide subject‑matter expertise in the Google Cloud domain
• Support and maintain cloud‑native security controls
• Conduct security reviews for cloud environments
• Develop documentation outlining security recommendations and best practices
• Identify weak spots, missing controls, vulnerabilities, providing clear recommendations for improvement and remediation
• Stay current on emerging security threats, vulnerabilities, and cloud security controls
• Participate in investigations and responses to potential security incidents
• Implement automation for security‑related tasks

Components for success. You...

• Bring at least 2 years of experience in a similar technical security role
• Demonstrate experience with Microsoft Azure Cloud or Google Cloud Platform (GCP) / Google Workspace
• Apply strong knowledge of CSPM and DSPM solutions
• Understand how cloud infrastructure works, including architecture best practices, managed services, typical vulnerabilities, mitigations, and security best practices
• Communicate clearly, positively, and persuasively on security topics to both technical and non‑technical stakeholders, building effective relationships
• Maintain a strong security mindset with a business‑enablement focus
• Leverage familiarity with modern application development approaches (infrastructure as code, CI/CD, containers, serverless, code/artifact repositories, etc.), with hands‑on experience considered a plus
• Possess broad IT and enterprise architecture knowledge (TCP/IP stack, relevant protocols/technologies—firewall, proxy, etc.; server OS like Windows/Linux; web/database servers, etc.)
• Use basic scripting skills (Python/Shell) to automate and streamline daily tasks
• Have a basic understanding of AI concepts and practical experience using AI tools to improve productivity, automation, and security workflows
• Communicate effectively in spoken and written English
• Operate effectively within an enterprise environment

You'll get extra points for...

• Knowledge of AWS cloud
• Relevant security, systems, networking certifications

Thrive in a culture that values...

• Collaborating with a true product company where your impact is visible
• Growing through a structured educational program designed to support your development
• Continuously learning in a collaborative environment where experienced colleagues help you expand your skills
• Working in a friendly, supportive, and inclusive atmosphere

SECURITY TEAM
A dynamic and innovative team that focuses on developing and maintaining networks across Playtech. If you’re looking for a challenging and rewarding work environment, the Security Unit at Playtech is a great place to be!

Playtech is an equal opportunities employer. Our mission is to welcome everyone and create inclusive teams. We celebrate differences and encourage everyone to join us and be themselves at work.

Who We Are 

PAR Retail, with its Open Commerce® product suite and patent pending Wallet Steering® System, empowers Convenience & Fuel Retailers to gain more share of wallet and customer lifetime value than possible with any other solution provider. PAR Retail’s unified Open Commerce product suite consists of: Activate for Intelligent 1:1 Loyalty, Transact for Contactless Commerce, and Experience for Cross-Channel Customer Experiences. PAR Retail’s solutions are supported by a set of subscription-based program management services and are contractually backed by its 1.5X Performance Guarantee. 

Requirements:  
- Operational knowledge of modern operating systems and networking; 

- Experience with common cloud services: AWS, GCP, and Azure; 

- Network Security and expertise in network pentesting; 

- Security testing of web applications, web services, mobile apps (hybrid and native), and IT infrastructure; 

- Understanding security certifications (PCI DSS / SOC2); 

- Ability to apply modern Application Security methodologies and frameworks; 

- Ability to use at least one modern programming language; 

- Practical experience with Burp Suite; 

- Experience with IDS, IPS, SIEM configuration; 

- Upper-intermediate English level. 

Responsibilities:  

- Requirements analysis, performing penetration testing and security audit; 

- BE, WEB, cloud and mobile clients testing; 

- Vulnerability reporting and remediation process; 

- Communication with development and project management teams; 

- Prepare security testing reports; 

- Prepare and support internal documentation for the project. 

PAR Retail Offers: 

- Long-term employment; 

- Competitive compensation with regular performance-based salary and career development reviews; 

- Paid vacations and sick leaves; 

- Health insurance program; 

- Flexible working hours; 

- Sponsored company educational program, corporate library; 

- Funny celebrations, team outings, and company events; 

- A unique and friendly environment where everyone can explore and learn new technologies. 

Our Partner is building a monitoring and management platform for critical energy infrastructure, helping operators securely monitor and manage power plants and looking for a Senior Network Security Engineer who will take ownership of securing the intersection between IT and Operational Technology (OT).

Platform already has active customers, and they are now expanding the engineering team to improve scalability, security, and reliability while preparing for broader European market expansion.

Main Responsibilities

– Design and implement secure network architecture for critical infrastructure environments.

– Secure connectivity between power plants, PLC devices, and the central platform.

– Build and maintain secure remote access solutions (VPN, WireGuard).

– Configure and maintain network segmentation, firewalls, and security policies.

– Manage internal PKI and certificate lifecycle for services, VPNs, and industrial communication.

– Perform infrastructure security assessments and vulnerability management.

– Deploy and maintain monitoring, logging, IDS/SIEM solutions.

– Investigate and respond to security incidents.

– Collaborate with backend engineers, PLC engineers, and an external cybersecurity consultant to implement security best practices and comply with modern EU cybersecurity requirements (including NIS2).

Mandatory Requirements

– 5+ years of hands-on experience in Network Engineering, with a strong focus on Cybersecurity.

– Strong understanding of networking fundamentals and secure network architecture.

– Experience responding to real security incidents.

– Hands-on experience with enterprise networking and security technologies, including:

▫️MikroTik RouterOS

▫️Enterprise firewalls (Fortinet, Palo Alto, pfSense or similar)

▫️WireGuard or other VPN technologies

▫️PKI, TLS and certificate management

▫️Linux server hardening

▫️Vulnerability assessment and security hardening

▫️IDS/SIEM solutions (Wazuh, Suricata, Zeek or similar)

– Experience working in Operational Technology (OT), industrial environments,  other critical infrastructure — or a strong understanding of OT security principles.

– Strong English communication skills (B2+) — (technical documentation, cybersecurity standards, and collaboration with international teams)

Why join us

– Work on a product protecting critical energy infrastructure.

– Opportunity to build security architecture from the ground up.

– Exposure to modern European cybersecurity regulations (NIS2).

– High level of ownership and influence on technical decisions.

– Flexible, results-oriented culture with significant technical autonomy.

– Remote format.

– Salary: Competitive, depending on experience.

The Defense Procurement Agency (DOT) is a state-owned enterprise responsible for procuring military equipment, ammunition, UAVs, fuel, food, clothing, and other critical supplies for the Armed Forces of Ukraine and the Defense Forces.

Our mission: Strengthening Ukraine's defense capabilities by ensuring reliable procurement and supporting the development of the national defense industry.

Our vision: To become the driving force behind a modern defense procurement ecosystem built according to NATO standards.

We are looking for a Head of Information Security to lead and strengthen our Information Security function across governance, engineering, and security operations. This role combines strategic leadership with hands-on technical expertise, ensuring the continuous development of our Information Security Management System (ISMS), alignment with the NIST Cybersecurity Framework, and the organization's readiness to prevent, detect, and respond to cyber threats.

What You'll Accomplish (First 6–12 Months)

• Ensure continued NIST compliance for DOT Chain and define the roadmap for future security initiatives, including platforms such as Azure AI Foundry.
• Strengthen the security posture of IT Enterprise by implementing and maintaining NIST security controls, establishing regular risk assessments, exception management, and vulnerability remediation processes.
• Build a high-performing security organization with defined OKRs, KPIs, resource planning, and performance management.
• Enhance Azure-based Security Operations by improving monitoring, incident response, vulnerability management, identity governance, and RBAC.
• Lead Red Team and Purple Team exercises (including ransomware readiness and identity compromise scenarios) and translate findings into engineering improvements.
• Establish vendor security governance, including security assessments, NDA/SLA/DPA requirements, and third-party security audits.

Responsibilities

Leadership & Team Management

• Lead both Information Security Governance (ISMS, Risk & Compliance) and Cybersecurity Engineering & Operations.
• Manage, mentor, and develop the Information Security team through structured performance management, OKRs, and individual development plans.
• Collaborate closely with Engineering, IT, Product, and business stakeholders to prioritize security initiatives and protect critical services.

Governance, Risk & Compliance

• Develop and maintain security policies, standards, procedures, and risk registers.
• Lead internal and external security audits and coordinate remediation activities.
• Drive the organization's transition toward NIST-based security practices while maintaining alignment with ISO 27001 where required.
• Own Incident Response Plans (IRP), post-incident reviews, and continuous improvement.
• Ensure compliance with Ukrainian legislation related to information security and personal data protection.

Security Engineering & Operations

• Oversee enterprise security technologies, including:
• Microsoft Sentinel
• Microsoft Defender
• EDR/XDR
• SIEM
• DLP
• PAM
• IAM / Microsoft Entra ID
• MDM
• Lead incident monitoring and response activities.
• Manage vulnerability lifecycle from discovery through remediation.
• Improve identity security through MFA, PIM, Least Privilege, JML processes, Key Vault, secrets management, and centralized logging.
• Define and improve SOC processes, runbooks, SLAs, and operational metrics.

Application Security & Secure SDLC

• Strengthen application security throughout the software development lifecycle.
• Drive Threat Modeling, Security Architecture Reviews, DevSecOps practices, automated code scanning (SAST/DAST), SBOM generation, and CI/CD security.
• Integrate Red/Purple Team findings into engineering roadmaps and development practices.

Vendor Security

• Evaluate and audit third-party vendors integrated with DOT Chain.
• Establish and maintain supplier security requirements, including NDA, SLA, DPA, and third-party security assessments.

Strategy, Reporting & Budget

• Report regularly to executive leadership on security posture, KPIs, risks, vulnerability remediation, and incident readiness.
• Own the Information Security budget and define a 12–18 month security roadmap with prioritized initiatives and measurable business value.

Requirements

Experience

• 5+ years of experience in Information Security or Cybersecurity.
• 3+ years leading Information Security teams and security programs.
• Proven experience implementing enterprise Information Security strategies and governance.
• Hands-on experience with Red Team/Purple Team exercises, attack simulations, ransomware preparedness, and identity compromise scenarios.
• Strong experience implementing and maintaining NIST Cybersecurity Framework and/or ISO 27001.
• Experience building or managing Security Operations (SOC/SecOps), incident response, vulnerability management, and security monitoring.
• Strong Microsoft Azure security expertise, including:
• Microsoft Defender for Cloud
• Defender for Endpoint
• Defender for Identity
• Defender for Office 365
• Microsoft Sentinel
• Microsoft Entra ID
• Azure Key Vault
• Understanding of Secure SDLC, Application Security, DevSecOps, SAST/DAST, CI/CD security, Infrastructure as Code, and secret management.
• Experience securing .NET and PHP application environments is an advantage.

Technical Knowledge

• Strong practical knowledge of:
• NIST Cybersecurity Framework (CSF 2.0)
• NIST SP 800 Series
• ISO/IEC 27001
• Knowledge of Ukrainian regulations related to information security and personal data protection.

Leadership & Soft Skills

• Strong leadership, people management, and stakeholder management skills.
• Experience establishing KPIs, OKRs, and performance management frameworks.
• Ability to balance strategic governance with hands-on technical leadership.
• Excellent communication skills, including the ability to explain technical risks to executive stakeholders.
• Strong analytical thinking and decision-making skills.
• Zero tolerance for corruption.

Preferred Qualifications

• CISSP
• CISM
• ISO 27001 Lead Implementer or Lead Auditor
• Microsoft certifications such as SC-100, SC-200, SC-300, SC-400, or AZ-500.
• Experience working within government organizations or other highly regulated environments.

What We Offer

• Meaningful work that directly contributes to strengthening Ukraine's defense capabilities.
• Official employment with competitive salary and full social benefits.
• Professional development, learning opportunities, and career growth.
• Structured onboarding and dedicated mentorship.
• A collaborative, supportive, and mission-driven team.
• Modern office near the metro with reliable internet and equipped shelter.
• Opportunity to build and lead cybersecurity for one of Ukraine's most strategically important digital ecosystems.

By joining our team, you will contribute to one of Ukraine's largest digital transformation initiatives in the defense sector and help build the future of defense procurement.

Ready to make a real impact? We'd love to hear from you. Apply today!

* By submitting your CV, you consent to the processing of your personal data in accordance with applicable legislation.

** Due to the high volume of applications, only candidates whose qualifications best match the position will be contacted.

Our client is a global leader in AI-powered IT Service Management (ITSM), developing intelligent platforms that automate IT support processes and help organizations operate more efficiently. Their solutions are trusted by thousands of companies worldwide, simplifying complex IT operations and enabling teams to focus on strategic initiatives.

We are looking for a Senior Application Security Engineer with a strong software engineering background who has designed, developed, deployed, and maintained production systems before transitioning into application security. This role will serve as the security backbone of the R&D organization, ensuring security is embedded throughout the software development lifecycle and partnering closely with Engineering, DevOps, Architecture, and Product teams.

This is a highly visible, hands-on position reporting directly to the CISO, offering a clear growth path toward an Application Security Lead role and exposure to cloud security, AI security, and governance initiatives.

Who We're Looking For

• 5+ years of hands-on experience as a Software Developer, Backend Developer, Full-Stack Developer, or similar engineering role, with a proven track record of designing, building, shipping, debugging, and maintaining production software.
• Strong understanding of software development processes, engineering best practices, architecture, and SDLC methodologies.
• 2+ years of experience in Application Security, Product Security, or Secure SDLC, with a demonstrated transition from software engineering into security.
• Experience partnering closely with R&D and development teams, acting as a trusted security advisor who enables innovation while improving security posture.
• Hands-on experience implementing Secure SDLC practices within modern CI/CD environments (GitHub, GitLab, Jenkins, ArgoCD, or similar).
• Solid understanding of common application vulnerabilities, secure coding principles, OWASP Top 10, CWE/SANS Top 25, threat modeling methodologies (e.g., STRIDE, PASTA), and security architecture reviews.
• Experience with application security tools and practices, including SAST, DAST, SCA, secret scanning, and secure code review.
• Strong knowledge of API security and experience securing and testing REST and/or GraphQL APIs.
• Understanding of software supply chain security, including third-party dependency risks, SBOM concepts, open-source risk management, dependency confusion, and related attack vectors.
• Knowledge of cloud security fundamentals, preferably AWS, including IAM, containers/Kubernetes security, and Infrastructure as Code (Terraform or similar).
• Familiarity with SaaS and product company environments and the security challenges associated with cloud-native applications.
• Understanding of AI/LLM security risks, including prompt injection, data leakage, model abuse, agentic risks, and secure adoption of AI assistants within engineering and security workflows.
• Experience performing security-focused design, architecture, and threat modeling reviews.
• Excellent communication and stakeholder management skills, with the ability to influence teams without direct authority.
• Strong written and verbal English communication skills.

• Bachelor’s degree in Computer Science, Information Security, or a related field (or equivalent practical experience).

   

Role Focus

The primary focus of this role is the application security of the product.

Key responsibilities:

• Working closely with R&D teams on a daily basis.
• Helping developers build more secure products and adopt security best practices.
• Reviewing application designs and architectures from a security perspective.
• Identifying security risks in APIs, integrations, third-party libraries, and development processes.
• Managing vulnerabilities by analyzing, prioritizing, and supporting remediation efforts.
• Promoting and maintaining secure development practices across CI/CD pipelines.

• Applying and advocating security standards, frameworks, and industry best practices.

   

Nice to Have

• Penetration testing experience.
• Experience with bug bounty programs and vulnerability management.
• Strong knowledge of OWASP frameworks and methodologies.
• Hands-on experience with SAST, DAST, IAST, SCA, and secret-scanning tools.
• Cloud security experience (AWS, Azure, or GCP).
• AI / LLM security knowledge and practical experience.
• Security certifications such as CISSP, CSSLP, OSCP, OSWE, GWAPT, GPEN, CEH, GIAC certifications, or similar.

We are looking for a Cyber Defense Manager to lead, mature, and operate our resilient security operations capability. In this role, you will own the defense of our environment, ensuring fast and precise threat detection, investigation, containment, and exposure reduction. You will lead our security operations function, making the organization faster in responding to threats while continuously improving controls across the attack surface.

Responsibilities

• Own Cyber Defense execution across SOC, detection engineering, incident response, and exposure remediation
• Lead alert triage quality, escalation standards, incident command, and response coordination
• Prioritize critical vulnerabilities and exposures using asset criticality, exploitability, and business impact
• Manage Cyber Defense dashboards, runbooks, remediation follow-up, and operational metrics
• Coordinate with IT, Platform, IAM, Product, GRC, Legal, and business owners during incidents and remediation
• Build and develop the Cyber Defense team, including hiring, onboarding, mentoring, and retaining security talent
• Drive continuous improvement of detection coverage, response playbooks, and security controls based on lessons learned and threat intelligence
• Report on Cyber Defense performance, incidents, and risk posture to security leadership and stakeholders

Requirements

• 10+ years of experience in Information Security
• 3+ years in a security management or team lead role with direct people management experience
• Hands-on experience managing SOC operations, leading incident command, and driving MTTD/MTTR improvement
• Ability to design, validate, and maintain detection logic across SIEM, EDR, and cloud platforms, with a deep understanding of runbook development and false-positive reduction
• Knowledge of top attack scenarios (ATO, credential theft, privilege escalation, data exfiltration) and ability to map detections to threat models like MITRE ATT&CK
• Experience prioritizing vulnerabilities using CVSS and asset criticality to reduce exposure aging
• Hands-on experience with at least one enterprise SIEM (Splunk, Microsoft Sentinel, Chronicle, Elastic) and SOAR tooling
• Understanding of cloud-native security controls and monitoring in AWS, GCP, or Azure
• Understanding of IAM, PAM, SSO, and identity-related attack vectors relevant to detection and response
• Ability to define, track, and communicate security KPIs and operational dashboards to technical and executive audiences
• English - Upper-Intermediate or higher

Will be a plus

• Experience in fintech, e-commerce, or other high-risk industries with complex threat landscapes
• Hands-on background as a SOC analyst, incident responder, or detection engineer prior to moving into management
• Experience building a SOC or Cyber Defense function from scratch or significantly maturing an existing one
• Familiarity with threat intelligence platforms and threat-informed defense methodologies
• Relevant certifications: CISSP, CISM, GIAC (GSOM, GCED, GCIH) or equivalent

We offer

• 20 paid vacation days per year
• 10 paid sick leave days per year
• Public holidays as per the company’s approved Public holiday list
• Medical budget
• Opportunity to work remotely
• Professional education budget
• Language learning budget
• Wellness budget (gym membership, sports gear and related expenses)

We are looking for an Enterprise & Cloud Security Manager to lead and mature our enterprise security function across cloud, network, identity, endpoint, and data domains. In this role, you will own the design and enforcement of security guardrails across a hybrid environment. You will lead a team of security engineers, drive the evolution toward a cloud-first model, and track and report on enterprise security metrics.
 

Responsibilities
 

• Own and lead Enterprise & Cloud Security across cloud, network, identity, endpoint, and data domains
• Define and enforce enterprise security guardrails, approving low/medium-risk platform exceptions
• Lead CSPM/CNAPP/CWPP, WAF, DNS security, and IaC scanning across cloud environments
• Manage cloud IAM and security-group guardrails in close collaboration with Platform and SRE teams
• Operate and mature endpoint security (EDR/XDR/MDM) across managed devices, including hardening and telemetry health
• Own data security and cryptography controls: KMS, secrets management, PKI, and certificate lifecycle
• Lead, mentor, and develop a team of security engineers (4 direct reports — Cloud & Network, Endpoint, IAM, Data Security & Cryptography)
• Track, analyze, and report enterprise security metrics

Requirements
 

• 5+ years of experience in managing and developing security teams
• Proven track record in hands-on cybersecurity engineering roles
• Enterprise-level background
• Practical experience with on-premises environments
• Solid experience with networking
• Hands-on experience with cloud platforms
• Broad experience across cloud posture, network, identity, endpoint, and data protection security domains
• Experience with CSPM/CNAPP/CWPP tooling and cloud guardrails (WAF, DNS security, IaC scanning)
• Experience with cloud IAM and security-group/IaC security patterns
• Experience operating EDR/XDR and MDM solutions
• Experience with KMS, secrets management, PKI, and certificate management
• Ability to enforce security controls without unnecessarily blocking delivery for Platform/SRE/DevOps teams
• Upper-Intermediate English and higher

Will be a plus

• Higher education in Computer Science, Information Security
• Background in fintech, brokerage, trading platforms, payments, or other regulated environments
• Track record of building or maturing an enterprise/cloud security function from an early stage
• Familiarity with tools such as Wiz, Panorama, Elastic Defender, Entra, or CyberArk
• Knowledge of Kubernetes/container security and cloud-native architectures
• Exposure to SOC 2, ISO 27001, or DORA compliance frameworks

We offer

• 20 paid vacation days per year
• 10 paid sick leave days per year
• Public holidays as per the company’s approved Public holiday list
• Medical budget
• Opportunity to work remotely
• Professional education budget
• Language learning budget
• Wellness budget (gym membership, sports gear and related expenses)

About project

We are a Barcelona-based R&D center seeking Vulnerability Researchers/Security Researchers to join our team. The role focuses on hands-on vulnerability research, including finding and exploiting vulnerabilities in complex systems such as browsers, kernels, mobile and desktop operating systems. We offer full-time remote work as well as relocation opportunities to Barcelona. Flexible working hours are supported depending on productivity and time zones.

Your area of responsibility

• Detect, analyze, and exploit vulnerabilities;
• Conduct vulnerability research across browsers, kernels, mobile and desktop operating systems, and other complex software;
• Understand the technical details of vulnerabilities and assess their real impact;
• Develop exploits, proof-of-concept code, scripts, and software modules to validate vulnerabilities;
• Perform reverse engineering and binary analysis as part of vulnerability research;
• Reverse-engineer security patches to better understand vulnerabilities;
• Use fuzzing and other research techniques to discover vulnerabilities;
• Effectively communicate vulnerability findings and their technical impact;
• Assist in the development of tools for vulnerability and security research.

Skills and requirements

• Proven hands-on experience in vulnerability research and vulnerability exploitation;
• Experience in exploit development;
• Experience in finding vulnerabilities in complex systems;
• Experience with reverse engineering;
• Knowledge of OS internals;
• Knowledge of modern exploitation techniques;
• Experience researching at least one of the following areas: browsers, kernels, mobile OSes, desktop OSes, or embedded systems;
• Experience with platforms such as Windows, Linux, macOS, iOS, or Android;
• Ability to work independently in a remote environment;
• Availability for full-time work.

Will be a plus

• Published CVEs or other proven records of discovered vulnerabilities;
• Experience finding and exploiting vulnerabilities in browsers or OS kernels;
• Experience with fuzzing;
• Participation in CTFs, security competitions, or security conferences;
• Bug bounty or independent vulnerability research experience;
• Published security research, technical write-ups, PoCs, or research tools;
• Offensive security background;
• Academic degree in Computer Science, Mathematics, or Physics.

We offer

• A real opportunity to influence the product, architecture, and technical decisions;
• Direct communication with C-level management, without unnecessary bureaucracy;
• Remote-first environment;
• Long-term and enjoyable cooperation;
• 20 paid working days of vacation per year;
• 5 paid undocumented sick days;
• Official public holidays as days off;
• Personal legal support;
• English classes;
• Team-building events and a friendly, supportive atmosphere.

We are expanding our Application Security team and need someone who is not only experienced but also shares our commitment to excellence.
 

Purpose of the role:

Our goal is to make sure that we deploy secure software to production without unnecessary bottlenecks, that applications are properly hardened, and security vulnerabilities, once discovered, are fixed by the developers.

As a Senior Application Security Engineer, you will play a crucial role in ensuring the security of our applications throughout the entire software development lifecycle (SDLC). You will partner closely with the product teams to identify, analyze, and mitigate security vulnerabilities, contributing to the creation of trustworthy and robust products.
 

Key responsibilities:

• Partner with product teams during the design phase to lead threat modeling and risk assessments sessions, translating complex security threats into clear, actionable security requirements.
• Perform in-depth manual code reviews on critical applications to identify complex logical vulnerabilities as part of white-box security assessment.
• Plan, design, implement, automate and (if you wish) support AppSec tools.
• Contribute to building a company-wide processes for secure code development and deployment.
• Triage identified security vulnerabilities, provide clear and actionable descriptions and ensure these findings are properly addressed and mitigated.
• Manage the bug bounty program, collaborate with researches and internal teams to resolve the discovered vulnerabilities.
• Partner with Dev/QA teams throughout the development lifecycle to enhance the application's security posture by providing expert consulting, continuous knowledge sharing, and actionable security guidance.

Required Experience:

• 5+ years of experience in Application Security.
• Knowledge of secure development processes and best practices.
• Deep understanding of web application security mechanisms (i.e., how the web actually works? What is SOP and why do we need CORS? What is CSP?).
• Deep understanding of common web application vulnerabilities (i.e., OWASP Top 10), and the most effective ways to prevent them.
• Knowledge of secure system/application architecture and design principles.
• Understanding of modern threats to high-performance web applications that are used by millions of users daily.
• Understanding of modern authentication/authorisation patterns (OAuth, OIDC, JWT, etc.)
• Practical hands-on expertise in identifying vulnerabilities through security assessment and secure code review, coupled with the ability to perform deep root-cause analysis to drive systemic fixes.
• University degree in Computer Science, Information Security, or related field, or equivalent combination of education and experience.
• English and Russian proficiency at an upper-intermediate level (B2+).
   

Nice to have:

• Passion about programming.
• Technical knowledge of network and operating systems security.
• Hands-on DevSecOps experience.
• Practice of participation in bug bounty programs and/or CTFs.
• Deep knowledge of SAST/DAST tools, including customisation.
• Relevant certifications (i.e., OSWE, GWEB, etc.).

Our Benefits:

• Private health insurance
• Sports benefits
• Comprehensive Mental Health Program
• Free English lessons (online)
• Local language courses
• Paid time off
• Maternity leave support
• Referral program rewards
• Upskilling, internal workshops, and participation in professional conferences and corporate events

We are looking for a Head of Security Operations Center to lead, mature, and operate our resilient security operations capability. In this role, you will own the defense of our environment, ensuring fast and precise threat detection, investigation, containment, and exposure reduction. You will lead our security operations function, making the organization faster in responding to threats while continuously improving controls across the attack surface.

Responsibilities

• Own Cyber Defense execution across SOC, detection engineering, incident response, and exposure remediation
• Lead alert triage quality, escalation standards, incident command, and response coordination
• Prioritize critical vulnerabilities and exposures using asset criticality, exploitability, and business impact
• Manage Cyber Defense dashboards, runbooks, remediation follow-up, and operational metrics
• Coordinate with IT, Platform, IAM, Product, GRC, Legal, and business owners during incidents and remediation
• Build and develop the Cyber Defense team, including hiring, onboarding, mentoring, and retaining security talent
• Drive continuous improvement of detection coverage, response playbooks, and security controls based on lessons learned and threat intelligence
• Report on Cyber Defense performance, incidents, and risk posture to security leadership and stakeholders

Requirements

• 10+ years of experience in Information Security
• 3+ years in a security management or team lead role with direct people management experience
• Hands-on experience managing SOC operations, leading incident command, and driving MTTD/MTTR improvement
• Ability to design, validate, and maintain detection logic across SIEM, EDR, and cloud platforms, with a deep understanding of runbook development and false-positive reduction
• Knowledge of top attack scenarios (ATO, credential theft, privilege escalation, data exfiltration) and ability to map detections to threat models like MITRE ATT&CK
• Experience prioritizing vulnerabilities using CVSS and asset criticality to reduce exposure aging
• Hands-on experience with at least one enterprise SIEM (Splunk, Microsoft Sentinel, Chronicle, Elastic) and SOAR tooling
• Understanding of cloud-native security controls and monitoring in AWS, GCP, or Azure
• Understanding of IAM, PAM, SSO, and identity-related attack vectors relevant to detection and response
• Ability to define, track, and communicate security KPIs and operational dashboards to technical and executive audiences
• English - Upper-Intermediate or higher

Will be a plus

• Experience in fintech, e-commerce, or other high-risk industries with complex threat landscapes
• Hands-on background as a SOC analyst, incident responder, or detection engineer prior to moving into management
• Experience building a SOC or Cyber Defense function from scratch or significantly maturing an existing one
• Familiarity with threat intelligence platforms and threat-informed defense methodologies
• Relevant certifications: CISSP, CISM, GIAC (GSOM, GCED, GCIH) or equivalent

We offer

• 20 paid vacation days per year
• 10 paid sick leave days per year
• Public holidays as per the company’s approved Public holiday list
• Medical budget
• Opportunity to work remotely
• Professional education budget
• Language learning budget
• Wellness budget (gym membership, sports gear and related expenses)

About the Role

We are looking for a highly skilled and strategic Senior DevSecOps Engineer to lead our security operations and infrastructure automation initiatives. In this role, you will bridge the gap between development, security, and operations, ensuring our on-premise environment remains secure, resilient, and efficient.
You will act as a subject matter expert, leveraging cutting-edge tools like CrowdStrike to automate threat detection and response, while maintaining robust perimeter security via Cloudflare.

Key Responsibilities
Implementation and automation of security tools in the CI/CD process (SAST, DAST, SCA).
Analysis of vulnerabilities in code, infrastructure and containers.
Development and configuration of security monitoring systems, incident response.
Monitoring and improving the security level of on-prem infrastructures.
Interaction with developers, DevOps and security teams to implement secure practices.
Active participation in the processes of IAM configuration, management of certificates, secrets and access policies.
Conducting internal security audits, participation in external (e.g. penetration) tests.

Requirements

Must-have:
Experience: 5+ years of experience in DevSecOps, Security Engineering, or a related field, with at least 2 years in a Senior role.
Tooling Expertise: Deep hands-on experience with the following specific tools:
Baremetal/on-premise infrastructure
Docker (Docker Swarm is a strong plus)
Gitlab CI 
CrowdStrike
Cloudflare
ELK.
SIEM Proficiency: Proven experience deploying and tuning SIEM solutions (e.g., Splunk, Elastic Security, Datadog, or similar).
Infrastructure: Strong background in managing on-premise infrastructure (physical servers, data centers, virtualization, networking).
Scripting: Proficiency in Python, Go, or Bash for automation and tooling.

Nice-to-have:
Experience with Kubernetes and such tools as Wiz.io and Torq.
Previous involvement in high-load, regulated, or 24/7 production environments (e.g., iGaming, FinTech, telecom or similar).

We offer
Fully remote work opportunity
Enhanced leave benefits:
20 days of paid vacation
5 paid days off
14 paid sick leaves
Company clubs & communities
Celebration gifts for personal milestones
Corporate online events, raffles & challenges
Corporate English program
Corporate yoga classes
Team-building activities
Coworking compensation
Training and development programs (internal & external).