Jobs Security

Our Security team is looking for a Product Security Engineer to strengthen the security of products across the entire software development lifecycle. The focus of the role is security automation and tooling: embedding security checks into CI/CD pipelines, making them reliable and developer-friendly, and ensuring that identified risks are owned and remediated.

This is a hands-on engineering position with direct influence on how product security controls are designed, rolled out and maintained. The role involves close collaboration with AppSec, Cloud Security, DevOps, Platform and product engineering teams.

Responsibilities

• Integration and maintenance of SAST, SCA and secrets scanning across CI/CD pipelines and developer workflows
• Development of reusable security integrations and rules as code, including cloud configuration checks in collaboration with Cloud Security and DevOps
• Safe rollout of security controls together with pipeline owners and tracking of security coverage across products and pipelines
• Tuning of scanner rules and configurations to reduce false positives and provide actionable feedback to engineering teams, without masking real risks
• Troubleshooting of failed scans and broken integrations, timely restoration of controls and escalation of blockers
• Automation of the vulnerability management workflow: collection, deduplication, ticket creation and status tracking, ensuring every High finding has an owner and a due date
• Collaboration with AppSec and development teams on finding validation, remediation guidance and conversion of recurring issues into automated checks
• Proposals for new security gates, tools and improvements to exception handling
• Maintenance of runbooks, coverage reports and documentation, as well as knowledge sharing across teams

Requirements

• 3+ years of hands-on experience in DevSecOps, Product Security or Security Engineering roles
• Strong knowledge of Git workflows and CI/CD pipelines, including design of reusable integrations, investigation of failed jobs and assessment of change impact on delivery
• Practical experience configuring and tuning SAST, SCA and secrets scanning tools, as well as routing results to responsible teams
• Solid automation skills in Python, Bash, Go or a similar language, including API integrations
• Experience implementing security checks or policies as code, with version control, testing and controlled rollouts
• Hands-on experience securing and hardening environments across major cloud providers, including automated compliance checks
• Working knowledge of Linux and containerized build environments: permissions, credentials, logs
• Solid understanding of application, dependency and exposed-secret risks; ability to distinguish a tool failure from a security finding and identify cases requiring specialist review
• Strong ownership, problem-solving and cross-functional communication skills
• Intermediate English or higher
• Fluent Ukrainian

Nice to have

• Experience with AWS
• GitLab CI/CD security integrations
• Terraform or Kubernetes security checks
• Software supply-chain security: SBOMs, artifact signing, build provenance
• DAST integration or use of AI-assisted tools in security automation with appropriate review
• Background in fintech, trading, payments or other security-sensitive product environments

We offer

• 20 paid vacation days per year
• 10 paid sick leave days per year
• Public holidays as per the company's approved Public holiday list
• Medical budget
• Opportunity to work remotely
• Professional education budget
• Language learning budget
• Wellness budget (gym membership, sports gear and related expenses)

We are seeking a Head of Enterprise & Cloud Security to lead and develop our security operations across cloud, network, identity, endpoint, and data domains. In this role, you will design and enforce security protocols in a hybrid environment, lead a team of security engineers, promote a cloud-first approach, and report on enterprise security metrics
 

Responsibilities

• Shape and oversee the infrastructure and cloud security strategy, reporting directly to the CISO
• Hire, lead, mentor, and develop security engineers and team leads
• Define and enforce enterprise security guardrails, approving low/medium-risk platform exceptions
• Manage and lead CSPM/CNAPP/CWPP, WAF, DNS security, and IaC scanning across cloud environments
• Collaborate with Platform and SRE teams to manage cloud IAM and security-group guardrails
• Enhance and manage endpoint security across managed devices, including hardening and telemetry health
• Own data security and cryptography controls, including KMS, secrets management, PKI, and certificate lifecycle
• Track, analyze, and report enterprise security metrics

Requirements

• Proven experience in leading security engineers and managing teams
• Hands-on experience in cybersecurity engineering
• Strong experience in securing on-premises infrastructure in an enterprise environment
• Experience with any major cloud provider
• Proficiency in cloud and network security, including CSPM/CNAPP/CWPP tools, WAF, DNS security, and IaC scanning
• Experience with EDR/XDR and MDM solutions
• Understanding of identity and access management, including cloud IAM and security-group guardrails
• Experience with KMS, secrets management, PKI, and certificate management
• Ability to enforce security controls without hindering delivery for Platform/SRE/DevOps teams

Will be a plus

• Experience in building or maturing an infrastructure/cloud security function from an early stage
• Background in fintech, brokerage, trading platforms, payments, or regulated environments
• Knowledge of Kubernetes/container security and cloud-native architectures
• Exposure to SOC 2, ISO 27001, or DORA compliance frameworks
• Familiarity with security tools such as Wiz, Panorama, Elastic Defender, Entra, or CyberArk

We offer

• 20 paid vacation days per year
• 10 paid sick leave days per year
• Public holidays as per the company’s approved Public holiday list
• Medical budget
• Opportunity to work remotely
• Professional education budget
• Language learning budget
• Wellness budget (gym membership, sports gear and related expenses)

Responsibilities

• Assess the existing AI-native platform, mapping architecture, APIs, sensitive data flows and trust boundaries; prioritize security findings and remediation.
• Review code for authentication, authorization, input handling, data isolation, secrets and privileged operations; reproduce vulnerabilities and verify fixes.
• Secure AI agent identities, tool permissions, data access, execution isolation and third-party integrations.
• Test prompt injection and tool misuse scenarios; implement approvals, execution limits, interruption and recovery controls for sensitive actions.
• Establish secure review practices for AI-generated code, with accountable engineering owners and specialist review of security-sensitive changes.
• Integrate code, dependency, secret and deployment security checks into CI/CD, and create meaningful security regression tests.
• Review AI coding agents' access to repositories, credentials and deployment systems; coordinate independent testing and ensure critical/high-risk findings are resolved and retested before release.

Requirements

• Strong software engineering background and the ability to review, debug and modify production code.
• Hands-on experience building or significantly contributing to an AI agent platform, including implementing and validating security and safety controls.
• Proven application security and architecture review experience, including finding, fixing and retesting vulnerabilities.
• Solid knowledge of authentication, authorization, API security, data isolation, secrets management and secure cloud deployment.
• Experience with manual code review, security testing and automated analysis, and the ability to distinguish genuine security risks from tool noise.
• Practical experience using AI development tools while independently checking generated code, tests and configuration changes.
• Clear English communication skills and the ability to collaborate with developers, architects and engineering leads.

As A Plus

• Hands-on application penetration testing and familiarity with OWASP ASVS or comparable application security standards.
• Experience introducing secure development practices into teams using AI coding agents.
• Security assessment of agent runtimes, tool servers, retrieval systems and third-party integrations.

We Offer

• Competitive salary
• Flexible schedule
• Social package
• Courses, webinars, and seminars to increase professional skills
• Possibility to work remotely and onsite
• Horizontal hierarchy. No micromanagement pressure
• Open company culture where your ideas and initiatives are valued
• Regular team building & corporate events
• International projects

✨ Welcome to WinMedia — Driving Innovation in iGaming Products! ✨
 

We build and develop product solutions in the iGaming industry 🎯. Our team works on in-house products, continuously improves internal processes, and uses data-driven approaches to make better decisions.

We are currently looking for an Anti-Fraud & Payments Manager who will take ownership of both the Anti-Fraud function and user payout operations. This is a hands-on role where you will build processes, develop risk and verification rules, oversee payout-related workflows, and ensure that user withdrawals are processed efficiently and safely.
 

📌 About the Role

We are looking for an experienced and proactive Anti-Fraud & Payments Manager to build and develop the Anti-Fraud and Payments function within our iGaming product company.

You will be responsible for user verification, fraud and risk assessment, payout checks, and the operational process of user withdrawals. You will decide when and how payouts should move forward, create and assign payout-related tasks, investigate suspicious cases, and continuously improve the rules and processes behind these operations.

This role combines Anti-Fraud expertise with ownership of the user payout process. You will work closely with Product, Customer Care, both VIP and Support teams, and other teams to make the verification and payout journey efficient, secure, and scalable.
 

🔨 Responsibilities

• Build and develop the Anti-Fraud & Payments function.
• Develop and implement rules, checks, and procedures for user verification, fraud detection, and payout processing.
• Review user activity and withdrawal requests, investigate suspicious cases, and make risk-based decisions.
• Take ownership of the user payout process, including creating, prioritizing, and assigning payout-related tasks.
• Identify fraud patterns, operational risks, and bottlenecks, and continuously improve related processes.
• Develop and maintain internal procedures, guidelines, and controls for Anti-Fraud and payouts.
• Monitor key metrics and ensure the verification and payout processes are efficient, secure, and scalable.
• Collaborate closely with Product, Support, VIP, and other teams to resolve cases and improve Anti-Fraud and payout workflows.
   

✅ Requirements

• 2+ years of experience in Anti-Fraud / Risk / Payments Operations, preferably in iGaming.
• Experience working with online casino / betting products is a strong advantage.
• Hands-on experience with user verification, fraud detection, and suspicious activity analysis.
• Strong understanding of common fraud scenarios, risk indicators, and detection methods.
• Practical experience with user withdrawals and payout processes.
• Understanding of how to assess and approve/reject payout requests based on risk and verification results.
• Experience building or significantly optimizing Anti-Fraud and/or payout processes.
• Experience working with tools such as Sumsub, KYCaid, Fingerprint.com, and similar solutions.
• Experience using AI tools in work processes is a strong advantage.
• Strong analytical and problem-solving skills with excellent attention to detail.
• Ability to make independent decisions and take ownership of operational processes.
• Ability to work with large amounts of information and prioritize cases effectively.
• Strong communication skills and the ability to collaborate with Product, Customer Care, VIP, and Support teams.
   

🎯 Ideal Candidate

• Has hands-on Anti-Fraud and/or Payments Operations experience in iGaming.
• Understands that the role is broader than traditional Anti-Fraud and is ready to own both risk and payout operations.
• Understands the specifics of users, deposits, withdrawals, and fraud risks in gambling products.
• Can independently develop a system of rules, checks, controls, and payout workflows.
• Is comfortable making decisions on individual cases while also thinking about the bigger process.
• Can build a structured and scalable process rather than simply following existing procedures.
• Takes full ownership of the Anti-Fraud & Payments function and is ready to develop it further.
   

🎁 What We Offer

💰 Competitive salary and financial incentives
🚀 The opportunity to build and develop the Anti-Fraud & Payments function
🎨 Freedom to make decisions and implement your ideas
📈 Professional and career growth opportunities
🌍 Flexible work setup
🤝 Work in a product-focused iGaming company alongside a professional team

We are the creators of a new fintech era!

Our mission is to change this world by making blockchain accessible to everyone in everyday life. WhiteBIT is a global team of over 1,200 professionals united by one mission — to shape the new world order in the Web3 era. Each of our employees is fully engaged in this transformative journey.

We work on our blockchain platform, providing maximum transparency and security for more than 8 million users worldwide. Our breakthrough solutions, incredible speed of adaptation to market challenges, and technological superiority are the strengths that take us beyond ordinary companies. Our official partners include the National Football Team of Ukraine, FC Barcelona, Lifecell, FACEIT, and VISA.

The future of Web3 starts with you: join us as an IAM/PAM Governance Specialist.
 

Requirements:

• 2+ years of experience in IAM, PAM, Identity Governance, Information Security, IT Controls, IT Audit, or a related area.
• Good understanding of Identity and Access Management concepts, including user lifecycle, role-based access control, least privilege, segregation of duties, and access recertification.
• Practical understanding of Privileged Access Management and risks associated with privileged, administrative, shared, and service accounts.
• Experience performing access reviews, privileged access reviews, or user entitlement assessments.
• Experience reviewing access controls and identifying excessive, outdated, or inappropriate permissions.
• Experience supporting internal or external audits, including evidence collection, control testing, findings follow-up, and remediation tracking.
• Ability to assess whether access controls are operating effectively and document identified gaps and recommendations.
• Experience working with system owners, administrators, Security, IT, and other stakeholders to investigate and remediate access-related issues.
• Understanding of security control frameworks and standards such as ISO 27001, NIST, SOC 2, or similar.
• Ability to work with IAM/PAM platforms, administrative consoles, access management systems, and related security tooling.
• Strong analytical and documentation skills, with attention to detail.
• Ability to independently manage assigned reviews, audits, and remediation activities.
• Good written and verbal communication skills and the ability to explain access control issues to both technical and non-technical stakeholders.

Responsibilities:

• Perform periodic reviews of privileged, administrative, shared, service, and other high-risk accounts across critical systems.
• Review user and administrative access to identify excessive, outdated, inappropriate, or conflicting permissions.
• Support and coordinate access recertification and entitlement review activities with system and business owners.
• Assess IAM/PAM-related security controls and verify that access management processes are operating effectively.
• Perform security and access control audits of internal systems and applications.
• Collect, validate, and maintain audit evidence related to identity, access management, and privileged access controls.
• Identify IAM/PAM control gaps, document findings, and track remediation actions through to closure.
• Monitor privileged access governance requirements, including least privilege, segregation of duties, and appropriate use of administrative accounts.
• Work with PAM and administrative consoles to review privileged access configurations, account usage, permissions, and control effectiveness.
• Support governance of service accounts, emergency/break-glass accounts, and other non-standard privileged identities.
• Collaborate with the IAM Cybersecurity team on access-related issues that require changes to IAM platforms, integrations, or technical controls.
• Work with system owners, administrators, IT, Security, and business stakeholders to investigate and remediate access-related risks.
• Support internal and external audits, compliance assessments, and security reviews related to IAM and PAM.
• Maintain and improve IAM/PAM governance documentation, procedures, control descriptions, and review records.
• Contribute to improving and automating access reviews, privileged access monitoring, evidence collection, and reporting processes.
• Provide regular reporting on access review status, identified risks, open findings, and remediation progress.

Would be a plus:

• Hands-on experience with PAM solutions such as CyberArk, BeyondTrust, Delinea, or similar.
• Experience with Identity Governance solutions such as SailPoint, Saviynt, Microsoft Entra ID Governance, or similar.
• Experience reviewing privileged access in cloud environments such as AWS, Azure, or GCP.
• Experience with joiner, mover, and leaver processes.
• Experience with service accounts, emergency/break-glass accounts, and privileged session controls.
• Familiarity with regulatory or compliance requirements related to access management.
• Relevant certifications in information security, IAM, audit, or risk management are a plus.

Working terms:

Immerse yourself in Crypto & Web3:

• Master cutting-edge technologies and become an expert in the most innovative industry.

Work with the Fintech of the Future:

• Develop your skills in digital finance and shape the global market.

Take Your Professionalism to the Next Level:

• Gain unique experience and be part of global transformations.

Drive Innovations:

• Influence the industry and contribute to groundbreaking solutions.

Join a Strong Team:

• Collaborate with top experts worldwide and grow alongside the best.

Work-Life Balance & Well-being:

• Modern equipment.
• Comfortable working conditions and an inspiring environment to help you thrive.
• 24 calendar days of paid leave.
• Additional days off for national holidays.

#vacancy #Cybersecurity Specialist / Security Engineer, #Cyprus office, 6-8k euros net. Fintech

About the Role

We are looking for an experienced Cybersecurity Specialist / Security Engineer to secure and continuously improve the company’s server, network, cloud, and application infrastructure.

The ideal candidate combines strong hands-on technical expertise with the ability to independently investigate security incidents, assess risks, design secure architectures, and implement effective security controls. A key requirement is practical experience with Zero Trust architecture and Zero Trust Network Access (ZTNA), including secure identity-based access to internal infrastructure and critical systems.

Key Responsibilities

• Ensure the security of the company’s server, network, and cloud infrastructure.

• Monitor and analyze information security events to detect attacks, scanning activity, anomalies, and unauthorized access attempts.

• Respond to security incidents, including investigation, containment, remediation, root cause analysis, and documentation.

• Conduct regular infrastructure security audits and manage vulnerabilities.

• Harden Linux and Windows servers, operating systems, and network services.

• Configure and maintain Firewalls, WAF, IDS/IPS, VPN, and DDoS protection solutions.

• Ensure the security of Web applications and APIs.

• Manage and control access to production infrastructure and critical systems.

• Develop and maintain security policies, procedures, and Incident Response Playbooks.

• Collaborate with DevOps engineers, system administrators, DBAs, and developers to identify and mitigate security risks.

• Design, implement, and continuously improve the company’s security architecture and technical controls.

Required Qualifications (Must-Have)

• 3+ years of hands-on experience in Cybersecurity / Information Security.

• Strong understanding of TCP/IP, DNS, HTTP/HTTPS, TLS, VPN, NAT, and network routing.

• Solid Linux administration skills.

• Practical experience configuring Firewalls, WAF, ACLs, and network segmentation.

• Hands-on experience with Cloudflare or equivalent WAF/CDN/DDoS protection solutions.

• Good understanding of the OWASP Top 10 and common Web/API attack vectors.

• Practical experience with Vulnerability Management tools such as Nessus, OpenVAS, Qualys, or equivalents.

• Knowledge of CVE/CVSS and the ability to assess the actual business and technical risks associated with identified vulnerabilities.

• Experience with SIEM, IDS/IPS, and centralized log collection.

• Ability to analyze system, network, application, and web server logs.

• Experience investigating security incidents and working with Indicators of Compromise (IOCs).

• Understanding of RBAC, MFA, PAM, the Principle of Least Privilege, and privileged access management.

• Experience with Docker and an understanding of container security principles.

• Understanding of SAST, DAST, dependency scanning, and secret scanning.

• Ability to automate security tasks using Bash and/or Python.

Zero Trust — Mandatory Requirements

Practical experience implementing Zero Trust Network Access (ZTNA) solutions and a solid understanding of Zero Trust architecture are essential for this role.

The candidate should be able to design, implement, and maintain a Zero Trust approach, including:

• Designing and implementing Zero Trust security architecture.

• Implementing ZTNA for employees’ and administrators’ access to internal infrastructure.

• Replacing network/IP-based trust with identity-based access controls.

• Implementing Device Trust and Device Posture checks.

• Configuring MFA and Conditional Access policies.

• Enforcing Least Privilege Access.

• Implementing microsegmentation.

• Providing short-lived access and temporary privileged access.

• Monitoring and auditing administrative sessions.

• Integrating Zero Trust solutions with IAM, SSO, and Identity Providers (IdPs).

• Building secure access mechanisms for Linux and Windows servers, databases, internal Web services, and administrative panels. 
• Managing and securing access to critical infrastructure through solutions such as Cloudflare Zero Trust, Teleport, BeyondTrust, CyberArk, Tailscale, Zscaler, or equivalent platforms.

Nice to Have

• Experience with AWS, Azure, or GCP security.

• Kubernetes security experience.

• Hands-on experience with Wazuh, Suricata, or Snort.

• Familiarity with ELK/OpenSearch and Loki/Grafana.

• Experience with HashiCorp Vault or equivalent secrets management solutions.

• Experience conducting penetration tests or Red Team exercises.

• Knowledge of Threat Modeling methodologies.

• Experience building security monitoring systems and automating incident response.

• Familiarity with ISO 27001, PCI DSS, SOC 2, or equivalent security standards.

Expected Level of Expertise

The successful candidate must be able to independently manage the entire security threat and incident lifecycle:

Detect → Analyze → Assess Risk → Contain → Remediate → Verify → Document

We are looking for a hands-on security professional who goes beyond operating security tools. The candidate must be capable of independently assessing risks, designing security architectures, making sound technical decisions, and implementing effective security measures to protect the company’s infrastructure and critical systems.

We are the creators of a new fintech era!

Our mission is to change this world by making blockchain accessible to everyone in everyday life. WhiteBIT is a global team of over 1,200 professionals united by one mission — to shape the new world order in the Web3 era. Each of our employees is fully engaged in this transformative journey.

We work on our blockchain platform, providing maximum transparency and security for more than 8 million users worldwide. Our breakthrough solutions, incredible speed of adaptation to market challenges, and technological superiority are the strengths that take us beyond ordinary companies. Our official partners include the National Football Team of Ukraine, FC Barcelona, Lifecell, FACEIT and VISA.

The future of Web3 starts with you: join us as an Application Security Engineer (AppSec)!

Requirements:

— 2+ years of experience in Application Security, Product Security, or a related security role.

— Strong knowledge of web application security, OWASP Top 10, common attack techniques, and secure coding practices.

— Hands-on experience with threat modeling, security architecture reviews, vulnerability assessment, and penetration testing.

— Ability to review source code and identify security vulnerabilities.

— Experience with SAST, DAST, SCA, secrets scanning, and vulnerability-management tools.

— Understanding of CI/CD pipelines and experience integrating security checks into the SDLC.

— Knowledge of API security, authentication, authorization, and common security protocols.

— Familiarity with cloud, container, or Kubernetes security.

— Basic knowledge of Web3 and smart contract security.

— Basic scripting or programming skills, preferably in Python or another relevant language.

— Ability to clearly communicate security risks and remediation guidance to technical and non-technical stakeholders.

Responsibilities:

— Perform application security assessments, source-code reviews, and penetration testing.

— Participate in threat modeling and security architecture reviews for new and existing products.

— Triage Bug Bounty submissions: validate and reproduce vulnerabilities, assess their severity and business impact, identify duplicates and false positives, communicate with researchers, and coordinate remediation with engineering teams.

— Identify, prioritize, and track vulnerabilities throughout the remediation process.

— Provide developers with clear remediation guidance and secure coding recommendations.

— Support the integration and operation of SAST, DAST, SCA, secrets scanning, and other security tools within CI/CD pipelines.

— Participate in defining and reviewing security requirements throughout the software development lifecycle.

— Validate security-tool findings and help reduce false positives.

— Support investigations and remediation of application-related security incidents.

— Contribute to application security standards, guidelines, and reusable security controls.

— Help deliver security training and promote secure development practices across engineering teams.

— Collaborate with developers, DevOps, QA, product teams, and other security specialists.

— Monitor emerging application security threats and contribute to improving AppSec processes.

Working terms:

Immerse yourself in Crypto & Web3:

— Master cutting-edge technologies and become an expert in the most innovative industry.

Work with the Fintech of the Future:

— Develop your skills in digital finance and shape the global market.

Take Your Professionalism to the Next Level:

— Gain unique experience and be part of global transformations.

Drive Innovations:

— Influence the industry and contribute to groundbreaking solutions.

Join a Strong Team:

— Collaborate with top experts worldwide and grow alongside the best.

Work-Life Balance & Well-being:

— Modern equipment.

— Comfortable working conditions, and an inspiring environment to help you thrive.

— 24 calendar days of paid leave.

— Additional days off for national holidays.

With us, you’ll dive into the world of unique blockchain technologies, reshape the crypto landscape, and become an innovator in your field. If you’re ready to take on challenges and join our dynamic team, apply now and start a new chapter in your career!

Let’s Build the Future Together!

WhiteBIT offers all candidates an equal opportunity to join the team. All hiring decisions are made without regard to race, national origin, gender identity or sexual orientation, age, religion, disability, medical condition, marital status, familial status, veteran status, or any other legally protected characteristic of an individual.

We are looking for a SOC & Incident Response Lead to shape how our operational defense works. You’ll set the workflows, investigation standards and team rhythm, lead SOC analysts and IR & Forensics specialists, and turn security alerts into timely, evidence-based decisions and coordinated response that protect critical systems and data.

What you’ll do

• Build and mature the SOC and IR/DFIR function: define investigation standards, workflows and playbooks
• Lead and grow SOC analysts (L1/L2) and IR & Forensics specialists, owning prioritization, coaching and investigation quality
• Own alert queue prioritization, triage standards, escalation thresholds and handovers to keep SLA risks under control
• Set case creation, enrichment and evidence standards so confirmed incidents reach responders with full business and technical context
• Coordinate incident investigations: assign response roles and maintain timelines, evidence logs, decision records and action tracking
• Supervise forensic preservation and analysis of endpoint, server, cloud, network and identity telemetry with strict chain of custody
• Coordinate containment, eradication and recovery validation with IT, Platform, IAM, Product and business owners within the approved authority matrix
• Escalate production-impacting incidents, high-impact containment and regulatory or legal triggers through Cyber Defense leadership and approved decision paths
• Partner with Detection Engineering to turn recurring false positives and detection gaps into tuning while keeping coverage
• Run post-incident reviews and RCA, turning findings into tracked, measurable improvements
• Maintain operational metrics, sample case quality, update playbooks, run readiness exercises and recommend changes to escalation thresholds and staffing coverage

What you bring

• 3+ years in SOC and IR/DFIR, including mentoring, coaching or leading technical specialists
• A degree or training in InfoSec, Computer Science or IT, or equivalent hands-on SecOps/IR experience
• Hands-on SIEM and XDR/EDR skills, with the ability to correlate endpoint, identity, network and cloud events into a defensible timeline
• Strong alert queue management and SLA enforcement, prioritizing by asset criticality, identity and business impact
• Solid knowledge of forensic evidence collection, preservation, referencing and chain of custody
• A track record of building runbooks, case checklists and review frameworks that separate facts from assumptions
• Experience working with Detection Engineering to cut noise without compromising coverage
• A clear grasp of containment authority limits, escalation paths and regulatory or legal considerations in IR
• Calm, evidence-based judgment under pressure, clear communication with technical and business stakeholders, and strict care with confidential evidence
• English at Upper-Intermediate or higher

Nice to have

• Background in fintech, trading, financial services or other high-availability environments
• Scripting (Python, PowerShell, Bash), advanced queries, or safe automation for enrichment, triage and reporting
• Cloud investigations (AWS, Azure, GCP), threat hunting or detection engineering
• Certifications such as GIAC (GCIH, GCFA, GNFA), BTL1/BTL2, CISSP, CySA+ or vendor credentials

Work format
Full-time, remote, regular schedule, no shift work. On-call may be arranged; rotation and terms are agreed together.

What we offer

• 20 paid vacation days per year
• 10 paid sick leave days per year
• Public holidays as per the company’s approved Public holiday list
• Medical budget
• Opportunity to work remotely
• Professional education budget
• Language learning budget
• Wellness budget (gym membership, sports gear and related expenses)

The Defense Procurement Agency (DOT) is a national agency responsible for procuring ammunition, UAVs, military equipment, fuel, food, clothing, and other critical supplies for the Armed Forces of Ukraine and the Defense Forces.

Our mission: Strengthening Ukraine by ensuring reliable support for the Defense Forces while fostering the development of the national defense industry.

Our vision: To become the driving force behind the transformation of Ukraine's defense procurement ecosystem—not only operating the system, but continuously improving it.

We are currently looking for a Security Engineer who will be responsible for administering and developing information security infrastructure, implementing security solutions across the Microsoft ecosystem, ensuring cloud infrastructure security, and advancing cybersecurity processes.

Responsibilities

• Implement, administer, and develop security services across the ecosystem (Defender XDR, Defender for Cloud, Sentinel, Entra ID, Purview, Palo Alto).
• Administer and maintain information security infrastructure in Microsoft Azure.
• Maintain, administer, and develop SIEM/SOAR infrastructure based on Microsoft Sentinel.
• Conduct security reviews of infrastructure, CI/CD pipelines, and Infrastructure as Code (Terraform).
• Develop and maintain Vulnerability Management processes using Nessus.
• Collaborate with Infrastructure, DevOps, and Software Engineering teams to integrate security requirements into architecture and development processes.
• Develop the AI Security domain, including AI Security Proxy, AI Governance, DLP, monitoring, and auditing

Requirements

• Higher education in Cybersecurity, Information Technology, Computer Science, or a related field.
• 3+ years of experience in cybersecurity roles such as Security Engineer or Cloud Security Engineer, with hands-on experience in Azure Security and Microsoft Security.
• Practical experience securing cloud infrastructure in Microsoft Azure.
• Strong knowledge of Microsoft security services, including Defender XDR, Defender for Cloud, Sentinel, Intune, Entra ID, and Purview.
• Experience building and developing Vulnerability Management processes.
• Understanding of modern CI/CD practices and Infrastructure as Code (Terraform).
• Hands-on experience securing containerized environments and Kubernetes.
• Experience building and maintaining network security.
• Experience analyzing and responding to information security incidents.

What We Offer

• Meaningful work that directly contributes to strengthening Ukraine's defense capabilities.
• Сompetitive salary and benefits.
• Professional development, learning opportunities, and career growth.
• Structured onboarding and dedicated mentorship.
• A collaborative, supportive, and mission-driven team.

By joining our team, you will contribute to one of Ukraine's largest digital transformation initiatives in the defense sector and help build the future of defense procurement.

Ready to make a real impact? We'd love to hear from you. Apply today!

* By submitting your CV, you consent to the processing of your personal data in accordance with applicable legislation.

** Due to the high volume of applications, only candidates whose qualifications best match the position will be contacted.

We are looking for a Cyber Defense Manager to lead, mature, and operate our resilient security operations capability. In this role, you will own the defense of our environment, ensuring fast and precise threat detection, investigation, containment, and exposure reduction. You will lead our security operations function, making the organization faster in responding to threats while continuously improving controls across the attack surface.

Responsibilities

• Own Cyber Defense execution across SOC, detection engineering, incident response, and exposure remediation
• Lead alert triage quality, escalation standards, incident command, and response coordination
• Prioritize critical vulnerabilities and exposures using asset criticality, exploitability, and business impact
• Manage Cyber Defense dashboards, runbooks, remediation follow-up, and operational metrics
• Coordinate with IT, Platform, IAM, Product, GRC, Legal, and business owners during incidents and remediation
• Build and develop the Cyber Defense team, including hiring, onboarding, mentoring, and retaining security talent
• Drive continuous improvement of detection coverage, response playbooks, and security controls based on lessons learned and threat intelligence
• Report on Cyber Defense performance, incidents, and risk posture to security leadership and stakeholders

Requirements

• 10+ years of experience in Information Security
• 3+ years in a security management or team lead role with direct people management experience
• Hands-on experience managing SOC operations, leading incident command, and driving MTTD/MTTR improvement
• Ability to design, validate, and maintain detection logic across SIEM, EDR, and cloud platforms, with a deep understanding of runbook development and false-positive reduction
• Knowledge of top attack scenarios (ATO, credential theft, privilege escalation, data exfiltration) and ability to map detections to threat models like MITRE ATT&CK
• Experience prioritizing vulnerabilities using CVSS and asset criticality to reduce exposure aging
• Hands-on experience with at least one enterprise SIEM (Splunk, Microsoft Sentinel, Chronicle, Elastic) and SOAR tooling
• Understanding of cloud-native security controls and monitoring in AWS, GCP, or Azure
• Understanding of IAM, PAM, SSO, and identity-related attack vectors relevant to detection and response
• Ability to define, track, and communicate security KPIs and operational dashboards to technical and executive audiences
• English - Upper-Intermediate or higher

Will be a plus

• Experience in fintech, e-commerce, or other high-risk industries with complex threat landscapes
• Hands-on background as a SOC analyst, incident responder, or detection engineer prior to moving into management
• Experience building a SOC or Cyber Defense function from scratch or significantly maturing an existing one
• Familiarity with threat intelligence platforms and threat-informed defense methodologies
• Relevant certifications: CISSP, CISM, GIAC (GSOM, GCED, GCIH) or equivalent

We offer

• 20 paid vacation days per year
• 10 paid sick leave days per year
• Public holidays as per the company’s approved Public holiday list
• Medical budget
• Opportunity to work remotely
• Professional education budget
• Language learning budget
• Wellness budget (gym membership, sports gear and related expenses)

About Come Back Agency & Client Position

Come Back Agency supports US software and technology companies by running their hiring process. We work with delivery and leadership teams to define roles, screen candidates, and manage interviews. Successful candidates are hired directly by the company and become part of its team.

This position is with a US-based software company providing custom development and AI implementation for North American clients. The team builds and maintains production software, including AI-enabled systems, and works in long-term client engagements. Team members operate as part of an internal, distributed team and collaborate directly with client stakeholders.
 

About the Role
 

As we continue to expand our Enterprise footprint in the US, we are looking for a dedicated Cloud Security & Compliance Engineer who will drive cloud security architecture, enforce technical security controls, and lead compliance readiness.
 

In this role, you will be responsible for hardening AWS infrastructure, integrating security scanners into CI/CD pipelines, enforcing identity and access management, and automating evidence collection for enterprise compliance standards (SOC 2, ISO 27001). You will focus purely on cloud security engineering and compliance automation, collaborating with the core DevOps team without handling routine application deployments.
 

What You Will Do

• Cloud Security Architecture & Hardening: Design and implement technical security controls in AWS, including IAM least-privilege policies, KMS encryption, network segmentation, and secrets management.
• Compliance Readiness & Automation: Lead SOC 2 and ISO 27001 audit preparation by identifying security gaps, maintaining compliance automation tools (Vanta, Drata, or AWS Security Hub), and collecting audit evidence.
• DevSecOps Integration: Integrate automated security scanning tools (SAST/DAST, container image scanning via Trivy, IaC scanning via Checkov/Tfsec) into CI/CD pipelines (GitHub Actions).
• Security Monitoring & Auditability: Configure and manage AWS native security tools (AWS Config, Security Hub, GuardDuty, CloudTrail) to maintain continuous visibility over cloud compliance.
• Vulnerability & Incident Management: Perform regular vulnerability scans, evaluate security alerts, coordinate remediation of infrastructure vulnerabilities, and support incident response efforts.
• Vendor & Enterprise Reviews: Provide technical support during enterprise client security reviews, questionnaires, and third-party security audits.
   

Requirements

• Experience: 2.5+ years of hands-on experience in Cloud Security, DevSecOps, or Information Security Engineering.
• AWS Security Depth: Deep understanding of AWS security tools and concepts (IAM policies, KMS, Secrets Manager, Security Groups, VPC Peering, CloudTrail, Security Hub).
• Compliance Standards: Practical experience with evidence collection, technical gap remediation, and readiness preparation for SOC 2 and/or ISO 27001 (PCI DSS is a plus).
• DevSecOps & Pipeline Security: Hands-on experience embedding security scanners (Trivy, Checkov, SonarQube) into automated CI/CD pipelines (GitHub Actions / GitLab CI).
• Scripting & IaC Understanding: Ability to read/write Terraform code to implement security configurations and technical controls.
• Communication: B2+ English level (Upper-Intermediate or higher) for clear verbal and written communication with US clients, security auditors, and internal teams.
   

Nice to Have

• Practical experience using compliance automation platforms (e.g., Vanta, Drata, Secureframe).
• Recognized security certifications (e.g., AWS Certified Security – Specialty, CKS, Certified Information Systems Auditor, or CISSP).
• Hands-on experience with Kubernetes security practices and benchmarks (CIS Kubernetes Benchmark).
   

What We Offer

• Working hours aligned with US time zones (16:00–00:00 Kyiv time).
• Company-sponsored English lessons to support clear and confident communication.
• Paid vacation and sick days.
• Fully remote work model.
• Opportunities for professional growth and financial support for professional certifications.
• Structured, personalized onboarding to help you ramp up effectively.
   

Apply with your resume and a short note outlining your relevant experience. You can also submit it through our website at comeback.ua. Selected candidates will be contacted by Come Back Agency.

RedCore is an international business group that creates technological solutions for digital markets. Our products and services cover fintech, marketing, e-commerce, customer service, communications, and regulatory technologies.

We are looking for a Security System Engineer to join our team!

Requirements:
- 5+ years in cybersecurity, including SOC engineering, SIEM, or detection engineering.
- Deep understanding of SOC operations, detection engineering, incident response, threat intelligence, threat hunting, DFIR, and SOC engineering.
- Hands-on experience with SIEM, EDR/XDR, NDR, threat intelligence platforms, and incident management systems.
- Knowledge of  ISO/IEC 27001, MITRE ATT&CK, and SOC maturity models, with experience assessing monitoring maturity and defining a target state and roadmap.
- Solid grasp of monitoring architecture: log collection and processing, data quality, and the trade-offs between visibility, cost, and operational load.
- Proven experience designing and tuning detections on application and infrastructure telemetry.

Responsibilities:

- Assess the maturity of the security monitoring function (data sources, pipelines, detections, processes, tooling) against industry good practice and the organization's threat landscape. Turn the findings into a prioritized, evidence-based improvement roadmap.
- Own the monitoring architecture: data sources, log pipelines, SIEM/analytics platforms, and their reliability, scalability, and cost. Define standards for log onboarding, normalization, and data quality.
- Design and evolve the detection engineering lifecycle: use-case management, coverage analysis, testing and validation, tuning, and retirement. Build detections from available telemetry and relevant threat scenarios, and measure their effectiveness.
- Use incident investigations and root cause analysis as inputs for systemic improvements to telemetry and detections.
- Automate repetitive monitoring, enrichment, and response tasks, prioritizing by the value they bring to SOC workflows.
- Work with the SOC, security, engineering, and infrastructure teams to onboard new services into monitoring by design. Provide technical guidance to SOC analysts.
- Maintain architecture and operational documentation so that decisions, integrations, and procedures stay transparent and transferable.

Our benefits to you:

- Paid annual leave.

- Paid days off.

- RedCore TEAM corporate gamification system.

- Annual corporate events for employees.

- Reimbursement of business travel expenses.

- Flexible working format and start time.

- Employee learning and development system.

- Mentoring program.

- Overtime compensation.

- Referral program with a cash bonus.

- Corporate psychologist.

- Cafeteria benefit system: sports, insurance, language learning (depends on region).

We're looking for a Security Engineer to help us build a reliable, secure product. You'll be the person who spots risks before anyone else and helps the team work with confidence and peace of mind. With us, you'll have real influence over how things are done, the freedom to choose your own solutions, and a team that sees security as a shared responsibility rather than a box to tick.

What you’ll do:

• Monitor security events, investigate incidents, and lead the response
• Configure and maintain SIEM, IDS/IPS, EDR, and other security tooling
• Integrate security checks into CI/CD (SAST, DAST, dependency and container scanning)
• Run vulnerability management: regular scanning, prioritization, and remediation tracking
• Audit cloud and on-premise infrastructure configurations; harden servers and services
• Manage access, secrets, and keys
• Write and maintain security policies, procedures, and incident response playbooks
• Advise development teams on secure coding and engineering practices
   

What we’re looking for:

• [2–3]+ years of experience in SecOps, a SOC, DevSecOps, or systems administration
• Strong knowledge of Linux, networking protocols, and network architecture
• Hands-on experience with SIEM platforms ([Splunk / ELK / Wazuh / other])
• Understanding of CI/CD and experience with [GitLab CI / GitHub Actions / Jenkins]
• Experience with Docker and Kubernetes
• Familiarity with the OWASP Top 10 and common attack vectors
• Scripting skills (Python, Bash)
• English sufficient to read technical documentation
   

Nice to have:

• Experience with cloud platforms ([AWS / GCP / Azure]) and their native security services
• Infrastructure-as-code tools (Terraform, Ansible)
• Knowledge of ISO 27001, SOC 2, or PCI DSS
• Certifications such as OSCP, CompTIA Security+, CEH, CISSP, or equivalent
• Penetration testing or bug bounty experience
   

If you love the idea of making security clear, approachable, and a natural part of how the whole team works, we'd be glad to meet you! Send your CV, and if you like, add a few words about a project or incident you're especially proud of.

Hiring Process:
Recruiter Interview → Interview with the Head of Dev → Job Offer 🚀
 

💌 CV review takes up to 7 days. If you haven’t heard from our recruiter within this time, it means your experience doesn’t currently match the requirements for this position. We’d be happy to stay in touch regarding other opportunities!

We are toogeza, a Ukrainian recruiting company that is focused on hiring talents and building teams for tech startups worldwide. People make a difference in the big game, and we may help to find the right ones.

We are looking for a Security Engineer / DevSecOps professional to implement and improve security controls across our corporate infrastructure and new digital services, including AI solutions.

Our environment combines Windows and Linux systems, private and cloud infrastructure, SaaS platforms, and internally developed applications and integrations.

You will work closely with the CISO, DevOps, IT Operations, and project teams to identify technical risks, implement safeguards, automate security tasks, and verify that controls work effectively. We value practical engineering skills, independent problem-solving, and experience translating governance requirements into technical implementation.

Reports to: Head of Cybersecurity (CISO)
Role type: Hands-on individual contributor

What you will do:

Security monitoring and detection

• Develop and implement a security monitoring roadmap, including requirements, architecture, and integration priorities.
• Contribute to the selection and evolution of our SIEM/XDR architecture.
• Integrate log sources and maintain reliable, complete, and useful security telemetry.
• Develop and test detection rules, correlation logic, and threat-hunting queries.
• Support incident investigation and improve response procedures.

Vulnerability management

• Implement a repeatable process for vulnerability discovery, validation, prioritisation, remediation tracking, and retesting.
• Assess exploitability and business impact, considering exposure, asset criticality, and potential attack paths.
• Develop remediation plans with IT and DevOps, track progress, and verify that fixes are effective.

Secure service delivery and hardening

• Review the security of service architectures, configurations, integrations, and CI/CD pipelines.
• Develop technical checklists covering access controls, role models, credentials and secrets, network connectivity, external integrations, encryption, and logging.
• Implement and automate secure configuration baselines.
• Work with DevOps to assess security readiness before production launches and address identified risks.
• Plan and validate security changes with attention to service availability and rollback options.

Security automation and AI-assisted engineering

• Build scripts and integrations for event analysis, configuration checks, vulnerability management, and reporting.
• Use AI coding assistants and agent tools to support engineering tasks.
• Validate generated code and findings, and protect credentials, access permissions, and corporate data throughout these workflows.

AI security and governance implementation

• Develop and apply security assessment checklists for corporate LLM services, AI assistants, agents, and their integrations.
• Assess access to data and tools, execution isolation, and scenarios that could adversely affect information or systems.
• Address risks such as prompt injection, data leakage, excessive permissions, and authorisation failures.
• Translate agreed AI governance requirements into technical controls and verification steps.

Security validation

• Conduct authorised tests of attack scenarios and vulnerability exploitability.
• Verify whether monitoring and protection tools detect or prevent the tested activity.
• Use findings to improve configurations, detection coverage, and response procedures.

What we are looking for:

• Practical experience in Security Engineering, DevSecOps, or infrastructure/DevOps roles with substantial responsibility for production security.
• Ability to own technical tasks from investigation and planning through implementation and validation.
• Hands-on SIEM/XDR experience, including log onboarding, queries, detection rules, and alert investigation.
• Practical experience with vulnerability management and system or service hardening.
• Strong understanding of Linux, Windows Server/Active Directory, networking, authentication, and access controls. Deeper expertise in one environment is welcome, supported by working knowledge of the other.
• Understanding of cloud, container, API, and CI/CD security, including secrets management.
• Ability to review code, Infrastructure as Code, and configurations, and propose actionable improvements.
• Scripting and automation skills using Python, PowerShell and/or Bash, APIs, and Git.
• Practical use of AI tools for engineering tasks, with a disciplined approach to checking their output.
• Ability to validate security weaknesses, explain their impact, and work constructively with technical teams on remediation.
• English proficiency sufficient for technical documentation and vendor support.

Experience working with governance

• You should be comfortable translating security policies, risk decisions, and agreed requirements into configurations, technical checklists, and acceptance criteria.
• This includes documenting control gaps, remediation plans, and compensating measures; providing evidence that controls have been implemented and tested; and escalating unresolved risks or exceptions through the agreed process.
• The CISO sets security direction and priorities and coordinates risk decisions with accountable stakeholders. Your role is to provide technical analysis, implementation, and verification.

Nice to have:

• Experience with Cortex XDR, Microsoft Sentinel, or Wazuh; familiarity with XQL or KQL.
• AWS or Azure security, Terraform, Ansible, and GitLab CI/CD.
• Palo Alto, Google Workspace, Microsoft 365/Entra ID, or privileged access management solutions.
• Experience implementing or testing AI agents, retrieval-augmented generation (RAG), or corporate LLM services.
• Penetration testing, red teaming, adversary emulation, or purple teaming experience.
• Experience providing technical evidence for audits or implementing controls within an ISMS/ISO 27001 programme.
• Experience building practical security processes in a small team.

How you will work

You will partner with experienced DevOps and IT engineers, explain security issues with clear technical evidence, and help develop workable solutions. Priorities will be agreed with the CISO, with delivery sequenced according to risk and team capacity.

We value demonstrated hands-on contribution and the ability to deliver verified improvements. Experience with every technology listed above is not required.

What can we offer you?

• Make a real impact on security. Take ownership of key security engineering initiatives, help shape security practices, and see the direct results of your work across the company’s infrastructure and digital services.
• Build and improve, not just maintain. Get hands-on experience developing security monitoring, vulnerability management, and automation solutions, with the opportunity to influence technical approaches and tooling.
• Combine offensive and defensive security. Apply a Purple Team mindset by identifying and validating vulnerabilities, testing detection capabilities, and turning findings into practical security improvements.
• Explore AI Security and emerging technologies. Work with AI-powered security tools and contribute to securing new AI services, assistants, and integrations as the company expands its use of AI.
• Expand your technical expertise. Gain exposure to diverse environments, including private cloud infrastructure, Linux and Windows systems, cloud platforms, and modern DevOps practices.
• Work closely with security leadership. Collaborate directly with the Cybersecurity Lead (CISO) and experienced DevOps and IT engineers, with room for technical initiative, knowledge sharing, and professional growth.
• Flexible remote work, with occasional in-person team meetings and collaboration sessions.
• €600 learning and development budget to support your professional growth.
• Flexible benefits allowance for sports, mental well-being, and leisure activities: €50/month for employees in Ukraine and other European locations, or €150/month for employees in Cyprus.
• Medical insurance to support your health and well-being.
• Coworking space reimbursement of up to €200/month in Europe.

We are inviting you, a highly motivated and results-oriented Detection Engineer to join our team on a full-time basis.

Our team has unique expertise in research, analysis, and product development. By relying on technical insights and a data-driven approach, we create disruptive future-defining innovations of the fin-tech industry that remain our basis for success.
Our role mission is to make priority threats visible and actionable by building, testing and tuning detections for attacker behaviour and control failures, and developing reliable workflows that enrich and route investigation evidence. We work closely with security operations and incident responders to turn operational feedback into better signals, usable runbooks and clearer response paths. Contribute practical engineering improvements within approved detection and automation standards, escalating missing critical telemetry, high-impact detection failures and unsafe automation rather than making unauthorised response decisions.

Responsibilities

• Develop, test, tune and maintain SIEM/EDR detections for assigned priority attacker behaviours and control failures within the detection standards, using evidence to reduce false positives while preserving required coverage.
• Experience with Elastic Security, Microsoft Defender or similar SIEM/EDR platforms and security workflow tools.
• Practical use of Sigma, YARA or other detection-content formats, and mapping detections to MITRE ATT&CK techniques.
• Experience with a scripting language, a specific SIEM query language or SOAR tooling that helps maintain the assigned integrations and workflows.
• Validate telemetry availability and quality; resolve missing fields, unreliable data and broken dependencies with the relevant owners.
• Document detection logic, assumptions, limitations, owners, test evidence, runbooks and expected analyst actions.
• Support detection-gap analysis after incidents, threat-intelligence updates and service changes, and work with SOC and IR to improve telemetry, runbooks, alert context and handoffs.
• Build low-risk automations for triage, enrichment, routing, evidence collection and reporting, with approvals, access controls, logging, failure handling and rollback; validate with SOC, IR and domain owners before operational use.
• Monitor the reliability of assigned detections and workflows, diagnose failures, and maintain documentation and recovery steps.
• Provide operational support for agreed detection-platform components, following approved diagnostic and recovery procedures, sharing knowledge within the team and escalating issues beyond the assigned scope.
• Approve rule logic and tuning changes that conform to the detection standards, and low-risk enrichment/routing changes within delegated automation authority; escalate deviations to the detection manager and submit response automations and integrations through the required approval path.
• Escalate missing critical logs, high-impact detection failures, unsafe or failed workflows and high-impact action requests to the detection manager.

Requirements

• Translate a defined attacker behaviour or control-failure scenario into working SIEM or EDR detection logic, explaining the signal, required data, assumptions, limitations and expected analyst action.
• Write and troubleshoot security-data queries; correlate relevant events and verify the fields, timestamps, source coverage and data quality needed for a detection to work.
• Design repeatable tests for expected suspicious and benign activity, interpret the results, and retain evidence of what the detection does and does not cover.
• Investigate noisy alerts and tune detection logic or exceptions without removing required coverage; use analyst feedback and evidence to justify changes.
• Use incident findings, threat-intelligence context and attacker techniques to improve assigned detection content and identify gaps.
• Document rules, owners, dependencies, validation results and linked runbooks so another engineer or analyst can understand and maintain the work.
• Build and troubleshoot API-based integrations and low-risk security workflows for enrichment, routing, evidence collection or reporting; apply appropriate access, logging, failure handling, testing and rollback controls. No particular scripting language is required.
• Diagnose failures in assigned rules, telemetry dependencies and workflows, distinguish a local engineering issue from a missing upstream dependency, and escalate critical gaps with actionable evidence.

Will be a plus

• Detection-as-code, version control, peer review, automated rule testing or continuous-integration practices.
• Relevant security training or certifications, or experience in fintech, trading, payments or crypto environments.

We offer

• 20 paid vacation days per year
• 10 paid sick leave days per year
• Public holidays as per the company's approved Public holiday list
• Medical budget
• Opportunity to work remotely
• Professional education budget
• Language learning budget
• Wellness budget (gym membership, sports gear and related expenses)