Jobs Security

About the Role
You’ll join the Application Security team within Engineering. The main focus is securing Windows desktop applications, with some work on macOS, iOS and Android.

Responsibilities

• Integrate SAST, DAST and SCA tools into CI/CD pipelines to automate security checks.
• Coordinate external code reviews and penetration tests, triage findings, assess severity and recommend fixes.
• Support product teams with threat modeling and design reviews.
• Run the bug bounty program, working with external researchers and the platform vendor.
• Validate reported vulnerabilities and verify that fixes work.
• Promote secure development practices across the organization.

Requirements

• Experience running a bug bounty program and working with SAST, DAST and SCA tools.
• Solid knowledge of GitHub, GitHub Actions and GitHub Advanced Security.
• Deep experience securing Windows desktop applications, including code review and security analysis.
• Development skills in C, C++, C# or Java.
• Experience securing cloud, desktop and mobile applications.
• Strong written and verbal communication skills in English.
• Adaptable, collaborative, and able to work independently with little supervision.

Nice to Have

• Red teaming experience.
• CISSP, CEH or GIAC (Reverse Engineering) certification.
• AWS and Terraform.
• Advanced knowledge of macOS, iOS and Android security.
• Digital forensics.
• Background in security architecture, system administration and networking.

We're looking for an Application Security Engineer to build security into our day-to-day development process, from idea and architecture through to release and post-release hardening. You'll work closely with product teams, DevOps and infrastructure on an Azure / AKS / GitHub Enterprise / Terraform stack.

What you'll do: 

• Run security reviews at every stage: pre-design, development and post-release hardening
• Build and improve DevSecOps processes in CI/CD (SAST, DAST, SCA, IaC scanning)
• Do threat modeling and secure code reviews
• Strengthen the security of AKS and our Azure infrastructure
• Automate security checks and routine tasks
• Advise developers and act as their Security Champion
   

What we're looking for:

• 4+ years of experience as an Application Security Engineer, DevSecOps Engineer, Security Engineer or Security Champion
• A degree in Cybersecurity, Computer Science, Software Engineering or a related field
• Experience working with product teams or internal development platforms
• Web application security: secure code review, threat modeling, SAST, DAST, OWASP ASVS
• CI/CD and IaC: GitHub Enterprise, securing Terraform code, Trivy, Checkmarx
• Containers: AKS security architecture, Network Policies, Azure Pod Identity
• Supply chain security: SCA, SBOM
• Automation: strong PowerShell and/or Python skills (Azure CLI, REST API)
• English: Pre-Intermediate / Intermediate or higher (enough to read technical documentation and architecture guides)
   

Nice to have

• A successful track record on Bug Bounty platforms
• Experience doing security reviews across the full product lifecycle
   

Who you are

• You love automation: if you've done something twice, it's time to write code for it
• You communicate easily: you get along with developers, infrastructure engineers, PMs and business analysts alike
• You want to grow: you keep learning, take initiative and motivate the people around you
   

What we offer

• A professional team and room to grow in your career
• A competitive salary
• Official employment and social benefits
• Military service deferment (reservation) for eligible employees, in line with current Ukrainian law
• A real say in how projects are managed and how key strategic initiatives are delivered
• A work culture that values initiative, responsibility, leadership and a focus on results

Senior D365 Platform, Integration & Security Administrator is responsible for ensuring the secure, stable, and controlled operation of the global Microsoft Dynamics 365 platform and Azure integration services. The role encompasses lifecycle administration of D365 Finance & Operations, D365 Customer Engagement, and Azure Integration Services, including release and environment management, performance monitoring, security role management, and access control. The position also involves implementing automation and artificial intelligence technologies to improve operational efficiency and ensure the reliable operation of enterprise systems.

Key Accountabilities

D365 application lifecycle and environment administration

• Administer the lifecycle of D365 Finance & Operations and D365 Customer Engagement solutions across development, test, accept and production environments.
• Maintain the release calendar; coordinate release readiness, deployment, validation, rollback and post-release review with IT applications leads, business owners, development teams and external partners.
• Operate and improve ALM processes using Azure DevOps, Dynamics 365 Lifecycle Services and Power Platform pipelines, including version control, build and deployment traceability.
• Plan environment refreshes, sandbox usage, platform updates and Microsoft release-wave assessments; maintain environment inventories, dependencies and operational runbooks.
• Ensure that business content is approved by the accountable product or process owner while the technical release process remains controlled by the platform team.

Azure Integration Services lifecycle and operations

• Administer the release lifecycle of integration components supporting D365, including Azure Logic Apps, Service Bus, API Management, Azure Functions, Event Grid, Storage and related integration resources.
• Coordinate integration releases with D365 application releases and maintain automated CI/CD pipelines, environment-specific configuration, deployment approvals and rollback arrangements.
• Monitor failed messages, queues, APIs, workflows, processing latency, throughput, availability and end-to-end transaction flows; establish actionable alerts and operational dashboards.
• Lead or coordinate incident triage, replay/reprocessing, root-cause analysis and problem management for recurring integration failures.
• Maintain interface catalogues, support ownership, dependencies, certificates, secrets, service principals, API versions and technical runbooks.
• Monitor Azure consumption and identify opportunities to improve reliability, supportability and cost efficiency.

Security, roles and access governance

• Design, create, test, document and maintain D365 F&O and D365 CE security roles, duties, privileges, teams and business-unit access models.
• Administer joiner, mover and leaver provisioning; assign and remove access through approved workflows and Microsoft Entra ID groups wherever applicable.
• Support periodic access reviews, audit evidence and remediation of security findings.
• Administer privileged access in line with organisational policy, including eligible and time-bound access through Microsoft Entra Privileged Identity Management where applicable.
• Manage service accounts, application registrations, certificates, secrets and integration identities in collaboration with Cybersecurity and Azure platform teams.
• Maintain clear ownership and documentation for roles, approvals, exceptions and emergency access.

License provisioning and optimization

• Administer the end-to-end allocation, modification and removal of Dynamics 365, Power Platform and related Microsoft cloud licenses through approved joiner, mover and leaver processes.
• Translate role and business requirements into appropriate license types and service plans, applying least-privilege and minimum-necessary licensing principles.
• Monitor license assignments, utilization, capacity and entitlement consumption; identify inactive, duplicate, over-provisioned or incorrectly assigned licenses and coordinate timely reclamation or reassignment.
• Maintain license inventories, assignment rules, approval records and audit evidence, ensuring alignment with contractual entitlements, organizational policy and Microsoft licensing terms.
• Produce regular license-demand forecasts and optimization recommendations, working with Procurement, Finance, application owners and Microsoft partners to control cost while protecting operational continuity.
• Support true-ups, renewals and license-model changes by validating current usage, anticipated demand, compliance exposure and opportunities to optimize subscription levels.

Monitoring, performance and service health

• Establish proactive monitoring across D365, Dataverse, Azure integrations and supporting services using relevant Microsoft tools such as Azure Monitor, Application Insights, LCS and Power Platform analytics.
• Monitor application performance, batch processing, integrations, APIs, capacity, storage, service limits, errors, user access and Microsoft service-health notifications.
• Define operational KPIs, service thresholds and alerts; analyse trends and coordinate corrective actions before they become business-impacting incidents.
• Coordinate performance testing and baseline comparisons for significant releases, customisations and integrations.
• Own technical escalation of complex platform incidents to Microsoft and external support partners.

Operational automation and applied AI

• Identify repetitive, manual and error-prone activities across platform administration, monitoring, access, license management, release management and support that can be simplified or automated.
• Design, implement and maintain practical automation using appropriate Microsoft technologies, including Power Automate, Azure Automation, scripting, APIs, Azure DevOps pipelines and platform-native capabilities.
• Evaluate and implement responsible AI-assisted solutions where they can improve operational efficiency, such as incident triage, knowledge retrieval, documentation, trend analysis, alert enrichment and support workflows.
• Work with business owners, Cybersecurity, Data and Architecture teams to assess value, risk, data protection, access controls, human oversight and compliance before deploying automation or AI capabilities.
• Test, document, monitor and continuously improve automated and AI-assisted processes, ensuring clear ownership, exception handling, auditability, support arrangements and safe fallback procedures.
• Measure realized benefits through reduced manual effort, faster processing, fewer errors and improved service quality, and share reusable patterns across the platform operations team.

Governance, documentation and continuous improvement

• Maintain platform standards, release procedures, environment strategy, security model, integration runbooks and disaster-recovery or rollback documentation.
• Ensure changes are linked to approved work items and retain evidence of testing, approval, deployment and validation.

• Contribute to audits, risk reviews, licence and capacity optimisation, technical-debt reduction and service improvement plans.

   

Experience and Qualifications

Essential

• At least 5 years of relevant experience administering or operating enterprise Microsoft business applications, including strong practical exposure to D365 F&O and/or D365 CE / Dataverse.
• Demonstrable experience with release management, multi-environment ALM, Azure DevOps pipelines and production deployment controls.
• Hands-on experience in D365 security-role design, access provisioning, least-privilege controls and audit support.
• Operational experience with Azure Integration Services, particularly Logic Apps, Service Bus, API Management and Azure Functions.
• Experience with monitoring, troubleshooting and root-cause analysis across applications and integrations.
• Ability to work with IT applications leads, business owners, technical teams and external suppliers in an international environment.
• Strong written documentation, prioritisation and stakeholder communication skills in English.
• Experience administering and optimizing Dynamics 365, Power Platform or comparable Microsoft cloud licensing, including provisioning controls, utilization analysis, reclamation and audit support.
• Practical skills in process analysis and operational automation using Power Automate, scripting, APIs, Azure Automation, Azure DevOps or comparable tools, with the ability to evaluate and safely apply AI-assisted capabilities.

Duration: long-term
Start: ASAP
Location: EU, Ukraine
Time zone: UK
 

We are looking for a strong Senior Platform Engineer with relevant security experience to urgently replace a team member who has left the project.

The project is confidential, so we cannot share requirements or technical details. The tech stack is not the main criterion for the client. They need a broad, experienced engineer who is comfortable with a wide range of technologies, is trustworthy, and will stay on the project long-term.

Format: remote, full-time, long-term contract 

Rate: $25–35/h (contractor, net)

 Hours: strong overlap with US Eastern / Central business hours Client: North American SaaS company serving the public sector (procurement, budgeting, payments, grants), 3,600+ organizations 

About the role The company is expanding its AI/ML product line: AI-powered features, intelligent automation, agentic pipelines and LLM integrations. You will join the Security Engineering team and own AI security end-to-end, from threat modeling agentic systems to defining secure development practices that engineering teams follow.

 What you will do

 - Own AI security projects from concept to delivery across the AI/ML lifecycle

 - Assess and mitigate AI-specific risks: prompt injection, data poisoning, model integrity, adversarial attacks, agentic AI threats

 - Evaluate and secure agentic AI systems: multi-agent architectures, tool use, autonomous pipelines

 - Build and maintain security tooling, automation and controls across AI/ML pipelines and infrastructure

 - Define secure AI development practices across the SDLC with Architecture, Product, Platform, DevOps and IT 

- Contribute to AI governance: policies, risk assessments, responsible AI frameworks 

- Write technical security documentation for AI systems 

Requirements

 - 6+ years in security engineering / architecture in a SaaS environment 

- Strong AppSec and security architecture for microservice, cloud-native and serverless applications 

- Security tooling and automation built as code; GitOps and continuous security and compliance

 - Hands-on experience securing AI/ML or LLM-based systems

 - Familiarity with OWASP LLM Top 10, MITRE ATLAS, NIST AI RMF, EU AI Act

 - Understanding of agentic AI risks: autonomous agents, tool orchestration, memory, multi-agent coordination 

- English C1: you will lead security initiatives with US teams and write policies 

Nice to have 

- LLM security, model red-teaming, AI threat modeling

 - Securing agents built with LangChain, AutoGen or CrewAI

- AI governance programs, risk registers, responsible AI policies

 - Certifications: ISC2 AI Security, CISSP, CCSP, CSSLP

The Role

The Security Engineer starts primarily in managed detection and response (MDR). On a normal day, the focus is detecting, investigating, and responding to security events. When project work requires additional engineering capacity, the engineer may be moved to support project work. When a significant cybersecurity incident occurs - whether for a client or internally - incident response becomes the priority and the broader security team participates as needed, regardless of normal schedules.

What You Will Do

• Investigate security alerts and events and determine whether activity is benign, suspicious, or requires escalation.
• Participate in detection and response operations, including guided containment and remediation decisions.
• Analyze security issues and recommend remediation or configuration changes; early in the role, changes are performed under guidance rather than independently.
• Work with logs and telemetry from endpoints, operating systems, networks, identity systems, cloud environments, and security platforms.
• Participate in client and internal cybersecurity incidents as part of the incident response team.
• Contribute to cybersecurity projects when assigned, learning the required technology as part of the project.
• Analyze internal and client security environments and make practical security recommendations under guidance.
• Grow into broader engineering responsibilities as your technical capability and interests develop.

Core Technical Foundation

We do not expect one person to know every security product. We care more about a strong technical foundation and the ability to understand how technologies fit together.

• Strong understanding of TCP/IP and computer networking. Networking knowledge is fundamental to this role.
• Intermediate knowledge of Windows and Linux administration and security, including how systems are secured and hardened without relying only on security tools.
• Solid understanding of core cybersecurity concepts, threats, controls, detection, and response.
• Working understanding of firewalls, network perimeter security, and modern security architecture concepts such as Zero Trust.
• Ability to reason through unfamiliar technical problems and learn new technologies quickly.
• Prior security operations, systems administration, network administration, or security engineering experience.
• Experience with any SIEM, EDR/XDR, log collection, or security monitoring platform.
• Active Directory, Microsoft Entra ID, identity management, or identity security experience.
• Cloud infrastructure or cloud security experience.
• Communication is in English – B1+ English level is required

Experience That Is a Plus

• Scripting or automation experience, such as PowerShell, Python, or similar technologies.
• Relevant technical certifications. Strong certifications in foundational technologies are valuable; we do not require a specific cybersecurity certification.

What Matters Most

• Responsibility and ownership – you take ownership of assigned work, follow it through to completion, communicate when something is blocked or unclear, and make sure important issues do not fall through the cracks.
• Curiosity - when something looks unusual, you want to understand why.
• Creativity - you can think beyond a checklist when an investigation does not follow an obvious path.
• Investigative mindset - you keep digging until the situation is understood and you are comfortable that the environment is secure.
• Attention to detail - small technical details can change the meaning of a security event.
• Learning ability - how quickly you comprehend new technologies and apply what you learn will directly influence how quickly you grow.
• Initiative and engagement - you are interested in the technology and the problem, not simply completing a queue of assigned tasks.

Training and Career Growth

This is a growth-oriented position. The initial concentration is detection and response. From there, the career path is not predetermined. We want to develop each engineer around both capability and passion. Someone with strength in scripting and automation may grow in that direction; another engineer may become stronger in infrastructure, cloud, incident response, security engineering, projects, or client-facing work. With sufficient growth, the path can lead to senior engineering, project leadership, client management, and potentially virtual CISO responsibilities.

Working Model

• Fully remote position.
• Aligned with U.S. working core hours (9 am to 5 pm EST/EDT).
• Detection and response is a 24x7 company function; over time, shifts may become more flexible based on team coverage and what works for the engineer.
• Significant cybersecurity incidents are treated as team events and may require participation outside the normal schedule.
• Client communication is not expected from day one; it can become part of the role as the engineer develops.
• No travel requirement.

Smarter is a management company responsible for defining the overall strategy of investment activities and ensuring optimal management and development strategies for each business unit within the group. The main areas of activity and focus of our company include the international fintech community SFORS (https://sfors.com), the brokerage company Statok (https://statok.global), and the product company Pine Software (https://pinesoftware.com.cy)

The Head of Security is responsible for the comprehensive protection of the Group’s and the Owner’s assets, information, and interests by establishing an integrated security system—encompassing financial-economic, information, internal, and physical security—that minimizes the risks of loss, fraud, and external threats while supporting the stability and value growth of the asset portfolio.

Responsibilities

1. Corporate & Enterprise Security

• Developing, updating and implementing the company’s global security strategy in line with business objectives.
• Establishing an effective security governance framework and developing corporate security policies.
• Assessing, structuring and managing corporate risks (Enterprise Risk Management).
• Protecting the company’s physical, information, financial and reputational assets.
• Transforming and developing the security culture within the company.
• Advising the Executive Team and the Board on strategic security and risk-related decisions.

2. Physical Security & Crisis Management

• Organising comprehensive physical security for offices, sites, facilities and personnel.
• Monitoring and modernising access control systems, CCTV, security and emergency response systems.
• Developing and regularly testing crisis response scenarios (including those specific to martial law, relocation and blackouts).
• Management of travel security and executive protection processes (where required).

3. Personnel Security & Background Checks

• Organisation and automation of background verification processes for candidates, employees and third-party vendors.
• Assessment of potential reputational, compliance and fraud risks.
• Development and implementation of employee screening and insider risk management procedures (to prevent internal leaks and sabotage).
• Effective collaboration with the HR and Legal departments when resolving sensitive cases.

4. Fraud Prevention & Internal Investigations

• Designing and auditing systems to prevent fraud, corruption and internal misconduct.
•  Organising and conducting independent internal investigations.
•  Identifying conflicts of interest, industrial espionage, financial fraud and leaks of trade secrets.
•  Developing preventive controls and tools for monitoring operational risks.
•  Leading the Incident Response process (responding to security incidents).

5. Information Protection & Insider Risk Management

•  Ensuring the security aspects of processes involving the handling of confidential information and trade secrets.
• Developing and implementing measures to prevent insider threats.
• Monitoring compliance with internal requirements for handling sensitive information.
•  Participating in the investigation of information leaks, breaches of NDAs and other incidents related to human error.
•  Assessing security risks associated with counterparties, partners and third-party contractors.

6. Risk Management & Business Continuity

•  Developing and maintaining procedures for responding to security incidents.
•  Preparing and conducting training sessions, drills and crisis simulations.
• Coordinating actions during incidents relating to physical, personnel or corporate security.
• Participating in post-incident analysis and the development of corrective measures.
• Preparing recommendations to enhance the company’s preparedness for security threats.

7. Compliance & Governance

• Monitoring compliance with internal security policies and external compliance requirements.
• Fostering constructive collaboration with the Legal and Audit functions, government and law enforcement agencies, as well as external stakeholders.
• Participating in the development and oversight of policies relating to data protection, confidentiality (NDAs) and acceptable use.

• Preparing regular security reports and dashboards for executive leadership.

   

Job requirements

• Experience: At least 5 years in roles such as Head of Security, Director of Corporate Security or Enterprise Risk Manager within established organisations (mature mid-market or enterprise-level).
• Expertise: A deep understanding of how physical, operational, personnel and financial security function within a modern business.
• Management skills: Experience of building security processes, regulations and policies ‘from scratch’ or completely transforming them to suit the new scale of the business.
• Crisis management: Practical experience of incident handling and coordinating actions in stressful, uncertain situations.
• Business focus: Skills in engaging with executive stakeholders. The ability to defend budgets and decisions using the language of figures, risk analysis and business opportunities, rather than the language of ‘restrictions’.
• Technical literacy: An understanding of the basic principles of information security and modern digital risks. The ability to interact effectively with IT and other technical functions within the company.
• Personal qualities: An impeccable reputation, high ethical standards, emotional intelligence, well-developed strategic thinking and absolute discretion.

Nice to have

•  Experience of working in international companies or matrix organisations.
•  Experience of managing security in high-risk environments or geographically dispersed teams/branches.
•  Professional certifications (e.g. ASIS CPP, CISM, risk management or audit certifications).
•  Knowledge of international practices and standards in the field of corporate security, risk management and internal controls (ISO 31000, ISO 22301, ISO 27001 would be an advantage).
•  Experience of professional and effective interaction with law enforcement or military organisations.

Company offers

• Care from Day One — medical insurance from your first day, including dental care, massage, and professional psychological support.
• Work-Life Balance — 21 days of paid vacation + 30 days of paid sick leave.
• Knowledge Library — office books and access to the Kuka online library. 
• Investment in Your Energy — partial reimbursement for sports and fitness activities.
• Modern Workspaces with full power-backup infrastructure in Larnaca, Cyprus.
• Island Relaxation — up to 14 days per year at the company villa in Cyprus. 

‍

Join the Smarter team, where your talents and aspirations will be recognized! We offer a dynamic work environment, opportunities for professional growth, and support at every step of your career path. Start your journey to success with us—apply today and take the first step towards your bright future.

Smarter is an equal opportunity employer. We encourage applications from candidates of all backgrounds and experiences. Please note that only shortlisted candidates will be contacted. Thank you for considering Smarter as your next career move!!

We are looking for a Senior DevSecOps Engineer to join our Product Security team and help strengthen security across our software development lifecycle.

In this role, you will design, implement, and maintain security integrations within CI/CD pipelines, automate security workflows, and improve the reliability and effectiveness of security controls.You will work closely with Application Security, Cloud Security, DevOps, Platform, and Engineering teams to ensure that security checks are integrated seamlessly into development workflows, vulnerabilities are identified and addressed efficiently, and developers receive clear, actionable feedback. 

This is a hands-on technical role offering the opportunity to influence how security tooling and automation are implemented across our engineering environment.

Responsibilities
 

• Integrate and maintain SAST, SCA and secrets scanning in CI/CD pipelines and developer workflows
• Build reusable pipeline integrations and security rules managed as code, including agreed cloud configuration checks with Cloud Security and DevOps. Test changes, plan safe rollouts with pipeline owners and verify that required checks run across the agreed scope
• Tune scanner rules and configurations to reduce false positives and give developers useful feedback. Validate changes with AppSec, record exclusions and avoid hiding real risks to keep pipelines green
• Troubleshoot failed scans, broken integrations and security-related pipeline failures. Restore controls or escalate blockers promptly, explaining the impact and the action needed
• Automate finding collection, duplicate handling, ticket creation and status updates. Ensure validated High pipeline and secrets findings have an owner, action and due date; follow up and escalate unresolved ownership or blockers
• Work with AppSec and developers to validate findings, improve remediation guidance and check fixes where needed. Turn recurring problems into reusable checks and workflow improvements
• Apply scanner configuration changes within the approved baseline. Recommend new gates, tool changes and exception-handling improvements for approval; escalate pipeline-breaking issues or critical unowned findings to Manager (DevSecOps & Application Security)
• Maintain clear coverage records, troubleshooting guides and operational runbooks. Use pipeline and tool data to show missing checks, control failures and outstanding findings, and share knowledge so others can support the integrations
   

Requirements
 

• At least 3+ years of hands-on experience in DevSecOps engineering roles
• Strong understanding of Git workflows and CI/CD pipelines, with the ability to design reusable integrations, investigate failed jobs and assess the impact of changes on software delivery
• Practical experience configuring static application security testing (SAST), software composition analysis (SCA) and secrets scanning, tuning rules, investigating false positives and routing results to the right teams
• Ability to write, test and maintain automation in a suitable language, such as Python, Bash or Go, and integrate systems through APIs. A specific language is less important than reliable, maintainable integrations
• Experience implementing security checks or policies as code, with version control, testing and controlled changes
• Practical experience securing and hardening cloud environments with at least one major cloud provider (AWS preferred), including automated compliance checks against agreed security requirements
• Working knowledge of Linux and container-based build environments, including permissions, credentials and logs needed to troubleshoot security tooling
• Understanding of common application, dependency and exposed-secret risks; ability to distinguish a tool failure from a security finding and identify when specialist review is needed
• Ability to maintain clear coverage records, operational runbooks and reporting using pipeline, scanner and work-item data
• Strong problem-solving, communication, and collaboration skills, with the ability to take ownership of technical tasks and coordinate with cross-functional teams
• English(В1), Russian (fluent)
   

Will be a plus
 

• Direct experience with GitLab CI/CD security integrations
• Experience with Terraform or Kubernetes security checks
• Software supply-chain security, including software bills of materials (SBOMs), artifact signing or build provenance
• Experience integrating dynamic application security testing (DAST), or using AI-assisted tools to improve security automation with appropriate review
• Experience in fintech, trading, payments or other security-sensitive product environments
   

We offer
 

• 20 paid vacation days per year
• 10 paid sick leave days per year
• Public holidays as per the company's approved Public holiday list
• Medical budget
• Opportunity to work remotely
• Professional education budget
• Language learning budget
• Wellness budget (gym membership, sports gear and related expenses)

Security work at Headway Inc already happens across Infrastructure and Engineering, but no one owns it end to end. We’re looking for a systems or infrastructure engineer who is ready to make security their main craft and become our first dedicated Security Engineer. You'll own identity, endpoints, cloud security, and incident response hands-on, with AI as your main tool, report directly to the CTO, and decide how security works here from day one.
 

About Headway Inc

Headway Inc is a global tech company building products that help people grow. Our apps have reached 170M+ downloads worldwide, and TIME ranked Headway Inc #4 among the World’s Top EdTech Companies.

Our achievements start with our people and the values we share. At Headway Inc, we believe in building strong teams around our SELECT values.

Millions of people trust our apps with their learning, and around 500 teammates rely on their accounts, devices, and cloud systems to keep building them. Your job is to keep all of that protected in a way that’s practical and doesn’t slow anyone down.
 

What you’ll do

• Identity and access: Own SSO, MFA, and the access lifecycle, so every account has the access it needs and nothing more.
• Endpoints and email: Run endpoint security (MDM, EDR) across our devices and keep phishing out with SPF, DKIM, and DMARC.
• Cloud security: Work hands-on with GCP security controls and make sure our logs show us when something goes wrong.
• Detection and incident response: Run detection together with an external MDR/SOC provider and own the incidents they escalate: make the calls, contain the issue, and find the root cause.
• AI-first automation: Use AI as your main tool to automate routine security work.
• Risk and communication: Prioritize by business impact and explain risks and trade-offs to Engineering, Operations, and leadership.

You’ll report to Rostyslav Vasiukov, our CTO, and work closely with IT Infrastructure, Core Platform, and teams driving AI adoption. Your role isn't to execute every security task alone, but to set risk-based priorities, establish clear ownership, align teams, and ensure we address the most important risks.

What success looks like

• First result: Within your first 3 months, you know our environment and how well our existing controls work. You've agreed on the top security risks with the CTO and closed the most urgent gaps, starting with endpoint security.
• Tangible progress: By 6 months, access management, endpoint security, and visibility across our systems work reliably, so we notice when something goes wrong.
• Longer-term impact: Within a year, corporate security runs as a coherent, largely automated system, and leadership has a clear picture of the main risks. With that foundation in place, you're actively involved in application security work alongside Core Platform.

You’d be a great fit if you

• Have decent experience in systems or infrastructure engineering, with real ownership of production or corporate systems.
• Have hands-on experience with corporate security basics: SSO/MFA and identity providers, MDM/EDR, and email authentication (SPF, DKIM, DMARC). You don’t need to have held a security title. Having done this work in other roles counts.
• Have worked with GCP or another major cloud provider, including IAM, logging, and monitoring, and you understand how core cloud controls fit together.
• Have handled real incidents: you investigated, contained the problem, found the root cause, and made sure it didn’t happen again.
• Are a heavy AI user. You use AI tools daily to analyze, automate, and get work done faster, and can show real examples of workflows you've built. Scripting (Python, Bash, or similar) and infrastructure as code (e.g., Terraform) help, but AI fluency matters more.
• Assess risk in a business context. You know an exposed admin credential matters more than a stale test account, and you prioritize accordingly rather than following a checklist.
• Are hands-on by default. You’re comfortable doing many different tasks yourself and want to grow deliberately into security as your specialization.
• Can explain a security risk clearly to an engineer, a manager, or leadership, and communicate confidently in English, both written and spoken.
• Align with our team values, SELECT, and put them into practice in the way you work, make decisions, and collaborate with others.

It would be a plus if you also have:

• Experience with WAF and DDoS protection (e.g. Cloud Armor).
• Experience writing and tuning detection rules in SIEM/EDR.
• Experience with GitLab security tooling, CI/CD, and security control automation.
• Experience selecting, onboarding, or working with an MDR/SOC provider.
• Understanding of AI Security risks: sensitive data handling, access control, third-party AI tools, and AI-enabled product features.
• Product Security / Application Security: secure SDLC, threat modeling, code and dependency scanning.
• Security awareness programs, tabletop exercises, and human risk management.

What we offer

• Two week-long paid corporate holidays each year and 20 vacation days.
• Medical insurance, full sick leave compensation and access to a corporate doctor.
• A personal development plan, professional communities and a knowledge base.
• Compensation for English-language learning, external training and courses.
• An office with a reliable shelter, generators, satellite internet, and other amenities.
• Sports activities, including running, yoga, boxing and more.
• Supporting initiatives that help Ukraine. .

Interested? Send us your CV — we’d love to hear from you.

ABOUT THE ROLE

We are looking for an experienced Cryptography Engineer to join our R&D team and work on security-critical open source system where cryptography is a core part of the product.

You will be working at the intersection of applied cryptography, software engineering, security and modern distributed systems — analysing cryptographic constructions, designing secure protocols, implementing cryptographic primitives and their optimization in the framework.

This role is suitable for both cryptography-first engineers with a strong mathematical background and engineering-first developers who have substantial experience with cryptographic systems and want to go deeper into applied cryptography.
 

WHAT YOU WILL DO

• Design, implement and review cryptographic protocols and security-critical components for the framework under creation.
• Implement and integrate cryptographic algorithms and primitives into production software and its releases.
• Work with symmetric and asymmetric cryptography, digital signatures, hashing and key-exchange mechanisms.
• Design and implement secure key management and key lifecycle processes.
• Analyse existing cryptographic implementations and identify potential weaknesses.
• Participate in security and cryptographic code reviews.
• Translate cryptographic research and academic papers into practical engineering solutions.
• Develop comprehensive unit, integration, negative and interoperability tests.
• Investigate vulnerabilities, implementation flaws and potential attack vectors.
• Keep up with developments in applied cryptography, cryptographic protocols and emerging security technologies.
   

WHAT WE EXPECT

Cryptography

• Strong understanding of modern cryptographic fundamentals:
  • symmetric encryption;
  • asymmetric encryption;
  • hash functions;
  • MAC / HMAC;
  • digital signatures;
  • key exchange;
  • public-key cryptography;
  • random number generation;
  • key derivation and key management.
• Practical understanding of algorithms and constructions such as:
  • AES;
  • ChaCha20 / Poly1305;
  • SHA-2 / SHA-3;
  • RSA;
  • ECC;
  • ECDSA / EdDSA;
  • Diffie–Hellman / ECDH;
  • HKDF;
  • AEAD.
• Understanding of common cryptographic protocols and how they are used in real systems.
• Ability to reason about cryptographic security assumptions and threat models.
• Understanding of common cryptographic implementation mistakes and attack vectors.
• Ability to read and understand cryptographic papers, specifications and technical documentation.
   

Software Engineering

• 4+ years of professional software engineering experience, with significant experience working with security-critical or low-level systems.
• Strong programming skills in at least one of:
  • Rust
  • C/C++
  • Go
  • Python
• Experience designing and implementing production-grade software.
• Strong understanding of algorithms, data structures and software architecture.
• Experience with unit testing, integration testing and code review.
• Understanding of networking and modern distributed systems.
• Good understanding of operating-system concepts and how applications interact with system resources.
• Experience working with APIs, protocols and serialization formats.
   

Security

• Understanding of threat modelling and security boundaries.
• Understanding of authentication, authorization and trust models.
• Familiarity with secure software development practices.
• Ability to distinguish between a cryptographic problem and a problem that should be solved by another security control.
• Experience analysing security vulnerabilities and their potential impact.
   

WOULD BE A PLUS

• Experience with Rust and/or cryptographic libraries.
• Experience developing cryptographic libraries or security-critical components.
• Experience with TLS, PKI, X.509, certificates and key management systems.
• Knowledge of modern protocols such as HPKE.
• Experience with zero-knowledge proofs, MPC, threshold cryptography or homomorphic encryption.
• Experience with blockchain cryptography and transaction privacy.
• Knowledge of secure distributed computing.
• Experience with hardware-backed security, HSM, TPM, Secure Enclave or similar technologies.
• Experience with side-channel attacks and constant-time programming.
• Contributions to open-source cryptographic or security projects.
• Academic or professional background in cryptography, information security, mathematics or computer science.
• Publications, conference talks or research experience in cryptography/security.
   

WHAT WE OFFER

• Work on technically challenging security-critical problems.
• Opportunity to work with modern applied cryptography rather than only standard application security.
• Direct involvement in real open source system development.
• Collaboration with experienced software engineers and network engineers.
• Flexible remote / hybrid work.
• Competitive compensation.
• Paid vacation and sick leave.

About us 

ARRISE is a global leader in software development and services for the iGaming industry, bringing together more than 2,500 professionals operating across more than 12 locations worldwide. 
 

From concept through to delivery, we combine technical expertise, creativity and industry knowledge to develop products, platforms and services that shape player experiences and support some of the industry's leading brands. 
 

We are best known for the work we deliver for Pragmatic Play, creating and supporting technology, products and specialists services enjoyed by millions of players worldwide. 

About the role 

The Senior Application Security Engineer acts as a technical authority. This role ensures secure design, development, deployment, and integrity across both on-prem and SaaS environments. You should be comfortable wearing multiple hats and thrive in a fast-paced, collaborative environment. 

What you will do 

• Define and mature secure SDLC and AppSec program frameworks. 
• Embed secure coding practices into development and backend platform engineering. 
• Lead threat modeling and high-risk security reviews for major releases. 
• Implement application security testing tools (e.g. SCA, ASPM), container scanning, and secrets detection in CI/CD pipelines. 
• Perform Penetration Testing and manage external penetration testing efforts 
• Manage application vulnerabilities from identification to remediation. 
• Provide guidance for development teams. 
• Design, maintain, and enforce organization-wide paved roads and guardrails. 

What you bring 

• 5+ years in application security, secure architecture, or related functions. 
• Demonstrated ability to influence senior engineering and product leadership. 
• Proven implementation of CI/CD security automation and secure coding practices. 
• Strong understanding of web, API, and microservice security. 
• Experience with Java, Javascript. 
• Experience in Penetration Testing 

What sets you apart 

• Kubernetes/container security knowledge. 

 
What we offer 

• Competitive compensation 
• A competitive salary that reflects your skills and experience. 
• Annual leave 
• In accordance with the applicable legislation (20 or 26 days of annual leave). 
• Private medical cover 
• Private medical insurance to help you look after your health and wellbeing, available after successfully passing the probation period. 
• Learning Hub 
• Access to our online learning platform, with courses and resources to help you build your skills and grow your career. 
• Gym & fitness membership 
• Multisport membership, after successfully passing probation. 

About the Project

You’ll build and lead a SOC team from scratch for a global SaaS company (unicorn-stage, 20+ offices, Fortune 500 clients). The customer Security team is super strong and the stack is superior. As the first SOC leader (in charge of 6 Tier 2 analysts), you’ll upgrade existing response processes so the internal team can focus on security engineering.

You’re the escalation point for your analysts and the client’s IT, DevOps, and App Security teams, and you own 24/7 coverage, SOC KPIs, and the feedback loop to Security Engineering. This is not a ticket-closing role: you set the tone for how incidents are handled.

What You’ll Do

• Lead the team: run the L2 analysts day-to-day (prioritization, playbooks, escalations), hold team syncs and handovers, and mentor and onboard analysts
• Own 24/7 coverage: build and maintain shift schedules and on-call rotations so the SOC is always staffed
• Own incident response: lead the full lifecycle from triage to closure, coordinate high-severity events and run post-incident reviews
• Investigate hands-on: be the escalation point and work complex alerts alongside analysts, beyond Tier 2 capability
• Measure and report: track team and individual performance and out comes against KPIs and SLAs (MTTA, MTTR, SLA compliance, false positive rate, backlog) and report to management and the client
• Bridge to Security Engineering: turn analyst pain points (false positives, alert fatigue, detection gaps) into detection tuning and improvement suggestions.
• Communicate clearly: work with the client’s security team at technical and managerial level, with honest status updates, including when something is unknown

What You Bring

Hard requirements (non-negotiable):

• 5+ years in SOC / incident response roles, including prior Tier 2/3 analyst experience. Not just monitoring: actual IR ownership
• 2+ years of team lead or management experience in a SOC, including shift lead or mentoring responsibility
• Proven experience building and running 24/7 shift schedules and on-call rotations, and keeping coverage intact in practice
• Proven experience owning SOC KPIs and SLAs (MTTA, MTTR, SLA compliance): you can show how you measured a team and improved it
• Experience leading or coordinating a team during an active incident, and the ability to describe it step by step
• Cloud / AWS security experience: ability to investigate and respond to cloud alerts on day one
• SaaS investigation experience
• SIEM hands-on: Splunk (required), with the ability to write and read SPL queries. CrowdStrike SIEM is a strong plus
• EDR: Microsoft Defender and/or CrowdStrike
• Working knowledge of both Windows and macOS environments
• Strong communication skills, bridging SOC operations and Security Engineering. Intellectual honesty: you say “I don’t know” when you don’t know

Strong plus:

• Identity platforms: Okta, Azure AD
• SOAR automation and threat hunting
• Experience building a SOC at level 4-5 based on SOC-CMM
• Feeding analyst findings into detection engineering (tuning, new detections)

Things that won’t work here

• Only closing alerts without owning the IR process
• Never having owned a shift schedule, on-call rota or KPI reporting
• Managing from the sidelines instead of investigating alongside the team
• Confident wrong answers instead of acknowledged gaps
• No ability to describe team coordination during a real incident

Tech Stack

Splunk · Microsoft Defender · CrowdStrike · Okta · AWS

What We Offer

• Superior technical team and a great customer with massive modern infrastructure
• AI everywhere, with the ability to automate every step: work smarter, not harder
• Real ownership from day one to build the SOC processes, coverage model and KPIs
• Direct collaboration with the client’s senior security team
• Warsaw office (day shifts), with a flexible on-call and night coverage model you design with your team
• Relocation support

We are looking for an Enterprise & Cloud Security Manager to lead and mature our enterprise security function across cloud, network, identity, endpoint, and data domains. In this role, you will own the design and enforcement of security guardrails across a hybrid environment. You will lead a team of security engineers, drive the evolution toward a cloud-first model, and track and report on enterprise security metrics.
 

Responsibilities
 

• Own and lead Enterprise & Cloud Security across cloud, network, identity, endpoint, and data domains
• Define and enforce enterprise security guardrails, approving low/medium-risk platform exceptions
• Lead CSPM/CNAPP/CWPP, WAF, DNS security, and IaC scanning across cloud environments
• Manage cloud IAM and security-group guardrails in close collaboration with Platform and SRE teams
• Operate and mature endpoint security (EDR/XDR/MDM) across managed devices, including hardening and telemetry health
• Own data security and cryptography controls: KMS, secrets management, PKI, and certificate lifecycle
• Lead, mentor, and develop a team of security engineers (4 direct reports — Cloud & Network, Endpoint, IAM, Data Security & Cryptography)
• Track, analyze, and report enterprise security metrics

Requirements
 

• 5+ years of experience in managing and developing security teams
• Proven track record in hands-on cybersecurity engineering roles
• Enterprise-level background
• Practical experience with on-premises environments
• Solid experience with networking
• Hands-on experience with cloud platforms
• Broad experience across cloud posture, network, identity, endpoint, and data protection security domains
• Experience with CSPM/CNAPP/CWPP tooling and cloud guardrails (WAF, DNS security, IaC scanning)
• Experience with cloud IAM and security-group/IaC security patterns
• Experience operating EDR/XDR and MDM solutions
• Experience with KMS, secrets management, PKI, and certificate management
• Ability to enforce security controls without unnecessarily blocking delivery for Platform/SRE/DevOps teams
• Upper-Intermediate English and higher

Will be a plus

• Higher education in Computer Science, Information Security
• Background in fintech, brokerage, trading platforms, payments, or other regulated environments
• Track record of building or maturing an enterprise/cloud security function from an early stage
• Familiarity with tools such as Wiz, Panorama, Elastic Defender, Entra, or CyberArk
• Knowledge of Kubernetes/container security and cloud-native architectures
• Exposure to SOC 2, ISO 27001, or DORA compliance frameworks

We offer

• 20 paid vacation days per year
• 10 paid sick leave days per year
• Public holidays as per the company’s approved Public holiday list
• Medical budget
• Opportunity to work remotely
• Professional education budget
• Language learning budget
• Wellness budget (gym membership, sports gear and related expenses)

We are looking for an Application Security Engineer to help build security into the software development lifecycle across our products and platforms.

In this role, you will work closely with Engineering, DevOps, Architecture, and Security teams to integrate security controls into development processes, identify risks early, and help teams build secure solutions without unnecessary bureaucracy.
 

Responsibilities

• Define and validate security requirements for applications, APIs, integrations, and new services.
• Participate in architecture and design reviews to identify security risks at early stages.
• Build and improve Secure Software Development Lifecycle (SSDLC) practices.
• Integrate security controls into CI/CD pipelines, including SAST, DAST, SCA, Secret Scanning, Container and IaC Scanning.
• Perform security assessments of web applications, APIs, backend services, and AI-driven solutions.
• Support development teams with remediation activities, secure coding practices, and security best practices.
• Develop security standards, baselines, templates, and engineering guidelines.
   

Requirements

• 2+ years of experience in Application Security, DevSecOps, Security Engineering, or a similar role.
• Strong understanding of SSDLC and secure development practices.
• Hands-on experience with SAST, DAST, SCA, threat modeling, and security reviews.
• Good knowledge of OWASP Top 10, OWASP ASVS, API Security, Authentication, Authorization, and Secure Design principles.
• Experience integrating security controls into CI/CD pipelines.
• Familiarity with container security and Kubernetes environments.
• Experience with Infrastructure as Code security (Terraform is a plus).
• Scripting skills in Python and/or PowerShell.
• Understanding of software supply chain security and dependency management.
• Strong communication skills and ability to work effectively with engineering teams.
   

Nice to Have

• Experience with Bug Bounty programs or CTFs.
• Experience securing AI/ML systems and services.
• Experience with Azure, AKS, GitHub Enterprise, Checkmarx, Trivy, or similar tooling.

Iterasec works with clients worldwide, helping them find vulnerabilities and secure their products. Our projects range from mobile/web applications to complex modern cloud and automotive stacks. We work with both small product companies as well as Fortune 500 enterprises.

We are looking for a talented and motivated Junior Pentester who will join our security team to work on penetration testing and vulnerability/cloud security assessment projects.

We expect a short motivation letter where you can explain your skills, achievements and motivation.

Required skills

- Solid non-commercial cybersecurity experience, such as HTB/THM

- Junior-level cybersecurity certifications would be a plus.

- Comfortable with basic application security testing and common vulnerabilities (like OWASP Top 10, CWE Top 25) and cybersecurity fundamentals

- Strong basic IT skills: Linux, networking (TCP/IP, DNS, HTTP etc.)

- Some experience in scripting/coding languages, such as Java, JS, Python, Shell, etc.

- Strong drive to learn and develop cybersecurity skills

- Technical English (Intermediate)

We offer

- Good salary + bonus system

- Rewarding environment: brilliant team ready to share knowledge and collaborate

- Support in obtaining professional certifications, such as BSCP, OSCP, eWPTX, cloud certifications, etc.

- Courses and conferences which are relevant to the position are sponsored by the company.

- We are a remote-first company with full WFH support and a flexible work schedule.

Responsibilities

- Execute penetration tests and security assessments as part of a team, including internal/external networks, web and mobile applications, Windows and Linux environments, cloud architectures, IoT devices, and more

- Create assessment documentation and reports, clearly identifying vulnerabilities and associated remediation steps

- Conduct security research