Jobs Security

Location: Remote — Worldwide
Engagement: Full-time / Part-time
Duration: Long-term
Start: ASAP
Seniority: Senior / Architect / Consultant
English: B2+
Compensation: Negotiable, based on experience and availability

About the Project

We are looking for an experienced Senior Security / GRC Consultant to support an innovative healthcare technology company developing a robotic remote ultrasound solution for hospitals in the US and EU.

The product involves remote medical examinations, patient data processing, and healthcare software integrations.

The primary objective is to establish a robust security and compliance framework, prepare the company for SOC 2 certification readiness and a successful external audit, and address cybersecurity requirements from healthcare customers.

This is a hands-on consulting role requiring proven experience leading SOC 2 readiness and audit preparation, not simply working as an engineer in a SOC 2-compliant environment.

Key Responsibilities

SOC 2 Readiness & Audit Preparation

• Independently lead SOC 2 readiness and compliance initiatives.
• Conduct gap assessments and identify security and compliance risks.
• Develop and implement security policies, procedures, and controls.
• Organize evidence collection and audit documentation.
• Coordinate with external auditors and support the SOC 2 audit process.
• Provide actionable recommendations to engineering and management teams.

Healthcare Security & Compliance

• Ensure alignment with HIPAA, GDPR, and healthcare data protection requirements.
• Define security requirements for handling Protected Health Information (PHI).
• Assess cybersecurity risks associated with medical software and patient data.
• Support compliance with security expectations of US and EU hospitals.

Security Documentation & Customer Support

• Prepare comprehensive security white papers describing security architecture, controls, processes, and data protection practices.
• Independently complete and review customer security questionnaires.
• Participate in client calls and address technical security and compliance questions.
• Develop technical security specifications and implementation guidelines for the development team.

Medical Software Compliance

• Collaborate with the client's QA/RA Manager on IEC 62304-related processes and documentation.
• Contribute to Software Requirements Specifications (SRS), software architecture documentation, and Verification & Validation (V&V) processes.

Required Qualifications

• Senior-level experience in information security, GRC, security compliance, or security consulting.
• Proven hands-on experience independently preparing at least one organization for SOC 2 and supporting it through a successful external audit.
• Strong understanding of SOC 2 Trust Services Criteria, security controls, audit evidence, and compliance processes.
• Practical experience implementing security policies and compliance frameworks.
• Knowledge of HIPAA, GDPR, and PHI protection requirements.
• Experience creating security white papers and responding to enterprise customer security questionnaires.
• Ability to translate regulatory and compliance requirements into clear technical tasks for engineering teams.
• Strong communication and stakeholder management skills.
• English B2+ or higher, with the ability to independently lead client discussions.

Nice to Have

• Previous SOC 2 audit preparation experience in healthcare, MedTech, or digital health.
• Experience with medical devices or medical software.
• Familiarity with IEC 62304 and medical software lifecycle documentation.
• Knowledge of ISO 27001, ISO 13485, or other healthcare-related standards.
• Experience with cloud infrastructure, SaaS security, or security architecture.
• Experience supporting enterprise sales or technical presales.

Engagement Details

The engagement will begin with a technical presales phase, during which the consultant will independently assess the client's security and compliance needs, answer relevant questions, and help define the scope of work.

Following successful presales, the consultant will take ownership of SOC 2 readiness and security compliance activities.

The initial workload is expected to be substantial, potentially full-time, with the possibility of transitioning to part-time involvement as the project progresses.

Part-time consultants are also welcome to apply. The exact workload and engagement model will be determined together with the selected specialist.

The project is long-term, with potential team expansion and additional healthcare software initiatives, including ultrasound video streaming, robotic HMI, and urgent examination booking platforms.

Important

We are specifically looking for someone who has personally led SOC 2 preparation and successfully supported an external audit.

Experience developing software within a SOC 2-compliant organization alone is not sufficient.

Candidates should be ready to discuss concrete examples of previous SOC 2 projects, their responsibilities, implemented controls, evidence collection processes, and audit outcomes.

How to Apply

Please share your CV, expected hourly rate, availability, and a brief description of your hands-on SOC 2 audit preparation experience.

We are particularly interested in candidates who can demonstrate successful SOC 2 readiness projects and independently lead security compliance discussions with healthcare clients.

Come Back Agency helps US software and technology companies run their hiring process. We work with delivery and leadership teams to define roles, screen candidates, and manage interviews. Successful candidates are hired directly by the company and become part of its team.

This position is with a US-based software company providing custom development and AI implementation for North American clients. The team builds and maintains production software, including AI-enabled systems, and works in long-term client engagements. Team members operate as part of an internal, distributed team and collaborate directly with client stakeholders.

About the Role

As we scale our operations to meet enterprise demands, we are looking for a driven DevSecOps Engineer who can help harden our cloud infrastructure, elevate our security posture, and drive compliance readiness. In this role, you’ll play a pivotal part in helping us pass enterprise vendor reviews and achieve key certifications like SOC 2 and ISO 27001. You will work closely with cross-functional engineering and leadership teams spanning infrastructure, security, and compliance.

What You Will Do

• Infrastructure & CI/CD: Build, scale, and maintain secure cloud infrastructure and automated CI/CD pipelines.
• Access & Security: Implement robust access controls, least privilege principles, secrets management, and security hardening across environments.
• Observability & Auditing: Standardize logging, monitoring, alerting, and comprehensive audit trails.
• Secure SDLC: Drive secure software development lifecycle practices, including code scanning, dependency scanning, and change control.
• Incident Response: Establish baseline incident response procedures, including runbooks, on-call expectations, and structured post-incident reviews.
• Compliance Readiness: Take ownership of technical controls and evidence gathering for SOC 2 and/or ISO 27001 frameworks.
• Vulnerability Management: Maintain proactive vulnerability patching routines for infrastructure and dependencies.
• Reliability & Recovery: Enhance backup, disaster recovery, and business continuity practices.
• Client Security Support: Respond to client security questionnaires and support audits with clear technical answers and evidence.

Requirements

• Experience: 2+ years of hands-on DevOps experience managing cloud infrastructure and deployment pipelines.
• Cloud & IaC: Strong practical experience with AWS (IAM, networking, compute, logging) and Terraform (Infrastructure as Code).
• Containers & GitOps: Hands-on experience with Kubernetes (Amazon EKS preferred), Helm, and GitOps workflows (ArgoCD or similar).
• CI/CD: Experience building and configuring CI/CD pipelines from scratch (e.g., Bitbucket Pipelines, GitLab CI, GitHub Actions).
• Security & Compliance: Familiarity with modern security tooling (SAST, DAST, dependency scanning, secret scanning), combined with hands-on experience in SOC 2 and/or ISO 27001 compliance preparation (controls implementation, gap analysis, and evidence collection using Security Hub or similar cloud security tooling).
• Documentation & Process: Strong ability to document systems clearly and collaborate effectively with auditors or compliance platforms.
• Communication: B2+ English level (upper-intermediate or higher) for seamless daily collaboration with US-based client stakeholders.

Nice to Have

• AWS certifications (e.g., DevOps Engineer - Professional or SysOps Administrator Associate).
• Experience with compliance automation tools such as Vanta, Drata, or Secureframe.
• Background working in regulated industries (e.g., HIPAA).

What We Offer

• Working hours aligned with US time zones, typically 16:00–23:59 Kyiv time.
• Company-sponsored English lessons to support clear and confident communication.
• Paid vacation and sick days.
• Fully remote work.
• Opportunities for professional growth within the team.
• Structured, personalized onboarding to help you ramp up effectively.

Apply with your resume and a short note outlining your relevant experience. You can also submit it through our website at comeback.ua. Selected candidates will be contacted by Come Back Agency.

Security Engineer

Work Type: Full-Time, Remote

We are a parent company developing two AI-powered platforms focused on business budgeting, financial management, payments, and financial infrastructure.

We are looking for a hands-on Security Engineer to help protect our platforms, infrastructure, and internal systems.

What You'll Do

• Monitor, investigate, and respond to security threats and incidents.
• Identify vulnerabilities and recommend security improvements.
• Manage security monitoring, detection, and response systems.
• Review cloud infrastructure, networks, and applications for security risks.
• Support incident response, remediation, and security projects.

• Work closely with our engineering and infrastructure teams to strengthen security.

   

Must Have

• 3+ years of cybersecurity, security operations, or security engineering experience.
• Strong understanding of networking, TCP/IP, DNS, VPNs, and firewalls.
• Experience with Windows and Linux security.
• Knowledge of SIEM, EDR/XDR, and security monitoring tools.
• Understanding of cloud security (AWS, Azure, or GCP).
• Familiarity with identity management, access controls, and Zero Trust principles.
• Good English communication skills.

Nice to Have

• Python, PowerShell, or security automation experience.
• Experience with penetration testing or vulnerability assessments.
• FinTech, payments, or financial infrastructure security experience.
• Relevant cybersecurity certifications.

What We're Looking For

Someone proactive, technically strong, and detail-oriented who can take ownership of security issues, investigate threats, and continuously improve our security infrastructure.

The Role

The Security Engineer starts primarily in managed detection and response (MDR). On a normal day, the focus is detecting, investigating, and responding to security events. When project work requires additional engineering capacity, the engineer may be moved to support project work. When a significant cybersecurity incident occurs - whether for a client or internally - incident response becomes the priority and the broader security team participates as needed, regardless of normal schedules.

What You Will Do

• Investigate security alerts and events and determine whether activity is benign, suspicious, or requires escalation.
• Participate in detection and response operations, including guided containment and remediation decisions.
• Analyze security issues and recommend remediation or configuration changes; early in the role, changes are performed under guidance rather than independently.
• Work with logs and telemetry from endpoints, operating systems, networks, identity systems, cloud environments, and security platforms.
• Participate in client and internal cybersecurity incidents as part of the incident response team.
• Contribute to cybersecurity projects when assigned, learning the required technology as part of the project.
• Analyze internal and client security environments and make practical security recommendations under guidance.
• Grow into broader engineering responsibilities as your technical capability and interests develop.

Core Technical Foundation

We do not expect one person to know every security product. We care more about a strong technical foundation and the ability to understand how technologies fit together.

• Strong understanding of TCP/IP and computer networking. Networking knowledge is fundamental to this role.
• Intermediate knowledge of Windows and Linux administration and security, including how systems are secured and hardened without relying only on security tools.
• Solid understanding of core cybersecurity concepts, threats, controls, detection, and response.
• Working understanding of firewalls, network perimeter security, and modern security architecture concepts such as Zero Trust.
• Ability to reason through unfamiliar technical problems and learn new technologies quickly.
• Prior security operations, systems administration, network administration, or security engineering experience.
• Experience with any SIEM, EDR/XDR, log collection, or security monitoring platform.
• Active Directory, Microsoft Entra ID, identity management, or identity security experience.
• Cloud infrastructure or cloud security experience.
• Communication is in English – B1+ English level is required

Experience That Is a Plus

• Scripting or automation experience, such as PowerShell, Python, or similar technologies.
• Relevant technical certifications. Strong certifications in foundational technologies are valuable; we do not require a specific cybersecurity certification.

What Matters Most

• Responsibility and ownership – you take ownership of assigned work, follow it through to completion, communicate when something is blocked or unclear, and make sure important issues do not fall through the cracks.
• Curiosity - when something looks unusual, you want to understand why.
• Creativity - you can think beyond a checklist when an investigation does not follow an obvious path.
• Investigative mindset - you keep digging until the situation is understood and you are comfortable that the environment is secure.
• Attention to detail - small technical details can change the meaning of a security event.
• Learning ability - how quickly you comprehend new technologies and apply what you learn will directly influence how quickly you grow.
• Initiative and engagement - you are interested in the technology and the problem, not simply completing a queue of assigned tasks.

Training and Career Growth

This is a growth-oriented position. The initial concentration is detection and response. From there, the career path is not predetermined. We want to develop each engineer around both capability and passion. Someone with strength in scripting and automation may grow in that direction; another engineer may become stronger in infrastructure, cloud, incident response, security engineering, projects, or client-facing work. With sufficient growth, the path can lead to senior engineering, project leadership, client management, and potentially virtual CISO responsibilities.

Working Model

• Fully remote position.
• Aligned with U.S. working core hours (9 am to 5 pm EST/EDT).
• Detection and response is a 24x7 company function; over time, shifts may become more flexible based on team coverage and what works for the engineer.
• Significant cybersecurity incidents are treated as team events and may require participation outside the normal schedule.
• Client communication is not expected from day one; it can become part of the role as the engineer develops.
• No travel requirement.

Smarter is a management company responsible for defining the overall strategy of investment activities and ensuring optimal management and development strategies for each business unit within the group. The main areas of activity and focus of our company include the international fintech community SFORS (https://sfors.com), the brokerage company Statok (https://statok.global), and the product company Pine Software (https://pinesoftware.com.cy)

The Head of Security is responsible for the comprehensive protection of the Group’s and the Owner’s assets, information, and interests by establishing an integrated security system—encompassing financial-economic, information, internal, and physical security—that minimizes the risks of loss, fraud, and external threats while supporting the stability and value growth of the asset portfolio.

Responsibilities

1. Corporate & Enterprise Security

• Developing, updating and implementing the company’s global security strategy in line with business objectives.
• Establishing an effective security governance framework and developing corporate security policies.
• Assessing, structuring and managing corporate risks (Enterprise Risk Management).
• Protecting the company’s physical, information, financial and reputational assets.
• Transforming and developing the security culture within the company.
• Advising the Executive Team and the Board on strategic security and risk-related decisions.

2. Physical Security & Crisis Management

• Organising comprehensive physical security for offices, sites, facilities and personnel.
• Monitoring and modernising access control systems, CCTV, security and emergency response systems.
• Developing and regularly testing crisis response scenarios (including those specific to martial law, relocation and blackouts).
• Management of travel security and executive protection processes (where required).

3. Personnel Security & Background Checks

• Organisation and automation of background verification processes for candidates, employees and third-party vendors.
• Assessment of potential reputational, compliance and fraud risks.
• Development and implementation of employee screening and insider risk management procedures (to prevent internal leaks and sabotage).
• Effective collaboration with the HR and Legal departments when resolving sensitive cases.

4. Fraud Prevention & Internal Investigations

• Designing and auditing systems to prevent fraud, corruption and internal misconduct.
•  Organising and conducting independent internal investigations.
•  Identifying conflicts of interest, industrial espionage, financial fraud and leaks of trade secrets.
•  Developing preventive controls and tools for monitoring operational risks.
•  Leading the Incident Response process (responding to security incidents).

5. Information Protection & Insider Risk Management

•  Ensuring the security aspects of processes involving the handling of confidential information and trade secrets.
• Developing and implementing measures to prevent insider threats.
• Monitoring compliance with internal requirements for handling sensitive information.
•  Participating in the investigation of information leaks, breaches of NDAs and other incidents related to human error.
•  Assessing security risks associated with counterparties, partners and third-party contractors.

6. Risk Management & Business Continuity

•  Developing and maintaining procedures for responding to security incidents.
•  Preparing and conducting training sessions, drills and crisis simulations.
• Coordinating actions during incidents relating to physical, personnel or corporate security.
• Participating in post-incident analysis and the development of corrective measures.
• Preparing recommendations to enhance the company’s preparedness for security threats.

7. Compliance & Governance

• Monitoring compliance with internal security policies and external compliance requirements.
• Fostering constructive collaboration with the Legal and Audit functions, government and law enforcement agencies, as well as external stakeholders.
• Participating in the development and oversight of policies relating to data protection, confidentiality (NDAs) and acceptable use.

• Preparing regular security reports and dashboards for executive leadership.

   

Job requirements

• Experience: At least 5 years in roles such as Head of Security, Director of Corporate Security or Enterprise Risk Manager within established organisations (mature mid-market or enterprise-level).
• Expertise: A deep understanding of how physical, operational, personnel and financial security function within a modern business.
• Management skills: Experience of building security processes, regulations and policies ‘from scratch’ or completely transforming them to suit the new scale of the business.
• Crisis management: Practical experience of incident handling and coordinating actions in stressful, uncertain situations.
• Business focus: Skills in engaging with executive stakeholders. The ability to defend budgets and decisions using the language of figures, risk analysis and business opportunities, rather than the language of ‘restrictions’.
• Technical literacy: An understanding of the basic principles of information security and modern digital risks. The ability to interact effectively with IT and other technical functions within the company.
• Personal qualities: An impeccable reputation, high ethical standards, emotional intelligence, well-developed strategic thinking and absolute discretion.

Nice to have

•  Experience of working in international companies or matrix organisations.
•  Experience of managing security in high-risk environments or geographically dispersed teams/branches.
•  Professional certifications (e.g. ASIS CPP, CISM, risk management or audit certifications).
•  Knowledge of international practices and standards in the field of corporate security, risk management and internal controls (ISO 31000, ISO 22301, ISO 27001 would be an advantage).
•  Experience of professional and effective interaction with law enforcement or military organisations.

Company offers

• Care from Day One — medical insurance from your first day, including dental care, massage, and professional psychological support.
• Work-Life Balance — 21 days of paid vacation + 30 days of paid sick leave.
• Knowledge Library — office books and access to the Kuka online library. 
• Investment in Your Energy — partial reimbursement for sports and fitness activities.
• Modern Workspaces with full power-backup infrastructure in Larnaca, Cyprus.
• Island Relaxation — up to 14 days per year at the company villa in Cyprus. 

‍

Join the Smarter team, where your talents and aspirations will be recognized! We offer a dynamic work environment, opportunities for professional growth, and support at every step of your career path. Start your journey to success with us—apply today and take the first step towards your bright future.

Smarter is an equal opportunity employer. We encourage applications from candidates of all backgrounds and experiences. Please note that only shortlisted candidates will be contacted. Thank you for considering Smarter as your next career move!!

✨ Welcome to WinMedia — Driving Innovation in iGaming Products! ✨
 

We build and develop product solutions in the iGaming industry 🎯. Our team works on in-house products, continuously improves internal processes, and uses data-driven approaches to make better decisions.

We are currently looking for an Anti-Fraud & Payments Manager who will take ownership of both the Anti-Fraud function and user payout operations. This is a hands-on role where you will build processes, develop risk and verification rules, oversee payout-related workflows, and ensure that user withdrawals are processed efficiently and safely.
 

📌 About the Role

We are looking for an experienced and proactive Anti-Fraud & Payments Manager to build and develop the Anti-Fraud and Payments function within our iGaming product company.

You will be responsible for user verification, fraud and risk assessment, payout checks, and the operational process of user withdrawals. You will decide when and how payouts should move forward, create and assign payout-related tasks, investigate suspicious cases, and continuously improve the rules and processes behind these operations.

This role combines Anti-Fraud expertise with ownership of the user payout process. You will work closely with Product, Customer Care, both VIP and Support teams, and other teams to make the verification and payout journey efficient, secure, and scalable.
 

🔨 Responsibilities

• Build and develop the Anti-Fraud & Payments function.
• Develop and implement rules, checks, and procedures for user verification, fraud detection, and payout processing.
• Review user activity and withdrawal requests, investigate suspicious cases, and make risk-based decisions.
• Take ownership of the user payout process, including creating, prioritizing, and assigning payout-related tasks.
• Identify fraud patterns, operational risks, and bottlenecks, and continuously improve related processes.
• Develop and maintain internal procedures, guidelines, and controls for Anti-Fraud and payouts.
• Monitor key metrics and ensure the verification and payout processes are efficient, secure, and scalable.
• Collaborate closely with Product, Support, VIP, and other teams to resolve cases and improve Anti-Fraud and payout workflows.
   

✅ Requirements

• 2+ years of experience in Anti-Fraud / Risk / Payments Operations, preferably in iGaming.
• Experience working with online casino / betting products is a strong advantage.
• Hands-on experience with user verification, fraud detection, and suspicious activity analysis.
• Strong understanding of common fraud scenarios, risk indicators, and detection methods.
• Practical experience with user withdrawals and payout processes.
• Understanding of how to assess and approve/reject payout requests based on risk and verification results.
• Experience building or significantly optimizing Anti-Fraud and/or payout processes.
• Experience working with tools such as Sumsub, KYCaid, Fingerprint.com, and similar solutions.
• Experience using AI tools in work processes is a strong advantage.
• Strong analytical and problem-solving skills with excellent attention to detail.
• Ability to make independent decisions and take ownership of operational processes.
• Ability to work with large amounts of information and prioritize cases effectively.
• Strong communication skills and the ability to collaborate with Product, Customer Care, VIP, and Support teams.
   

🎯 Ideal Candidate

• Has hands-on Anti-Fraud and/or Payments Operations experience in iGaming.
• Understands that the role is broader than traditional Anti-Fraud and is ready to own both risk and payout operations.
• Understands the specifics of users, deposits, withdrawals, and fraud risks in gambling products.
• Can independently develop a system of rules, checks, controls, and payout workflows.
• Is comfortable making decisions on individual cases while also thinking about the bigger process.
• Can build a structured and scalable process rather than simply following existing procedures.
• Takes full ownership of the Anti-Fraud & Payments function and is ready to develop it further.
   

🎁 What We Offer

💰 Competitive salary and financial incentives
🚀 The opportunity to build and develop the Anti-Fraud & Payments function
🎨 Freedom to make decisions and implement your ideas
📈 Professional and career growth opportunities
🌍 Flexible work setup
🤝 Work in a product-focused iGaming company alongside a professional team

About us:

ARRISE sets the benchmark for service delivery and excellence in the iGaming industry. Playing a key role in the success of its clients, which include Pragmatic Play, a brand relied upon by the world’s biggest online casinos for its cutting-edge products, ARRISE helps to deliver exceptional gaming experiences to millions of players worldwide. 

Our global team of talented and driven professionals are shaping the future of iGaming. Headquartered in Gibraltar, we have offices spanning Canada, India, the Isle of Man, Latvia, Malta, Romania, Serbia, Bulgaria, and the UAE, and more exciting destinations on the horizon. 

At ARRISE, we take pride in creating growth opportunities at all levels, constantly investing in our people while welcoming new colleagues and forging strategic partnerships that open new opportunities for success. 

To achieve this, we bet on ourselves. We know that success is a collective effort, and our team is driven by ambition, collaboration, and a shared commitment to grow and succeed—while embracing every step of the journey. 

Be part of the future of iGaming with ARRISERS! See a job that excites you? Apply now, and our friendly recruitment   team   will   connect   with   you   soon.   Your   journey   starts   here! 

About the Role 

We are seeking an experienced IT Compliance Specialist to lead and manage our compliance programs across ISO 27001 and SOC 2, ensuring our gaming platform and related services meet the highest standards of security, privacy, and regulatory compliance. The role will serve as the primary liaison for both external and internal auditors for ISO 27001 certification and SOC 2 attestation, with a focus on addressing scope changes, corporate structure changes, and responding to client security questionnaires. 

 
Key Responsibilities 

ComplianceManagement 

• Lead and maintain the company’s ISO 27001 Information Security Management System (ISMS) and SOC 2 Trust Services Criteria certification programs. 
• Serve as the primary point of contact for engaging with external and internal auditors, facilitating ISO 27001 certification and SOC 2 attestation processes. 
• Own compliance audits: plan, coordinate with auditors, collect evidence, and provide comprehensive audit responses. 
• Manage risk assessments, control testing, and remediation activities to ensure ongoing compliance. 

Policy & Process Governance 

• Develop, maintain, and enforce IT security and compliance policies, procedures, and standards. 
• Ensure documentation aligns with ISO 27001 Annex A controls, SOC 2 requirements, and addresses evolving compliance needs due to scope or structural changes. 
• Respond to client security questionnaires with accurate and detailed information to demonstrate compliance. 

Control Implementation & Monitoring 

• Oversee access control, change management, incident management, and third-party/vendor risk management within the scope of ISO 27001 and SOC 2. 
• Ensure compliance across environments supporting software development, hosting platforms, and APIs. 
• Monitor the effectiveness of security controls and recommend improvements to mitigate emerging risks. 

Audit & Assurance 

• Act as the central liaison for external auditors, regulators, and certification bodies, ensuring clear communication and issue resolution. 
• Conduct internal compliance audits, gap assessments, and readiness reviews to maintain certification readiness. 
• Track and close compliance findings and audit issues, ensuring timely resolution and documentation. 
• Provide expert guidance on compliance implications of ISO 27001 scope changes and corporate structure changes. 

Training & Awareness 

• Build awareness of compliance requirements across development, operations, and support teams. 
• Deliver targeted training on compliance obligations, including secure software development, data handling, and gaming industry standards. 
• Vendor & Third-Party Risk Management 
• Assess compliance of key vendors, including cloud hosting providers, content partners (e.g., Pragmatic Play), and integration providers. 
• Ensure contractual and SLA alignment with ISO 27001 and SOC 2 requirements. 
• Reporting 
• Provide regular compliance updates, risk posture reports, and responses to client inquiries to senior management and stakeholders. 
• Support management with compliance performance metrics and KPIs. 

Qualifications & Experience 

• Bachelor's degree in Information Security, Computer Science, Risk Management, or a related field. 
• 5+ years’ experience in IT compliance, GRC, risk management, or information security, ideally in gaming, fintech, or other regulated industries. 
• Strong understanding of: 
• ISO 27001:2022 Information Security Management System (ISMS) 
• SOC 2 Trust Services Criteria (Security, Availability, Confidentiality, Processing Integrity, Privacy) 
• Proven track record of leading certification and audit processes, including direct engagement with auditors. 
• Experience responding to client security questionnaires and communicating compliance status effectively. 
• Experience with SaaS/PaaS environments, APIs, and cloud-based hosting services. 
• Knowledge of secure SDLC, DevOps, and CI/CD compliance integration. 
• Professional certifications preferred (e.g., CISA, CISM, ISO 27001 Lead Implementer/Auditor, CCSK, CRISC). 

Key Skills 

• Excellent knowledge of IT compliance, audit, and risk frameworks, with expertise in ISO 27001 and SOC 2. 
• Strong communication and stakeholder management skills, with the ability to represent the company to auditors and clients. 
• Ability to influence cross-functional teams (dev, ops, support) to adopt compliance practices. 
• Analytical thinker with a problem-solving approach to compliance challenges, including scope and structural changes. 
• Detail-oriented with strong documentation, evidence management, and client questionnaire response skills. 

What we offer: 

• We offer a highly competitive salary 
• A detailed company training on highest standards 
• A chance to work in friendly and supportive culture 
• Tremendous growth opportunities in a large fast moving international company. 

RedCore is an international business group that creates technological solutions for digital markets. Our products and services cover fintech, marketing, e-commerce, customer service, communications, and regulatory technologies. 

We are looking for a Security Engineer!

Requirements:

- 3+ years of experience in security coordination, product security, project management, technical delivery, GRC, compliance, or similar roles
- Experience working with software development teams
- Understanding of SDLC, release management, product delivery, and engineering workflows
- Basic understanding of application security, penetration testing, vulnerability management and secure development practices
- Experience working with regulated products, preferably in fintech, payments, banking, crypto, cards or PSP environments
- Ability to coordinate multiple stakeholders across product, engineering, security, and compliance teams
- Experience with Jira, Confluence, or similar task management and documentation tools
- Ability to turn unclear security needs into structured tasks, owners, deadlines, and next steps
- Good understanding of risk-based prioritization

Will be a plus:

- Experience with PCI DSS, ISO 27001, SOC 2 or other security/compliance frameworks
- Experience with card payments, issuing, acquiring, crypto payments, wallets, payment gateways or transaction monitoring
- Basic knowledge of cloud security, API security, authentication, authorization and data protection
 

Responsibilities:

- Act as the main security point of contact for the FinTech department
- Work as a bridge between FinTech product and engineering teams and the central Cybersecurity team
- Understand FinTech products, payment flows, crypto-related features, card payment solutions, integrations, APIs, and release plans
- Participate in product, engineering and delivery meetings to identify security needs early
- Coordinate security activities required for new features, releases, integrations, and product changes
- Create and manage requests to internal security teams, including Application Security, Penetration Testing, Cloud Security, GRC and Compliance
- Track security tasks from request creation to closure
- Ensure that security reviews, threat modeling, code reviews, penetration tests, and compliance checks are planned and completed on time
- Help prioritize security requests based on product risk, business impact, regulatory requirements and release timelines
- Coordinate remediation of security findings with product and engineering teams
- Maintain visibility of open security risks, blockers, dependencies, and deadlines
- Support preparation for audits, partner due diligence, compliance reviews and regulatory assessments
- Help translate security requirements into clear and practical actions for product and engineering teams
- Improve the security request process between FinTech and Cybersecurity teams
- Maintain dashboards, trackers, or reports for security delivery status
Escalate delays, ownership issues, and critical risks when needed
- Support the central Cybersecurity team with operational, coordination, or documentation tasks when capacity allows

Our benefits to you:
🍀 An exciting and challenging job in a fast-growing business group, the opportunity to be part of a multicultural team of top professionals in Development, Architecture, Management, Operations, Marketing, Legal, Finance, and more
🤝🏻 A great working atmosphere with passionate experts and leaders, sharing a friendly culture and a success-driven mindset, is guaranteed
🧑🏻‍💻 Modern corporate equipment based on macOS or Windows, and additional equipment is provided
🏖️ Paid vacations, sick leave, personal event days, days off
💵 Referral program — enjoy cooperation with your colleagues and get a bonus
📚 Educational programs: regular internal training sessions, compensation for external education, attendance at specialized global conferences
🎯 Rewards program for mentoring and coaching colleagues
✈️ In-house Travel Service
🦄 Multiple internal activities: online platform for employees with quests, gamification, presents and news, clubs for movie/book/pets lovers, and more
🎳 Other benefits could be added based on your location

Important: after confirming your application on this platform, you’ll receive an email with the next step: completing your application on our internal site, LaunchPod. So keep an eye on your inbox and don’t miss this step — without it, the process can’t move forward.

Why join us

If you're looking for a place to grow, make an impact, and work with people who care, we'd love to meet you! :)

About the role

We are looking for a Python Application Security Engineer to automate application security controls and integrate secure coding practices into software development and cloud workflows.

The mandatory requirements are 3+ years of experience in software engineering and security, Python, AppSec tool APIs, CSPM, IaC/Terraform checks and independent execution; upper-intermediate English is required. SAST/DAST/SCA, AI security, threat modeling and Java are a plus.

Must haves

• 3+ years of experience combining software engineering experience, security implementation and/or architecture experience.
• Strong coding and architectural proficiency in Python (for security automation and scripting).
• Hands-on experience or familiarity with Wiz, Prisma Cloud, or similar tools for cloud security posture management and threat detection.
• Implementation experience with deploy-time checks against Infrastructure as Code (IaC) / Terraform.
• Implementation experience with runtime checks through Cloud Security Posture Management (CSPM).
• Fully autonomous execution capability, requiring no daily supervision to map out and build automated security runbooks.
• Upper-intermediate English level.

Nice to haves

• Deep, hands-on expertise deploying and tuning modern application security testing tools (SAST, DAST, SCA) and integrating them into complex CI/CD orchestration ecosystems.
• Experience integrating LLMs, AI agents, or automated coding assistants to streamline vulnerability triaging or secure code generation.
• Advanced application threat modeling experience.
• Ability to confidently read, review and secure enterprise source Java code.

What you will do

• AppSec Engineering & Automation: Engineer and deploy AI-enabled secure code scanning capabilities and "Golden Images" to drive secure-from-the-start adoption.
• Technical Modernization: Automate the development of secure coding patterns and integrate them with traditional and Agentic SDLC workflows.
• Security Tooling Integration: Architect the integration of continuous security scanning tools (SAST, DAST, SCA) into enterprise CI/CD pipelines, tuning them to eliminate noise.
• Cloud & Runtime Security: Implement runtime security checks via CSPM to maintain continuous cloud visibility and threat posture management.
• Developer Experience (DevEx): Act as a senior technical SME, reading and reviewing complex application code (Java/Python) to provide software engineers with highly specific, code-level remediation guidance.

The benefits of joining us

• Professional growth

Accelerate your professional journey with mentorship, TechTalks, and personalized growth roadmaps

• Competitive compensation

We match your ever-growing skills, talent, and contributions with competitive USD-based compensation and budgets for education, fitness, and team activities

• A selection of exciting projects

Join projects with modern solutions development and top-tier clients that include Fortune 500 enterprises and leading product brands

• Flextime

Tailor your schedule for an optimal work-life balance, by having the options of working from home and going to the office – whatever makes you the happiest and most productive.

Meet Our Recruitment Process

Asynchronous stage – An automated, self-paced track that helps us move faster and give you quicker feedback:

• Short online form to confirm basic requirements
• 30–60 minute skills assessment via Codility – a platform founded in Poland that helps us provide quicker feedback and streamline this stage of the process.
• 5-minute introduction video

Synchronous stage – Live interviews

• Technical interview with our engineering team (scheduled at your convenience)
• Final interview with your future teammates

If it’s a match — you’ll get an offer!

We are looking for an experienced Information Security GRC Manager to lead and develop our Information Security Governance, Risk & Compliance function.

This is a hands-on leadership role with the opportunity to shape the GRC operating model, roadmap, team, and core processes in a growing international FinTech environment.

You will work directly with the CISO and collaborate closely with Security, Legal, Risk, Procurement, IT, Engineering, Product, Platform, HR, and business teams.

The role combines security governance, cyber risk, regulatory assurance, third-party risk, policy management, and security awareness, with a strong focus on building practical controls and processes that support business growth.
 

Responsibilities

• Own and develop the Information Security GRC strategy, roadmap, operating model, and governance cadence
• Lead security governance, regulatory assurance, cyber risk, third-party security risk, policy lifecycle, and security-awareness oversight
• Establish clear ownership for security controls, risks, exceptions, evidence, and remediation actions
• Coordinate SOC 2, DORA/CySEC-related assurance, internal and external audits, and regulatory requests
• Maintain cyber-risk and exception registers and ensure material risks are treated, accepted, or escalated
• Lead security aspects of ICT supplier tiering, due diligence, reassessment, and high-risk supplier decisions
• Develop practical security policies, standards, controls, and guidance
• Ensure audit and assurance evidence is reliable, traceable, and reusable
• Track control gaps, findings, and remediation commitments and escalate material risks
• Partner with Security, IT, Engineering, Product, Platform, Legal, and business teams on control design and risk-based decisions
• Prepare concise GRC and risk reporting for the CISO and executive stakeholders
• Build, develop, and manage the GRC team, including responsibilities, goals, and performance expectations
• Improve GRC efficiency through automation, reusable evidence, better data quality, and responsible AI-assisted workflows
   

Requirements

• Strong practical experience in Information Security GRC, cyber/technology risk, security compliance, or assurance
• Hands-on experience with recognized frameworks such as SOC 2, ISO 27001, DORA, PCI DSS, NIST CSF, COBIT, or similar
• Experience establishing or operating security controls, risk registers, exception processes, and assurance programs
• Strong understanding of control design, operating effectiveness, evidence quality, findings, and remediation
• Experience coordinating internal or external audits and regulatory or assurance activities
• Practical experience with cyber risk assessment, risk treatment, risk acceptance, and escalation
• Understanding of third-party and ICT supplier security risk
• Ability to translate regulatory and security requirements into practical controls and processes
• Strong stakeholder management skills and ability to work effectively with technical, business, and executive audiences
• Sufficient technical understanding of cloud, infrastructure, identity, IT operations, and product development to work effectively with technical teams
• Experience leading a team, function, program, or complex cross-functional initiatives
• Strong ownership, prioritization, and decision-making skills
   

We Offer

• 20 paid vacation days per year
• 10 paid sick leave days per year
• Public holidays according to company policy
• Medical budget
• Remote work opportunity
• Professional education budget
• Language learning budget
• Wellness budget (gym membership, sports gear, etc.)

RedCore is an international business group that creates technological solutions for digital markets. Our products and services cover fintech, marketing, e-commerce, customer service, communications, and regulatory technologies.

We are looking for a Middle SecOps Engineer!  

Requirements: 
- 2+ years of professional experience in Security Engineering, Infrastructure Security, Cloud Security, DevSecOps, or a related role.
- Strong understanding of infrastructure and network security principles, including network segmentation, firewalls, access control, TLS, secure network configuration, and service-to-service
communication.
- Practical experience with Linux systems security and hardening.
- Experience conducting security audits, configuration reviews, vulnerability assessments, or compliance assessments.
- Good understanding of CIS Benchmarks and security hardening principles.
- Experience with vulnerability management, including vulnerability validation, prioritization, remediation tracking, and risk-based decision making.
- Experience with security monitoring / SIEM / security analytics tools.
- Understanding of security incident response processes and basic incident investigation techniques.
- Understanding of patch management and operating system vulnerability remediation processes.
- Experience with cloud infrastructure security, preferably AWS.
- Understanding of Kubernetes security and container security principles.
- Ability to read and understand infrastructure configurations, logs, security findings, and network flows.
- Basic understanding of Infrastructure as Code and security implications of infrastructure changes.
- Good understanding of security controls and their practical implementation rather than purely theoretical knowledge.
- English sufficient for reading technical documentation and communicating with international teams. 

Will be a plus:
- Experience with OpenStack security.
- Experience automating security checks and operational processes using Python, Bash, or similar scripting languages.
- Experience integrating security controls into CI/CD pipelines. 

Responsibilities: 
- Infrastructure Security Monitoring — continuously monitor infrastructure for security events, anomalies, misconfigurations, and potential threats.
- Infrastructure Security Audits — plan and conduct regular security audits of infrastructure, cloud environments, operating systems, networks, and security controls.
- CIS Compliance & Hardening Assessment — assess infrastructure against CIS Benchmarks and internal security baselines, identify gaps, and drive remediation.
- Vulnerability Management — monitor infrastructure vulnerabilities, validate findings, prioritize remediation based on risk, and track remediation progress.
- Security Findings Triage & Escalation — triage findings from security tools, audits, and monitoring systems; validate their severity and escalate critical issues according to defined SLAs.
- Security Posture Management — continuously assess and improve the security posture of infrastructure and track security improvement initiatives.
- Security Standards & Baseline Compliance — ensure infrastructure complies with approved security standards, baselines, and security requirements.
- Security Control Validation — verify that implemented security controls are properly configured and effectively mitigate the intended risks. 
- Security Risk Identification & Reporting — identify infrastructure security risks, assess their potential impact, and provide clear reports and recommendations to stakeholders.
- Data Security — ensure appropriate infrastructure-level controls are implemented to protect sensitive and business-critical data.
- Patch Management Monitoring & Compliance — monitor patch management processes, identify overdue or missing security updates, and work with infrastructure teams to ensure
timely remediation.

Our benefits to you:

☘️An exciting and challenging job in a fast-growing business group, the opportunity to be part of a multicultural team of top professionals in Development, Architecture, Management, Operations, Marketing, Legal, Finance, and more

🤝🏻Great working atmosphere with passionate experts and leaders, sharing a friendly culture and a success-driven mindset is guaranteed

🧑🏻‍💻Modern corporate equipment based on macOS or Windows and additional equipment are provided

🏖Paid vacations, sick leave, personal events days, days off

💵Referral program — enjoy cooperation with your colleagues and get the bonus

📚Educational programs: regular internal training sessions, compensation for external education, attendance of specialized global conferences

🎯Rewards program for mentoring and coaching colleagues

✈️In-house Travel Service

🦄Multiple internal activities: online platform for employees with quests, gamification, presents and news, clubs for movie / book / pets lovers and more

🎳Other benefits could be added based on your location 

SOFTSWISS is growing, and we are seeking a skilled Application Security Engineer to join our team. If you are driven by excellence and share our values, we would love to hear from you.
 

Purpose of the role:

Our goal is to make sure that we deploy secure software to production without unnecessary bottlenecks, that applications are properly hardened, and security vulnerabilities, once discovered, are fixed by the developers.

As an Application Security Engineer, you will play a crucial role in ensuring the security of our applications throughout the entire software development lifecycle (SDLC). You will partner closely with the product teams to identify, analyze, and mitigate security vulnerabilities, contributing to the creation of trustworthy and robust products.
 

Key responsibilities:

• Partner with product teams during the design phase to facilitate threat modeling and risk assessment sessions.
• Perform in-depth manual code reviews on critical applications to identify logical vulnerabilities as part of white-box security assessments.
• Tune and adjust rulesets for automated security scanning tools to reduce false positives and improve detection rates.
• Develop scripts and automation tools to streamline workflows and free up time for more complex analysis.
• Assist developers in understanding security risks and threats discovered during risk assessments, threat modeling, and dynamic testing.
• Triage vulnerabilities from the bug bounty program, collaborating with external researchers and internal engineering teams to resolve discovered flaws.
• Collaborate with Dev/QA teams throughout the development lifecycle to enhance the application's security posture by providing dedicated security consulting, continuous knowledge sharing, and actionable guidance.
• Develop and maintain the internal security knowledge base, including comprehensive secure coding guidelines and technical manuals for standard security features.

Required Experience:

• 5+ years of experience in application security, software development, or related technical roles.
• Solid understanding of web fundamentals (e.g., HTTP/HTTPS protocols, cookie storage mechanisms, and session management).
• Knowledge of web application security mechanisms and controls (e.g., SOP, CORS, CSP).
• Comprehensive understanding of common web vulnerabilities (e.g., OWASP Top 10) and their practical mitigation strategies.
• Knowledge of secure system and application architecture alongside secure-by-design principles.
• Practical, hands-on expertise in identifying vulnerabilities through manual security assessments and secure code reviews.
• Ability to clearly articulate and explain the business impact of identified threats and vulnerabilities to developers and product teams.
• A strong security-first mindset with a continuous drive to learn and achieve excellence in the cybersecurity field.
• University degree in Computer Science, Information Security, or a related field (or an equivalent combination of education and practical experience).
• High proficiency in English and Russian (B2 level or above) for effective technical communication.

Nice to have:

• Passion about programming.
• Technical knowledge of network and operating systems security.
• Hands-on DevSecOps experience.
• Practice of participation in bug bounty programs and/or CTFs.
• Knowledge of SAST/DAST tools, including customization.
• Relevant certifications (i.e., BSCP, eWPT, etc.).

Job Description

• 4+ years in DevOps / DevSecOps or software engineering with a strong security focus.
• Hands-on with CI/CD tooling (e.g. GitLab CI, GitHub Actions, Jenkins, Azure DevOps).
• Security scanning in pipelines: SAST, DAST, SCA, secrets scanning (e.g. Semgrep, Snyk, Trivy, OWASP ZAP).
• Infrastructure-as-Code (e.g. Terraform) and IaC security.
• Containers and Kubernetes security (Docker, K8s, image scanning, hardening).
• Cloud platforms (AWS / Azure / GCP) and cloud security fundamentals.
• Secrets management (e.g. HashiCorp Vault, cloud KMS) and IAM basics.
• Scripting and automation (Python, Bash) and Git.
• Familiarity with standards and frameworks: OWASP, NIST, CIS Benchmarks, ISO 27001.
• Understanding of and hands-on experience with different LLMs; ability to build AI agents; and knowledge of embedding LLMs into the SDLC and pipelines.
• Strong Linux skills (administration, hardening, command line, shell scripting).

• Nice to have: certifications (e.g. CKA/CKS, AWS/Azure Security, CISSP); pentesting or vulnerability-management exposure.

   

Job Responsibilities

• Build and maintain secure CI/CD pipelines; embed security gates (SAST, DAST, SCA, secrets scanning) into the build.
• Automate security testing and policy checks across the SDLC (shift-left).
• Implement Infrastructure-as-Code (IaC) security and secure baseline configuration.
• Manage secrets, keys and credentials (vaulting, rotation) across environments.
• Secure containers and Kubernetes (image scanning, hardening, runtime policies).
• Set up security tooling and route findings into developer workflows and dashboards.
• Define and enforce policy-as-code guardrails; track exceptions and drift.
• Support vulnerability management: triage, prioritize and follow remediation through pipelines.
• Work with developers and architects to embed security by design.
• Monitor, log and respond to pipeline and cloud security events; support incident response.
• Contribute to AI-assisted automation (LLMs/agents) for security tasks in the pipeline.
   

Department/Project Description

An enterprise technology group is building a dedicated security validation team focused on vulnerability assessment and security testing across the group's products and systems. The team runs structured testing campaigns: penetration testing, vulnerability discovery and triage, secure code review, and building automated test suites to make the process repeatable at scale.
The team also gets early access to specialized AI models and evaluates how they can accelerate security testing - an area we're actively investing in, though the core of the work remains hands-on security engineering. Scope covers internal systems as well as business-unit products across the group, agreed campaign by campaign. The team starts small and scales into a permanent capability.

We are inviting you, a highly motivated and results-oriented Incident Response & DFIR Lead to join our team on a full-time basis.

Our team has unique expertise in research, analysis, and product development. By relying on technical insights and a data-driven approach, we create disruptive future-defining innovations of the fin-tech industry that remain our basis for success.
 

Responsibilities

• Lead incident response, containment and forensic coordination for confirmed security incidents.
• Act as Incident Commander for major security incidents within the defined authority model.
• Assign incident roles and maintain clear ownership of investigation, containment and recovery actions.
• Maintain incident timelines, evidence logs, decision logs and action tracking.
• Coordinate investigation across endpoints, servers, identities, cloud platforms, SaaS environments and relevant network telemetry.
• Direct forensic collection and analysis required to determine attack path, scope, persistence and impact.
• Coordinate containment actions with IAM, Platform, IT, Security Engineering, Product and other technical owners.
• Recommend high-impact containment decisions to the Group Manager of Cyber Defense and CISO where required.
• Coordinate eradication and recovery activities and ensure systems return to a sufficiently trusted state.
• Ensure relevant evidence is preserved for Legal, HR, regulatory, disciplinary and post-incident requirements.
• Maintain practical forensic and evidence-handling standards.
• Develop and maintain incident playbooks, forensic checklists and containment procedures.
• Lead post-incident reviews and root-cause analysis.
• Ensure post-incident remediation actions have accountable owners, due dates and follow-up.
• Identify telemetry, detection and forensic-readiness gaps exposed during investigations.
• Convert investigation findings into recommendations for Detection Engineering, IAM, Security Engineering, Product Security and other control owners.
• Support incident exercises and readiness testing.
• Develop and mentor Incident Response / DFIR Specialists.
• Coordinate with external forensic, incident-response or specialist providers where required.
• Provide concise incident updates to Cyber Defense leadership, CISO and relevant stakeholders.
   

Requirements

• Strong hands-on knowledge of the incident response lifecycle: investigation, containment, eradication, recovery and lessons learned.
• Experience leading complex security incidents and coordinating multiple technical teams during active response.
• Practical experience investigating endpoint, identity, server, cloud or network compromise using EDR/XDR, SIEM and relevant audit logs.
• Ability to reconstruct attacker activity, including initial access, credential abuse, persistence, privilege escalation, lateral movement, data access and exfiltration.
• Working knowledge of digital forensics, evidence preservation, forensic timelines and chain-of-custody principles.
• Experience designing and validating containment actions such as endpoint isolation, account/session revocation, credential rotation, blocking indicators, network restrictions and service isolation.
• Experience with Microsoft Entra ID / Active Directory incident investigation.
• Understanding of common incident scenarios including ransomware, malware, phishing/BEC, account takeover, cloud/SaaS compromise, data exfiltration and insider misuse.
• Strong understanding of Windows, Linux, identity and enterprise networking from an investigation perspective.
• Ability to document technical findings, timelines, evidence, assumptions and containment recommendations clearly.
   

Will be a plus

• Hands-on experience with Cortex XDR, Elastic Security or equivalent enterprise platforms.
• Experience investigating AWS or other cloud environments.
• Experience with forensic tools such as Velociraptor, KAPE, Volatility, Autopsy, Magnet, EnCase, FTK or equivalent.
• Experience investigating ransomware, BEC, insider-threat or cloud-account-compromise cases.
• Experience developing or improving incident response playbooks and containment procedures.
• Experience running tabletop or cyber incident exercises.
• Experience working with Legal, Privacy, HR or regulators during security incidents.
• Experience managing external DFIR or incident-response retainers.
• Python, PowerShell or other scripting experience useful for investigation and evidence processing.
• Experience in fintech, payments, brokerage, trading, banking or another regulated environment.
• Relevant certifications such as GCIH, GCFA, GCFE, GNFA, OSCP, CISSP or equivalent (preferred, not mandatory).
   

We offer

• 20 paid vacation days per year
• 10 paid sick leave days per year
• Public holidays as per the company's approved Public holiday list
• Medical budget
• Opportunity to work remotely
• Professional education budget
• Language learning budget
• Wellness budget (gym membership, sports gear and related expenses)

We are looking for a Senior Compliance Manager who has personally built a compliance system, taken certifications through a successful audit, and kept them valid year after year. You will own the compliance and certification function across our healthcare products and our service organization — from certification strategy and policies to audits, corrective actions, and annual renewals. 

About the role: 

Langate is focused on the healthcare domain and develops its own healthcare products alongside its software development services. The company already holds ISO/IEC 27001 certification, confirmed at this year’s audit, and ISO 9001 certification is in progress — so you will not be starting from zero. We are now building a dedicated compliance function: about 70% of your time will go to certifying our healthcare products and about 30% to the company’s ongoing compliance processes and existing certificates. You will work closely with the manager who owns the compliance direction, with internal product owners, and with an experienced external audit partner the company has worked with for two years. 

Requirements:  

• Proven end-to-end experience building a compliance system and personally obtaining and maintaining certifications 
• Practical knowledge of ISO/IEC 27001 and ISO 9001, and a solid understanding of SOC 2, HIPAA, and GDPR 
• Strong expertise in policies, procedures, evidence and document control: approvals, signatures, versioning and review cycles 
• Systemic thinking: you define the right sequence, priorities, and dependencies and turn them into a realistic plan 
• Senior-level ownership and proactivity, strong attention to detail and confidence working with large volumes of documentation 

Will be a plus:  

• Experience in both product and service companies 
• Product certification experience 
• Exposure to the healthcare domain 
• Experience working with external auditors or certification partners 
• Practical use of AI tools or agents to automate compliance documentation work 

 
Responsibilities: 

• Assess the current state of compliance, identify gaps, and build a prioritized certification roadmap 
• Define the certification strategy and sequence for the company’s healthcare products and service organization 
• Write, update, and maintain policies and procedures; control document flow, approvals, signatures and versioning 
• Plan and run internal audits and prepare the company for external certification and surveillance audits 
• Manage audit findings and corrective actions through to verified closure 
• Keep existing certificates valid through annual audit cycles and renewals 
• Build a repeatable compliance approach that can be scaled across several products 
• Use AI tools and agents to analyze how new requirements affect policies, find documents that need updating or re-signing, and reduce manual work 
• Work with the external audit and certification partner 

We offer:  

• 20 working days of paid vacation per year 
• 7 paid sick days per year 
• Official Ukrainian public holidays are non-working days 
• Paid courses (50% compensation for an individual course once a year) and certifications 
• Corporate English lessons, including classes with a native speaker 
• Workshops and master classes 
• Coach and psychologist support 
• Online yoga classes with an instructor 
• Paid team-building events every two months 
• Mentoring programs 
• Medical insurance for employees in Ukraine 

Schedule: full-time, 5/2, 40 hours per week, working hours aligned with the Kyiv time zone (EEST). No dependency on US client hours. 

Why Choose Us? What Do We Offer that's Exceptional?    

1. Ownership and Real Impact: You will own the compliance and certification function end-to-end, with room to build and improve processes rather than only maintain paperwork. 
2. A Clear Healthcare Focus: The company concentrates on the healthcare domain instead of spreading across many industries, and your approach can be scaled across several products. 
3. AI-First Compliance: The company actively supports AI and agent automation to make compliance work faster and more reliable. 
4. Work-Life Balance with Benefits: We value work-life balance and offer paid vacation, paid sick leave, and official public holidays off. 
5. Investment in Your Growth: We're committed to your professional development. You can expect training programs, courses, and opportunities to enhance your English language skills.    
6. Team Building and Unity: We know that a happy team is a productive team. That's why we organize team-building events and group activities to foster strong bonds and a sense of belonging.    

When you choose us, you're choosing a company that values innovation, invests in its employees, and provides a supportive and engaging work environment. Join us in shaping the future of technology!