Jobs Security

Job Description

• 4+ years in DevOps / DevSecOps or software engineering with a strong security focus.
• Hands-on with CI/CD tooling (e.g. GitLab CI, GitHub Actions, Jenkins, Azure DevOps).
• Security scanning in pipelines: SAST, DAST, SCA, secrets scanning (e.g. Semgrep, Snyk, Trivy, OWASP ZAP).
• Infrastructure-as-Code (e.g. Terraform) and IaC security.
• Containers and Kubernetes security (Docker, K8s, image scanning, hardening).
• Cloud platforms (AWS / Azure / GCP) and cloud security fundamentals.
• Secrets management (e.g. HashiCorp Vault, cloud KMS) and IAM basics.
• Scripting and automation (Python, Bash) and Git.
• Familiarity with standards and frameworks: OWASP, NIST, CIS Benchmarks, ISO 27001.
• Understanding of and hands-on experience with different LLMs; ability to build AI agents; and knowledge of embedding LLMs into the SDLC and pipelines.
• Strong Linux skills (administration, hardening, command line, shell scripting).

• Nice to have: certifications (e.g. CKA/CKS, AWS/Azure Security, CISSP); pentesting or vulnerability-management exposure.

   

Job Responsibilities

• Build and maintain secure CI/CD pipelines; embed security gates (SAST, DAST, SCA, secrets scanning) into the build.
• Automate security testing and policy checks across the SDLC (shift-left).
• Implement Infrastructure-as-Code (IaC) security and secure baseline configuration.
• Manage secrets, keys and credentials (vaulting, rotation) across environments.
• Secure containers and Kubernetes (image scanning, hardening, runtime policies).
• Set up security tooling and route findings into developer workflows and dashboards.
• Define and enforce policy-as-code guardrails; track exceptions and drift.
• Support vulnerability management: triage, prioritize and follow remediation through pipelines.
• Work with developers and architects to embed security by design.
• Monitor, log and respond to pipeline and cloud security events; support incident response.
• Contribute to AI-assisted automation (LLMs/agents) for security tasks in the pipeline.
   

Department/Project Description

An enterprise technology group is building a dedicated security validation team focused on vulnerability assessment and security testing across the group's products and systems. The team runs structured testing campaigns: penetration testing, vulnerability discovery and triage, secure code review, and building automated test suites to make the process repeatable at scale.
The team also gets early access to specialized AI models and evaluates how they can accelerate security testing - an area we're actively investing in, though the core of the work remains hands-on security engineering. Scope covers internal systems as well as business-unit products across the group, agreed campaign by campaign. The team starts small and scales into a permanent capability.

Key tasks:

• Writing and maintaining up-to-date Information Security Management System (ISMS) documentation;
• Participating in information security incident investigations;
• Conducting internal information security audits;
• Supporting third-party penetration tests, supervisory audits, and certification processes;
• Managing access to company and/or customer systems (if necessary);
• Developing and delivering information security training;
• Implementing information security risk mitigation measures;
• Implementing new information security standards;
• Ensuring GDPR and privacy compliance (updating policies, conducting DPIAs, and data mapping);
• Managing third-party privacy risks and Data Processing Agreements (DPAs);
• Handling data breach protocols and Data Subject Access Requests (DSARs).
   

Core Competencies:

• Knowledge and understanding of network infrastructure;
• Understanding of Information Security Management System (ISMS) principles;
• Experience administering Active Directory-based domains;
• Knowledge of virtualization systems (e.g., VMware, Hyper-V);
• Knowledge of Linux-based servers (Ubuntu);
• Knowledge and understanding of PCI DSS, ISO 27001, and GDPR standards and compliance requirements;
• Practical knowledge of Data Protection principles (DPIA, data mapping, DPAs);
• Experience in developing regulatory and procedural documentation (concepts, policies, regulations, provisions, instructions, etc.);
• Knowledge of risk analysis methods, organizational and technical measures for information protection, as well as related technologies, software, and hardware tools;
• Knowledge and ability to apply best practices in the field of information security and data privacy;
• At least 1 year of professional experience in information security or data protection;
• English proficiency at B2 level.
  
   

We offer:

• Stable salary;
• Convenient work schedule: Monday to Friday, 9:00 AM — 6:00 PM;
• Comfortable working conditions: cozy office or remote work (subject to stable internet and electricity availability);
• Opportunities for growth and development in a dynamic company.

We are inviting you, a highly motivated and results-oriented Incident Response & DFIR Lead to join our team on a full-time basis.

Our team has unique expertise in research, analysis, and product development. By relying on technical insights and a data-driven approach, we create disruptive future-defining innovations of the fin-tech industry that remain our basis for success.
 

Responsibilities

• Lead incident response, containment and forensic coordination for confirmed security incidents.
• Act as Incident Commander for major security incidents within the defined authority model.
• Assign incident roles and maintain clear ownership of investigation, containment and recovery actions.
• Maintain incident timelines, evidence logs, decision logs and action tracking.
• Coordinate investigation across endpoints, servers, identities, cloud platforms, SaaS environments and relevant network telemetry.
• Direct forensic collection and analysis required to determine attack path, scope, persistence and impact.
• Coordinate containment actions with IAM, Platform, IT, Security Engineering, Product and other technical owners.
• Recommend high-impact containment decisions to the Group Manager of Cyber Defense and CISO where required.
• Coordinate eradication and recovery activities and ensure systems return to a sufficiently trusted state.
• Ensure relevant evidence is preserved for Legal, HR, regulatory, disciplinary and post-incident requirements.
• Maintain practical forensic and evidence-handling standards.
• Develop and maintain incident playbooks, forensic checklists and containment procedures.
• Lead post-incident reviews and root-cause analysis.
• Ensure post-incident remediation actions have accountable owners, due dates and follow-up.
• Identify telemetry, detection and forensic-readiness gaps exposed during investigations.
• Convert investigation findings into recommendations for Detection Engineering, IAM, Security Engineering, Product Security and other control owners.
• Support incident exercises and readiness testing.
• Develop and mentor Incident Response / DFIR Specialists.
• Coordinate with external forensic, incident-response or specialist providers where required.
• Provide concise incident updates to Cyber Defense leadership, CISO and relevant stakeholders.
   

Requirements

• Strong hands-on knowledge of the incident response lifecycle: investigation, containment, eradication, recovery and lessons learned.
• Experience leading complex security incidents and coordinating multiple technical teams during active response.
• Practical experience investigating endpoint, identity, server, cloud or network compromise using EDR/XDR, SIEM and relevant audit logs.
• Ability to reconstruct attacker activity, including initial access, credential abuse, persistence, privilege escalation, lateral movement, data access and exfiltration.
• Working knowledge of digital forensics, evidence preservation, forensic timelines and chain-of-custody principles.
• Experience designing and validating containment actions such as endpoint isolation, account/session revocation, credential rotation, blocking indicators, network restrictions and service isolation.
• Experience with Microsoft Entra ID / Active Directory incident investigation.
• Understanding of common incident scenarios including ransomware, malware, phishing/BEC, account takeover, cloud/SaaS compromise, data exfiltration and insider misuse.
• Strong understanding of Windows, Linux, identity and enterprise networking from an investigation perspective.
• Ability to document technical findings, timelines, evidence, assumptions and containment recommendations clearly.
   

Will be a plus

• Hands-on experience with Cortex XDR, Elastic Security or equivalent enterprise platforms.
• Experience investigating AWS or other cloud environments.
• Experience with forensic tools such as Velociraptor, KAPE, Volatility, Autopsy, Magnet, EnCase, FTK or equivalent.
• Experience investigating ransomware, BEC, insider-threat or cloud-account-compromise cases.
• Experience developing or improving incident response playbooks and containment procedures.
• Experience running tabletop or cyber incident exercises.
• Experience working with Legal, Privacy, HR or regulators during security incidents.
• Experience managing external DFIR or incident-response retainers.
• Python, PowerShell or other scripting experience useful for investigation and evidence processing.
• Experience in fintech, payments, brokerage, trading, banking or another regulated environment.
• Relevant certifications such as GCIH, GCFA, GCFE, GNFA, OSCP, CISSP or equivalent (preferred, not mandatory).
   

We offer

• 20 paid vacation days per year
• 10 paid sick leave days per year
• Public holidays as per the company's approved Public holiday list
• Medical budget
• Opportunity to work remotely
• Professional education budget
• Language learning budget
• Wellness budget (gym membership, sports gear and related expenses)

We are looking for a Senior Compliance Manager who has personally built a compliance system, taken certifications through a successful audit, and kept them valid year after year. You will own the compliance and certification function across our healthcare products and our service organization — from certification strategy and policies to audits, corrective actions, and annual renewals. 

About the role: 

Langate is focused on the healthcare domain and develops its own healthcare products alongside its software development services. The company already holds ISO/IEC 27001 certification, confirmed at this year’s audit, and ISO 9001 certification is in progress — so you will not be starting from zero. We are now building a dedicated compliance function: about 70% of your time will go to certifying our healthcare products and about 30% to the company’s ongoing compliance processes and existing certificates. You will work closely with the manager who owns the compliance direction, with internal product owners, and with an experienced external audit partner the company has worked with for two years. 

Requirements:  

• Proven end-to-end experience building a compliance system and personally obtaining and maintaining certifications 
• Practical knowledge of ISO/IEC 27001 and ISO 9001, and a solid understanding of SOC 2, HIPAA, and GDPR 
• Strong expertise in policies, procedures, evidence and document control: approvals, signatures, versioning and review cycles 
• Systemic thinking: you define the right sequence, priorities, and dependencies and turn them into a realistic plan 
• Senior-level ownership and proactivity, strong attention to detail and confidence working with large volumes of documentation 

Will be a plus:  

• Experience in both product and service companies 
• Product certification experience 
• Exposure to the healthcare domain 
• Experience working with external auditors or certification partners 
• Practical use of AI tools or agents to automate compliance documentation work 

 
Responsibilities: 

• Assess the current state of compliance, identify gaps, and build a prioritized certification roadmap 
• Define the certification strategy and sequence for the company’s healthcare products and service organization 
• Write, update, and maintain policies and procedures; control document flow, approvals, signatures and versioning 
• Plan and run internal audits and prepare the company for external certification and surveillance audits 
• Manage audit findings and corrective actions through to verified closure 
• Keep existing certificates valid through annual audit cycles and renewals 
• Build a repeatable compliance approach that can be scaled across several products 
• Use AI tools and agents to analyze how new requirements affect policies, find documents that need updating or re-signing, and reduce manual work 
• Work with the external audit and certification partner 

We offer:  

• 20 working days of paid vacation per year 
• 7 paid sick days per year 
• Official Ukrainian public holidays are non-working days 
• Paid courses (50% compensation for an individual course once a year) and certifications 
• Corporate English lessons, including classes with a native speaker 
• Workshops and master classes 
• Coach and psychologist support 
• Online yoga classes with an instructor 
• Paid team-building events every two months 
• Mentoring programs 
• Medical insurance for employees in Ukraine 

Schedule: full-time, 5/2, 40 hours per week, working hours aligned with the Kyiv time zone (EEST). No dependency on US client hours. 

Why Choose Us? What Do We Offer that's Exceptional?    

1. Ownership and Real Impact: You will own the compliance and certification function end-to-end, with room to build and improve processes rather than only maintain paperwork. 
2. A Clear Healthcare Focus: The company concentrates on the healthcare domain instead of spreading across many industries, and your approach can be scaled across several products. 
3. AI-First Compliance: The company actively supports AI and agent automation to make compliance work faster and more reliable. 
4. Work-Life Balance with Benefits: We value work-life balance and offer paid vacation, paid sick leave, and official public holidays off. 
5. Investment in Your Growth: We're committed to your professional development. You can expect training programs, courses, and opportunities to enhance your English language skills.    
6. Team Building and Unity: We know that a happy team is a productive team. That's why we organize team-building events and group activities to foster strong bonds and a sense of belonging.    

When you choose us, you're choosing a company that values innovation, invests in its employees, and provides a supportive and engaging work environment. Join us in shaping the future of technology!  

Position Name: Information Security Analyst
Reports to: Chief Information Security Officer
Location/Type: Remote (UA Candidates only)

Atlas Technica's mission is to shoulder IT management, user support, and cybersecurity for our clients, who are hedge funds and other investment firms. Founded in 2016, we have grown year over year through our uncompromising focus on service.

We value ownership, execution, growth, intelligence, and camaraderie. We are looking for people who share our Core Values, thrive, and contribute to this environment while putting the customer first. At Atlas Technica, we offer a competitive salary, comprehensive benefits, and great perks to our global Team. We strive to maintain a professional yet friendly environment while promoting professional and career development for our Team Members. Join Atlas Technica now!

We seek a skilled Information Security Analyst to join our rapidly growing organization. This is a highly technical role providing excellent career development opportunities for the successful candidate. You will be work closely with the Chief Information Security Officer (CISO) and various teams to maintain and improve the security posture of Atlas and its clients. As a new position, this role will evolve, providing opportunities for growth and adaptation.

Responsibilities:

Vulnerability Management:

• Review vulnerability reports.
• Research scalable solutions for vulnerability remediation.
• Collaborate with Support/NOC to ensure remediations have minimal impact on clients and facilitate maintenance windows.
• Work with CS/Engineering to script and automate remediations.
• Track progress in ticketing system, including master tickets for multi-client initiatives and sub tickets for individual clients.
• Address vulnerabilities for clients' third-party vulnerability management, including overlap with Cavelo, and apply remedies to other clients.

Risk Management and Due Diligence:

• Provide accurate and timely responses to Due Diligence Questionnaires (DDQs).
• Review and analyze findings from risk assessments and penetration tests for Atlas and clients.
• Address identified vulnerabilities and recommend remediation strategies.
• Participate in Business Impact Analyses and tabletop exercises to enhance organizational resilience.

Industry Benchmark Alignment and Standards Updating:

• Start measuring alignment with Microsoft benchmarks in Intune and work on increasing the score.
• Address vulnerabilities and issues identified in workstation builds, cloud infrastructure configurations, and security configurations.
• Harden systems to enhance security across workstations, cloud infrastructure, and security configurations.

SOC 2 Maintenance and Additional Security Tasks:

• Perform test restores.
• Conduct reviews of our KnowBe4 phishing tests and training.
• Review SIEM logs.
• Assist in addressing cybersecurity incidents.
• Work with NOC and outsourced SOC on remediation runbooks.
• Perform additional tasks as assigned to support the security team and organization

Requirements:

• Strong understanding of cybersecurity principles and practices.
• Experience with vulnerability management and remediation.
• Familiarity with Microsoft Intune and security benchmarks.
• Excellent analytical and problem-solving skills.
• Ability to work collaboratively with cross-functional teams.
• Strong communication skills, both written and verbal.
• Strong ability to work independently
• Experience with security tools (SIEM, IDS/IPS, vulnerability scanners)
• Experience with RMM/SOAR and other automation platforms.
• Experience scripting
• Experience writing runbooks.

Desirable Qualities:

• Experience working in an MSP environment (preferred, but not required)
• Relevant certifications (AZ-500, SC-900, SC-300, CompTIA Security+, etc.)

Metamindz is a UK-based technical consultancy - CTO-led software development, fractional CTO services, and technical recruitment for startups and scaleups across the UK, US, and Middle East. Every project is run by real developers and CTOs rather than non-technical account managers, so engineers here work directly on real products and real technical problems.

We're looking for a Chief Information Security Officer (CISO) to own and lead our client's global information security strategy, organization, and execution. The CISO will report directly to the CTO and work closely with Engineering, Platform, SRE, IT, Product, Data, AI, Legal, Privacy and the wider executive team.

This is a highly technical and hands-on security leadership role. It's not primarily about policies, audits, or certifications. We're looking for someone who can understand how systems actually work, identify the risks that matter, and build the technology, processes, teams and culture needed to manage those risks while allowing the company to move quickly.

Who we're looking for:

• 10+ years of experience in security roles, ideally within global software product companies
• 5+ years of significant security leadership experience in a technology, SaaS, marketplace, fintech, HR-tech or similarly data-intensive environment
• 2+ years of experience as a CISO or VP of Security in a global software technology company
• Strong technical security background with the ability to go deep into architecture, infrastructure, identity, applications, cloud and security incidents when required
• Experience leading security across both product technology and corporate IT environments
• Strong cloud security experience, particularly with AWS and/or GCP
• Strong understanding of IAM, SSO, MFA, privileged access, device trust and Zero Trust principles
• Deep product and application security experience, including threat modelling, secure SDLC, vulnerability management, security testing and supply-chain security
• Experience building or operating mature security operations and incident response capabilities
• Experience protecting environments containing significant volumes of personal or otherwise sensitive data
• Strong understanding of SaaS, third-party and supply-chain security risks
• Experience with ISO 27001, SOC 2, GDPR and enterprise customer security requirements
• Familiarity with AI security and emerging risks around LLM-based applications and AI agents
• Strong communication skills and the ability to translate technical security risks into clear business context
• Pragmatic and risk-driven approach - security should enable the business rather than become an unnecessary blocker
• Strong leadership and organizational skills, with the ability to decide what should be built internally, automated, or outsourced

What you'll work on:

• Owning global information security strategy, roadmap and security organization
• Defining measurable security objectives, KPIs, KRIs and risk-acceptance processes
• Building security into the software development lifecycle alongside Engineering rather than creating external approval gates
• Leading product and application security across threat modelling, architecture reviews, secure coding, SAST/DAST, dependency and supply-chain security, secrets management, vulnerability management, penetration testing and bug bounty programs
• Owning the security architecture of cloud infrastructure, including the ongoing migration from AWS to GCP
• Working across IAM, privileged access, network security, containers, infrastructure-as-code, encryption, logging, detection, data security and cloud security posture management
• Building and improving security operations, detection engineering, SIEM, incident response, investigations and security incident playbooks
• Leading security across the corporate technology environment, including identity, SSO/MFA, endpoint security, SaaS and device trust
• Moving the organization towards a practical Zero Trust model
• Building a scalable third-party and supply-chain security program based on actual exposure and business impact
• Establishing security controls for AI-powered products and internal AI usage, including LLM access, AI agents, prompt injection, data exfiltration, model/provider risk, logging and shadow AI
• Working with Legal and Privacy on GDPR, EU AI Act and other regulatory requirements while maintaining ownership of the underlying technical security controls
• Maintaining and evolving security programs such as ISO 27001 and SOC 2 Type II
• Providing the CTO and executive team with a clear and measurable view of the company's security posture and material risks
•  

Nice to have:

• Experience in HR-tech, workforce technology, marketplace, fintech or another data-intensive technology environment
• Experience leading a major cloud migration or transformation, particularly AWS to GCP

What we offer:

• A global CISO role with direct reporting to the CTO and significant ownership of the company's security strategy
• The opportunity to shape security across product, engineering, cloud infrastructure, corporate IT, data and AI
• A genuinely technical leadership position where you can engage directly with architecture, engineering and security problems
• The opportunity to lead security during a major cloud transformation from AWS to GCP
• The chance to build and scale a security organization rather than simply maintain an established security program

Requirements:

• 3+ years in IT security and compliance
• Extensive, practice-based knowledge of security management frameworks, such as ISO 27k series, GDPR, SOC2 etc.;
• Proven track record of IT security audits/projects implementation
• Ability to develop information security policies, setup ISMS and guidelines, implement CIS20 and derive security requirements from them;
• Understanding access modelling. Ability to develop access models and assess them. Understanding of segregation of duties
• Experience in IAM & SSO solutions. Understanding of purpose and approaches of IAM. Knowledge of key tasks: identify, authenticate, and authorize
• Good knowledge of risk management, its purpose, and approaches. Ability to evaluate risks and create a risks management plan
• Understanding OWASP Top 10. Ability to describe vulnerabilities, ways of exploitations, and fix methods
• Understanding and implemented of vulnerability & patch management. Knowledge in vulnerability scanners. Ability to validate scan results and provide recommendations
• Ability to develop and conduct security trainings and workshops
• Good level of professional English
• Good communication skills, responsible, initiative, self-organized, eager to learn
• Experience in Secure SDLC or AWS Security would be a plus
   

Responsibilities:

• Conduct security audits and consulting projects,  create an action plan & practical roadmap based on the audit results
• Develop and enhance an information security management framework to ensure business sustainability
• Build and maintain compliance guidelines. Create policies and standards for IT security and compliance
• Conduct general IT security awareness training for the company staff
• Evaluate and manage corporate risks related to IT security
• Build and maintain application-specific threat models, explicitly apply security principles to design
• Participate in the corporate certification and compliance activities
• Design and implement security architecture and detailed cybersecurity designs together with IT and software development departments
• Prepare and document standard operating procedures and protocols
• Cooperation with Account Management, Sales & Marketing, Legal, Delivery and Clients for all security-related topics (audits, contractual compliance, reviews, risk assessments, etc.)
• Keeping up to date with developments in IT security standards and threats

We are looking for an experienced Information Security Specialist to join our team. This is a hands-on position for someone who enjoys investigating security events, improving security tools, and working closely with both technical teams and business users.
 

You will contribute to the full security lifecycle—from prevention and detection to incident response and vulnerability management. The role offers a broad range of responsibilities, opportunities to work with modern security technologies, and the possibility to influence how security services and processes develop within the organization.
 

Main responsibilities

• Operate, configure, maintain, and optimize security platforms used for prevention, detection, incident response, and vulnerability management;
• Provide day-to-day security support to IT teams and business users;
• Analyze email threats, investigate phishing attempts, and manage email security controls and quarantine processes;
• Monitor security events, analyze logs, and correlate information from different sources to identify and respond to threats;
• Investigate security incidents, alerts, and security-related requests reported by users;
• Develop and improve security policies, standards, procedures, and operational documentation;
• Create security awareness materials and deliver information security training sessions;
• Review technical solutions, system architectures, and third-party agreements to ensure they meet security, regulatory, and compliance requirements;
• Work with vendors, service providers, IT teams, and other stakeholders to support and improve security services and technologies;
• Support security assessments, audits, risk management activities, and compliance initiatives;
• Identify and recommend new technologies and improvements that can strengthen the organization’s security posture.

Must-have requirements

• At least three years of hands-on experience in information security or cybersecurity;
• Experience implementing, administering, or maintaining security solutions in production environments;
• Practical knowledge of Windows and Linux operating systems, TCP/IP networking, and common security technologies and protocols;
• Experience with enterprise security platforms in areas such as:
  • Security monitoring
  • Identity and access management
  • Endpoint protection
  • Data protection
  • Vulnerability management
• Experience supporting security services and working with IT teams and business users;
• Good understanding of cybersecurity threats, attack techniques, security controls, and security operations;
• Ability to analyze security events and support incident investigation and remediation;
• Ability to analyze logs, investigate alerts, and correlate events from multiple sources;
• Basic scripting skills in PowerShell and/or Bash;
• Working knowledge of SQL and willingness to learn technologies such as Kusto Query Language (KQL);
• Professional proficiency in Ukrainian and English at B2 level or higher;
• Strong communication, analytical, and problem-solving skills.

Nice to have

• A degree in Computer Science, Information Technology, Cybersecurity, or a related field.
• Industry certifications such as CompTIA Security+, CEH, CISSP, Microsoft SC-200, or Microsoft SC-300.
• Experience with Kusto Query Language and Python.
• Familiarity with cloud security, especially Microsoft Azure security services.
• Knowledge of Polish.

This position gives you the opportunity to work across several areas of cybersecurity instead of focusing on only one tool or process. You will take part in real security operations, collaborate with different teams, and help improve the organization’s overall security maturity.
 

If you are proactive, curious, and ready to take ownership of security topics, we would be happy to hear from you.

 

We are looking for an experienced Application Security Engineer or Penetration Tester to help strengthen the security of our web and mobile applications.
This is a hands-on role that combines penetration testing, secure code review, security engineering, and collaboration with development teams. You will identify real security risks, recommend practical solutions, and help integrate security throughout the software development lifecycle.
 

Main responsibilities

• Plan, coordinate, and perform penetration tests of web and mobile applications;
• Conduct infrastructure security assessments and security audits.
• Identify vulnerabilities, threats, and security risks affecting web and mobile applications;
• Clearly communicate identified vulnerabilities, their business impact, and recommended remediation actions;
• Evaluate, recommend, and implement security solutions for web and mobile applications;
• Perform secure code reviews and provide practical guidance to development teams;
• Analyze security events and monitor the security posture of applications;
• Implement and maintain security standards and controls within the Secure Software Development Life Cycle;
• Integrate application security tools and security testing into CI/CD pipelines;
• Investigate security incidents and recommend remediation and preventive measures;
• Deliver training and awareness sessions on secure software development practices;
• Work closely with developers, engineering teams, and other stakeholders to improve application security.

Must-have requirements

• At least three years of professional experience as a Penetration Tester, Application Security Engineer, or Security Engineer;
• Hands-on experience conducting penetration tests of web and mobile applications;
• Experience identifying, validating, and assessing the impact of application security vulnerabilities;
• Ability to explain vulnerabilities, risks, and remediation recommendations to both technical and non-technical stakeholders;
• Practical experience performing secure code reviews;
• Basic proficiency in at least one programming language, such as C#, Python, or JavaScript;
• Strong understanding of the Software Development Life Cycle;
• Hands-on experience implementing or maintaining application security tools, including:
  • Static Application Security Testing (SAST)
  • Dynamic Application Security Testing (DAST)
  • Software Composition Analysis (SCA)
• Familiarity with integrating security controls and testing tools into CI/CD pipelines and Secure SDLC processes;
• Professional proficiency in Ukrainian and English at B2 level or higher.
• Strong analytical, communication, and problem-solving skills.

Nice to have

• Knowledge of security risks related to artificial intelligence and large language models;
• Hands-on experience testing or securing AI- and LLM-based solutions;
• Knowledge of Polish.

This role gives you the opportunity to combine offensive security skills with practical security engineering. You will not only identify vulnerabilities but also help teams fix them, improve development processes, and build more secure products from the start.
 

You will work across penetration testing, secure code review, security tooling, CI/CD, and Secure SDLC. If you enjoy solving complex security challenges and working closely with development teams, we would be happy to hear from you.

✨ Welcome to WinMedia — Driving Innovation in iGaming Products! ✨
 

We build and develop product solutions in the iGaming industry 🎯. Our team works on in-house products, continuously improves internal processes, and uses data-driven approaches to make better decisions.

We are currently looking for an Anti-Fraud & Payments Manager who will take ownership of both the Anti-Fraud function and user payout operations. This is a hands-on role where you will build processes, develop risk and verification rules, oversee payout-related workflows, and ensure that user withdrawals are processed efficiently and safely.
 

📌 About the Role

We are looking for an experienced and proactive Anti-Fraud & Payments Manager to build and develop the Anti-Fraud and Payments function within our iGaming product company.

You will be responsible for user verification, fraud and risk assessment, payout checks, and the operational process of user withdrawals. You will decide when and how payouts should move forward, create and assign payout-related tasks, investigate suspicious cases, and continuously improve the rules and processes behind these operations.

This role combines Anti-Fraud expertise with ownership of the user payout process. You will work closely with Product, Customer Care, both VIP and Support teams, and other teams to make the verification and payout journey efficient, secure, and scalable.
 

🔨 Responsibilities

• Build and develop the Anti-Fraud & Payments function.
• Develop and implement rules, checks, and procedures for user verification, fraud detection, and payout processing.
• Review user activity and withdrawal requests, investigate suspicious cases, and make risk-based decisions.
• Take ownership of the user payout process, including creating, prioritizing, and assigning payout-related tasks.
• Identify fraud patterns, operational risks, and bottlenecks, and continuously improve related processes.
• Develop and maintain internal procedures, guidelines, and controls for Anti-Fraud and payouts.
• Monitor key metrics and ensure the verification and payout processes are efficient, secure, and scalable.
• Collaborate closely with Product, Support, VIP, and other teams to resolve cases and improve Anti-Fraud and payout workflows.
   

✅ Requirements

• 2+ years of experience in Anti-Fraud / Risk / Payments Operations, preferably in iGaming.
• Experience working with online casino / betting products is a strong advantage.
• Hands-on experience with user verification, fraud detection, and suspicious activity analysis.
• Strong understanding of common fraud scenarios, risk indicators, and detection methods.
• Practical experience with user withdrawals and payout processes.
• Understanding of how to assess and approve/reject payout requests based on risk and verification results.
• Experience building or significantly optimizing Anti-Fraud and/or payout processes.
• Experience working with tools such as Sumsub, KYCaid, Fingerprint.com, and similar solutions.
• Experience using AI tools in work processes is a strong advantage.
• Strong analytical and problem-solving skills with excellent attention to detail.
• Ability to make independent decisions and take ownership of operational processes.
• Ability to work with large amounts of information and prioritize cases effectively.
• Strong communication skills and the ability to collaborate with Product, Customer Care, VIP, and Support teams.
   

🎯 Ideal Candidate

• Has hands-on Anti-Fraud and/or Payments Operations experience in iGaming.
• Understands that the role is broader than traditional Anti-Fraud and is ready to own both risk and payout operations.
• Understands the specifics of users, deposits, withdrawals, and fraud risks in gambling products.
• Can independently develop a system of rules, checks, controls, and payout workflows.
• Is comfortable making decisions on individual cases while also thinking about the bigger process.
• Can build a structured and scalable process rather than simply following existing procedures.
• Takes full ownership of the Anti-Fraud & Payments function and is ready to develop it further.
   

🎁 What We Offer

💰 Competitive salary and financial incentives
🚀 The opportunity to build and develop the Anti-Fraud & Payments function
🎨 Freedom to make decisions and implement your ideas
📈 Professional and career growth opportunities
🌍 Flexible work setup
🤝 Work in a product-focused iGaming company alongside a professional team

Ajax Systems is an international technology company and the largest security systems manufacturer in Europe. Ajax products are trusted by more than 4.5 million end users and 330,000 PRO users across over 180 countries. The company offers comprehensive solutions for protecting residential and commercial properties of various sizes. Today, the Ajax portfolio includes 280 devices for intrusion protection, video surveillance, fire safety, and comfort and automation. Every year, we demonstrate exponential growth both in the size of our team and in the number of users worldwide.

Ajax Systems operates a full-cycle production model, from idea generation and prototyping to mass production and global sales. Each department fully covers a specific operational need of the business. The company’s specialists are involved at every stage — from the production line in Ukraine to the logistics center in Poland, from where products are shipped to distributors worldwide.

Now we are looking for a hands-on Cyber Security Specialist to strengthen our security posture and operational resilience. You will be at the forefront of our cybersecurity defense, responsible for incident monitoring and investigation, the deployment and improvement of security solutions, and ensuring our corporate processes and infrastructure meets compliance standards. If you are passionate about building secure systems, incidents investigation and translating technical findings into efficient mitigation actions, this role is for you.

Key Responsibilities:

• Security systems support and improvements: Participate in security architecture improvement, provide support for the full lifecycle of security systems — from design and deployment to enhancement and technical support.
• Security Monitoring & Incident Response: Improve security monitoring processes and practices, participate in security events monitoring and triaging detected events. Develop and refine SIEM detection rules, investigate anomalies and identify root-cause of incidents, develop and execute mitigation plans to neutralize threats.
• Conduction Security Assessments: Conduct technical security assessments of corporate IT systems to identify compliance deviations and vulnerabilities. Participate in risks assessments, mitigation measures design and implementation.
• Compliance & Governance: Participate in improvement of security procedures, policies, and operational instructions. Collaborate with stakeholders on security processes implementation and improvement to ensure readiness for external security audits (e.g., ISO 27001, SOC2).
• Consultancy & Support: Partner with internal teams to define security requirements for new systems and solutions, provide expert guidance on implementing security controls. Participate in security requests processing, security awareness trainings preparation and conduction.
• Reporting & Strategy: Participate in preparation of reports for management, definition and description of security strategy.

Required Technical Skills & Qualifications:

• Experience: 5+ years in CyberSecurity with a strong focus on SOC operations and security systems implementation.
• Core Proficiency: Hands-on experience with SIEM systems (Splunk/QRadar/Logsign/Wazuh), MDM solutions (Jamf/Crowdstrike/JumpCloud/Zoho), EDR/XDR solutions (SentinelOne/ESET/Defender), Cloud security monitoring (M365, GWS, AWS), and Firewall/WAF technologies (Cisco/PaloAlto/Fortinet/Ubiquiti).
• Domain Knowledge: Strong understanding of On-Premise and Cloud architectures, network security protocols, endpoint and application security. Practical experience in industry security best practices implementation (CIS, OWASP, NIST).
• Security assessment: Practical experience performing IT systems and application security assessments and reports preparation.
• Security governance: Experience in preparation of security reports, procedures and instructions for reporting. Practical knowledge of ISO 27001 technological controls implementation.
• Language Proficiency: Intermediate (B1-B2) English level required for working with technical documentation, cross-regional communication with colleagues and partners.

Preferred Skills & Certifications:

• Certifications: Vendor-specific security certifications (e.g., Google, MIcrosoft, Cisco, Palo Alto PCNSE, Fortinet NSE) are highly valued.
• Frameworks: Practical knowledge of ISO 27001 organizational controls implementation.

Why Join Us:

• Impact: Take ownership of security projects from concept to deployment.
• Culture: Work in a “zero bullshit” environment that values technical excellence and autonomy.
• Growth: Access to corporate English training and professional development/certification support.
• Health care: medical insurance.
• Beta Access: Get hands-on experience with new Ajax security systems before they reach the market.
• Innovation: Help shape the future of “Made in Ukraine” reliability.

The Defense Procurement Agency (DOT) is a national agency responsible for procuring ammunition, UAVs, military equipment, fuel, food, clothing, and other critical supplies for the Armed Forces of Ukraine and the Defense Forces.

Our mission: Strengthening Ukraine by ensuring reliable support for the Defense Forces while fostering the development of the national defense industry.

Our vision: To become the driving force behind the transformation of Ukraine's defense procurement ecosystem—not only operating the system, but continuously improving it.

We are looking for a Tech Lead / Senior DevSecOps to provide technical leadership to the Security Engineering team, develop information security architecture, implement security solutions across the Microsoft ecosystem, and integrate security requirements into infrastructure and software development processes.

Responsibilities

• Provide technical leadership to the Security Engineering team, including prioritizing and distributing tasks, mentoring team members, and ensuring the quality of implementation.
• Design and develop information security architecture and key cybersecurity capabilities, including Cloud Security, Identity & Access Management, Vulnerability Management, DevSecOps, and Incident Response.
• Implement, administer, and develop security services across the Microsoft security ecosystem.
• Conduct security reviews of infrastructure, CI/CD pipelines, and Infrastructure as Code (Terraform).
• Collaborate with Infrastructure, DevOps, and Software Engineering teams to integrate security requirements into architecture and development processes.
• Develop the AI Security function, including AI Security Proxy, AI Governance, DLP, monitoring, and auditing.
• Develop technical security standards, guidelines, recommendations, and information security documentation.

Requirements

• Bachelor's or Master's degree in Cybersecurity, Information Technology, Computer Science, or a related field.
• 3+ years of experience in cybersecurity roles such as Security Engineer, Cloud Security Engineer, or DevSecOps Engineer, with hands-on experience in Azure Security and Microsoft Security.
• Hands-on experience securing cloud infrastructure in Microsoft Azure.
• Strong knowledge of Microsoft security services, including Defender XDR, Defender for Cloud, Sentinel, Intune, Entra ID, Purview, and related solutions.
• Experience building and developing Vulnerability Management processes.
• Strong understanding of modern DevSecOps practices, including CI/CD security, Infrastructure as Code (Terraform), SAST, DAST, Secret Scanning, and IaC Security.
• Hands-on experience securing containerized environments and Kubernetes.
• Experience with information security incident analysis and response.
• Previous technical leadership experience or strong Senior Security Engineer experience with the readiness to take on a Tech Lead role.

What We Offer

• Meaningful work that directly contributes to strengthening Ukraine's defense capabilities.
• Official employment with competitive salary and full social benefits.
• Professional development, learning opportunities, and career growth.
• Structured onboarding and dedicated mentorship.
• A collaborative, supportive, and mission-driven team.
• Modern office near the metro with reliable internet and equipped shelter.

By joining our team, you will contribute to one of Ukraine's largest digital transformation initiatives in the defense sector and help build the future of defense procurement.

Ready to make a real impact? We'd love to hear from you. Apply today!

* By submitting your CV, you consent to the processing of your personal data in accordance with applicable legislation.

** Due to the high volume of applications, only candidates whose qualifications best match the position will be contacted.

Who We Are 

PAR Retail, with its Open Commerce® product suite and patent pending Wallet Steering® System, empowers Convenience & Fuel Retailers to gain more share of wallet and customer lifetime value than possible with any other solution provider. PAR Retail’s unified Open Commerce product suite consists of: Activate for Intelligent 1:1 Loyalty, Transact for Contactless Commerce, and Experience for Cross-Channel Customer Experiences. PAR Retail’s solutions are supported by a set of subscription-based program management services and are contractually backed by its 1.5X Performance Guarantee. 

Requirements:  
- Operational knowledge of modern operating systems and networking; 

- Experience with common cloud services: AWS, GCP, and Azure; 

- Network Security and expertise in network pentesting; 

- Security testing of web applications, web services, mobile apps (hybrid and native), and IT infrastructure; 

- Understanding security certifications (PCI DSS / SOC2); 

- Ability to apply modern Application Security methodologies and frameworks; 

- Ability to use at least one modern programming language; 

- Practical experience with Burp Suite; 

- Experience with IDS, IPS, SIEM configuration; 

- Upper-intermediate English level. 

Responsibilities:  

- Requirements analysis, performing penetration testing and security audit; 

- BE, WEB, cloud and mobile clients testing; 

- Vulnerability reporting and remediation process; 

- Communication with development and project management teams; 

- Prepare security testing reports; 

- Prepare and support internal documentation for the project. 

PAR Retail Offers: 

- Long-term employment; 

- Competitive compensation with regular performance-based salary and career development reviews; 

- Paid vacations and sick leaves; 

- Health insurance program; 

- Flexible working hours; 

- Sponsored company educational program, corporate library; 

- Funny celebrations, team outings, and company events; 

- A unique and friendly environment where everyone can explore and learn new technologies. 

The Defense Procurement Agency (DOT) is a state-owned enterprise responsible for procuring military equipment, ammunition, UAVs, fuel, food, clothing, and other critical supplies for the Armed Forces of Ukraine and the Defense Forces.

Our mission: Strengthening Ukraine's defense capabilities by ensuring reliable procurement and supporting the development of the national defense industry.

Our vision: To become the driving force behind a modern defense procurement ecosystem built according to NATO standards.

We are looking for a Head of Information Security to lead and strengthen our Information Security function across governance, engineering, and security operations. This role combines strategic leadership with hands-on technical expertise, ensuring the continuous development of our Information Security Management System (ISMS), alignment with the NIST Cybersecurity Framework, and the organization's readiness to prevent, detect, and respond to cyber threats.

What You'll Accomplish (First 6–12 Months)

• Ensure continued NIST compliance for DOT Chain and define the roadmap for future security initiatives, including platforms such as Azure AI Foundry.
• Strengthen the security posture of IT Enterprise by implementing and maintaining NIST security controls, establishing regular risk assessments, exception management, and vulnerability remediation processes.
• Build a high-performing security organization with defined OKRs, KPIs, resource planning, and performance management.
• Enhance Azure-based Security Operations by improving monitoring, incident response, vulnerability management, identity governance, and RBAC.
• Lead Red Team and Purple Team exercises (including ransomware readiness and identity compromise scenarios) and translate findings into engineering improvements.
• Establish vendor security governance, including security assessments, NDA/SLA/DPA requirements, and third-party security audits.

Responsibilities

Leadership & Team Management

• Lead both Information Security Governance (ISMS, Risk & Compliance) and Cybersecurity Engineering & Operations.
• Manage, mentor, and develop the Information Security team through structured performance management, OKRs, and individual development plans.
• Collaborate closely with Engineering, IT, Product, and business stakeholders to prioritize security initiatives and protect critical services.

Governance, Risk & Compliance

• Develop and maintain security policies, standards, procedures, and risk registers.
• Lead internal and external security audits and coordinate remediation activities.
• Drive the organization's transition toward NIST-based security practices while maintaining alignment with ISO 27001 where required.
• Own Incident Response Plans (IRP), post-incident reviews, and continuous improvement.
• Ensure compliance with Ukrainian legislation related to information security and personal data protection.

Security Engineering & Operations

• Oversee enterprise security technologies, including:
• Microsoft Sentinel
• Microsoft Defender
• EDR/XDR
• SIEM
• DLP
• PAM
• IAM / Microsoft Entra ID
• MDM
• Lead incident monitoring and response activities.
• Manage vulnerability lifecycle from discovery through remediation.
• Improve identity security through MFA, PIM, Least Privilege, JML processes, Key Vault, secrets management, and centralized logging.
• Define and improve SOC processes, runbooks, SLAs, and operational metrics.

Application Security & Secure SDLC

• Strengthen application security throughout the software development lifecycle.
• Drive Threat Modeling, Security Architecture Reviews, DevSecOps practices, automated code scanning (SAST/DAST), SBOM generation, and CI/CD security.
• Integrate Red/Purple Team findings into engineering roadmaps and development practices.

Vendor Security

• Evaluate and audit third-party vendors integrated with DOT Chain.
• Establish and maintain supplier security requirements, including NDA, SLA, DPA, and third-party security assessments.

Strategy, Reporting & Budget

• Report regularly to executive leadership on security posture, KPIs, risks, vulnerability remediation, and incident readiness.
• Own the Information Security budget and define a 12–18 month security roadmap with prioritized initiatives and measurable business value.

Requirements

Experience

• 5+ years of experience in Information Security or Cybersecurity.
• 3+ years leading Information Security teams and security programs.
• Proven experience implementing enterprise Information Security strategies and governance.
• Hands-on experience with Red Team/Purple Team exercises, attack simulations, ransomware preparedness, and identity compromise scenarios.
• Strong experience implementing and maintaining NIST Cybersecurity Framework and/or ISO 27001.
• Experience building or managing Security Operations (SOC/SecOps), incident response, vulnerability management, and security monitoring.
• Strong Microsoft Azure security expertise, including:
• Microsoft Defender for Cloud
• Defender for Endpoint
• Defender for Identity
• Defender for Office 365
• Microsoft Sentinel
• Microsoft Entra ID
• Azure Key Vault
• Understanding of Secure SDLC, Application Security, DevSecOps, SAST/DAST, CI/CD security, Infrastructure as Code, and secret management.
• Experience securing .NET and PHP application environments is an advantage.

Technical Knowledge

• Strong practical knowledge of:
• NIST Cybersecurity Framework (CSF 2.0)
• NIST SP 800 Series
• ISO/IEC 27001
• Knowledge of Ukrainian regulations related to information security and personal data protection.

Leadership & Soft Skills

• Strong leadership, people management, and stakeholder management skills.
• Experience establishing KPIs, OKRs, and performance management frameworks.
• Ability to balance strategic governance with hands-on technical leadership.
• Excellent communication skills, including the ability to explain technical risks to executive stakeholders.
• Strong analytical thinking and decision-making skills.
• Zero tolerance for corruption.

Preferred Qualifications

• CISSP
• CISM
• ISO 27001 Lead Implementer or Lead Auditor
• Microsoft certifications such as SC-100, SC-200, SC-300, SC-400, or AZ-500.
• Experience working within government organizations or other highly regulated environments.

What We Offer

• Meaningful work that directly contributes to strengthening Ukraine's defense capabilities.
• Official employment with competitive salary and full social benefits.
• Professional development, learning opportunities, and career growth.
• Structured onboarding and dedicated mentorship.
• A collaborative, supportive, and mission-driven team.
• Modern office near the metro with reliable internet and equipped shelter.
• Opportunity to build and lead cybersecurity for one of Ukraine's most strategically important digital ecosystems.

By joining our team, you will contribute to one of Ukraine's largest digital transformation initiatives in the defense sector and help build the future of defense procurement.

Ready to make a real impact? We'd love to hear from you. Apply today!

* By submitting your CV, you consent to the processing of your personal data in accordance with applicable legislation.

** Due to the high volume of applications, only candidates whose qualifications best match the position will be contacted.

HighCraft is looking for an Application Security Engineer to assess a healthcare platform for practitioners and patients.

This is an ongoing remote, part-time contract, starting with a security assessment estimated at 40–60 hours. You will then provide security reviews and support as new features and integrations are developed.

What you will do

• Perform manual security assessments of web applications and APIs.
• Identify and validate vulnerabilities in authentication, access controls, business logic and data handling.
• Review security-sensitive changes and third-party integrations.
• Document findings with clear evidence, reproduction steps and practical remediation guidance.
• Work with developers to resolve security issues and retest fixes.

What we are looking for

• Hands-on experience independently testing authenticated web applications and APIs.
• Practical understanding of OWASP web and API security, authentication, authorization and multi-tenant applications.
• Ability to investigate and validate findings manually using HTTP requests and application behavior.
• Clear technical reporting and practical remediation guidance.
• Upper-Intermediate English (B2), with the ability to discuss findings with developers.

Experience with Burp Suite, .NET, Azure or healthcare systems is a plus.

To apply

Please include:

• Your relevant web/API security testing experience.
• Your expected hourly rate.
• Your weekly availability and earliest start date.
• A brief, anonymized example of a security issue you identified and how you documented it.