Jobs Security

WCC Technologies Group is a rapidly growing Managed Network Services Provider and technology consulting firm specializing in enterprise networking, Wi-Fi engineering, structured cabling, and physical security systems. We are seeking a Network Security Engineer with 5 years of hands-on experience who will support both pre-sales and post-sales consulting engagements, advising WCC customers on and delivering advanced firewall, SD-WAN, and SASE solutions across our K-12, municipal, and enterprise client base.

Job Responsibilities:

• Support the sales team in pre-sales consulting engagements by advising WCC customers on security requirements, recommending best-fit technologies, and designing firewall, SD-WAN, and SASE solutions.
• Design, configure, and deploy next-generation firewalls and secure network architectures using Palo Alto Networks (PAN-OS, Panorama), Fortinet (FortiGate, FortiManager), Cisco, and other leading platforms.
• Architect and implement SD-WAN and SASE solutions, including ZTNA, SWG, CASB, and cloud-delivered security services (e.g., Prisma Access, Cisco Umbrella, Fortinet SASE).
• Participate in customer discovery calls, RFP reviews, and requirements gathering, and help build Bills of Materials (BoMs) for firewall, SD-WAN, and SASE projects.
• Configure and troubleshoot advanced routing and switching environments, including BGP, OSPF, VLANs, and enterprise WAN/LAN architectures.
• Implement site-to-site and remote access VPNs, IPsec/GRE tunnels, and Zero Trust access policies across hybrid and multi-cloud customer environments.
• Perform security policy audits, firewall rule optimization, and vulnerability remediation to strengthen customer security postures.
• Support post-sales delivery for WCC customers, including staging, configuration, validation, on-site installation, and support during network cutovers.
• Create and maintain customer-facing technical documentation including network diagrams, firewall rule sets, configuration standards, and implementation runbooks.
• Serve as a client-facing technical resource, mentoring junior engineers and escalating/resolving complex customer security incidents as needed.

• Build and maintain network automation workflows and monitoring integrations using tools such as Ansible, n8n, Python, and platforms like Zabbix or PRTG to improve visibility and reduce manual effort.

   

Experience:

• 5 years managing enterprise network security platforms: Palo Alto Networks (PAN), Fortinet, Cisco, or similar.
• Strong knowledge of SD-WAN and SASE, including ZTNA, SWG, and CASB.
• Advanced routing and switching: BGP, OSPF, VLANs, spanning tree, enterprise WAN design.
• Hands-on experience with Panorama and FortiManager.
• Solid understanding of VPNs (IPsec, SSL/TLS), network segmentation, and Zero Trust.
• Familiarity with cloud networking (AWS, Azure, or GCP) — VPC/VNet peering, Transit Gateway, ExpressRoute.
• Strong troubleshooting skills: packet capture, log analysis, and monitoring tools like Zabbix, PRTG, SolarWinds, or LibreNMS.
• Experience with automation tools such as Ansible, n8n, Python, or Terraform.
• Exposure to AI-assisted network operations (AIOps) or AI-driven troubleshooting is a plus.
• Familiarity with IPAM/DCIM (e.g., NetBox) and ITSM tools (e.g., ServiceNow, Jira).
• Strong communication and documentation skills; able to manage multiple client-facing projects.
• Certifications such as PCNSE, Fortinet NSE 4-7, CCNP (Enterprise or Security), or CCIE are highly desired.

For our client in Berlin we are looking for Penetration Tester / Security Tester (m/f/d)

We are looking for an experienced Penetration Tester to perform security assessments of AI and Agentic AI platforms. 

Responsibilities include penetration testing of LLMs, AI agents, multi-agent systems, AI workflows, MCP implementations, APIs, cloud and infrastructure. Conduct AI Red Teaming, threat modeling, vulnerability assessments, and evaluate Prompt Injection, Jailbreaking, Data Leakage, Model Poisoning, RAG security, Tool Abuse, and Agent Exploitation. Collaborate with Engineering and Security teams, deliver security reports, and support secure-by-design AI.

Requirements: 5+ years in Penetration Testing/Security, mandatory OSCP, strong experience with LLM Security, AI Security Engineering, Agentic AI, OWASP Top 10, offensive security tools, web/API/cloud security, and excellent English. Nice to have: MCP Security, AI Red Teaming, AWS/Azure/GCP, OSEP, OSWE, GPEN, CISSP, CEH, German.

Project: ASAP – end of 2027

100% Remote, Full-time

English mandatory.

Location: EU and country near EU

Cloudfresh ⛅️ is a Global Google Cloud Premier Partner, Zendesk Premier Partner, Asana Solutions Partner, GitLab Select Partner, Hubspot Platinum Partner, Okta Activate Partner, and Microsoft Partner.

Since 2017, we’ve been specializing in the implementation, migration, integration, audit, administration, support, and training for top-tier cloud solutions. Our products focus on cutting-edge cloud computing, advanced location and mapping, seamless collaboration from anywhere, unparalleled customer service, and innovative DevSecOps.

We’re looking for a Google Cloud Security Engineer to harden client environments across GCP. You’ll implement and help design security controls, automate guardrails, improve detection & response, and guide stakeholders through pragmatic, risk-based decisions across EMEA.

Requirements:

• 3+ years proven, hands-on experience in a Security Engineer, SecOps (or similar) role.
• Strong knowledge of building and operating Security Porture, Edge protection, WAF, Endpoint security.
• Technical certifications related to CyberSecurity Google Cloud Solutions, Cloudflare and JumpCloud are an advantage.
• Experience of presentation, documentation.
• Excellent communication and strategic planning abilities, able to explain trade-offs, influence remediation, and drive adoption of guardrails.
• Basic scripting experience (e.g., Python, Bash, or gcloud CLI).
• Fluency in English.

Responsibilities:

• Design, implement, and operate security controls for internal needs and clients across.
• Perform cybersecurity audits.
• Configure and monitor Security Command Center, audit logs, and threat protection.
• Establish logging, detection and incident response.
• Assist clients with implementation of Cybersecurity products (Google Cloud Security Center, Google Workspace Security, Cloudflare, JumpCloud) and compliance controls.
• Generate security assessment reports and provide actionable recommendations.
• Continuously assess the landscape: track new Vendors features and update baselines to improve posture, reliability, and cost efficiency.

Work conditions:

• Competitive Salary & Transparent Motivation: Receive a competitive base salary with performance-based bonuses, providing clear financial rewards for your success.
• Flexible Work Format: Work remotely with flexible hours, allowing you to balance your professional and personal life efficiently.
• Training with Leading Cloud Products: Access in-depth training on cutting-edge cloud solutions, enhancing your expertise and equipping you with the tools to succeed in an ever-evolving industry.
• International Collaboration: Work alongside A-players and seasoned professionals in the cloud industry. Expand your expertise by engaging with international markets across the EMEA and CEE regions.
• Vibrant Team Environment: Be part of an innovative, dynamic team that fosters both personal and professional growth, creating opportunities for you to advance in your career.

When applying to this position, you consent to the processing of your personal data by CLOUDFRESH for the purposes necessary to conduct the recruitment process, in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 (GDPR).
Additionally, you agree that CLOUDFRESH may process your personal data for future recruitment processes. You can withdraw this consetn at any time.

Come Back Agency supports US software and technology companies by running their hiring process. We work with delivery and leadership teams to define roles, screen candidates, and manage interviews. Successful candidates are hired directly by the company and become part of its team.

This position is with a US-based software company providing custom development and AI implementation for North American clients. The team builds and maintains production software, including AI-enabled systems, and works in long-term client engagements. Team members operate as part of an internal, distributed team and collaborate directly with client stakeholders.

About the role

We are looking for an experienced DevSecOps / Security & Compliance Consultant for a 3–4 month contract.
 

The company already has two DevOps engineers responsible for the existing infrastructure. Your role will be to independently assess the company’s current security and compliance posture, create a practical SOC 2 and/or ISO 27001 readiness roadmap, coordinate the implementation of required controls, and prepare the company for an external audit.
 

What you will do:

• Conduct a security and compliance gap assessment
• Define a realistic SOC 2 and/or ISO 27001 readiness roadmap
• Map requirements to technical and organizational controls
• Configure and manage Vanta, Drata, Secureframe, or a similar compliance platform
• Define the required evidence and coordinate its collection
• Work with the existing DevOps engineers to implement AWS, IAM, logging, monitoring, backup, vulnerability management, and secure SDLC controls
• Prepare or improve security policies, risk registers, incident response procedures, access reviews, and business continuity documentation
• Support client security questionnaires and auditor requests
• Conduct a readiness review or mock audit
• Document remaining gaps and provide a clear handover plan
   

Requirements:

• Proven hands-on ownership of at least one SOC 2 or ISO 27001 readiness and audit cycle
• Experience implementing controls, collecting evidence, and working directly with auditors or external assessors
• Strong understanding of AWS infrastructure, IAM, logging, security, CI/CD, and vulnerability management
• Experience with Vanta, Drata, Secureframe, or similar compliance automation tools
• Ability to independently manage the compliance workstream and coordinate technical implementation with the internal DevOps team
• Strong documentation and stakeholder communication skills
• English at B2 level or higher

Apply with your resume and a short note outlining your relevant experience. You can also submit it through our website at comeback.ua. Selected candidates will be contacted by Come Back Agency.

Наш клієнт, Growe, провідна консалтингова компанія та група сервісів у сфері iGaming і розваг. Вони створюють стратегії, що працюють, та рішення, які масштабуються. 

Ідеально для тих, хто прагне:

• Сортувати, перевіряти та визначати пріоритети результатів перевірки безпеки, отриманих за допомогою інструментів сканування SAST, SCA та Secret, фільтрація хибнопозитивних результатів, оцінка ризиків та відстеження проблем до їх усунення;
• Проводити ручні та інструментальні перевірки коду для виявлення вразливостей безпеки та небезпечних варіантів реалізації до того, як код потрапить у Production;
• Проводити практичне тестування безпеки вебзастосунків, мікросервісів та API для виявлення вразливостей безпеки та недоліків у бізнес-логіці;
• Проводити аудит REST та GraphQL API та веб-додатків з акцентом на основні ризики безпеки додатків, аутентифікацію, авторизацію та бізнес-логіку.

Досвід, який стане твоєю перевагою:

• 2-4 роки досвіду роботи в Application Security, Product Security, or Penetration Testing;
• Практичний досвід сортування та аналізу результатів, отриманих за допомогою Semgrep/OpenGrep, Gitleaks, Trivy та OSV-Scanner;
• Досвід роботи з Burp Suite (Pro), Nuclei, Subfinder, SQLmap, Metasploit та NetExec;
• Розуміння класичних вразливостей OWASP Top 10, включаючи недоліки ін'єкцій (SQLi, Command Injection), підробку запитів на стороні сервера (SSRF), міжсайтовий скриптинг (XSS), підробку міжсайтових запитів (CSRF), порушений контроль доступу / незахищені прямі посилання на об'єкти (IDOR / BOLA), неправильні конфігурації безпеки, криптографічні збої, незахищену десеріалізацію та масове призначення;
• Знання OWASP API Security Top 10 для архітектур REST та GraphQL;
• Розуміння протоколів ідентифікації та механіки контролю доступу (OAuth 2.0, OIDC, JWT, SAML, RBAC/ABAC);
• Здатність виявляти складні обходи авторизації, недоліки управління сеансами та помилки бізнес-логіки;
• Середній рівень англійської мови (розмовний та письмовий).
• Здатність читати та аналізувати сучасний код додатків для виявлення недоліків безпеки (буде плюсом);
• Базове розуміння принципів хмарної безпеки в середовищах AWS та основ безпеки Kubernetes (K8s) (буде плюсом);
• Сертифікації BSCP, CWES, OSCP, CPTS (будуть плюсом).

Ми цінуємо:

• Сильні комунікативні навички для ефективної співпраці з командами інженерів, розробників продуктів та DevOps;
• Навички спрямованості на результат;
• Відкритість до навчання.

Наші клієнти пропонують конкурентні переваги для підтримки вашого професійного та особистого зростання, зокрема:

• Орієнтація на здоров’я та добробут;
• Глобальне медичне страхування;
• Можливості для зростання;
• Програми бенефітів (компенсація спорту / стоматології / психолога тощо);
• Бонуси за досягнення результатів;
• Динамічне робоче середовище.

English version:

Our client, Growe, is a leading business advisory and services group in iGaming and Entertainment. Сreators of strategies that work and solutions that scale. 

Perfect for those who aim to:

• Triage, validate, and prioritize security findings from SAST, SCA, and Secret scanning tools, filter out false positives, assess risks, and track issues through to remediation;
• Conduct manual and tool-assisted code reviews to identify security vulnerabilities, logic flaws, and insecure implementation choices before code reaches production;
• Perform hands-on penetration testing of web applications, microservices, and APIs to uncover security vulnerabilities and business logic flaws; 
• Audit REST and GraphQL APIs and web applications with a strong focus on core application security risks, authentication, authorization, and business logic.

Experience you’ll need to bring:

• 2-4 years of experience in Application Security, Product Security, or Penetration Testing; 
• Hands-on experience triaging and analyzing findings from Semgrep / OpenGrep, Gitleaks, Trivy, and OSV-Scanner;
• Experience with Burp Suite (Pro), Nuclei, Subfinder, SQLmap, Metasploit, and NetExec; 
• Deep understanding of classic OWASP Top 10 vulnerabilities, including Injection flaws (SQLi, Command Injection), Server-Side Request Forgery (SSRF), Cross-Site Scripting (XSS), Cross-Site Request Forgery (CSRF), Broken Access Control / Insecure Direct Object References (IDOR / BOLA), Security Misconfigurations, Cryptographic Failures, Insecure Deserialization, and Mass Assignment;
• Solid knowledge of OWASP API Security Top 10 for REST and GraphQL architectures; 
• Deep understanding of identity protocols and access control mechanics (OAuth 2.0, OIDC, JWT, SAML, RBAC/ABAC);
• Ability to identify complex authorization bypasses, session management flaws, and business logic bugs;
• Ability to read and analyze modern application code to spot security flaws (will be a plus); 
• Basic understanding of cloud security principles in AWS environments and Kubernetes (K8s) security fundamentals (will be a plus);
• Intermediate level of English (spoken and written);
• BSCP, CWES, OSCP, CPTS certifications (will be a plus).

It's a perfect match if you have those personal features:

• Strong communication skills to effectively collaborate with engineering, product, and DevOps teams;
• Result-oriented mindset;
• Openness to learning.

Our clients offer competitive benefits to support your professional and personal growth, including: 

• Health & Wellness Focus;
• Global Medical Coverage;
• Growth Opportunities;
• Benefits Programs (compensation for the gym/stomatology/psychological service & etc.);
• Performance-Driven Rewards;
• Dynamic Work Environment.

We’re hiring a DevSecOps Engineer who thrives in fast-moving environments, understands
technical depth, and can independently own security across multiple areas — from architecture and infrastructure to monitoring and investigations.

The role is ideal for someone who prefers deep thinking over surface-level “best practices”.
You’ll play a key role in securing our systems and eventually take ownership of technical implementation and decision-making.

The project is a high-load financial platform that acts as a payment processor for cryptocurrency and fiat transactions. The system utilizes integrations with blockchain networks and processes a high volume of requests within the cloud infrastructure.

Must-Have Skills:

• General Security Engineering: Multipurpose security engineer with broad security knowledge.
• Network Security: Understanding of network principles and network security.
• Cloud Security: Knowledge of cloud providers and cloud security.
• Kubernetes Security: Experience with Kubernetes, specifically how to secure Kubernetes, including knowledge of security policies, admission tasks, securing pods, and tools like Kyverno.
• DevOps Basics: Some basic DevOps knowledge, including CI/CD pipelines.
• Infrastructure as Code: Familiarity with tools like Terraform.
• Audit Infrastructure: Ability to implement audit infrastructure.
• DevSecOps: Familiarity with DevSecOps practices.
• Cryptographic Principles: Strong knowledge of cryptographic principles.
• Proactive Mindset: Proactive approach to security and problem-solving.
• Experience in FinTech or Web3: Experience in either FinTech or Web3 is acceptable; both are considered relevant backgrounds.

Nice-to-Have / Plus:

• Web3/Blockchain Security: Some knowledge of blockchain security, consensus protocols, or smart contract security (but not required).

We offer:

• Competitive compensation
• Social package (24 working days of annual leave, 5 paid sick days)
• Flexible working hours
• Challenging projects in diverse business domains and a variety of tech stacks
• Personal development and professional growth opportunities
• Work with talented, ambitious and family-feel teams
• Educational possibilities: corporate courses, knowledge hubs, and in-house English classes
• Compensation for your professional certification & support for your learning activities
• Opportunity to choose IT equipment you like
• Corporate social responsibility

About the Company & Product

We are a rapidly growing product company entering the global gaming entertainment market. Our mission is to bring innovative business solutions to the iGaming industry by developing cutting-edge technology products.

Our core product is a SaaS gaming platform made up of over 200 microservices, delivering a seamless gaming experience to millions of users worldwide. It provides a full suite of iGaming solutions, including game management, payments, analytics, CRM, and more.

Ready for a career upgrade?

As we continue to scale our platform, expand into new markets, and strengthen our security governance function, we are looking for an Information Security GRC Analyst with a strong technical mindset to join our team.

This is not a purely documentation-focused role. You will work closely with engineering, infrastructure, and business teams to understand how our platform operates in practice and help translate technical risks into effective governance and compliance processes.

As a company operating in the iGaming industry, many aspects of our business are subject to regulatory and licensing requirements across different jurisdictions. You will be directly involved in these processes — from preparing documentation and collecting audit evidence to analyzing regulatory requirements and participating in audits and certification activities.

You will report to the Security Lead and collaborate with engineering, DevOps, legal, and business teams to help build a mature, scalable, security-driven governance function.

What you’ll be doing

• Maintain and improve security and compliance frameworks ISO 27001, GDPR, and jurisdiction-specific licensing requirements;
• Own security policies, procedures, and documentation lifecycle: creation, versioning, and periodic reviews;
• Support internal and external audits: collect evidence, track findings, coordinate remediation;
• Conduct security risk assessments across systems, infrastructure, and cloud environments; maintain risk registers and control matrices;
• Run vendor security assessments and handle security questionnaires;
• Work with engineering and DevOps teams on vulnerability management tracking, prioritization, and remediation coordination;
• Collaborate with engineering to translate compliance requirements into real technical controls;
• Use AI tools to automate GRC workflows and actively look for ways to reduce manual work across the team;
• Support security awareness initiatives and incident response activities when needed.

You have these superpowers

• 2+ years in Information Security, GRC, or Compliance;
• Solid hands-on understanding of ISO 27001 and audit support;
• Good grasp of GDPR and security governance processes;
• Experience with risk registers, control matrices, policies, and compliance documentation;
• Experience running vendor risk assessments and handling security questionnaires;
• Good understanding of networking basics, OS-level security, IAM, and common attack vectors;
• Comfortable discussing cloud infrastructure and modern application environments with engineering teams;
• Familiarity with at least one security tooling area: SIEM, vulnerability scanners, or similar;
• Can read architecture diagrams and technical docs — not just compliance checklists;
• Actively uses AI tools (ChatGPT, Claude, Copilot, or similar) in daily work;
• Strong written communication, structured thinking, and ability to drive things forward independently.

Nice to have

• Experience in iGaming or familiarity with industry standards such as GLI-19 and GLI-33;
• Knowledge of AML / KYC requirements;
• Experience with SOC 2 or other compliance frameworks beyond ISO 27001;
• Familiarity with GCP, containerized environments, or Kubernetes from a security angle;
• Exposure to OSINT or threat intelligence practices;
• Familiarity with DevSecOps or security in CI/CD pipelines;
• Experience building simple AI-assisted automations (LLM APIs, no-code tools);
• Awareness of ISO/IEC 42001 and the EU AI Act.

What we offer:

Flexible schedule—work from home, the office, or hybrid.

Extra day off for your birthday—take a break any day within the month.

Competitive compensation that matches your skills.

Medical insurance (in Ukraine) and health support.

20 paid vacation days + an additional 15 personal leave days.

22 sick leave days, including mental health days.

Gifts and support for life’s key moments (wedding, childbirth, kindergarten).

Professional development—conferences, training, courses, and learning opportunities. We care about your comfort and help you maintain work-life balance!

What’s next?

• HR interview with a recruiter
• Technical interview
• Final interview
• Background Check
• If it’s a match — Offer

Feel like this is the right fit? Send your resume—we’re waiting for you!

Our Partner is building a monitoring and management platform for critical energy infrastructure, helping operators securely monitor and manage power plants and looking for a Senior Network Security Engineer who will take ownership of securing the intersection between IT and Operational Technology (OT).

Platform already has active customers, and they are now expanding the engineering team to improve scalability, security, and reliability while preparing for broader European market expansion.

Main Responsibilities

– Design and implement secure network architecture for critical infrastructure environments.

– Secure connectivity between power plants, PLC devices, and the central platform.

– Build and maintain secure remote access solutions (VPN, WireGuard).

– Configure and maintain network segmentation, firewalls, and security policies.

– Manage internal PKI and certificate lifecycle for services, VPNs, and industrial communication.

– Perform infrastructure security assessments and vulnerability management.

– Deploy and maintain monitoring, logging, IDS/SIEM solutions.

– Investigate and respond to security incidents.

– Collaborate with backend engineers, PLC engineers, and an external cybersecurity consultant to implement security best practices and comply with modern EU cybersecurity requirements (including NIS2).

Mandatory Requirements

– 5+ years of hands-on experience in Network Engineering, with a strong focus on Cybersecurity.

– Strong understanding of networking fundamentals and secure network architecture.

– Experience responding to real security incidents.

– Hands-on experience with enterprise networking and security technologies, including:

▫️MikroTik RouterOS

▫️Enterprise firewalls (Fortinet, Palo Alto, pfSense or similar)

▫️WireGuard or other VPN technologies

▫️PKI, TLS and certificate management

▫️Linux server hardening

▫️Vulnerability assessment and security hardening

▫️IDS/SIEM solutions (Wazuh, Suricata, Zeek or similar)

– Experience working in Operational Technology (OT), industrial environments,  other critical infrastructure — or a strong understanding of OT security principles.

– Strong English communication skills (B2+) — (technical documentation, cybersecurity standards, and collaboration with international teams)

Why join us

– Work on a product protecting critical energy infrastructure.

– Opportunity to build security architecture from the ground up.

– Exposure to modern European cybersecurity regulations (NIS2).

– High level of ownership and influence on technical decisions.

– Flexible, results-oriented culture with significant technical autonomy.

– Remote format.

– Salary: Competitive, depending on experience.

The Defense Procurement Agency (DOT) is a state-owned enterprise responsible for procuring military equipment, ammunition, UAVs, fuel, food, clothing, and other critical supplies for the Armed Forces of Ukraine and the Defense Forces.

Our mission: Strengthening Ukraine's defense capabilities by ensuring reliable procurement and supporting the development of the national defense industry.

Our vision: To become the driving force behind a modern defense procurement ecosystem built according to NATO standards.

We are looking for a Head of Information Security to lead and strengthen our Information Security function across governance, engineering, and security operations. This role combines strategic leadership with hands-on technical expertise, ensuring the continuous development of our Information Security Management System (ISMS), alignment with the NIST Cybersecurity Framework, and the organization's readiness to prevent, detect, and respond to cyber threats.

What You'll Accomplish (First 6–12 Months)

• Ensure continued NIST compliance for DOT Chain and define the roadmap for future security initiatives, including platforms such as Azure AI Foundry.
• Strengthen the security posture of IT Enterprise by implementing and maintaining NIST security controls, establishing regular risk assessments, exception management, and vulnerability remediation processes.
• Build a high-performing security organization with defined OKRs, KPIs, resource planning, and performance management.
• Enhance Azure-based Security Operations by improving monitoring, incident response, vulnerability management, identity governance, and RBAC.
• Lead Red Team and Purple Team exercises (including ransomware readiness and identity compromise scenarios) and translate findings into engineering improvements.
• Establish vendor security governance, including security assessments, NDA/SLA/DPA requirements, and third-party security audits.

Responsibilities

Leadership & Team Management

• Lead both Information Security Governance (ISMS, Risk & Compliance) and Cybersecurity Engineering & Operations.
• Manage, mentor, and develop the Information Security team through structured performance management, OKRs, and individual development plans.
• Collaborate closely with Engineering, IT, Product, and business stakeholders to prioritize security initiatives and protect critical services.

Governance, Risk & Compliance

• Develop and maintain security policies, standards, procedures, and risk registers.
• Lead internal and external security audits and coordinate remediation activities.
• Drive the organization's transition toward NIST-based security practices while maintaining alignment with ISO 27001 where required.
• Own Incident Response Plans (IRP), post-incident reviews, and continuous improvement.
• Ensure compliance with Ukrainian legislation related to information security and personal data protection.

Security Engineering & Operations

• Oversee enterprise security technologies, including:
• Microsoft Sentinel
• Microsoft Defender
• EDR/XDR
• SIEM
• DLP
• PAM
• IAM / Microsoft Entra ID
• MDM
• Lead incident monitoring and response activities.
• Manage vulnerability lifecycle from discovery through remediation.
• Improve identity security through MFA, PIM, Least Privilege, JML processes, Key Vault, secrets management, and centralized logging.
• Define and improve SOC processes, runbooks, SLAs, and operational metrics.

Application Security & Secure SDLC

• Strengthen application security throughout the software development lifecycle.
• Drive Threat Modeling, Security Architecture Reviews, DevSecOps practices, automated code scanning (SAST/DAST), SBOM generation, and CI/CD security.
• Integrate Red/Purple Team findings into engineering roadmaps and development practices.

Vendor Security

• Evaluate and audit third-party vendors integrated with DOT Chain.
• Establish and maintain supplier security requirements, including NDA, SLA, DPA, and third-party security assessments.

Strategy, Reporting & Budget

• Report regularly to executive leadership on security posture, KPIs, risks, vulnerability remediation, and incident readiness.
• Own the Information Security budget and define a 12–18 month security roadmap with prioritized initiatives and measurable business value.

Requirements

Experience

• 5+ years of experience in Information Security or Cybersecurity.
• 3+ years leading Information Security teams and security programs.
• Proven experience implementing enterprise Information Security strategies and governance.
• Hands-on experience with Red Team/Purple Team exercises, attack simulations, ransomware preparedness, and identity compromise scenarios.
• Strong experience implementing and maintaining NIST Cybersecurity Framework and/or ISO 27001.
• Experience building or managing Security Operations (SOC/SecOps), incident response, vulnerability management, and security monitoring.
• Strong Microsoft Azure security expertise, including:
• Microsoft Defender for Cloud
• Defender for Endpoint
• Defender for Identity
• Defender for Office 365
• Microsoft Sentinel
• Microsoft Entra ID
• Azure Key Vault
• Understanding of Secure SDLC, Application Security, DevSecOps, SAST/DAST, CI/CD security, Infrastructure as Code, and secret management.
• Experience securing .NET and PHP application environments is an advantage.

Technical Knowledge

• Strong practical knowledge of:
• NIST Cybersecurity Framework (CSF 2.0)
• NIST SP 800 Series
• ISO/IEC 27001
• Knowledge of Ukrainian regulations related to information security and personal data protection.

Leadership & Soft Skills

• Strong leadership, people management, and stakeholder management skills.
• Experience establishing KPIs, OKRs, and performance management frameworks.
• Ability to balance strategic governance with hands-on technical leadership.
• Excellent communication skills, including the ability to explain technical risks to executive stakeholders.
• Strong analytical thinking and decision-making skills.
• Zero tolerance for corruption.

Preferred Qualifications

• CISSP
• CISM
• ISO 27001 Lead Implementer or Lead Auditor
• Microsoft certifications such as SC-100, SC-200, SC-300, SC-400, or AZ-500.
• Experience working within government organizations or other highly regulated environments.

What We Offer

• Meaningful work that directly contributes to strengthening Ukraine's defense capabilities.
• Official employment with competitive salary and full social benefits.
• Professional development, learning opportunities, and career growth.
• Structured onboarding and dedicated mentorship.
• A collaborative, supportive, and mission-driven team.
• Modern office near the metro with reliable internet and equipped shelter.
• Opportunity to build and lead cybersecurity for one of Ukraine's most strategically important digital ecosystems.

By joining our team, you will contribute to one of Ukraine's largest digital transformation initiatives in the defense sector and help build the future of defense procurement.

Ready to make a real impact? We'd love to hear from you. Apply today!

* By submitting your CV, you consent to the processing of your personal data in accordance with applicable legislation.

** Due to the high volume of applications, only candidates whose qualifications best match the position will be contacted.

Our client is a global leader in AI-powered IT Service Management (ITSM), developing intelligent platforms that automate IT support processes and help organizations operate more efficiently. Their solutions are trusted by thousands of companies worldwide, simplifying complex IT operations and enabling teams to focus on strategic initiatives.

We are looking for a Senior Application Security Engineer with a strong software engineering background who has designed, developed, deployed, and maintained production systems before transitioning into application security. This role will serve as the security backbone of the R&D organization, ensuring security is embedded throughout the software development lifecycle and partnering closely with Engineering, DevOps, Architecture, and Product teams.

This is a highly visible, hands-on position reporting directly to the CISO, offering a clear growth path toward an Application Security Lead role and exposure to cloud security, AI security, and governance initiatives.

Who We're Looking For

• 5+ years of hands-on experience as a Software Developer, Backend Developer, Full-Stack Developer, or similar engineering role, with a proven track record of designing, building, shipping, debugging, and maintaining production software.
• Strong understanding of software development processes, engineering best practices, architecture, and SDLC methodologies.
• 2+ years of experience in Application Security, Product Security, or Secure SDLC, with a demonstrated transition from software engineering into security.
• Experience partnering closely with R&D and development teams, acting as a trusted security advisor who enables innovation while improving security posture.
• Hands-on experience implementing Secure SDLC practices within modern CI/CD environments (GitHub, GitLab, Jenkins, ArgoCD, or similar).
• Solid understanding of common application vulnerabilities, secure coding principles, OWASP Top 10, CWE/SANS Top 25, threat modeling methodologies (e.g., STRIDE, PASTA), and security architecture reviews.
• Experience with application security tools and practices, including SAST, DAST, SCA, secret scanning, and secure code review.
• Strong knowledge of API security and experience securing and testing REST and/or GraphQL APIs.
• Understanding of software supply chain security, including third-party dependency risks, SBOM concepts, open-source risk management, dependency confusion, and related attack vectors.
• Knowledge of cloud security fundamentals, preferably AWS, including IAM, containers/Kubernetes security, and Infrastructure as Code (Terraform or similar).
• Familiarity with SaaS and product company environments and the security challenges associated with cloud-native applications.
• Understanding of AI/LLM security risks, including prompt injection, data leakage, model abuse, agentic risks, and secure adoption of AI assistants within engineering and security workflows.
• Experience performing security-focused design, architecture, and threat modeling reviews.
• Excellent communication and stakeholder management skills, with the ability to influence teams without direct authority.
• Strong written and verbal English communication skills.

• Bachelor’s degree in Computer Science, Information Security, or a related field (or equivalent practical experience).

   

Role Focus

The primary focus of this role is the application security of the product.

Key responsibilities:

• Working closely with R&D teams on a daily basis.
• Helping developers build more secure products and adopt security best practices.
• Reviewing application designs and architectures from a security perspective.
• Identifying security risks in APIs, integrations, third-party libraries, and development processes.
• Managing vulnerabilities by analyzing, prioritizing, and supporting remediation efforts.
• Promoting and maintaining secure development practices across CI/CD pipelines.

• Applying and advocating security standards, frameworks, and industry best practices.

   

Nice to Have

• Penetration testing experience.
• Experience with bug bounty programs and vulnerability management.
• Strong knowledge of OWASP frameworks and methodologies.
• Hands-on experience with SAST, DAST, IAST, SCA, and secret-scanning tools.
• Cloud security experience (AWS, Azure, or GCP).
• AI / LLM security knowledge and practical experience.
• Security certifications such as CISSP, CSSLP, OSCP, OSWE, GWAPT, GPEN, CEH, GIAC certifications, or similar.

We are looking for a Cyber Defense Manager to lead, mature, and operate our resilient security operations capability. In this role, you will own the defense of our environment, ensuring fast and precise threat detection, investigation, containment, and exposure reduction. You will lead our security operations function, making the organization faster in responding to threats while continuously improving controls across the attack surface.

Responsibilities

• Own Cyber Defense execution across SOC, detection engineering, incident response, and exposure remediation
• Lead alert triage quality, escalation standards, incident command, and response coordination
• Prioritize critical vulnerabilities and exposures using asset criticality, exploitability, and business impact
• Manage Cyber Defense dashboards, runbooks, remediation follow-up, and operational metrics
• Coordinate with IT, Platform, IAM, Product, GRC, Legal, and business owners during incidents and remediation
• Build and develop the Cyber Defense team, including hiring, onboarding, mentoring, and retaining security talent
• Drive continuous improvement of detection coverage, response playbooks, and security controls based on lessons learned and threat intelligence
• Report on Cyber Defense performance, incidents, and risk posture to security leadership and stakeholders

Requirements

• 10+ years of experience in Information Security
• 3+ years in a security management or team lead role with direct people management experience
• Hands-on experience managing SOC operations, leading incident command, and driving MTTD/MTTR improvement
• Ability to design, validate, and maintain detection logic across SIEM, EDR, and cloud platforms, with a deep understanding of runbook development and false-positive reduction
• Knowledge of top attack scenarios (ATO, credential theft, privilege escalation, data exfiltration) and ability to map detections to threat models like MITRE ATT&CK
• Experience prioritizing vulnerabilities using CVSS and asset criticality to reduce exposure aging
• Hands-on experience with at least one enterprise SIEM (Splunk, Microsoft Sentinel, Chronicle, Elastic) and SOAR tooling
• Understanding of cloud-native security controls and monitoring in AWS, GCP, or Azure
• Understanding of IAM, PAM, SSO, and identity-related attack vectors relevant to detection and response
• Ability to define, track, and communicate security KPIs and operational dashboards to technical and executive audiences
• English - Upper-Intermediate or higher

Will be a plus

• Experience in fintech, e-commerce, or other high-risk industries with complex threat landscapes
• Hands-on background as a SOC analyst, incident responder, or detection engineer prior to moving into management
• Experience building a SOC or Cyber Defense function from scratch or significantly maturing an existing one
• Familiarity with threat intelligence platforms and threat-informed defense methodologies
• Relevant certifications: CISSP, CISM, GIAC (GSOM, GCED, GCIH) or equivalent

We offer

• 20 paid vacation days per year
• 10 paid sick leave days per year
• Public holidays as per the company’s approved Public holiday list
• Medical budget
• Opportunity to work remotely
• Professional education budget
• Language learning budget
• Wellness budget (gym membership, sports gear and related expenses)

We are looking for an Enterprise & Cloud Security Manager to lead and mature our enterprise security function across cloud, network, identity, endpoint, and data domains. In this role, you will own the design and enforcement of security guardrails across a hybrid environment. You will lead a team of security engineers, drive the evolution toward a cloud-first model, and track and report on enterprise security metrics.
 

Responsibilities
 

• Own and lead Enterprise & Cloud Security across cloud, network, identity, endpoint, and data domains
• Define and enforce enterprise security guardrails, approving low/medium-risk platform exceptions
• Lead CSPM/CNAPP/CWPP, WAF, DNS security, and IaC scanning across cloud environments
• Manage cloud IAM and security-group guardrails in close collaboration with Platform and SRE teams
• Operate and mature endpoint security (EDR/XDR/MDM) across managed devices, including hardening and telemetry health
• Own data security and cryptography controls: KMS, secrets management, PKI, and certificate lifecycle
• Lead, mentor, and develop a team of security engineers (4 direct reports — Cloud & Network, Endpoint, IAM, Data Security & Cryptography)
• Track, analyze, and report enterprise security metrics

Requirements
 

• 5+ years of experience in managing and developing security teams
• Proven track record in hands-on cybersecurity engineering roles
• Enterprise-level background
• Practical experience with on-premises environments
• Solid experience with networking
• Hands-on experience with cloud platforms
• Broad experience across cloud posture, network, identity, endpoint, and data protection security domains
• Experience with CSPM/CNAPP/CWPP tooling and cloud guardrails (WAF, DNS security, IaC scanning)
• Experience with cloud IAM and security-group/IaC security patterns
• Experience operating EDR/XDR and MDM solutions
• Experience with KMS, secrets management, PKI, and certificate management
• Ability to enforce security controls without unnecessarily blocking delivery for Platform/SRE/DevOps teams
• Upper-Intermediate English and higher

Will be a plus

• Higher education in Computer Science, Information Security
• Background in fintech, brokerage, trading platforms, payments, or other regulated environments
• Track record of building or maturing an enterprise/cloud security function from an early stage
• Familiarity with tools such as Wiz, Panorama, Elastic Defender, Entra, or CyberArk
• Knowledge of Kubernetes/container security and cloud-native architectures
• Exposure to SOC 2, ISO 27001, or DORA compliance frameworks

We offer

• 20 paid vacation days per year
• 10 paid sick leave days per year
• Public holidays as per the company’s approved Public holiday list
• Medical budget
• Opportunity to work remotely
• Professional education budget
• Language learning budget
• Wellness budget (gym membership, sports gear and related expenses)

About project

We are a Barcelona-based R&D center seeking Vulnerability Researchers/Security Researchers to join our team. The role focuses on hands-on vulnerability research, including finding and exploiting vulnerabilities in complex systems such as browsers, kernels, mobile and desktop operating systems. We offer full-time remote work as well as relocation opportunities to Barcelona. Flexible working hours are supported depending on productivity and time zones.

Your area of responsibility

• Detect, analyze, and exploit vulnerabilities;
• Conduct vulnerability research across browsers, kernels, mobile and desktop operating systems, and other complex software;
• Understand the technical details of vulnerabilities and assess their real impact;
• Develop exploits, proof-of-concept code, scripts, and software modules to validate vulnerabilities;
• Perform reverse engineering and binary analysis as part of vulnerability research;
• Reverse-engineer security patches to better understand vulnerabilities;
• Use fuzzing and other research techniques to discover vulnerabilities;
• Effectively communicate vulnerability findings and their technical impact;
• Assist in the development of tools for vulnerability and security research.

Skills and requirements

• Proven hands-on experience in vulnerability research and vulnerability exploitation;
• Experience in exploit development;
• Experience in finding vulnerabilities in complex systems;
• Experience with reverse engineering;
• Knowledge of OS internals;
• Knowledge of modern exploitation techniques;
• Experience researching at least one of the following areas: browsers, kernels, mobile OSes, desktop OSes, or embedded systems;
• Experience with platforms such as Windows, Linux, macOS, iOS, or Android;
• Ability to work independently in a remote environment;
• Availability for full-time work.

Will be a plus

• Published CVEs or other proven records of discovered vulnerabilities;
• Experience finding and exploiting vulnerabilities in browsers or OS kernels;
• Experience with fuzzing;
• Participation in CTFs, security competitions, or security conferences;
• Bug bounty or independent vulnerability research experience;
• Published security research, technical write-ups, PoCs, or research tools;
• Offensive security background;
• Academic degree in Computer Science, Mathematics, or Physics.

We offer

• A real opportunity to influence the product, architecture, and technical decisions;
• Direct communication with C-level management, without unnecessary bureaucracy;
• Remote-first environment;
• Long-term and enjoyable cooperation;
• 20 paid working days of vacation per year;
• 5 paid undocumented sick days;
• Official public holidays as days off;
• Personal legal support;
• English classes;
• Team-building events and a friendly, supportive atmosphere.

We are expanding our Application Security team and need someone who is not only experienced but also shares our commitment to excellence.
 

Purpose of the role:

Our goal is to make sure that we deploy secure software to production without unnecessary bottlenecks, that applications are properly hardened, and security vulnerabilities, once discovered, are fixed by the developers.

As a Senior Application Security Engineer, you will play a crucial role in ensuring the security of our applications throughout the entire software development lifecycle (SDLC). You will partner closely with the product teams to identify, analyze, and mitigate security vulnerabilities, contributing to the creation of trustworthy and robust products.
 

Key responsibilities:

• Partner with product teams during the design phase to lead threat modeling and risk assessments sessions, translating complex security threats into clear, actionable security requirements.
• Perform in-depth manual code reviews on critical applications to identify complex logical vulnerabilities as part of white-box security assessment.
• Plan, design, implement, automate and (if you wish) support AppSec tools.
• Contribute to building a company-wide processes for secure code development and deployment.
• Triage identified security vulnerabilities, provide clear and actionable descriptions and ensure these findings are properly addressed and mitigated.
• Manage the bug bounty program, collaborate with researches and internal teams to resolve the discovered vulnerabilities.
• Partner with Dev/QA teams throughout the development lifecycle to enhance the application's security posture by providing expert consulting, continuous knowledge sharing, and actionable security guidance.

Required Experience:

• 5+ years of experience in Application Security.
• Knowledge of secure development processes and best practices.
• Deep understanding of web application security mechanisms (i.e., how the web actually works? What is SOP and why do we need CORS? What is CSP?).
• Deep understanding of common web application vulnerabilities (i.e., OWASP Top 10), and the most effective ways to prevent them.
• Knowledge of secure system/application architecture and design principles.
• Understanding of modern threats to high-performance web applications that are used by millions of users daily.
• Understanding of modern authentication/authorisation patterns (OAuth, OIDC, JWT, etc.)
• Practical hands-on expertise in identifying vulnerabilities through security assessment and secure code review, coupled with the ability to perform deep root-cause analysis to drive systemic fixes.
• University degree in Computer Science, Information Security, or related field, or equivalent combination of education and experience.
• English and Russian proficiency at an upper-intermediate level (B2+).
   

Nice to have:

• Passion about programming.
• Technical knowledge of network and operating systems security.
• Hands-on DevSecOps experience.
• Practice of participation in bug bounty programs and/or CTFs.
• Deep knowledge of SAST/DAST tools, including customisation.
• Relevant certifications (i.e., OSWE, GWEB, etc.).

Our Benefits:

• Private health insurance
• Sports benefits
• Comprehensive Mental Health Program
• Free English lessons (online)
• Local language courses
• Paid time off
• Maternity leave support
• Referral program rewards
• Upskilling, internal workshops, and participation in professional conferences and corporate events

We are looking for a Head of Security Operations Center to lead, mature, and operate our resilient security operations capability. In this role, you will own the defense of our environment, ensuring fast and precise threat detection, investigation, containment, and exposure reduction. You will lead our security operations function, making the organization faster in responding to threats while continuously improving controls across the attack surface.

Responsibilities

• Own Cyber Defense execution across SOC, detection engineering, incident response, and exposure remediation
• Lead alert triage quality, escalation standards, incident command, and response coordination
• Prioritize critical vulnerabilities and exposures using asset criticality, exploitability, and business impact
• Manage Cyber Defense dashboards, runbooks, remediation follow-up, and operational metrics
• Coordinate with IT, Platform, IAM, Product, GRC, Legal, and business owners during incidents and remediation
• Build and develop the Cyber Defense team, including hiring, onboarding, mentoring, and retaining security talent
• Drive continuous improvement of detection coverage, response playbooks, and security controls based on lessons learned and threat intelligence
• Report on Cyber Defense performance, incidents, and risk posture to security leadership and stakeholders

Requirements

• 10+ years of experience in Information Security
• 3+ years in a security management or team lead role with direct people management experience
• Hands-on experience managing SOC operations, leading incident command, and driving MTTD/MTTR improvement
• Ability to design, validate, and maintain detection logic across SIEM, EDR, and cloud platforms, with a deep understanding of runbook development and false-positive reduction
• Knowledge of top attack scenarios (ATO, credential theft, privilege escalation, data exfiltration) and ability to map detections to threat models like MITRE ATT&CK
• Experience prioritizing vulnerabilities using CVSS and asset criticality to reduce exposure aging
• Hands-on experience with at least one enterprise SIEM (Splunk, Microsoft Sentinel, Chronicle, Elastic) and SOAR tooling
• Understanding of cloud-native security controls and monitoring in AWS, GCP, or Azure
• Understanding of IAM, PAM, SSO, and identity-related attack vectors relevant to detection and response
• Ability to define, track, and communicate security KPIs and operational dashboards to technical and executive audiences
• English - Upper-Intermediate or higher

Will be a plus

• Experience in fintech, e-commerce, or other high-risk industries with complex threat landscapes
• Hands-on background as a SOC analyst, incident responder, or detection engineer prior to moving into management
• Experience building a SOC or Cyber Defense function from scratch or significantly maturing an existing one
• Familiarity with threat intelligence platforms and threat-informed defense methodologies
• Relevant certifications: CISSP, CISM, GIAC (GSOM, GCED, GCIH) or equivalent

We offer

• 20 paid vacation days per year
• 10 paid sick leave days per year
• Public holidays as per the company’s approved Public holiday list
• Medical budget
• Opportunity to work remotely
• Professional education budget
• Language learning budget
• Wellness budget (gym membership, sports gear and related expenses)