Vulnerability Jobs

Everpure (NYSE: P) has evolved from storage pioneer to data platform, closing fiscal 2026 with $3.7 billion in revenue, its first billion-dollar quarter, and accelerating growth into FY27. Our strategic agenda spans the companies defining the next era of technology - hyperscalers, AI labs, the AI hardware supply chain, data platform providers, and the broader AI ecosystem. This type of work—work that changes the world—is what the tech industry was founded on. So, if you're ready to seize the endless opportunities and leave your mark, come join us. THE ROLE As a Senior Security Operations Engineer – Attack Surface Management , you will help engineer, operate, and continuously improve our enterprise Attack Surface and Vulnerability Management capabilities. You will focus on discovering and understanding our attack surface, identifying vulnerabilities and exposures, prioritizing them based on real-world risk, and driving remediation across our global environment. The role spans Attack Surface Management, Vulnerability Management, Zero Trust, Secrets and Credential Security, SSPM, Deception, Detection Engineering and Security Automation. We are looking for engineers with strong ASM/Vulnerability Management fundamentals and deeper expertise in one or more adjacent security domains. WHAT YOU’LL DO Engineer and improve enterprise Attack Surface and Vulnerability Management across cloud, infrastructure, endpoints, applications, and internet-facing environments. Discover and correlate assets across security platforms and identify unknown, unmanaged, stale, and externally exposed assets. Drive risk-based vulnerability prioritization using asset criticality, exposure, exploitability, known exploitation, threat intelligence, and compensating controls. Establish remediation workflows and SLAs and partner with asset owners to drive measurable risk reduction. Operate and troubleshoot Zscaler ZIA/ZPA, including SSL inspection, access policies, connectivity, and Zero Trust controls.

Title: Senior Product Designer — Enterprise Security Platform Location: Remote — United States; preference given to San Francisco Bay Area candidates Reports to: VP of Product & Design Focus: Approximately 80% Product Design / 20% Brand & Marketing Design Eligibility: U.S. citizenship is required due to the role’s support of federal government projects. About RapidFort RapidFort is a software supply chain security platform. We help enterprises understand what's running in their software, reduce vulnerability risk, and ship curated, near-zero-CVE container images, backed by runtime-informed analysis and automated attack surface reduction. Our users include security teams, platform engineers, developers, administrators, and enterprise leaders. We're Series A, with $42M raised, and we're a small, senior team moving quickly. The role This is a product-first design role. You'll own major parts of the RapidFort platform and work directly with Product and Engineering from early problem definition through shipped software. The problems are genuinely complex: thousands of vulnerabilities across images, clusters, and workloads; relationships between software artifacts; policies, permissions, and enterprise environments; and very different technical users with very different needs. We want someone who enjoys that complexity. You should be equally comfortable thinking about the overall system and getting into the details of how a table, filter, workflow, visualization, or interaction should behave. About 80% of your time will focus on product. The other 20% will help keep our website, launches, sales materials, and broader brand consistent with the product, in partnership with Marketing and external specialists. You'll start as a hands-on IC and the senior design voice at RapidFort. You'll help establish how design operates: how we frame problems, review work, collaborate with Engineering, use research and data, and decid

Als Technical Information Security Officer (TISO) in Rotterdam versterk je onze digitale veiligheid in een organisatie die volop in cloudtransitie is. Je werkt aan cloudsecurity, identity & access, vulnerability management en incident response, binnen een omgeving van moderne technologie én legacy. Vind je het leuk om zichtbaar verschil te maken? Dan voel je je hier waarschijnlijk snel op je plek. We don't want to disappoint, but we only accept applicants that have a good command of the Dutch language and are already (or about to be) based in the Netherlands. Hier krijg jij positieve energie van Het verbeteren van onze technische security, van Azure-cloudsecurity en identity & access tot endpoint- en vulnerability management. Het analyseren en opvolgen van security-incidenten en samen met ons SOC en DevOps-teams dreigingen vertalen naar concrete acties. Het zoeken naar praktische oplossingen die onze organisatie stap voor stap veiliger maken. Dit ga je doen als Technical Information Security Officer We zitten midden in een transitie naar de cloud, waar moderne technologie en legacy samenkomen. In deze rol versterk je onze Azure- en Microsoft-security en werk je onder andere met Microsoft Defender XDR, Conditional Access en Intune. Je ontwikkelt en verbetert detecties in Microsoft Defender XDR, onder andere met KQL, vertaalt dreigingsinformatie naar concrete acties en helpt security stevig te verankeren in onze DevSecOps-keten. Bij incidenten voer je zelf de eerste analyse uit en werk je samen met ons externe SOC aan de verdere afhandeling. Daarnaast help je technische risico’s te vertalen naar heldere adviezen voor teams en management. Ook help je het securitybewustzijn binnen de organisatie te vergroten en draag je bij aan trainingen, e-learnings en phishingcampagnes. Je begeleidt pentests en red-team-oefeningen, bewaakt CIS-baselines en staat als ‘officer of the day’ klaar voor vragen en meldingen. Jouw uitdagingen Navigeren tussen moderne cloudsecurity en een bes

The Engineering Lead Analyst – SonarQube & Code Quality Engineering is a senior-level engineering role responsible for leading static code analysis, automated code quality governance, security vulnerability remediation, and AI-augmented developer enablement across enterprise software delivery pipelines. In this role, you will champion software reliability, maintainability, clean-coding standards, and automated quality gates. You will partner with development teams, system architects, and platform engineering to integrate and manage enterprise-scale code quality platforms (such as SonarQube) both on-premises and in cloud/SaaS environments. Additionally, you will drive modern engineering practices by embedding Behavior-Driven Development (BDD) within your own software delivery and leveraging Agentic AI workers and Model Context Protocol (MCP) architectures to optimize developer experience, streamline code governance, and boost engineering velocity. Key Responsibilities 1. Code Quality & Static Analysis Platform Ownership Lead the architecture, deployment, administration, and continuous enhancement of enterprise Static Application Security Testing (SAST) and Code Quality platforms (e.g., SonarQube , DeepSource, Codacy, Semgrep). Configure, calibrate, and enforce automated Quality Gates, code rulesets, technical debt calculation models, and code-coverage baselines across multi-language enterprise repositories. Oversee version upgrades, patching, high availability, and operational maintenance for on-premises and SaaS/cloud-hosted code quality infrastructure. 2. CI/CD & Pipeline Integration <li style=

Everpure (NYSE: P) has evolved from storage pioneer to data platform, closing fiscal 2026 with $3.7 billion in revenue, its first billion-dollar quarter, and accelerating growth into FY27. Our strategic agenda spans the companies defining the next era of technology - hyperscalers, AI labs, the AI hardware supply chain, data platform providers, and the broader AI ecosystem. This type of work—work that changes the world—is what the tech industry was founded on. So, if you're ready to seize the endless opportunities and leave your mark, come join us. THE ROLE As a Staff Security Operations Engineer , you will own and continuously mature capabilities across Attack Surface Management, Vulnerability Management, Zero Trust, Secrets and Credential Security, Detection Engineering, and Security Automation . This is a hands-on role requiring strong security engineering expertise combined with the ability to build teams, establish operating processes, measure outcomes, and drive remediation across Engineering, Cloud, Infrastructure, and Product organizations. You will partner closely with GISO leadership and global security teams to translate security strategy into measurable execution and risk reduction. WHAT YOU’LL DO Lead and mature enterprise Attack Surface and Vulnerability Management capabilities across cloud, infrastructure, endpoints, applications, and internet-facing environments. Drive risk-based vulnerability prioritization using asset criticality, exposure, exploitability, known exploitation, threat intelligence, and compensating controls. Establish operating processes, remediation SLAs, KPIs/KRIs, dashboards, and governance to measure and drive security risk reduction. Identify systemic security gaps and develop scalable technical and operational solutions. Provide technical leadership across Zscaler/Zero Trust, secrets and credential security, SIEM/detection engineering, EDR, cloud security, and security automation. Drive automation and integrations using APIs, sc

SPECIFIC JOB RESPONSIBILITIES Defensive Operations (SecOps): Design and automate the Security Incident Response (SIR) and Vulnerability Response (VR) lifecycles. Build playbooks in Flow Designer to automate threat containment and remediation. Offensive Operations: Develop custom scoped applications to track penetration testing results, manage red-team engagement lifecycles, and automate the ingestion of reconnaissance data. Compliance & GRC: Configure and customize Integrated Risk Management (IRM) modules to map technical controls to frameworks like SOC2, ISO 27001, HIPAA, and FedRAMP. Integrations & Orchestration: Build robust, secure integrations (REST/SOAP, IntegrationHub , MID Servers) with our XDR, SIEM (Splunk/Sentinel), and cloud-native services (AWS/Azure/GCP). Multi-Tenancy & MSSP Architecture: Architect a scalable, multi-tenant environment that ensures strict data isolation between clients while allowing for unified " ClickOps " and Terraform-driven automation. AI & Innovation: Explore and implement Now Assist (GenAI) and AI-heavy workflows to automate security reporting and incident summarization. Defensive Operations (SecOps): Design and automate the Security Incident Response (SIR) and Vulnerability Response (VR) lifecycles. Build playbooks in Flow Designer to automate threat containment and remediation. Offensive Operations: Develop custom scoped applications to track penetration testing results, manage red-team engagement lifecycles, and automate the ingestion of reconnaissance data. Compliance & GRC: Configure and customize Integrated Risk Management (IRM) modules to map technical controls to frameworks like SOC2, ISO 27001, HIPAA, and FedRAMP. Integrations & Orchestration: Build robust, secure integrations (REST/SOAP, IntegrationHub , MID Servers) with our XDR, SIEM (Splunk/Sentinel), and cloud-native services (AWS/Azure/GCP)

Why Sony Interactive Entertainment? Sony Interactive Entertainment isn’t just the Best Place to Play — it’s also the Best Place to Work. Sony Interactive Entertainment (SIE) is the company behind the PlayStation brand. As a subsidiary of Sony Group Corporation, we’re part of a proud legacy of innovation and excellence. SIE is a dynamic technology company, delivering cutting-edge hardware and network services to more than 100 million people and an entertainment leader, home to some of the most beloved and recognizable intellectual properties (IP) in the world. Our role at SIE is to create and nurture the experiences under the PlayStation brand, a name synonymous with entertainment excellence and creativity. Reporting to the Director of Global Vulnerability Management, you will serve as a Senior Security Research Engineer and technical lead within SIE’s Global Vulnerability Management team. You will lead complex work that advances our Threat Exposure Management capability and supports our transition to a Continuous Threat Exposure Management operating model, while remaining directly engaged in vulnerability research, analysis, security validation, prioritization, and remediation support. You will partner across Information Security, engineering, technology, and business teams to improve how SIE discovers, prioritizes, validates, and mobilizes action on security risks. You will translate annual TEM goals into defined workstreams, delivery plans, success measures, and repeatable operating practices that improve visibility, decision-making, remediation outcomes, and program scale. Responsibilities Lead complex Global Vulnerability Management workstreams that advance SIE’s Threat Exposure Management capability and transition toward a Continuous Threat Exposure Management operating model across discovery, prioritization, validation, and mobilization. Translate annual TEM goals into defined delivery plans, milestones, success measures, dependencies, and repeatable operating

At Affirm, we exist for the moments that matter—giving people a clear, predictable way to pay over time, with no hidden fees, no surprises, and no tradeoffs on what matters most. About the InfoSec & IT Team The Application Security team helps Affirm build and launch products that earn customer trust, meet compliance obligations, and reduce business risk. We partner closely with product, engineering, infrastructure, risk, compliance, and other teams to identify security risks early, recommend pragmatic mitigations, and help teams find safe paths to launch. We are looking for an early-career Application Security Engineer who is curious, collaborative, and comfortable working with code. You will help assess application risks, support vulnerability management efforts, partner with engineering teams on secure design decisions, and contribute lightweight tooling, automation, and code-informed analysis that helps AppSec scale across Affirm. This role is a great fit for someone who has hands-on software or security experience, enjoys reading and reasoning about code, is actively developing offensive security skills, and wants to apply those skills in a product-minded, risk-based way. What You'll Do Partner with product and engineering teams to identify application security risks and help frame them as clear business risks, launch options, and recommended next steps. Read application code, configuration, pull requests, logs, and documentation to understand how systems work and where security risks may exist. Contribute small code changes, scripts, detections, tests, secure defaults, or automation that improve AppSec workflows and reduce recurring issues. Work in GitHub to review code changes, understand engineering context, participate in pull request discussions, track remediation work, and collaborate with engineers. Help evaluate vulnerabilities from internal testing, bug bounty reports, security tooling, penetration tests, and other sources; partner with teams to pri

The Security team is responsible for protecting Asana’s employees, users, and customers. We are a team of security engineers and risk and compliance practitioners who build innovative safeguards to ensure that our data is protected against threats and that we comply with legal, regulatory, and customer requirements. We collaborate closely with teams across the organization to foster a culture of security throughout our product and operations. We’re looking for an Application Security Engineer to join our Security team in Warsaw. You’ll be a foundational member of the security presence in a key engineering hub, partnering directly with IT, infrastructure, and product teams to ensure we design and ship secure software. You will be instrumental in scaling our security practices by conducting security design reviews, threat modeling, and vulnerability assessments across our products and internal applications, eliminating entire classes of vulnerabilities, and championing a security-first mindset. This role is based in our Warsaw office with an office-centric hybrid schedule. The standard in-office days are Monday, Tuesday, and Thursday. Most Asanas have the option to work from home on Wednesdays. Working from home on Fridays depends on the type of work you do, and your recruiter can share more about the in-office requirements. We offer a Contract of Employment (UoP) for our employees in Poland. What you’ll achieve ● Conduct security architecture reviews and threat modeling for new features and services across our product and internal applications, identifying risks early and influencing secure design decisions. ● Perform vulnerability assessments of software and systems, using a range of assessment methodologies to surface and prioritize security weaknesses across our product surface. ● Triage, investigate, and drive remediation of vulnerabilities from our bug bounty program and automated s

Role Summary We are seeking an experienced SOC / Security Operations Lead to oversee and strengthen the organization's Security Operations Center (SOC), threat detection, incident response, vulnerability management, data protection, and security monitoring capabilities. The ideal candidate will possess extensive experience in managing enterprise security operations, SIEM/SOAR platforms, threat hunting, incident response, DLP, endpoint security, and vulnerability management programs. The role requires leadership of a multi-functional security operations team responsible for protecting critical business systems, customer data, and digital assets while ensuring compliance with RBI regulations and industry security standards. Key Responsibilities Security Operations Center (SOC) Management -Lead and manage 24x7 Security Operations Center (SOC) functions. -Establish and enhance SOC processes, playbooks, escalation procedures, and operational metrics. -Ensure timely detection, triage, investigation, containment, and remediation of security incidents. -Develop SOC maturity roadmaps aligned with industry best practices and regulatory expectations. -Monitor security KPIs, SLAs, MTTR, MTTD, and incident response effectiveness. SIEM, XSIAM & Threat Detection -Lead implementation, administration, and optimization of: -Palo Alto Cortex XSIAM -SIEM Platforms -SOAR Platforms -UEBA Solutions -Threat Intelligence Platforms -Develop and tune correlation rules, detection logic, and analytics use cases. -Enhance detection coverage across cloud, endpoints, applications, networks, and third-party environments. -Drive threat hunting and proactive security monitoring initiatives. Incident Response & Threat Management -Lead enterprise cyber incident response activities. -Develop and maintain incident response plans, runbooks, and communication procedures. -Coordinate investigations involving malware, ransomware, phishing, insider threats, account compromise, fraud, and adv

About Vercel: Vercel is the agentic infrastructure company, freeing people and agents to ship what's next. For more than a decade we've helped builders move from idea to production with speed, security, and exceptional developer experience. Now we're scaling our products for both agents and people to ship and run software, built in the open and trusted by OpenAI, PayPal, Ramp, Supreme, and millions of developers worldwide. About the role: We are looking for a Product Security Engineer to build the systems that triage and validate bug bounty and other externally reported security findings, not to work the queue, and this role suits a software engineer moving into security or a security engineer with a strong engineering background. You will build large language model (LLM) and agent-based tooling that validates findings, traces them to their root cause, and opens fixes for well-understood vulnerability classes. This is a hybrid role based in San Francisco or New York City, with three days a week in the office. What you’ll do: Build the systems that take in externally reported vulnerabilities and assess validity, severity, and reproducibility at a volume manual triage cannot match Build LLM and agent-based analysis that validates business logic, authentication, and design-level findings, not just known signatures Build systems that trace validated findings to their root cause and propose, and increasingly open, fixes for well-understood vulnerability classes, with human review gates Own the bug bounty program, including scope, policy, and researcher engagement, and feed every resolved report back into automated triage Extend the tooling into security testing capabilities that customers can use on what they build and deploy What you need: 5+ years of software engineering or security engineering experience, building and shipping production systems or internal tools Wrote production code in JavaScript/TypeScript on Node.js, with hands-on experience in web frameworks such

This role is part of Datadog’s Security Agent team, which powers critical security capabilities across Workload Protection, Vulnerability Management, Cloud Security products, and other emerging security offerings. As a Staff Software Engineer, you will lead the design and development of low-level Linux instrumentation and runtime security technologies that help customers detect threats, monitor system activity, and protect cloud-native workloads at scale. You will work on complex technical challenges involving eBPF, Linux kernel internals, performance-sensitive systems, and large-scale data collection while influencing technical direction across multiple product teams. This role offers significant ownership, broad organizational impact, and the opportunity to shape the future of Datadog’s security platform. At Datadog, we place value in our office culture - the relationships and collaboration it builds and the creativity it brings to the table. We operate as a hybrid workplace to ensure our Datadogs can create a work-life harmony that best fits them. What You’ll Do: Lead the architecture and development of security agent capabilities that power runtime threat detection and workload protection across Datadog Security products. Design and build reusable eBPF-based monitoring functionality for process, file, and network visibility within Linux environments. Drive end-to-end delivery of new features, from technical strategy and design through implementation, testing, and rollout. Establish and evolve testing methodologies that improve platform coverage, detection quality, reliability, and performance. Partner with product, security, infrastructure, and engineering teams to deliver shared platform capabilities used across multiple Datadog products. Provide technical leadership by influencing engineering direction, mentoring peers, and helping resolve complex cross-functional challenges. Who You Are: You have significant experience building software in Linux environments,

This role is part of Datadog’s Security Agent team, which powers critical security capabilities across Workload Protection, Vulnerability Management, Cloud Security products, and other emerging security offerings. As a Staff Software Engineer, you will lead the design and development of low-level Linux instrumentation and runtime security technologies that help customers detect threats, monitor system activity, and protect cloud-native workloads at scale. You will work on complex technical challenges involving eBPF, Linux kernel internals, performance-sensitive systems, and large-scale data collection while influencing technical direction across multiple product teams. This role offers significant ownership, broad organizational impact, and the opportunity to shape the future of Datadog’s security platform. At Datadog, we place value in our office culture - the relationships and collaboration it builds and the creativity it brings to the table. We operate as a hybrid workplace to ensure our Datadogs can create a work-life harmony that best fits them. What You’ll Do: Lead the architecture and development of security agent capabilities that power runtime threat detection and workload protection across Datadog Security products. Design and build reusable eBPF-based monitoring functionality for process, file, and network visibility within Linux environments. Drive end-to-end delivery of new features, from technical strategy and design through implementation, testing, and rollout. Establish and evolve testing methodologies that improve platform coverage, detection quality, reliability, and performance. Partner with product, security, infrastructure, and engineering teams to deliver shared platform capabilities used across multiple Datadog products. Provide technical leadership by influencing engineering direction, mentoring peers, and helping resolve complex cross-functional challenges. Who You Are: You have significant experience building software in Linux environments,

This role is part of Datadog’s Security Agent team, which powers critical security capabilities across Workload Protection, Vulnerability Management, Cloud Security products, and other emerging security offerings. As a Staff Software Engineer, you will lead the design and development of low-level Linux instrumentation and runtime security technologies that help customers detect threats, monitor system activity, and protect cloud-native workloads at scale. You will work on complex technical challenges involving eBPF, Linux kernel internals, performance-sensitive systems, and large-scale data collection while influencing technical direction across multiple product teams. This role offers significant ownership, broad organizational impact, and the opportunity to shape the future of Datadog’s security platform. At Datadog, we place value in our office culture - the relationships and collaboration it builds and the creativity it brings to the table. We operate as a hybrid workplace to ensure our Datadogs can create a work-life harmony that best fits them. What You’ll Do: Lead the architecture and development of security agent capabilities that power runtime threat detection and workload protection across Datadog Security products. Design and build reusable eBPF-based monitoring functionality for process, file, and network visibility within Linux environments. Drive end-to-end delivery of new features, from technical strategy and design through implementation, testing, and rollout. Establish and evolve testing methodologies that improve platform coverage, detection quality, reliability, and performance. Partner with product, security, infrastructure, and engineering teams to deliver shared platform capabilities used across multiple Datadog products. Provide technical leadership by influencing engineering direction, mentoring peers, and helping resolve complex cross-functional challenges. Who You Are: You have significant experience building software in Linux environments,

Replit is the agentic software creation platform that enables anyone to build applications using natural language. With millions of users worldwide, Replit is democratizing software development by removing traditional barriers to application creation. About the Role We are seeking a mid-level Infrastructure Vulnerability Management Engineer with a strong background in Cloud Security, DevSecOps, and Infrastructure-as-Code (IaC). In this role, you will bridge the gap between security, compliance, DevOps, and Platform engineering teams. You will identify infrastructure misconfigurations, secure multi-cloud environments, and manage continuous vulnerability lifecycles across cloud workloads, containers, and data repositories to satisfy strict regulatory compliance frameworks. You will also serve as a technical infrastructure responder during security incidents, deploying real-time cloud or network countermeasures to protect our production ecosystem. What You'll Do Core Responsibilities Infrastructure Scanning & Triage: Perform continuous security scanning across our cloud posture and workloads. Review, validate, and prioritize flaws and misconfigurations based on CVSS scores, real-world exploitability, and infrastructure network exposure. Posture Management & Visibility : Own and optimize Cloud Security Posture Management (CSPM), Kubernetes Security Posture Management (KSPM), and Data Security Posture Management (DSPM) tools to ensure uniform compliance, prevent data leakage, and maintain hardened baselines. Infrastructure-as-Code (IaC) Security: Configure, tune, and embed automated IaC security scanning tools into CI/CD pipelines to identify architectural risks (e.g., overly permissive IAM, public S3 buckets/Cloud Storage) before they are deployed to production. Workload & Container Security: Manage the continuous vulnerability scanning lifecycle for container images, registries, and Virtual Machines (VMs), partnering with SRE and Platform teams to build aut