product security engineer

Delivery Hero

<div>Company Description 
As the world&rsquo;s pioneering local delivery platform, our mission is to deliver an amazing experience, fast, easy, and to your door. We operate in around 65 countries worldwide powered by tech, designed by people. As one of Europe&rsquo;s largest tech platforms, headquartered in Berlin, Germany. Delivery Hero has been listed on the Frankfurt Stock Exchange since 2017 and is part of the MDAX stock market index. We enable creative minds to deliver solutions that create impact within our ecosystem. We move fast, take action and adapt. No matter where you're from or what you believe in, we build, we deliver, we lead. We are Delivery Hero. 
Job Description 
We are looking for a Staff Security Engineer (all genders) to join our Product Security team on our journey to always deliver amazing experiences.
We are looking for a pragmatic, high-impact individual contributor to join our Product Security team as a Staff Product Security Engineer (IC4). In this pivotal role, you will drive the overarching technical strategy for application security, ensuring we reduce real-world risk across our entire product landscape without slowing down engineering velocity.
You will champion a &quot;Secure by Design&quot; philosophy, moving away from reactive auditing and security gatekeeping. Instead, you will treat security as a collaborative engineering challenge, designing the automated guardrails, developer tooling, and technical frameworks that enable our engineering teams to scale rapidly and securely by default. As a Staff-level individual contributor, your leadership will extend beyond the immediate product boundaries and you will achieve domain-wide impact by seamlessly bridging the gap between Application Security, AI/ML security, Infrastructure Security, and Security Operations.
Your mission:<ul><li>
Drive Product Security Maturity: Drive the strategic technical roadmap for the Product Security team, ensuring threat-modeling methodologies and secure coding practices scale efficiently across our global web and mobile application ecosystem.</li><li>
Lead Threat Modeling &amp; Security Architecture Reviews: Apply your expertise to identify complex security design flaws early in the Software Development Life Cycle (SDLC) using frameworks and automation tools, co-authoring architectural blueprints that are secure by default.</li><li>
Scale Vulnerability Management &amp; Governance: Architect and run our vulnerability management program at scale. You will ingest inputs from internal testing, automated tooling, and external Bug Bounty / Vulnerability Disclosure Programs, systematically validating and ranking vulnerabilities based on actual business risk.</li><li>
Master Stakeholder Management: Translate complex software and AI-related vulnerabilities into clear, actionable business risks, partnering closely with engineering leadership and product verticals to drive timely remediation without friction. systematically tracking and optimizing metrics such as Mean Time to Remediate (MTTR) and SLA Adherence % to elevate our overall security posture.</li><li>
Automate DevSecOps &amp; CI/CD Pipelines: Replace manual gates with seamless DevSecOps workflows, embedding automated security testing tools (SAST, DAST, SCA) directly into developer pipelines to catch high-risk flaws early.</li><li>
Pioneer AI-Driven Security Automation: Champion the adoption of artificial intelligence and LLMs to revolutionize our security workflows. You will design and implement cutting-edge AI-powered code security automation, leverage AI for automated vulnerability triage, and build smart security automation guardrails that scale engineering productivity.</li><li>
Cross-Domain Collaboration &amp; CSPM Management: Drive domain-wide impact by collaborating with Infrastructure Security to leverage Cloud Security Posture Management (CSPM) platforms, ensuring that application vulnerabilities are contextualized with cloud risk. Partner with Security Operations (Detection &amp; Response) to ensure proper application logging, alerting, and incident readiness.</li><li>
Mentor and Inspire: Act as a technical beacon within the security and engineering organizations. Define key security metrics, drive a strong security culture, and mentor junior and senior engineers to foster a world-class community of Security Champions</li></ul> 
Qualifications<ul><li> 
Proven Engineering Leadership: A strong track record of driving complex application security and DevSecOps initiatives as a staff-level individual contributor in massive, global software environments.</li><li>
Comprehensive Web &amp; Mobile Security: Deep, fundamental understanding of modern web and mobile application security topics, including hands-on experience managing external Bug Bounty and vulnerability disclosure programs.</li><li>
AI Security Expertise: Strong working knowledge of industry-standard security frameworks for artificial intelligence, such as the OWASP Top 10 for LLM Applications, MITRE ATLAS, and the NIST AI RMF.</li><li>
AI &amp; Security Automation Hands-on Experience: Practical understanding of utilizing artificial intelligence (including LLMs/Generative AI) for security engineering use cases, such as automated vulnerability analysis, script generation, triage optimization, and code security remediation.</li><li>
Privacy, Ethics &amp; Regulations: A solid understanding of global data privacy laws (e.g., GDPR), ethical AI considerations, and the regulatory impacts of the EU AI Act on application architecture.</li><li>
Risk-Based Vulnerability Management: Strong expertise in vulnerability validation and triage, with the ability to look past raw CVSS scores to calculate actual business impact, coupled with excellent stakeholder management skills to align engineering teams on remediation.</li><li>
Secure Coding &amp; Remediation Proficiency: Deep hands-on proficiency in multiple modern programming languages (e.g., Java, Python, Go) and the ability to confidently code, review, and remediate complex vulnerabilities (such as the OWASP Top 10) directly within application repositories.</li><li>
Cloud &amp; CSPM Familiarity: Strong working knowledge of cloud security (AWS, GCP, or Azure) and containerized ecosystems (Kubernetes, Docker), alongside an understanding of how to align application security signals with Cloud Security Posture Management (CSPM) platforms.</li><li>
Identity &amp; Access Management (IAM): Deep understanding of modern authentication and authorization protocols (OAuth, OIDC, SAML) and how to design and enforce Zero Trust architectures at scale.</li><li>
Cross-Functional Security Ops Alignment: Basic working knowledge of security operations, threat detection, and incident response, ensuring that product architectures are built to be auditable, observable, and resilient against live attacks.</li></ul>
Nice to have:<ul><li>
Experience securing highly distributed, event-driven microservices architectures at global scale.</li><li>
History of public security research, CVE discovery, or active contributions to open-source security or AI safety tooling.</li><li>
Advanced application security or cloud certifications (e.g., CSSLP, CASE, AWS Security Specialty, Google Professional Cloud Security Engineer, or CISSP).</li></ul> 
Additional Information 
Ensuring you and all our Heroes are looked after, happy, and healthy is always on the menu. Because if you&rsquo;re in good shape, then we&rsquo;re in good shape.<ul><li>
Make the most of our hybrid working model and join the team for face-to-face connection and collaboration in our beautiful Berlin campus 2 days a week</li><li>
We offer 27 days holiday with an extra day on 2nd and 3rd year of service</li><li>
We will support you in developing yourself and your career growth opportunities: 1.000 &euro; Educational Budget, Language Courses, Parental Support and access to the Udemy Business platform to explore a variety of online courses.</li><li>
Get moving and release those wonderful, mind-boosting endorphins: Health Checkups, Meditation, Yoga, Gym &amp; Bicycle Subsidy</li><li>
Cash. Dough. Cheddar. Whatever you call it, we&rsquo;ll help you with it: Employee Share Purchase Plan, Sabbatical Bank, Public Transportation Ticket Discount, Life &amp; Accident Insurance, Corporate Pension Plan</li><li>
The power of getting together over some food is unrivaled. Here are a few ways to help you do that. All the yum: Digital Meal Vouchers, Food Vouchers, Corporate Discounts. Courses.</li></ul> 
We believe diversity and inclusion are key to creating not only an exciting product, but also an amazing customer and employee experience. Fostering this starts with hiring - therefore we do not discriminate on the basis of racial identities, religious beliefs, color, national origin, gender identities or expressions, sexual orientations, age, marital or disability statuses, or any other aspect that makes you, you. 
 
We encourage you to let us know if you need any accommodations or specific accessibility support to ensure a smooth interview experience&mdash;just let us know with an email to our Inclusion Officer at inclusion@deliveryhero.cominclude it in your application. 
 
Severely disabled applicants with equal qualifications will be given preferential consideration. 
 
You're welcome to share your pronouns (he/she/they) right from the start so we can address you respectfully from our first contact.<div></div>
We believe diversity and inclusion are key to creating not only an exciting product, but also an amazing customer and employee experience. Fostering this starts with hiring - therefore we do not discriminate on the basis of racial identities, religious beliefs, color, national origin, gender identities or expressions, sexual orientations, age, marital or disability statuses, or any other aspect that makes you, you. 
 
We encourage you to let us know if you need any accommodations or specific accessibility support to ensure a smooth interview experience&mdash;just let us know with an email to our Inclusion Officer at inclusion@deliveryhero.com. 
 
Severely disabled applicants with equal qualifications will be given preferential consideration. 
 
You're welcome to share your pronouns (he/she/they) right from the start so we can address you respectfully from our first contact.</div>

Staff Security Engineer, Product Security team

Cognism

<div><div><h2 class="jobSectionHeader">WHO ARE WE</h2>

Cognism is the leading provider of European B2B data and sales intelligence. Ambitious businesses of every size use our platform to discover, connect, and engage with qualified decision-makers faster and close more deals. Headquartered in London with global offices, Cognism's contact data and contextual signals are trusted by thousands of revenue teams to eliminate the guesswork from prospecting.</div>
THE ROLE

The Senior Application Security Engineer is a key member of Cognism's Information Security Team, reporting into the Application &amp; Infrastructure Security Manager. Your mission is to embed security by design across our engineering and product organization by integrating modern application security practices throughout the full development lifecycle. We focus on building secure, scalable, and resilient systems while enabling the business to innovate quickly and safely. It is to drive a culture where the fastest path for our engineers is the securest path.

You will work closely with Product, Engineering, Architecture, and Data teams to understand risks within our platform, including risks introduced by AI powered features, and ensure the right controls, guardrails, and security patterns are built into the product at its inception &ndash; all the while ensuring a balanced approach to the product experience that our thousands of large global enterprise customers use every day.

This role is ideal for a senior IC who is technical, collaborative, and pragmatic, with the ability to influence engineering teams while driving hands on improvements to Cognism's secure SDLC.

KEY RESPONSIBILITIES

Security by Design &amp; Product Integration
<ul>
<li>Partner with Product, Web and Data Engineering teams from the ideation stage to ensure security requirements are considered early in feature and model design.</li>
<li>Translate product and application risks into actionable security controls, making recommendations repeatable to build guardrails and guidance that product, design, and engineering teams can apply as they scale and build the products in the teams they own.</li>
<li>Help shape security acceptance criteria and guide engineering teams during design reviews and backlog planning.</li>
</ul>
Application Risk Assessment &amp; AI Security
<ul>
<li>Identify and assess application risks across Cognism's SaaS platform, data processing pipelines, including emerging risks associated with AI/ML capabilities.</li>
<li>Contribute to AI feature reviews and participate in AI risk assessments to ensure responsible and secure use of models, in a way that balances the need to innovate and challenge the status quo in AI implementation.</li>
<li>Assess and pragmatically recommend mitigations for security risks in data pipelines, model-training workflows, feature stores, and ML systems, ensuring strong controls for data access, data lineage, model integrity, and protection of sensitive datasets.</li>
</ul>
Secure SDLC &amp; DevSecOps Enablement
<ul>
<li>Partner with our engineering and platform team to embed security guardrails into our software development lifecycle and agile engineering workflows.</li>
<li>Partner with engineering teams to integrate and optimize security tooling into CI/CD pipelines (SAST, SCA, DAST, container scanning, IaC scanning).</li>
<li>Drive automation and developer-friendly security processes that minimize friction and support rapid delivery.</li>
</ul>
Threat Modelling &amp; Architecture Support
<ul>
<li>Conduct and facilitate a self-serve, risk-driven approach to pragmatic threat modelling sessions for new features, services, and AI components.</li>
<li>Conduct threat modelling for data architectures, including ingestion, transformation, storage, streaming, and ML model deployment patterns, ensuring data confidentiality, integrity, and responsible use.</li>
<li>Provide hands-on application security guidance to engineering teams, helping them implement secure APIs, microservices, data flows, and integrations.</li>
<li>Maintain and expand Cognism's secure coding standards, guidance, and reusable security patterns.</li>
</ul>
Application Security Testing &amp; Engineering
<ul>
<li>Perform hands-on security testing (manual and automated) for web applications, microservices, APIs, and cloud components.</li>
<li>Plan, coordinate, and oversee penetration tests, red team exercises, and third-party security assessments, ensuring findings are addressed and tracked.</li>
<li>Validate findings, assist with prioritization, and partner with engineering teams on remediation strategies.</li>
</ul>
Collaboration, Education &amp; Influence
<ul>
<li>Work directly with product squads, acting as a trusted advisor and embedded security partner. Take the time to understand what other teams are working on, what business priorities are, and partner with teams to recommend risk mitigations that balance risk with opportunity and that take into account the threat landscape.</li>
<li>Deliver security training, workshops, and guidance to improve engineering teams' security maturity.Communicate security risk and tradeoffs clearly and constructively to technical and nontechnical stakeholders.</li>
</ul>
CORE COMPETENCIES
<ul>
<li>Strong technical depth in application security, cloud security, and secure development.</li>
<li>Understanding of modern data stack components (e.g., data pipelines, feature stores) and the ability to collaborate effectively with data practitioners.</li>
<li>Deep understanding of communication protocols used for web development is a must-have.</li>
<li>Hands on experience with web application development, specifically for back-end development is a must-have competency.</li>
<li>Risk-Based Prioritization: Ability to distinguish between theoretical security risks and actual business threats, demonstrating a &quot;risk-driven&quot; rather than &quot;compliance-driven&quot; mindset. Comfortable balancing security risk with product and commercial realities.</li>
<li>Contextual Communication: Capacity to translate complex technical vulnerabilities into business-impact stories that resonate with non-technical stakeholders and product owners.</li>
<li>Collaborative Conflict Resolution: Proven track record of approaching engineering friction with transparency and pragmatism, balancing a firm stance on security with a deep care for the developer experience. Pragmatic problem solver with a growth mindset and bias toward action.</li>
<li>Architectural Empathy: Ability to put yourself in the position of your users (the engineers) to build security guardrails that are repeatable and embedded into existing workflows rather than added as hurdles.</li>
</ul>
EDUCATION &amp; EXPERIENCE
<ul>
<li>5&ndash;10+ years of experience in Application Security, Product Security, or Security Engineering roles.</li>
<li>Strong experience securing cloud native SaaS platforms (AWS preferred) and Data pipelines.</li>
<li>Handson experience with secure coding, application testing, and CI/CD security automation.</li>
<li>Experience working closely with engineering and product teams in agile environments.</li>
<li>Familiarity with security frameworks such as OWASP ASVS, OWASP Top 10, NIST, ISO 27001/2.</li>
<li>Experience evaluating and securing AI/ML enabled features is a strong advantage.</li>
<li>Experience in SME or high-growth SaaS environments preferred.</li>
</ul><div>
<h2 class="jobSectionHeader">WHY COGNISM</h2>

At Cognism, we're not just building a company - we're building an inclusive community of brilliant, diverse people who support, challenge, and inspire each other every day. If you're looking for a place where your work truly makes an impact, you're in the right spot!

Our values aren't just words on a page&mdash;they guide how we work, how we treat each other, and how we grow together. They shape our culture, drive our success, and ensure that everyone feels valued, heard, and empowered to do their best work.

Here's what we stand for:

 We Own the Outcome Together. 
 We Deeply Understand our Customers. 
 We Celebrate Impact Wherever It Comes From.

At Cognism, we are committed to fostering an inclusive, diverse, and supportive workplace. We welcome applications from individuals typically underrepresented in tech, so if this role excites you but you're unsure if you meet every requirement, we encourage you to apply!</div></div>

Senior Application Security Engineer

Bausch + Lomb

Date: Jul 10, 2026
 
Location: USA - Remote, US
 
#job-location.job-location-inline { display: inline; }
 
Company: Bausch+Lomb Companies Inc.
 
Bausch + Lomb (NYSE/TSX: BLCO) is a leading global eye health company dedicated to protecting and enhancing the gift of sight for millions of people around the world—from the moment of birth through every phase of life. Our mission is simple, yet powerful: helping you see better, to live better.
 
Our comprehensive portfolio of over 400 products is fully integrated and built to serve our customers across the full spectrum of their eye health needs throughout their lives. Our iconic brand is built on the deep trust and loyalty of our customers established over our 170-year history. We have a significant global research, development, manufacturing and commercial footprint of approximately 13,000 employees and a presence in approximately 100 countries, extending our reach to billions of potential customers across the globe. We have long been associated with many of the most significant advances in eye health, and we believe we are well positioned to continue leading the advancement of eye health in the future.
 
Why this Role Matters
 
Join the Surgical R&D organization in a role where you will help ensure the cybersecurity, safety, and reliability of innovative surgical products that support patient care. In this position, you will be responsible for embedding secure-by-design practices throughout the product lifecycle while partnering with engineering, quality, regulatory, and corporate security teams to deliver compliant and resilient solutions. This is a strong opportunity for someone who brings deep product security expertise, strong cross-functional collaboration skills, and a passion for advancing cybersecurity within a regulated medical device environment.
 
What You'll Do
 
Architect and implement a consistent cybersecurity strategy across surgical capital equipment product lines to establish a scalable and secure product ecosystem.
 Embed secure-by-design principles throughout the product lifecycle, providing guidance on secure architecture, threat modeling, design controls, cryptography, and secure communication protocols.
 Lead execution of cybersecurity requirements across development programs, ensuring alignment with regulatory expectations, corporate standards, and product quality objectives.
 Coordinate vulnerability management activities, including intake, triage, risk assessment, remediation tracking, and documentation of product security issues through closure.
 Serve as the Surgical R&D cybersecurity representative for vulnerability disclosure and incident response activities, supporting investigations, impact assessments, root cause analyses, and remediation efforts.
 Partner with engineering teams to implement security testing practices, including SAST, DAST, SCA, penetration testing, and automated security controls within development pipelines.
 Support supplier and third-party security initiatives by defining security requirements, managing software supply chain risks, and maintaining Software Bill of Materials (SBOM) processes.
 Collaborate with Quality, Regulatory Affairs, IT, and Corporate Product Security teams to ensure compliance with evolving cybersecurity regulations and industry standards while enabling efficient product delivery.
 
What You'll Bring
 
Required Education & Experience: 
Bachelor's degree in Engineering, Computer Science, Cybersecurity, or a related technical discipline.
 7+ years of experience in product security, application security, medical device cybersecurity, or software security within a regulated environment.
 Demonstrated experience supporting or leading cybersecurity activities for medical device or other regulated product development programs.
 Strong communication, collaboration, stakeholder management, and problem-solving skills.
 Ability to translate technical cybersecurity risks into clear, actionable guidance for engineering, quality, and regulatory stakeholders.
 
Specialized Technical, Regulatory & Industry Skills & Knowledge
 
Strong expertise in secure product design, threat modeling, vulnerability management, and secure software development practices.
 Working knowledge of connected device security, embedded systems, and software-enabled product architectures.
 Experience with security testing tools and methodologies, including SAST, DAST, SCA, and penetration testing.
 Understanding of software supply chain security practices, including SBOM development and third-party risk management.
 Experience working across cross-functional and global teams to drive cybersecurity outcomes and influence stakeholders without direct authority.
 Knowledge of secure development lifecycle (SDLC) frameworks, vulnerability disclosure processes, and product incident response activities.
 Familiarity with cybersecurity governance, risk assessment, and compliance processes within regulated industries.
 
Preferred
 
Advanced degree in Cybersecurity, Computer Science, Engineering, or a related field.
 Relevant industry certifications such as CISSP, CSSLP, OSCP, GWAPT, or equivalent.
 Experience in medical device, healthcare, or other regulated industries, and/or working within a quality-managed or GxP regulated environment.
 Working knowledge of medical device cybersecurity regulations and standards (e.g., FDA premarket/post market guidance, IEC 81001-5-1, AAMI TIR57, UL 2900, NIST frameworks).
 Experience developing cybersecurity documentation to support regulatory submissions and audits.
 
This position may be available in the following location(s): US - Remote
 
All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability, or veteran status.
 
For U.S. locations that require disclosure of compensation, the starting pay for this role is between $140,000 and $180,000. The estimated salary range reflects an anticipated range for this position. The actual base salary offered may depend on a variety of factors.
 
U.S. based employees may be eligible for short-term and/or long-term incentives. They may also be eligible to participate in medical, dental, vision insurance, disability and life insurance, a 401(k) plan and company match, a tuition reimbursement program (select degrees), company holidays, and well-being benefits, among others. U.S. based employees are also eligible to receive sick time, floating holidays and paid vacation.
 
Job Applicants should be aware of job offer scams perpetrated through the use of the Internet and social media platforms.
 
To learn more please read Bausch + Lomb's Job Offer Fraud Statement.
 
Our Benefit Programs: Employee Benefits: Bausch + Lomb
 
Applicants must be authorized to work for ANY employer in the U.S. We are unable to sponsor or take over sponsorship of an employment Visa at this time.

Product Cybersecurity Architect

Ironsail

Lead Security EngineerLocation: RemoteCompensation$20.00&ndash;$30.00 USD per hourThis position is compensated in U.S. Dollars (USD) regardless of the candidate's country of residence.For candidates outside the United States, compensation will still be paid in USD and converted by your payment provider or financial institution based on applicable exchange rates.Employment Type: Full-Time Independent ContractorAbout IronsailIronsail is an AI-driven healthcare technology company seeking a Lead Security Engineer to become our first dedicated security hire and build our security program from the ground up.This is not a compliance role.This is not a governance role.This is not a policy-writing position.This is not a traditional CISO role.This is a highly technical engineering position for someone who enjoys solving difficult infrastructure and security problems.We are looking for an engineer who evolved into security.The strongest candidates typically started their careers as:<ul><li>DevOps Engineer</li><li>DevSecOps Engineer</li><li>Infrastructure Engineer</li><li>Systems Engineer</li><li>Cloud Engineer</li><li>Site Reliability Engineer (SRE)</li><li>Security Engineer</li><li>Senior Software Engineer with infrastructure ownership</li></ul>If your experience is primarily governance, compliance, auditing, consulting, or risk management, this role is unlikely to be the right fit.If you've personally built infrastructure, secured cloud environments, automated deployments, implemented production security controls, and enjoy owning technical outcomes, we'd love to speak with you.Why This Role Is DifferentThis isn't joining an existing security department.You'll build it.You'll become the technical owner responsible for designing, implementing, and continuously improving security across our cloud infrastructure, applications, engineering processes, and internal systems.You'll work directly with Engineering, DevOps, Product, and Leadership to establish security as a core engineering function&mdash;not a compliance checkbox.You'll have significant autonomy to shape how security is implemented across the company.Why We're HiringFollowing a recent internal security review, we've identified several areas requiring dedicated ownership, including:<ul><li>Privileged Access Management (PAM)</li><li>Endpoint security</li><li>Identity &amp; Access Management (IAM)</li><li>Vulnerability Management</li><li>Backup &amp; Disaster Recovery</li><li>Security monitoring and alerting</li><li>Security automation</li><li>Formal onboarding and offboarding processes</li><li>Access governance</li><li>Security architecture ownership</li></ul>Today these responsibilities are distributed across Engineering and DevOps.We want one experienced engineer to own them.What You'll DoSecurity Engineering<ul><li>Assess existing cloud infrastructure and security posture</li><li>Design and implement security architecture improvements</li><li>Harden Linux systems and cloud environments</li><li>Secure applications, endpoints, and production infrastructure</li><li>Design practical remediation strategies</li><li>Build scalable security standards</li></ul>Implement and manage<ul><li>Privileged Access Management (PAM)</li><li>Identity &amp; Access Management (IAM)</li><li>Multi-Factor Authentication (MFA)</li><li>Endpoint Detection &amp; Response (EDR)</li><li>Backup &amp; Disaster Recovery</li><li>Network Security</li><li>Secrets Management</li></ul>Vulnerability ManagementBuild and own our vulnerability management program.Responsibilities include:<ul><li>Nessus</li><li>Qualys</li><li>Security monitoring platforms</li><li>Alerting</li><li>Security metrics</li><li>Configuration reviews</li><li>Security code reviews</li><li>Internal security assessments</li><li>Access reviews</li><li>Phishing simulations</li></ul>Own remediation through completion.Security Operations<ul><li>Respond to incidents</li><li>Perform root cause analysis</li><li>Improve monitoring</li><li>Automate repetitive security tasks</li><li>Improve operational resilience</li><li>Design secure engineering workflows</li></ul>Identity &amp; Access ManagementOwn:<ul><li>Employee onboarding</li><li>Employee offboarding</li><li>Role-based access control</li><li>Privileged account governance</li><li>Least-privilege access</li><li>Periodic access reviews</li></ul>ComplianceSecurity comes first.Compliance follows.You'll support initiatives including:<ul><li>HIPAA</li><li>SOC 2</li><li>ISO 27001</li></ul>You'll also:<ul><li>Support vendor security reviews</li><li>Coordinate penetration tests</li><li>Assist cyber insurance requirements</li><li>Drive remediation of audit findings</li></ul>AI-First EngineeringIronsail is an AI-first engineering company.We expect our Lead Security Engineer to use AI every day.Examples include:<ul><li>Threat investigations</li><li>Security research</li><li>Log analysis</li><li>Incident response</li><li>Security automation</li><li>Python scripting</li><li>Report generation</li><li>Vulnerability remediation</li><li>Infrastructure analysis</li></ul>We expect candidates to already be comfortable using tools such as:<ul><li>Claude</li><li>ChatGPT</li><li>Gemini</li><li>Cursor</li><li>GitHub Copilot</li><li>Similar AI engineering tools</li></ul>Candidates should be able to explain how AI improves their daily engineering workflow.Required QualificationsWe are specifically looking for engineers.Candidates should have 7+ years of hands-on experience in one or more of the following:<ul><li>DevOps Engineering</li><li>DevSecOps</li><li>Infrastructure Engineering</li><li>Systems Engineering</li><li>Cloud Engineering</li><li>Site Reliability Engineering (SRE)</li><li>Security Engineering</li><li>Senior Software Engineering with infrastructure ownership</li></ul>Required Technical ExperienceYou have personally implemented production security controls including:<ul><li>Linux administration</li><li>AWS, Azure and/or GCP</li><li>Identity &amp; Access Management</li><li>Privileged Access Management</li><li>MFA</li><li>Endpoint Detection &amp; Response</li><li>Vulnerability Management</li><li>Network Security</li><li>Backup &amp; Disaster Recovery</li></ul>You also have experience with:<ul><li>Python</li><li>Bash</li><li>PowerShell</li><li>CI/CD security</li><li>Infrastructure as Code</li><li>Kubernetes</li><li>Docker</li><li>Cloud-native infrastructure</li></ul>What We're Looking ForYou are a builder.You can walk into an unfamiliar environment, quickly understand how systems work, identify the highest-risk security issues, prioritize what matters, and begin implementing improvements.You've built security programs&mdash;not simply audited them.You don't hand engineering teams a list of recommendations.You implement the solutions yourself.You enjoy startups, ambiguity, ownership, and solving difficult engineering problems.Nice to Have<ul><li>Healthcare or pharmaceutical experience</li><li>HIPAA</li><li>CyberArk</li><li>Delinea</li><li>HashiCorp Vault</li><li>Kubernetes Security</li><li>Terraform</li><li>Incident Response</li><li>Digital Forensics</li></ul>Certifications are appreciated but not required, including:<ul><li>CISSP</li><li>CISM</li><li>CISA</li><li>Security+</li><li>AWS Security Specialty</li></ul>This Role Is Not a Fit If<ul><li>Your experience is primarily governance, compliance, or auditing.</li><li>You have never personally implemented production security controls.</li><li>You rely on engineering teams to deploy your recommendations.</li><li>You prefer strategy and policy over hands-on engineering.</li><li>You are uncomfortable being the first dedicated security owner.</li></ul>Why Join IronsailThis is a rare opportunity to build an engineering-driven security program inside a fast-growing AI healthcare technology company.You'll work directly with leadership, engineering, and DevOps to shape how security is designed, implemented, and scaled across the organization.If you're excited by ownership, autonomy, technical challenges, and the opportunity to build something from the ground up, we'd love to hear from you.Job Type: ContractPay: &pound;15.11-&pound;22.66 per hourApplication question(s):<ul><li>Have you personally been responsible for building or significantly improving a security program in an organization where no dedicated security function previously existed?</li><li>Do you actively use AI tools (ChatGPT, Claude, Gemini, Copilot, Cursor, etc.) as part of your daily cybersecurity workflow?</li><li>Have you personally implemented and managed security controls such as PAM, MFA, endpoint protection, vulnerability management, or access control systems in a production environment?</li><li>Are you comfortable serving as the first dedicated security hire and independently identifying, prioritizing, and remediating security risks with minimal oversight?</li></ul>Work Location: Remote

Lead Security Engineer - Independent Contractor

Voxquill

<div>I'm looking for our founding engineer!
 
The person who takes a live, paying fintech product and makes it truly ours.
We build receipt-and-proof automation for the self-employed: the app quietly finds your receipts (email, bank feeds, camera roll, texts), sorts them, matches them to your bank transactions, and produces accountant-ready exports. It's live on iOS and Android, it's SOC 2 certified, and people are paying for it. The model works.
I need one person who treats this codebase as theirs, ships fast, and owns the platform end-to-end. This is a founding engineer role with a real path to CTO.
Your first job is to take the keys.
 
Move the platform off the agency's Azure into ours, take custody of production, and the headline deliverable.
 
Build the automated test suite this codebase never had, with a CI/CD pipeline where a green build genuinely means &quot;safe to ship.&quot; Then you own the roadmap.
How we build matters as much as what we build.
 
We are not rebuilding an IT shop of tickets and manual QA.
 
Terrapin runs as an AI-native pod: Claude Code and agents do the repetitive work and produce tested, PR-ready changes; you own architecture, review, security, and the hard 20%.
 
AI gives you the velocity, your tests and pipeline are what keep that velocity from turning into breakage!
We want to ship multiple times a week and almost never break anything, and hold our SOC 2 line the whole way. If that model excites you rather than worries you, you're the person.
This is genuinely full-stack.
 
Strong .NET / C# backend on Azure, real ownership of infra, security, and DevOps, and polished mobile (React Native + Expo, iOS and Android); Because the app is the product. Testing isn't someone else's job here. It's the core discipline.
The kind of person whose teammates would describe as:<ul><li>
an owner, not a ticket-taker</li><li>
obsessive about shipping quality fast</li><li>
calm owning production for a product with real money moving through it</li><li>
someone who builds automation instead of doing the same thing twice</li><li>
security-minded by instinct, not as an afterthought</li></ul>
What you'd bring:<ul><li>
Senior+ .NET / C# backend, PostgreSQL, solid API design</li><li>
Real Azure ownership: App Services, networking, Key Vault, identity, CI/CD (Azure DevOps or similar)</li><li>
Strong React Native + Expo mobile, with genuine UI/UX taste</li><li>
Test automation and CI/CD as a way of life &mdash; you write the tests with the code</li><li>
Hands-on building with Claude Code / agent tooling, and doing it safely in a SOC 2 world</li></ul>
Bonus points: fintech / payments background, Plaid experience, or applied LLM work.
And the reason the right engineer will actually stay: receipts are just the wedge. We're building toward a verifiable, tamper-evident record of an economic event. Proof that banks, insurers, and AI agents can consume directly. Stripe is a payment rails. We're building proof rails.
You'd work directly with me every day &mdash; 18+ years in fintech and payments, two exits behind me &mdash; so you own the engineering but never carry the hard architecture, security, or product calls alone.
The details:
 
UK or EU-remote(temporarily), with solid overlap to UK hours and business trips.
We're genuinely open to strong candidates across both. Being open to relocating to the UK down the line is a plus, but not a day-one requirement.
 
Competitive base plus real founding-level equity.
One hard line: you build quality in through tests and CI/CD. We're deliberately leaving the manual-testing, hope-it-works world behind, and a dev who treats testing as optional isn't the hire. Everything else, we can talk about.
If you want founder-level ownership, a CTO trajectory, and an AI-native way of building, and owning a live fintech platform from week one lights you up, let's talk.
Apply and tell me about something you shipped that you're proud of, and one thing you broke and how you made sure it never happened again.</div>

Founding Engineer (Full Stack); Patch to CTO

Heygen

<div><div><h2 class="jobSectionHeader">About HeyGen</h2>

At HeyGen, our mission is to make visual storytelling accessible to all. Over the last decade, visual content has become the preferred method of information creation, consumption, and retention. But the ability to create such content, in particular videos, continues to be costly and challenging to scale. Our ambition is to build technology that equips more people with the power to reach, captivate, and inspire audiences. 
Learn more at www.heygen.com. .</div><div>
Position Summary

As a Security Engineer at HeyGen, you will own the security posture of one of the fastest-growing AI companies in the world. You will partner directly with engineering teams to ship secure features, harden our cloud infrastructure, and build the compliance and trust programs that unlock enterprise deals. This is a high-impact, high-autonomy role for an engineer who thinks in threat models and ships code.

Key Responsibilities
<ul>
<li>Product &amp; Infrastructure Security: Partner with engineering teams as an embedded security expert &mdash; writing code, reviewing architectures, and building secure application features and infrastructure components from the ground up.</li>
<li>Fraud Detection &amp; Remediation: Design and implement automated fraud detection systems to mitigate platform abuse, credential stuffing, and payment fraud. Partner with product and engineering to build real-time monitoring and rapid-response remediation workflows.</li>
<li>Cloud &amp; Vulnerability Management: Own the strategy and execution for hardening our AWS/Python infrastructure. Build and run a robust vulnerability management program, including network security, cloud configuration, and remediation workflows.</li>
<li>AI Security: Serve as HeyGen's point person for AI and agentic system security. As we scale our agentic coding and AI agent products, you will ensure these rollouts are designed and deployed with strong security controls.</li>
<li>GRC &amp; Compliance: Oversee our SOC 2 compliance operations (currently managed via Drata) and annual audit cycles. Evaluate and roadmap future certifications, including ISO 27001, as the business scales.</li>
<li>Trust &amp; Safety Oversight: Provide high-level oversight for platform abuse and content moderation (in partnership with growth and avatar teams), and serve as the escalation point for IT security incidents.</li>
</ul>
Qualifications
<ul>
<li>Strong software engineering background with hands-on Python and AWS experience; you write code, not just policies.</li>
<li>Demonstrated experience securing cloud infrastructure and applications &mdash; vulnerability management, network security, IAM, and secrets management.</li>
<li>Familiarity with GRC frameworks and compliance programs (SOC 2, ISO 27001, or equivalent).</li>
<li>Excellent communication skills: able to translate threat models for engineers, compliance requirements for auditors, and security architecture for enterprise CISOs.</li>
<li>Comfortable with ambiguity and rapid scale; you prioritize ruthlessly and know when to build vs. buy.</li>
<li>Experience with modern security tooling is a plus (Drata, Infisical, Bugcrowd, or equivalents).</li>
</ul>
Why HeyGen:
<ul>
<li>Massive Scale, Unique Problems: We are protecting user identity at one of the fastest growth rates in SaaS history. The security engineering challenges here are genuinely novel.</li>
<li>Speed with Guardrails: Our security philosophy is not about saying &quot;no.&quot; It is about building guardrails that let the engineering team ship fast without introducing unacceptable risk.</li>
<li>Mature Tooling from Day One: We already run Drata for GRC, Infisical for secrets management, and a private bug bounty program via Bugcrowd. You are not starting from zero.</li>
<li>Autonomy and Ownership: You will have the visibility and resources to shape HeyGen's entire security roadmap. Small team, big mandate.</li></ul></div></div>

Security Engineer

JAWRAA

<div>
 
 Jawraa is a leading digital transformation partner committed to empowering businesses in Saudi Arabia. With over two decades of experience, we've helped organizations navigate the evolving digital landscape and achieve their goals. Our deep industry expertise and strategic partnerships with top-tier technology providers set us apart.
 
 
 
 
 
 
 About the job :
 
 
 
 We are looking for a Senior Cloud Engineer with deep expertise in Google Cloud Platform (GCP) to join our growing engineering team. In this role, you will be responsible for designing, building, and maintaining scalable, secure, and highly available cloud infrastructure that powers our core products and services. You will partner with software engineers, data teams, and security to lead cloud-native transformation initiatives and champion best practices across the organization.
 
 
 
 
 
 
 Key Responsibilities :
 
 
 
 
 Infrastructure Architecture &amp; Design
 
 
 
 &bull; Architect and implement highly available, fault-tolerant, and scalable cloud solutions on GCP
 
 
 &bull; Lead the design of GCP-native infrastructure using services such as GKE, Cloud Run, Compute Engine, Cloud SQL, BigQuery, Pub/Sub, and Cloud Storage
 
 
 &bull; Define infrastructure standards, patterns, and reference architectures for engineering teams
 
 
 
 
 
 
 DevOps &amp; Automation
 
 
 
 &bull; Build and maintain Infrastructure as Code (IaC) using Terraform and Google Deployment Manager
 
 
 &bull; Design and manage CI/CD pipelines using Cloud Build, GitHub Actions, or similar tooling
 
 
 &bull; Automate cloud operations, monitoring, and remediation using scripting (Python, Bash, Go)
 
 
 
 
 
 
 Security &amp; Compliance
 
 
 
 &bull; Implement and enforce GCP security best practices including IAM, VPC Service Controls, and Cloud Armor
 
 
 &bull; Ensure compliance with regulatory frameworks (SOC 2, ISO 27001, GDPR) within the cloud environment
 
 
 &bull; Conduct regular security assessments and drive vulnerability remediation efforts
 
 
 
 
 
 
 Reliability &amp; Performance
 
 
 
 &bull; Define and maintain SLIs, SLOs, and error budgets for cloud infrastructure services
 
 
 &bull; Lead incident response, root cause analysis, and blameless post-mortems
 
 
 &bull; Optimize cloud resource utilization and drive cost management through FinOps practices
 
 
 
 
 
 
 Collaboration &amp; Leadership
 
 
 
 &bull; Mentor junior and mid-level cloud engineers and promote a culture of learning
 
 
 &bull; Collaborate with product, data, and security teams to align cloud strategy with business goals
 
 
 &bull; Document architecture decisions, runbooks, and operational procedures
 
 
 
 
 
 
 Google Cloud Networking
 
 
 
 &bull; Design and manage Google Cloud VPC networks, subnets, firewall rules, and network policies
 
 
 &bull; Configure and optimize Cloud Load Balancing (HTTP(S), TCP/SSL, Internal) for high-availability workloads
 
 
 &bull; Implement Cloud CDN, Cloud DNS, and Traffic Director for global traffic management
 
 
 &bull; Set up and manage hybrid connectivity using Cloud Interconnect (Dedicated &amp; Partner) and Cloud VPN
 
 
 &bull; Deploy and configure Shared VPC and VPC Network Peering for multi-project architectures
 
 
 &bull; Apply network security controls including Cloud Armor (WAF/DDoS), VPC Service Controls, and Private Google Access
 
 
 &bull; Monitor and troubleshoot network performance using Network Intelligence Center, Connectivity Tests, and VPC Flow Logs
 
 
 &bull; Design private networking for GKE clusters using Alias IP ranges, Cloud NAT, and Private Service Connect
 
 
 
 
 
 
 Requirements :
 
 
 
 &bull; Bachelor's degree in Computer Science, Information Technology, Engineering, or a related technical field &mdash; or equivalent practical experience.
 
 
 &bull; 7+ years of experience in cloud engineering, with at least 5 years hands-on with GCP
 
 
 &bull; Deep expertise in GCP services: GKE, Cloud Run, BigQuery, Pub/Sub, Cloud Functions, VPC, IAM
 
 
 &bull; Proficiency in Infrastructure as Code using Terraform
 
 
 &bull; Strong programming/scripting skills in Python, Go, or Bash
 
 
 &bull; Experience with Kubernetes and containerized workloads
 
 
 &bull; Hands-on experience with CI/CD tooling and GitOps workflows
 
 
 &bull; Solid understanding of networking concepts: DNS, VPNs, load balancing, CDN, TCP/IP
 
 
 &bull; Experience implementing security controls and compliance in cloud environments
 
 
 &bull; Google Cloud Professional certifications (Cloud Architect, DevOps Engineer, Security Engineer)
 
 
 &bull; Experience with multi-cloud or hybrid cloud architectures
 
 
 &bull; Familiarity with data engineering tools: Dataflow, Dataproc, BigQuery ML
 
 
 &bull; Experience with service mesh technologies (Istio, Anthos Service Mesh)
 
 
 &bull; Background in SRE principles and practices
 
 
 
 
 
 
 
 
 
 Required Specialized Certifications :
 
 
 
 Google Professional Cloud Architect
 
 
 Google Professional DevOps Engineer
 
 
 Google Professional Cloud Security Engineer
 
 
 Google Associate Cloud Engineer
 
</div>

Senior Cloud Engineer {GCP}

Search 6164+ Product security engineer jobs near you this July. New roles added regularly across leading industries. Apply today.