• Punët
• Rreth nesh
• Për punëdhënësit

Security operations and incident readiness

• Help establish and improve logging, detection and protective monitoring capabilities across infrastructure, corporate systems and internal applications
• Develop and improve incident response processes, runbooks and exercises
• Work closely with system owners to identify security gaps, prioritise remediation and verify that implemented controls effectively reduce risk

Vulnerability management and coordinated disclosure

• Participate in the security triage rotation, assessing incoming vulnerability reports, validating findings and prioritising remediation
• Collaborate with engineering teams to coordinate vulnerability remediation, verify fixes and support secure patch and release processes
• Help manage our vulnerability disclosure and bug bounty programmes, including engagement with security researchers, coordinated disclosures and GitHub Security Advisories

Customer trust and compliance engineering

• Support SOC 2 compliance through continuous control monitoring, automated evidence collection and processes that make security assurance part of everyday operations
• Collaborate with Sales, Solutions Engineering and Customer Success to respond to customer security assessments and build reusable resources
• Partner with Legal, Finance, IT and other stakeholders to assess security risks, improve security policies and controls, and strengthen trust with enterprise customers

We’re hiring two Security Engineers with complementary strengths, so you don’t need to be an expert in every security domain.

Must-haves

• Threat modelling and risk assessment: hands-on experience assessing real-world systems, identifying risks, determining defensible severity levels and recommending practical controls
• Technical security expertise: ability to validate findings, reproduce vulnerabilities, develop proof-of-concepts and write code or automation when needed
• Security engineering experience: hands-on work in infrastructure, product or application security within a product-focused organisation
• Cross-functional influence: comfortable acting as an internal security consultant and influencing stakeholders without direct authority
• Risk remediation and ownership: experience securing systems you don’t directly own and translating findings into actionable requirements
• AI and LLM fluency: comfortable using LLM-assisted tooling and aware of its limitations, security implications and failure modes
• Clear communication: ability to explain complex risks and provide guidance that technical and non-technical stakeholders can act on

Deep expertise in at least two of the following

• Application security: security checks, engineering guardrails, tooling or guidance that helps product teams ship secure software
• Platform security: securing a major cloud provider and Kubernetes environments, including sandboxing, multi-tenancy or identity
• Corporate security: identity and access management, endpoint security, employee access lifecycles or data access controls
• Security monitoring: logging, protective monitoring or security detection capabilities supporting investigation and incident response
• Security assurance and compliance: SOC 2 or ISO 27001 from an engineering perspective, including technical controls or automated evidence collection

Nice-to-haves

• Vulnerability disclosure: operating bug bounty or coordinated disclosure programmes, including publishing GHSAs or CVEs
• AI and agent security: assessing or securing LLM-powered applications and AI agents, including permissions, tool access, prompt injection or sensitive data
• Corporate IT tooling: familiarity with Okta, Azure or Drata
• Open-source ecosystems: experience with open-source or source-available products, or contributions to security communities
• Penetration testing: practical experience identifying, demonstrating and helping remediate vulnerabilities
• Early-stage security experience: being an early security hire or establishing security practices in a startup or scaling organisation

Security operations and incident readiness

• Help establish and improve logging, detection and protective monitoring capabilities across infrastructure, corporate systems and internal applications
• Develop and improve incident response processes, runbooks and exercises
• Work closely with system owners to identify security gaps, prioritise remediation and verify that implemented controls effectively reduce risk

Vulnerability management and coordinated disclosure

• Participate in the security triage rotation, assessing incoming vulnerability reports, validating findings and prioritising remediation
• Collaborate with engineering teams to coordinate vulnerability remediation, verify fixes and support secure patch and release processes
• Help manage our vulnerability disclosure and bug bounty programmes, including engagement with security researchers, coordinated disclosures and GitHub Security Advisories

Customer trust and compliance engineering

• Support SOC 2 compliance through continuous control monitoring, automated evidence collection and processes that make security assurance part of everyday operations
• Collaborate with Sales, Solutions Engineering and Customer Success to respond to customer security assessments and build reusable resources
• Partner with Legal, Finance, IT and other stakeholders to assess security risks, improve security policies and controls, and strengthen trust with enterprise customers

We’re hiring two Security Engineers with complementary strengths, so you don’t need to be an expert in every security domain.

Must-haves

• Threat modelling and risk assessment: hands-on experience assessing real-world systems, identifying risks, determining defensible severity levels and recommending practical controls
• Technical security expertise: ability to validate findings, reproduce vulnerabilities, develop proof-of-concepts and write code or automation when needed
• Security engineering experience: hands-on work in infrastructure, product or application security within a product-focused organisation
• Cross-functional influence: comfortable acting as an internal security consultant and influencing stakeholders without direct authority
• Risk remediation and ownership: experience securing systems you don’t directly own and translating findings into actionable requirements
• AI and LLM fluency: comfortable using LLM-assisted tooling and aware of its limitations, security implications and failure modes
• Clear communication: ability to explain complex risks and provide guidance that technical and non-technical stakeholders can act on

Deep expertise in at least two of the following

• Application security: security checks, engineering guardrails, tooling or guidance that helps product teams ship secure software
• Platform security: securing a major cloud provider and Kubernetes environments, including sandboxing, multi-tenancy or identity
• Corporate security: identity and access management, endpoint security, employee access lifecycles or data access controls
• Security monitoring: logging, protective monitoring or security detection capabilities supporting investigation and incident response
• Security assurance and compliance: SOC 2 or ISO 27001 from an engineering perspective, including technical controls or automated evidence collection

Nice-to-haves

• Vulnerability disclosure: operating bug bounty or coordinated disclosure programmes, including publishing GHSAs or CVEs
• AI and agent security: assessing or securing LLM-powered applications and AI agents, including permissions, tool access, prompt injection or sensitive data
• Corporate IT tooling: familiarity with Okta, Azure or Drata
• Open-source ecosystems: experience with open-source or source-available products, or contributions to security communities
• Penetration testing: practical experience identifying, demonstrating and helping remediate vulnerabilities
• Early-stage security experience: being an early security hire or establishing security practices in a startup or scaling organisation