Security Engineer jobs in Tel Aviv-Yafo

The Company ZEST Security offers an AI-powered risk resolution platform that enables security and DevOps teams to remediate and mitigate cloud risks at a scale and speed that wasn't possible before. The Mission ZEST's mission is to bridge the gap between identifying cloud security risks and resolving them. It's not about opening tickets; it's about closing them. Role Description Conduct security research to identify vulnerabilities in cloud environments, including detecting and addressing CVEs Lead the design and implementation of security solutions for cloud infrastructure (AWS, Azure, GCP) Assess and mitigate cloud security risks, including misconfigurations, vulnerabilities, and compliance gaps Perform penetration testing and vulnerability assessments to identify new vulnerabilities Develop and maintain security policies, standards, and procedures for cloud services Contribute to security incident response processes, providing guidance on remediation and mitigation Design and implement automation scripts for vulnerability detection and remediation Conduct research on emerging threats, security tools and methodologies to enhance the overall security posture Qualifications 2+ years of experience in cloud security, with a strong focus on vulnerability management and research (CVE detection and mitigation) In-depth experience with cloud platforms such as AWS, Azure, and Google Cloud Platform Strong understanding of security concepts such as IAM, firewalls, encryption, key management, and network security Hands-on experience with vulnerability management and cloud misconfiguration (scanning and remediation) Hands-on experiences with cloud tools such as Wiz, Crowdstrike or other CNAPP tools Proven ability to identify and mitigate cloud vulnerabilities, including research into CVEs and applying patches or security workarounds Experience with DevSecOps practices, including integrating security into CI/CD pipelines Strong understanding of security standards and frameworks such as CIS, NIST, or ISO 27001 Experience in scripting and automation for security tasks (Python, Bash, PowerShell, etc.) Excellent analytical and problem-solving skills, with strong attention to detail Strong communication and collaboration skills, with the ability to work with cross-functional teams Preferred Qualifications Relevant certifications such as AWS Certified Security – Specialty, Certified Ethical Hacker (CEH), Certified Cloud Security Professional (CCSP), or Offensive Security Certified Professional (OSCP) Experience with Kubernetes security and container-based environments Knowledge of threat modeling and risk assessment methodologies

Overview We’re looking for an experienced and driven Senior Security Engineer to join our STORM security research group and help shape the security posture of Microsoft Specialized Cloud systems from the ground up. As part of our mission to embed security throughout the development lifecycle, you’ll lead security design reviews, threat modeling, and architectural security assessments across a wide range of technologies, from OS internals and virtualization to cloud platforms, containerized environments, application security, and AI-enabled systems. This role combines deep security engineering and architecture expertise with a forward-looking approach to AI-assisted security engineering. You’ll be expected to reason deeply about complex systems and review designs hands-on, while also using and building AI-powered capabilities that make security analysis more effective, scalable, and repeatable. This is a high-impact role for security engineers who thrive on technical depth, enjoy building, and want to influence secure design at scale. Responsibilities 🔍 What You’ll Do • Lead security design and architecture reviews and structured threat modeling engagements for complex systems. • Analyze systems and architectures to identify trust-boundary violations, architectural vulnerabilities, unsafe assumptions, and opportunities for security-driven redesign. • Partner closely with engineering and security teams to influence architecture early in the product lifecycle and guide teams toward secure design patterns. • Perform security analysis using a combination of deep manual investigation and AI-augmented workflows, applying engineering judgment to validate findings and challenge assumptions. • Design, prototype, and build AI-assisted security capabilities that augment design review, threat modeling, architecture analysis, vulnerability discovery, and other security engineering workflows. • Experiment with new approaches for combining security expertise, automation, and AI to improve the scale, depth, and consistency of security reviews. • Communicate security findings, design tradeoffs, and recommended mitigations clearly to both technical and non-technical stakeholders. • Drive security hardening and security-driven redesign efforts that address systemic weaknesses rather than individual vulnerabilities. • Help evolve our security engineering methodology, tooling, and practices as AI changes how both products and security analysis are built. Qualifications • Strong experience in security engineering, security architecture, or related technical security roles. • Deep technical knowledge in one or more of the following areas: • Operating system internals, including Windows/Linux, memory management, boot security, or platform security. • Virtualization, confidential computing, cloud architecture, or container security. • Containerized environments incl. Kubernetes and AKS • Application security and secure software development across services, APIs, and distributed systems. • Cloud-native security, including identity, secrets management, isolation, and service-to-service trust. • Experience building with modern AI technologies to solve real engineering or security problems and designing workflows where AI augments expert analysis 🌟 Preferred Qualifications • Expertise in structured threat modeling, architectural risk analysis, and reasoning about complex systems and trust boundaries. • Ability to prototype and build tools rather than only consume existing security tooling. • Experience integrating LLMs or AI agents with existing engineering workflows, tools, data sources, or analysis pipelines. • Experience applying AI to security problems such as threat modeling, design analysis, code analysis, vulnerability discovery, or security automation. • Understanding of security challenges introduced by AI-enabled systems and the ability to threat-model systems incorporating AI components. • Experience with scalable security analysis techniques, including static analysis, dynamic analysis, code analysis, or custom security automation. • Prior expertise and experience with Azure-based solutions and services • Strong understanding of secure coding and code review principles. 🤝 Leadership & Collaboration • Strong sense of ownership and responsibility. • Excellent communication skills, with the ability to articulate complex security issues and design tradeoffs clearly and persuasively. • Proven ability to lead cross-functional technical engagements and influence engineering teams without direct authority. • Analytical and curious mindset with a strong drive to understand how systems actually work. • Comfortable navigating ambiguity and working on problems where neither the security answer nor the engineering solution is predetermined. • Builder mindset: willing to experiment, prototype, iterate, and turn promising ideas into capabilities that other security engineers can use. 📈 Experience & Impact • 6+ years of experience in security engineering, architecture, software engineering, or related roles. • Demonstrated success leading security design reviews, threat modeling, or architectural security assessments for complex systems. • Track record of identifying and helping mitigate significant architectural or system-level security weaknesses. • Experience influencing engineering decisions and driving security improvements across organizational boundaries. This position will be open for a minimum of 5 days, with applications accepted on an ongoing basis until the position is filled. Microsoft is an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to age, ancestry, citizenship, color, family or medical care leave, gender identity or expression, genetic information, immigration status, marital status, medical condition, national origin, physical or mental disability, political affiliation, protected veteran or military status, race, ethnicity, religion, sex (including pregnancy), sexual orientation, or any other characteristic protected by applicable local laws, regulations and ordinances. If you need assistance with religious accommodations and/or a reasonable accommodation due to a disability during the application process, read more about requesting accommodations.

Description At Sunbit, we're building financial technology that puts people first. By combining intelligent decisioning with a personalized, transparent approach, we help consumers access the payment options that are right for them while empowering merchants to build stronger customer relationships. Engineering is at the heart of how we make that happen. We build scalable distributed systems, cloud-native services, intelligent data platforms, and AI-powered solutions that enable real-time financial decisions at scale. By leveraging modern engineering practices and integrating AI into both our products and development workflows, we solve complex technical challenges, accelerate innovation, and continuously improve the way we build software. Every service, model, and architectural decision we make directly impacts our products, our customers, and the future of financial technology. About the Role We are looking for an Application Security Engineer to join our Security Engineering team. You will take ownership of strengthening security across Sunbit’s products, services, and development lifecycle. This includes identifying and addressing security gaps in application architecture and code, APIs and service-to-service communication, authentication and authorization flows, open source dependencies and third-party libraries, CI/CD pipelines and build systems, secrets handling, and AI-powered product features. As a Security Engineer at Sunbit, you will dig into how our systems actually work, understand where the real risk is, and decide what needs to be built to close it. Some problems are solved by changing an architecture or a design pattern, others by implementing a new control, embedding a security gate into the pipeline, integrating and tailoring a security platform, or writing something from scratch. You will own that decision and the implementation that follows. The Security Engineering team works as a group of all-rounders. Alongside your core focus, you will contribute to cloud and infrastructure security, corporate IT security, detection engineering, incident response, and our growing AI security work, both securing AI workloads and using AI to make our own security capabilities better. What You Will Work On • Identify security gaps across Sunbit’s applications, services, and development lifecycle, then translate them into practical technical solutions. • Design and implement scalable security controls that address root causes and fit our architecture and engineering practices. • Review architectures and designs, run threat modeling, and guide R&D teams toward secure patterns before code is written. • Secure APIs, authentication and authorization flows, service-to-service trust, data handling, and multi-tenant boundaries. • Own the secure development lifecycle end to end, including security gates in GitHub Actions, SAST, SCA, secrets scanning, and dependency and supply chain risk. • Build reusable security capabilities, libraries, paved-road patterns, and developer-facing tooling that make the secure path the default path. • Build custom AI agents and AI-powered capabilities that improve our security tools, workflows, visibility, and control. • Understand and secure AI-powered product features, including their data access, identities, permissions, integrations, and runtime behavior. • Partner with R&D, DevOps, Infrastructure, Data, AI, and IT teams from initial analysis through implementation, adoption, and validation. Requirements • At least 5 years of hands-on experience in application security, product security, security engineering, DevSecOps, or a related field. • Strong experience securing production applications and services, including APIs, microservices, and cloud-native workloads on AWS and Kubernetes. • Proven ability to identify security gaps, design appropriate controls, and take solutions through implementation. • Hands-on experience with secure code review, threat modeling, API security, and common vulnerability classes in modern application stacks. • Practical experience embedding security into CI/CD and GitOps workflows, including GitHub Actions, SAST, DAST, SCA, and secrets scanning. • Strong understanding of authentication and authorization, session management, secrets management, cryptography in practice, TLS, SSO, SAML, and OIDC. • Ability to read and write code in at least one modern language, and enough engineering depth to work as a peer to developers. • A broad security mindset, strong engineering judgment, and the ability to collaborate effectively with technical teams. Nice to Have • Experience building AI agents, LLM-based tools, or AI-powered security capabilities. • Experience assessing or securing AI workloads, including data exposure, prompt injection, agent permissions, and third-party integrations. • Experience with ASPM platforms, WAF, bot and abuse prevention, or runtime application protection. • Familiarity with cloud and infrastructure security, Terraform, policy as code, and container security. • Offensive security background, such as penetration testing, bug bounty, or exploit development. • Experience working in a regulated fintech or financial services environment. Recruitment Fraud Disclaimer We’ve been made aware of fraudsters impersonating Sunbit employees during the hiring process. Please note that all official communication will come from an @sunbit.com email address, through our applicant tracking platform @sunbit.comeet-notifications.com or directly via LinkedIn. We will never ask for your age, Social Security number, bank account details, payment of any kind, or other unrelated personal information during the application process. Our hiring process always includes interviews, either by phone, zoom, or in person, before any offer is made. If something feels suspicious, please contact us at HR to confirm. We ask that you contact HR only about potential instances of fraud. HR does not reach our recruiting team directly. Your application directly through the posting is the best way to ensure that your candidacy is reviewed by our team. Due to the volume of applications, we will not respond to nor forward emails about your candidacy that are sent to HR directly, and your email about your application will be deleted from our systems.

Description We run Crown Coins, a high-traffic social gaming platform on AWS and GCP. You'll join the Platform team and own day-to-day security across our cloud, identity, edge and endpoints. You'll automate that work with AI, and work with engineering to stop bot abuse and fraud before it costs us money. Responsibilities • Cloud security (AWS + GCP): Enforce least-privilege IAM and org guardrails (SCPs and GCP org policies). Monitor and triage cloud security findings and audit logs. Harden our EKS clusters. • Identity and access: Run JumpCloud and Google Workspace as our identity layer: SSO, MFA, access reviews and device policies. • Edge protection: Own Cloudflare WAF, bot management, rate limiting and Zero Trust Access. Tune rules against signup bots, credential stuffing and abuse. • Browser and endpoint security: Manage Island Enterprise Browser policies, including DLP, data boundaries and access to sensitive admin tools. • Detection and response: Build alerts and write runbooks. Lead security incidents alongside SRE on-call, and follow through on post-incident fixes. • AI agents that triage security alerts, enrich them with context and suggest or apply a response Requirements • 2+ years in SecOps, cloud security, or SRE/DevOps with a strong security focus • Hands-on experience with AWS IAM and AWS security services, plus working knowledge of GCP • Admin experience with an identity provider (JumpCloud, Okta or Google Workspace), including SAML/OIDC SSO, MFA and SCIM • Experience with Cloudflare (WAF, rules, Zero Trust) or a comparable edge security platform • Terraform, Git and Python, plus hands-on experience building automation with LLMs or AI agents (such as Claude, OpenAI or MCP-based tools) Nice to have • Google Cloud Professional Cloud Architect certification • Island or another enterprise browser, or MDM tools • Kubernetes/EKS security: RBAC, network policies and image scanning • Fighting bots or fraud in gaming, fintech or e-commerce • SIEM or detection engineering experience • Other certifications such as AWS Security Specialty, Security+ or CCSK

Daylight is a security services company delivering Managed Agentic Security Services (MASS), including MDR, threat hunting, security data lake, and more, through a fundamentally different architecture than traditional security services providers. Daylight's architecture combines an agentic platform that runs the full cycle from detection to response with security experts from IR and threat hunting backgrounds. The platform collects identity and business context across systems to investigate alerts and continuously learns your environment. Security experts validate decisions, feed insights into the platform, optimize detections, and take over in case of an incident. The result: security teams move from firefighting to strategic work. We're looking for a Senior Security Engineer to join our globally distributed, high-impact security engineering team. You will design and implement detection logic, investigate alerts, and automate response mechanisms. As an early hire, you'll work closely with our platform and AI teams to shape how autonomous threat detection and response is built and delivered at scale. Responsibilities: • Lead Investigations: Triage, analyze, and respond to alerts across cloud, endpoint, and network environments with automation-first principles. • Build Detections: Write detection logic and behavioral rules as code that is clear, testable, and scalable. • Automate Response Workflows: Develop Go-based automation for enrichment, containment, and remediation playbooks. • Define Detection-as-Code Practices: Implement a detection and response framework with strong engineering fundamentals (testing, CI/CD, version • control). • Collaborate Across Functions: Partner with platform and AI teams to integrate detection logic into the broader Daylight stack. • Support DFIR: Participate in incident investigations and post-incident reviews; DFIR skills (memory, disk, or cloud forensics) are a strong plus. Requirements: • Security Operations Experience: 3+ years in detection engineering, incident response, or blue team roles. • Automation Mindset: You automate what others manually repeat. Experience building or integrating automated response systems is key. • Cloud-Native Awareness: Familiarity with detecting and responding to threats in cloud environments (AWS, GCP, or Azure). • DFIR Skills: Practical experience in digital forensics and incident response — logs, memory, containers, cloud. • Threat-Informed Thinking: Comfort with attacker tactics and techniques (MITRE ATT&CK, behavioral detection, threat modeling).

Senior Application Security Engineer About the role Unity builds the real-time 3D platform that powers games and interactive experiences, along with tools used across ads, automotive, aerospace, architecture, retail, energy, and government. Our Product Security team keeps that platform, and the software built on top of it, safe for millions of creators and their users. We are seeking a Senior Application Security Engineer with profound expertise in application security. In this role, you will execute fundamental AppSec tasks, including threat modeling, secure design reviews, code evaluation, and vulnerability management, leveraging both manual methods and advanced AI tooling. You will also help secure the AI systems Unity itself is building, including agentic tools and AI-assisted development workflows. You will work directly with engineering teams across the US and EMEA. What you will do • Lead threat modeling, secure design reviews, and penetration testing for Unity products and services, from the engine and editor to cloud services, APIs, and internal platforms. • Perform deep code review and manual testing on high-risk systems, using AI-assisted review processes and covering areas automated tooling cannot fully reach. • Build and operate security automation. Use and extend AI-assisted tooling for continuous code review, finding triage, and automated penetration testing, and step in where human judgment is required. • Secure Unity's AI and agentic systems. Assess AI-native products, LLM integrations, and agent workflows for the risks specific to them. • Partner with engineering teams to drive remediation, turning recurring findings into guardrails, secure defaults, and paved paths. • Investigate and respond to application security incidents, including root cause analysis and durable corrective action. • Contribute to Unity's secure development lifecycle and to compliance work. What you bring: domain expertise • 5+ years in application security, with a track record on complex, large-scale systems. • Strong command of secure coding and common vulnerability classes (OWASP Top 10 and beyond) • Hands-on secure development experience across several languages. • Practical penetration testing, security assessment, and vulnerability management experience with standard tooling (SAST, DAST, SCA, and manual techniques). • Experience with Cloud security (GCP, AWS, or Azure). • Working knowledge of authentication, authorization, cryptography, and secure architecture patterns. • Clear technical communication for both engineers and non-technical partners across regions. Preferred Qualifications • Experience in the technology, gaming industry or Ad tech. Denmark: Base Salary Range: kr702,200 – kr1,053,400 DKK grossIsreal Base Salary Range: ₪352,000 – ₪528,000 ILS gross This range reflects the anticipated base salary for this position. Beyond base salary, this role may be eligible for equity awards and participation in our company incentive plans (such as annual discretionary bonuses or sales commissions). The final offer amount will depend on several factors, including geographic location and the candidate’s relevant experience, professional background, and skill set. This range reflects the anticipated base salary for this position. Beyond base salary, this role may be eligible for equity awards and participation in our company incentive plans (such as annual discretionary bonuses or sales commissions). The final offer amount will depend on several factors, including geographic location and the candidate’s relevant experience, professional background, and skill set. Benefits At Unity, we want our team members to thrive. We offer a wide range of benefits designed to support well-being and work-life balance. Please note: Benefits eligibility, specific offerings, and coverage vary based on the country and employment status. While specific benefits vary, here are some of the ways we strive to take care of our eligible team members globally: Comprehensive health, life, and disability insurance | Commute subsidy | Employee stock ownership | Competitive retirement/pension plans | Generous vacation and personal days | Support for new parents through leave and family-care programs | Office food snacks | Mental Health and Wellbeing programs and support | Employee Resource Groups | Global Employee Assistance Program | Training and development programs | Volunteering and donation matching program Life at Unity Unity [NYSE: U] is the world’s leading game engine, powering play for more than 3 billion consumers each month. The top mobile games in the world, the most played PC indie titles, the most innovative console games, and virtually all of the top XR and Web Games are developed, deployed, and grown in Unity. Unity also enables teams across industries like automotive, manufacturing, and healthcare to design, simulate, and collaborate in 3D — closing the gap between ideas and reality. For more information, please visit www.unity.com. Unity is a proud equal opportunity employer. We are committed to fostering an inclusive, innovative environment and celebrate our employees across age, race, color, ancestry, national origin, religion, disability, sex, gender identity or expression, sexual orientation, or any other protected status in accordance with applicable law. Our differences are strengths that enable us to support the growing and evolving needs of our customers, partners, and collaborators. If you have a disability that means there are preparations or accommodations we can make to help ensure you have a comfortable and positive interview experience, please fill out this form to let us know. This position requires the incumbent to have a sufficient knowledge of English to have professional verbal and written exchanges in this language since the performance of the duties related to this position requires frequent and regular communication with colleagues and partners located worldwide and whose common language is English. This posting is intended to fill an existing vacancy, and we are committed to providing applicants with updates throughout the hiring process in accordance with applicable law. Headhunters and recruitment agencies may not submit resumes/CVs through this website or directly to managers. Unity does not accept unsolicited headhunter and agency resumes. Unity will not pay fees to any third-party agency or company that does not have a signed agreement with Unity. Your privacy is important to us. Please take a moment to review our Prospect and Applicant Privacy Policies. Should you have any concerns about your privacy, please contact us at [email protected].

Description Come join the company building the security operating model for the age of AI. AI has changed how data is used — and security must change with it. Cyera's mission is to empower businesses to accelerate AI Adoption by defining a holistic approach to securing AI - from data to access to model. Instead of perimeter controls and static policies, Cyera provides a unified control plane that understands relationships between data, access, and behaviors across humans, systems, and AI. Backed by the world's leading investors and working with a large and growing list of Fortune 1000 companies, we are looking for world-class talent to join us as we usher in the new era of data and AI security. About the Role Our customers trust Cyera with their most sensitive data, and we hold our own platform to the standard we set for the industry. We meet and exceed industry security standards, and we treat that as the baseline rather than the finish line. We're looking for an Application Security Lead to own product security inside R&D and be the focal point at Cyera for validating how secure our platform is. Your mandate is continuous assurance: proving, through hands-on adversarial testing and architecture-level review, that no gaps exist across our code, infrastructure, and architecture — and keeping it that way as we ship fast. You'll map our most sensitive areas, lead research and red team exercises against our own systems, run an internal bug bounty, define how R&D reasons about risk in development and production, and keep the engineering organization exercised and ready. This is a technical leadership role under Infrastructure, serving all of R&D and partnering closely with the Security organization, Product, and Engineering leadership. You'll start hands-on, with the mandate to build the function — and the team — around you. What you’ll do • Own product security end to end and be the trusted authority on Cyera's security posture for R&D leadership, the Security organization, and our customers — able to answer "how secure is our product?" with evidence. • Lead continuous adversarial validation of our code, infrastructure, and architecture, confirming the strength of authorization, tenant isolation, business logic, and every path to sensitive data. • Maintain a living map of Cyera's attack surface and sensitive data flows, and use it to focus assurance effort where the stakes are highest. • Run threat modeling and security architecture review for new services, integrations, cloud connectors, and multi-tenant components — early enough to shape the design. • Own multi-tenancy and customer data boundaries: tenant isolation, authorization logic, secrets and key handling, and the controls that keep every customer's data unreachable from any other. • Secure our AI and agentic surfaces — prompt injection, tool and agent authorization, and model and data boundaries for autonomous systems acting on customer data. • Lead red team exercises across production and pre-production, and run an internal bug bounty that puts Cyera engineers to work on our own code with real incentives and real follow-through. • Define risk management for our development and production environments: standards, severity models, security gates, and an exception process practical enough that teams follow it — and drive findings to verified, structural resolution. • Build the paved road for secure development: secure-by-default patterns and guardrails, SAST/DAST/SCA and secrets detection tuned so signal beats noise, and a security champions network across R&D. Scale assurance through automation and self-service rather than headcount. • Keep the engineering organization exercised and incident-ready — tabletop drills, detection and forensic coverage in our own environments, escalation paths, and runbooks. • Represent product security externally, supporting customer security reviews, questionnaires, third-party penetration tests, and CISO-level conversations alongside the Security organization. Requirements What You’ll Bring • 8+ years in application security or product security, including hands-on ownership of a security program. • Deep, current expertise in authentication and authorization, multi-tenant isolation, API and web security, cryptography and secrets management, software supply chain risk, and business logic vulnerabilities. • An attacker's mindset applied to systems you didn't build. You can read unfamiliar code, form a hypothesis about how it breaks, and prove it — and you can scope and direct red team work against your own organization. • Threat modeling and security architecture review as a practiced discipline, ideally at a scale serving many engineering teams at once. • Strong engineering background: you write code (Python, Go, TypeScript, Java, or similar), understand distributed systems, and hold credible design discussions with senior engineers. • Cloud-native security depth in AWS, GCP, or Azure — IAM, network boundaries, Kubernetes, containers, CI/CD security, and infrastructure-as-code — and comfort working shoulder-to-shoulder with DevOps and Infrastructure engineers. • Experience embedding security across the development lifecycle from design through deployment, including secure SDLC processes and developer-facing tooling. • Technical leadership without authority: driving security outcomes across engineering teams through credibility, clarity, and prioritization. Fluency in SOC 2, ISO 27001, or similar — enough to satisfy them efficiently, and the judgment to know where they stop. The judgment to separate real risk from theoretical risk, and to say so plainly to engineers and executives alike. Nice to have: • Experience at a cybersecurity startup, especially one where the product itself was the trust boundary. • Experience at a cloud-native SaaS company operating a multi-tenant platform at scale. • Experience in high-consequence data environments — payments, financial services, crypto, or healthcare. • Offensive security background: penetration testing, vulnerability research, exploit development, published CVEs, or service in an elite technology unit. • Experience building or running a bug bounty program. • Security experience with AI/ML systems, LLM applications, or agentic architectures — including using AI to scale security review itself. • Experience securing data platforms or pipelines processing large volumes of sensitive data. • Experience hiring, mentoring, and growing security engineers. • Contributions to the security community: research, open-source tooling, writing, or talks.

Description About Cyera Come join the company building the security operating model for the age of AI. AI has changed how data is used — and security must change with it. Cyera's mission is to empower businesses to accelerate AI Adoption by defining a holistic approach to securing AI - from data to access to model. Instead of perimeter controls and static policies, Cyera provides a unified control plane that understands relationships between data, access, and behaviors across humans, systems, and AI. Backed by the world's leading investors and working with a large and growing list of Fortune 1000 companies, we are looking for world-class talent to join us as we usher in the new era of data and AI security. About the Role Join our team as a Senior Application Security Engineer. You will be a senior technical leader in the application security program, working with R&D teams to build security into how we design, build, and ship our products. You will report to the Head of Application Security and act as the technical lead for some of the program’s most important workstreams. You will help build a modern product security program that uses automation, pipeline integration, and AI-assisted workflows rather than manual review alone. You will turn standards into guardrails engineers can use, find and fix real risk in our code and architecture, and make secure development the easy path. The ideal candidate has 6–9 or more years of cybersecurity experience, including at least 4 years in application security, strong software engineering skills, and a record of influencing engineering teams and mentoring other engineers. We are looking for someone who is credible in the code, clear in their communication, and focused on outcomes. What You’ll Do • Code and Design Review: Review high-risk code and designs, and help engineers fix issues at the root rather than one finding at a time. • Pipeline Security: Build and tune security checks in CI/CD, including static and dynamic analysis, dependency and container scanning, and secrets detection, with a focus on accuracy and low noise. • Vulnerability Triage and Remediation: Triage and prioritize vulnerabilities by real risk, work with engineering owners to drive remediation, and track progress against service levels. • Software Supply Chain: Improve visibility and control of third-party and open-source dependencies, including SBOM generation and accuracy. • Automation and AI: Develop automation and AI-assisted workflows for triage, code review, and reporting that remove manual work and scale the team. • Security Testing Partnership: Work with the offensive security team and perform penetration tests and bug bounty reports, and turn findings into fixes and better standards. • Product Security Incidents: Support the PSIRT process by analyzing reported vulnerabilities, assessing impact, and helping engineering ship and communicate fixes. • Standards and Enablement: Contribute to secure coding standards, guardrails, and a paved road for engineers, and run training or office hours that make teams more self-sufficient. • Mentorship and Technical Leadership: Mentor Security Engineers, review their work, and lead workstreams and projects across R&D with limited supervision. • Agentic AppSec Fleet: Design, build, and run a fleet of AI agents that take on AppSec work at scale, such as triaging scanner findings, validating exploitability, reviewing pull requests and designs for security issues, drafting threat models, proposing fixes, and routing vulnerabilities to the right owners. Define the guardrails, human approval points, evaluation methods, and audit trail that keep agent output accurate, safe, and trusted by engineers, and report the impact on risk and review capacity. What You’ll Bring • Experience: 6–9 or more years in cybersecurity, security engineering, or software engineering, including at least 4 years in application or product security. • Application Security Depth: Strong knowledge of common vulnerability classes, secure design, threat modeling, and authentication and authorization in cloud-native, API-driven applications. • Software Engineering Skills: Strong programming skills in at least one language such as Python, Go, Java, or TypeScript, and the ability to review other engineers’ code for security issues. • Security Tooling: Hands-on experience with application security tools, including SAST, SCA, DAST, and secrets scanning, and with integrating them into CI/CD pipelines. • Cloud and Containers: Working knowledge of at least one major cloud provider and of securing containerized workloads. • Influence: Track record of working with engineering teams to get security work prioritized and done. • Mentorship: Track record of developing other engineers. • Communication: Clear written and verbal communication with engineers, product teams, and senior leaders. Nice to Have • AI and Agentic Security: Experience securing LLM-based features and agent systems, including prompt injection and data exposure risks. • Offensive Security Skills: Experience in penetration testing, vulnerability research, or bug bounty work. • Software Supply Chain: Experience with SBOM tooling, dependency management, and build integrity. • Infrastructure and Cloud Posture: Familiarity with Terraform, Kubernetes security, and cloud posture tooling. • Certifications: OSCP, CSSLP, GIAC, or similar.

Description About Cyera Come join the company building the security operating model for the age of AI. AI has changed how data is used — and security must change with it. Cyera's mission is to empower businesses to accelerate AI Adoption by defining a holistic approach to securing AI - from data to access to model. Instead of perimeter controls and static policies, Cyera provides a unified control plane that understands relationships between data, access, and behaviors across humans, systems, and AI. Backed by the world's leading investors and working with a large and growing list of Fortune 1000 companies, we are looking for world-class talent to join us as we usher in the new era of data and AI security. About the Role Join our team as a Security Operations Engineer . You will own escalated investigations end to end, lead the response to moderate-scope incidents, and improve the detections, playbooks, and automations behind our agentic SOC. This is a role for someone who wants to spend more of their time improving the system than working the queue. You will also own a domain of our customer zero program, operating the Cyera platform in our own environment and turning operator experience into product feedback. You will also help newer Security Operations Engineers grow. You will join a team that is building a modern, AI-assisted SOC from the ground up at a fast-growing data and AI security company. Your work will directly shape how we detect and respond, how our agents operate, and how our product behaves. The ideal candidate has 2 to 4 years of experience in security operations or incident response, has led real incidents, writes production-quality Python, and is comfortable building and tuning detections. What you’ll do • Investigation Ownership: Own escalated investigations from triage to closure, including correlation, scoping, and remediation coordination. • Incident Response: Lead moderate-scope incidents, serve as a core responder on major incidents, and write after-action reports. • Detection Engineering: Build and tune detections across cloud, identity, SaaS, and endpoint telemetry, with test cases and documented rationale. • SOC Automation: Improve agent workflows, enrichment, and playbooks, and measure the effect on autonomous handling and time to resolution. • Customer Zero: Own a domain of our internal Cyera deployment: posture goals, remediation with data owners, and prioritized product feedback. • Threat Hunting: Run hypothesis-driven hunts and convert findings into detections or automations. • Mentorship: Review the work of newer Security Operations Engineers, pair on investigations, and help them build engineering habits. What You’ll Bring • Experience: 2 to 4 years in security operations, incident response, or detection engineering. • Incident Response: Experience leading or co-leading incidents, including containment decisions and post-incident write-ups. • AWS Knowledge: Working knowledge of AWS security services, IAM, logging, and common cloud attack paths. • AWS Certification: AWS Certified Cloud Practitioner required; Security Specialty or Solutions Architect Associate preferred. • Python: Hands-on proficiency, with automation others rely on. • SIEM and Detection: Experience building, tuning, and maintaining detections and investigating from raw logs. • Communication: Can write a clear incident report and brief a non-technical stakeholder. Nice to have: • AI Workflows: Hands-on work with LLM applications, agent frameworks, or AI-assisted security operations. • Detection Languages: Sigma, SQL, KQL, SPL, YARA, or similar. • Data Security: Experience with DSPM, DLP, or data access governance. • Infrastructure as Code: Terraform, CloudFormation, or CDK. • Certifications: GCIH, GCIA, GCFA, AWS Security Specialty, or similar.

About the role: This is an opportunity to join K's critical InfoSec team as a Senior Security Engineer - AppSec and operate with foresight in protecting our infrastructure, applications, cloud security, and customer trust. As a lean team, we span across multiple areas such as AppSec, CloudSec, SecOps, ITSec, and Compliance and apply it towards reading and interpreting architecture, or planning and building out net new security solutions. You will have the autonomy to define and implement cutting-edge security solutions across our entire technical ecosystem, ensuring our innovative work remains robust and compliant against evolving global threats. This role is crucial for establishing and maintaining a world-class security posture, particularly within the sensitive and highly regulated healthcare technology space. What you will do: • Lead the development and implementation of robust application security protocols throughout the entire Software Development Lifecycle (SDLC). • Partner with engineering teams to incorporate security into architecture, design, development, testing and deployment • Perform hands-on security testing of web applications, APIs, cloud-native services and supporting infrastructure • Build and improve automated security testing within CI/CI pipelines, including static analysis, dependency scanning, secrets detection, container scanning and dynamic testing • Evaluate effectiveness of application security tools, improve tooling output quality and reduce unnecessary findings and developer friction • Develop secure coding standards with developer-focused documentation • Contribute application security expertise to vulnerability management, during security incidents/investigations and post-incident reviews • Evaluate third party applications, libraries and APIs and integrations for security risk • Ensure adherence to relevant healthcare regulatory and compliance requirements (e.g., HIPAA, GDPR, etc.) across all product lines and systems. What we're looking for: • 4+ years of professional experience in application, product or software security, operating as an individual contributor, OR as a software engineer that has pivoted into security • Strong understanding of application security vulnerabilities and attach techniques, including OWASP Top 10 and API security risks • Experience performing manual security testing of modern web applications, APIs and distributed systems • Ability to review application architecture and source code for security weaknesses • Experience integrating application security tools into modern CI/CD workflows • Familiarity with static application security testing, dynamic testing, secrets detection, container security and infrastructure-as-code scanning • Understanding of authentication, authorization, session management, cryptography, secrets management and secure API design • Strong expertise in cloud technology (AWS, GCP, or Azure), modern programming languages, utilization of generative coding utilities, and the security implications of utilizing AI code development utilities. • Demonstrated experience researching, establishing, and successfully rolling out enterprise-wide security policies and guidelines. Bonus: • Exploring, partnering and implementing bleeding edge tech not readily available to others. • Experience with specific tools and tech K uses including but not limited to: Datadog, Sumologic, Torq, flare.io, GCP, Entitle, Okta, Orca, GitLab, Prisma Access Browser Who We Are: Behind every leading health system is K Health’s AI-powered virtual care engine. Our deeply integrated model modernizes the primary care loop by using AI to put humans first. For our patients, we offer clinical AI (i.e., PatientGPT) and unparalleled access to close care gaps around the clock. For our Providers, we deliver provider-serving agentic solutions (i.e., Perfect Note) to eliminate administrative overload and burnout. And for the health systems, we deploy our top-grade Virtualists in AI-powered virtual clinics 24/7 to capture the patients' care journeys at step one, retain the journey through the system for longitudinal care, and strengthen profitability. We’re founded in 2016, headquartered in New York City, and backed by over $443.5M from leading investors including Valor Equity Partners, Claure Group, Mangrove Capital Partners, 14W, Notable Capital, Lerer Hippeau, Primary Venture Partners, Comcast Ventures, PICO Venture Partners, Max Ventures, and other strategic healthcare partners. We offer competitive compensation packages based on industry benchmarks for function, level, and geographic location. Offer amounts are determined by multiple factors such as a candidate's experience and expertise. We are proud to be an Equal Opportunity Employer and consider applicants for employment regardless of race, ethnicity, religion, color, national origin, ancestry, disability, medical condition, genetic information, marital status, sex, gender, gender identity, gender expression, sexual orientation, pregnancy, childbirth and breastfeeding, age, citizenship, military or veteran status, or any other class protected by applicable federal, state, and local laws. We’re deeply committed to building teams as diverse as the patients we serve and strive to cultivate an environment where everyone can bring their most authentic self to work. We depend on our differences to make our team stronger, our workplace more dynamic, and our product accessible to all of our users. We are committed to maintaining the integrity of our hiring process and ensuring a safe environment for all candidates. All communication for job offers from K Health will come from email addresses ending in @khealth.com. K Health will never ask you to provide financial information about yourself during the recruitment process. We will never use personal email accounts or other domains for official correspondence. Our official job postings are only listed on our official website and reputable job boards. Be cautious of job offers from sources other than these platforms.

Applying to Paxos? Our only careers site is paxos.com/careers, and we only recruit via @paxos.com email. Details below. ___ About Paxos Today’s financial infrastructure is archaic, expensive, inefficient and risky — supporting a system that leaves out more people than it lets in. So we’re rebuilding it. We’re on a mission to open the world’s financial system to everyone by enabling the instant movement of any asset, any time, in a trustworthy way. For over a decade, we’ve built blockchain infrastructure that tokenizes, custodies, trades and settles assets for the world's leading financial institutions, like PayPal, Venmo, Mastercard, Interactive Brokers and Charles Schwab. About the team The Security team at Paxos protects the cloud infrastructure, crypto systems, endpoints, and network that our regulated financial platform runs on. You'll join the Detection and Response function, working alongside our 24x7 SOC, which handles first-line triage, and partnering with Product Security teams to validate that our coverage holds up against real attacker techniques. About the role The Senior Detection and Response Engineer at Paxos serves as a builder of the detections, hunts, and automations that protect our cloud infrastructure, crypto systems, endpoints, and network. You will write detections as code and automate response, and act as a purple teamer, emulating attacks alongside our Product Security teams to confirm our detections work. Our 24x7 SOC handles first-line triage, so your focus is the detection engineering, threat hunting, and validation that make our coverage effective. Strong hands-on investigation skills are expected, but they support this work rather than define it. What you'll do • Detection Coverage & Quality: Ship production-grade detections as code with measurable signal improvements—reducing false positives and closing gaps identified in purple team exercises. • Validated Defenses: Run purple team exercises with other teams to confirm detection effectiveness and identify blind spots. • Threat Hunting Program: Execute proactive hunts based on threat intelligence and convert findings into new detections and documented IOCs/TTPs. • Operational Efficiency: Build automations to accelerate investigation and triage; create and maintain runbooks and incident write-ups that make response consistent and repeatable across the team. • Detection Stack: Identify gaps and integrate best-in-class tools that increase team effectiveness and visibility across endpoints, cloud, network, and signing systems. About you • You bring 5-8+ years of experience in security operations, detection engineering, offensive security testing, or a related security engineering role — with a track record of scope growth, not just years. • You independently own complex, ambiguous, or multi-stage incidents from initial triage through containment, eradication, and recovery — making the call in the moment and building or improving the runbook afterward, rather than waiting for one to exist. • You bring deep, hands-on expertise in SIEM and EDR platforms, can design new detections from scratch, own detection strategy for a significant surface area, and meaningfully reduce false-positive rates across a rule set you own. • You can design and run purple-team exercises in partnership with other engineering teams, emulating real attacker techniques and using the findings to reshape the detection roadmap rather than just confirm what already works. • You have a strong point of view on what tools and architecture the team should invest in, not just how to use what's already there, and you make credible build-vs-buy calls. • You think like a builder and continuously find ways to automate repetitive security workflows, applying AI thoughtfully to improve the speed, consistency, and scale of investigation and response across the team. • You produce original threat intelligence assessments and run proactive threat hunts based on hypotheses, translating findings directly into new detections and a stronger detection roadmap. • You communicate fluently with engineering leadership and cross-functional stakeholders during major incidents, and your docs and retros shape team direction, not just record what happened. • You actively mentor junior members of the team, serve as a trusted technical escalation point, and have a track record of measurably accelerating others' growth. • You're comfortable participating in an on-call rotation and can act as incident commander when needed — driving structural fixes that prevent a class of incidents from recurring, not just one instance. Important Notice for Paxos Applicants Fraudulent accounts sometimes pose as Paxos recruiters on LinkedIn and other platforms, and fake websites sometimes impersonate our careers site. These scammers attempt to deceive applicants into paying for job opportunities or providing personal financial information. To verify a legitimate Paxos opportunity: • Our only official careers site is paxos.com/careers • We only use @paxos.com email addresses • We never ask for payment or financial details to apply, interview, or work here • For technical roles, we do not perform a coding interview without prior screening by our engineering team Thanks for your interest in Paxos!

At Semperis, our mission is to be a Force for Good. Starting with being a great place to work. We believe that when people feel valued, supported, and empowered, they do their best work. That’s why we focus on creating an employee experience rooted in purpose, growth, and balance. Semperis has been recognized as one of America’s Fastest-Growing Cybersecurity Companies by the Inc. 5000, a DUNS 100 Top Startup to Work For, and a multi-year Inc. Best Workplace awardee. Semperis is looking for a hands-on Senior Security Operations Engineer who wants to do more than monitor alerts and hand off tickets. In this role, you will have the rare opportunity to identify security problems, understand their root causes, and work directly with the teams responsible for fixing them. You will strengthen Semperis’ threat detection, incident response, vulnerability management, and cloud security operations through a combination of investigation, engineering, and automation. You will design and tune detections, lead investigations and response efforts, prioritize and route vulnerabilities and CSPM/CWP findings, improve security telemetry, and build capabilities that reduce manual effort and help the organization respond faster. This is an engineering-focused SecOps role- not a traditional alert-monitoring position. You will be expected to turn operational insights into durable improvements: better detections, stronger controls, cleaner telemetry, streamlined workflows, and measurable risk reduction. You will work closely with Cloud Security, Identity and IT, AppSec, Product Engineering, Platform Engineering, GRC, and service owners to secure Semperis’ corporate and cloud environments. You will also help shape how Semperis secures AI-enabled tools, agents, and automation as they become part of the way we work. If you enjoy moving from signal to solution—and want the autonomy and cross-functional access to make security improvements stick—this role is built for you. What You Will Do Threat Detection and Incident Response • Operate and improve SIEM, EDR, cloud, identity, email, and security monitoring capabilities. • Develop and tune detection rules, analytics, dashboards, alert routing, and investigation playbooks. • Investigate security alerts and incidents, including scoping, evidence collection, containment, remediation coordination, and recovery tracking. • Support high-severity incident response and contribute to post-incident improvements. Vulnerability and Cloud Security Operations • Lead SecOps triage of vulnerability, exposure, endpoint patching, and CSPM/CWP findings across endpoints, third-party applications, cloud environments, and other technology assets. • Validate findings, assess risk using business and technical context, assign ownership, establish remediation priorities, track patching and other corrective actions, manage exceptions, and verify closure. • Partner with Cloud Security on posture-management rules, alert tuning, cloud logging, and recurring misconfiguration analysis. • Define monitoring and detection requirements for new cloud services, SaaS capabilities, and significant architecture changes. • Monitor privileged activity, develop detections for risky identity, endpoint, and cloud administration behavior, and support endpoint-hardening efforts focused on least privilege, reduce local-administrator access, and secure configuration. Automation, Metrics, and Engineering • Build scripts, integrations, workflows, and playbooks that improve triage, enrichment, notification, containment, remediation tracking, and reporting. • Monitor log-source and connector health and improve telemetry coverage across cloud, identity, endpoint, SaaS, and network sources. • Maintain metrics covering MTTD, MTTR, alert quality, incident trends, detection coverage, vulnerability risk, CSPM/CWP exposure, and remediation performance. • Maintain clear runbooks, technical documentation, and operational records. AI Security, Guardrails, and Monitoring • Assess AI tools, agents, plugins, and MCP integrations for data access, identity, execution, retention, and supply chain risk. • Design and operate guardrails for least-privilege identities, read-only-by-default connectors, sandboxed execution, network-egress restrictions, and human approval before irreversible actions. • Monitor prompts, retrieved content, model outputs, tool calls, agent actions, and administrative changes for prompt injection, indirect prompt injection, sensitive data exposure, unsafe code, abnormal behavior, and policy violations. • Onboard AI audit and runtime telemetry into the SIEM and build detections and response playbooks for rogue tools, connector misuse, suspicious tool calls, data exfiltration, and agent compromise. • Run controlled pilots and adversarial tests, measure false positives and user impact, and promote controls from monitor or flag to block based on evidence. Cross-Functional Security Engineering • Translate security findings into clear actions, owners, priorities, and deadlines. • Provide practical security guidance to engineering and IT teams. • Mentor analysts and engineers through technical reviews, incident walkthroughs, and knowledge sharing. • Balance risk, engineering effort, availability, customer impact, and business priorities when recommending actions. What You Will Bring • 5+ years of hands-on experience in Security Operations, Security Engineering, Detection Engineering, Incident Response, or related field. • Strong experience with SIEM operations, detection engineering, alert triage, investigation, and incident response. • Practical experience with vulnerability management, endpoint patching and hardening, CSPM/CWP, cloud security posture, or attack-surface analysis. • Experience with Azure, AWS, or comparable cloud environments; multi-cloud experience is a plus. • Strong understanding of identity and access risks, privileged activity, risky sign-ins, and cloud administration. • Understanding modern AI security risks, including prompt injection, indirect prompt injection, excessive agency, data leakage, tool misuse, and AI supply-chain risk. • Ability to query and analyze security data using KQL, SQL, or equivalent language. • Ability to automate using Python, PowerShell, JavaScript, or a comparable language, including API integration. • Experience with endpoint, email, SaaS, cloud, and identity security telemetry. • Strong technical writing and communication skills, including the ability to work with distributed, cross-functional teams. • Ability to work independently, make sound decisions under pressure, and manage competing priorities. Preferred Qualifications • Experience with Microsoft Sentinel, Microsoft Defender, Log Analytics, SOAR, or comparable platforms. • Familiarity with MITRE ATT&CK, Sigma, YARA, threat hunting, or detection testing. • Experience with infrastructure-as-code, CI/CD, containers, or Kubernetes security. • Experience securing LLMs, AI agents, MCP or plugin ecosystems, AI-enabled SaaS tools, or AI runtime environments is a plus. • Experience with endpoint security capabilities such as endpoint privilege management, privileged access workstations, application control, and other least-privilege or attack-surface-reduction measures. • Experience supporting SOC 2, ISO 27001, NIST, FedRAMP, or similar assurance requirements. • Relevant security certifications or equivalent practical experience. Success Measures • Improved detection coverage and alert quality across priority security signals. • Consistent, risk-based triage and remediation of vulnerability, endpoint patching, and CSPM/CWP findings, with measurable improvement in patch compliance and endpoint-hardening coverage. • Reduced time to detect, investigate, contain, and recover from security incidents. • Increased automation and reduced manual effort in recurring SecOps workflows. • Reliable operational metrics, current playbooks, and measurable improvement actions. • Strong execution across SecOps, Cloud Security, Identity and IT, AppSec, and Engineering teams. • AI tools and agent workflows operate with risk-based guardrails, auditable telemetry, actionable detections, and clear escalation paths. • Controlled AI pilots demonstrate the least privilege, sandboxing, human approval, and safe handling of sensitive data before wider rollout. #LI-TI1 Why Join Semperis? You’ll be part of a global team on the front lines of cybersecurity innovation. At Semperis, we celebrate curiosity, integrity, and people who take initiative. If you’re someone who sees the glass as half full, embraces challenges as growth opportunities, and values a healthy balance between work and life—we’d love to meet you. **Semperis maintains office locations in several cities across the globe. Where the job description specifies a required location, candidates will follow our hybrid work model. This includes working up to three days per week and remotely the remaining days. Semperis is an equal opportunity employer and will not discriminate against an applicant or employee based on race, color, religion, creed, national origin or ancestry, ethnicity, sex (including gender, pregnancy, sexual orientation, and gender identity), age, physical or mental disability, veteran or military status, genetic information, citizenship, marital status, or any other legally recognized protected basis under federal, state, or local law. The information collected by the Semperis application is solely to determine suitability for employment, verify identity, and maintain employment statistics. Applicants with disabilities may be entitled to reasonable accommodation under the Americans with Disabilities Act and/or other applicable state or local laws. A reasonable accommodation is a change in the way things are normally done which will ensure an equal employment opportunity without imposing undue hardship on Semperis. Please inform Semperis representative Anna Taylor, Director of Global Recruiting, if you need assistance completing this application or to otherwise participate in the application process.

Who is Eleos Health? The people who deliver care in our communities and homes do some of the most important work in healthcare. But too often, theyʼre asked to spend their time navigating paperwork, administrative burden, and problems they only discover after something has already gone wrong. Eleos exists to change that. Weʼre building the system of action for community-based care - helping behavioral health, hospice, home health, and other care teams spend less time reacting to problems and more time focused on the people they serve. Powered by our Polaris AI, Eleos works alongside clinicians and their teams to understand whatʼs happening across care in real time and take action before issues become problems, reducing administrative burden, protecting revenue and compliance, and giving care teams more time and capacity to deliver great care. Our vision is a world where care teams can stay one step ahead, rather than constantly catching up. Weʼre helping shift an entire industry from reactive to proactive, and we need talented people to help us get there. What is this opportunity? Senior Security Engineer to act as a hands-on technical leader inside our security org, part builder, part architect, part trusted partner to R&D. You'll sit in design reviews, push back (constructively) on architecture choices, prototype the controls we're missing, and help R&D ship faster and safer. This role suits an engineer who thinks in systems, codes when needed, and is energized by securing modern AI-driven, multi-cloud environments. What you'll do • Act as a security architect for new initiatives. Join design and solution-concept meetings with R&D before code is written and help shape architectures that are secure by default. Produce threat models, reference designs, and decision docs that engineers actually use. • Partner with R&D as a peer, not a gatekeeper. Embed with product and engineering teams. Translate security requirements into engineering language, and engineering trade-offs into risk language for leadership. • Own security across our multi-cloud footprint (AWS, GCP, Azure). Design and implement controls for identity, network, workload, and data protection that work consistently across environments. • Drive AI security. Build our defenses against threats specific to LLM and ML systems: prompt injection, model abuse, training-data integrity, agentic-workflow risks, MCP/tool-use exposure, secrets in prompts, and supply-chain risk in the AI stack. Help define what "secure AI development" means for us in practice. • Lead data security initiatives. Classification, encryption, key management, DLP, access governance, and data-flow mapping. • Evaluate and implement new technologies. Run POCs and deploy new tooling end-to-end. We expect you to have strong opinions on the security stack and to evolve it as the threat landscape shifts. • Write code. Automate controls, build internal tools, contribute to detection pipelines, and integrate security into CI/CD. What qualifications and skills will help you to be successful? Must-haves • 5+ years in security engineering, application security, or cloud security, with meaningful time in a hands-on technical capacity • Strong software development background — you've shipped production code and read others' code fluently. • Deep experience securing multi-cloud environments, including IAM, networking, workload security, and infrastructure-as-code • Architect-level thinking: ability to look at a system diagram and identify trust boundaries, blast radius, failure modes, and the controls that actually matter • Hands-on experience with data security at scale, classification, encryption, key management, access controls • Demonstrated experience introducing and operationalizing new security technologies, not just maintaining existing ones • Track record of working closely with engineering teams; you're comfortable in design reviews and code reviews • Direct experience with AI/ML security, securing LLM applications, agentic systems,model deployments, or AI infrastructure

Via is using technology to transform transportation around the world. From changing a single person’s daily commute to reducing humanity’s collective environmental footprint — we’ve got huge goals. As a Application Security Engineer at Via, you will be a key member of the team, responsible for ensuring the security of Via's applications throughout the software development lifecycle. You will work closely with development, operations, and product teams to identify and mitigate vulnerabilities, promote secure coding practices, and build a robust application security program. What You’ll Do: • Perform security assessments, including penetration testing, vulnerability scanning, and code reviews, to identify security weaknesses in applications. • Collaborate with development teams to remediate identified vulnerabilities and implement secure coding practices. • Define and implement application security testing strategies, including static analysis, dynamic analysis, and software composition analysis. • Use AI (LLMs, agents, MCP-based tooling) to improve AppSec work such as vulnerability triage, code review, remediation and detection, and set best practices for doing so safely. • Design and build security tooling and automation, such as CI/CD integrations, internal services and AI-assisted workflows. • Contribute to the development and maintenance of application security policies, standards, and procedures. • Research and evaluate new application security tools and technologies. • Monitor application security metrics and provide regular reports on the security posture of applications. • Participate in incident response activities related to application security. • Champion a security-first culture within the engineering organization. Who You Are: • A Bachelor's degree in Computer Science or a related field is a plus. • Minimum of 3 years of experience as an Application Security Engineer or a similar role. • Strong understanding of application security concepts, including OWASP Top 10, CWE Top 25, and SANS Critical Security Controls. • Experience with various application security testing tools and techniques (e.g., SAST, DAST, SCA). • Proficiency in at least one scripting language (e.g., Python, JavaScript, Ruby). • Experience with secure coding practices and vulnerability remediation. • Familiarity with CI/CD pipelines and DevOps practices. • Excellent communication and collaboration skills. • Ability to work independently and as part of a team. • Experience with cloud platforms (AWS is an advantage). Compensation and Benefits • Our product impacts millions of users around the world providing alternative transport solutions that are more: efficient and accessible, changing cities to make them greener. • Competitive compensation package which includes base salary and equity • Health insurance with a discount for family members • Hybrid work and a lovely office situated in the heart of TLV, in Midtown, close to the light rail and train station • Career development and growth opportunities • Other perks: Freefit and other sports lessons, 10bis/Cibus - you choose!, happy hours, team events, communities and many more benefits We’re Via, and we build technology that changes the way the world moves. We’re driven by a simple mission: to create modern and efficient public transportation systems that provide far greater access to jobs, healthcare, and education. With our best in class suite of products, we make transit thrive. Our teams of worldclass engineers, data-scientists, product managers, operations specialists, marketers, transit experts and more bring cutting-edge AI-powered software and innovative technology-enabled operations to our partners across the globe. Founded in 2012, Via builds solutions to digitize, automate, and enable data-driven decision making for entire transportation networks; fixed-route buses, microtransit, paratransit, school buses, autonomous vehicles, and more. If you’re excited to be at the forefront of modernizing the future of transportation, are up for solving tough problems, and willing to become/already are a transit nerd, we are the place for you. Even if your past experience doesn’t align perfectly with every qualification in the job description for this role, we encourage you to apply. You may be just the right candidate for this or other opportunities. Ready to join the ride? Via is an equal opportunity employer.

Senior Product Security Engineer We are looking for a Senior Product Security Engineer to join Tipalti’s Product Security team and help strengthen security across our products and software development lifecycle. The role is hands-on and engineering-focused, working closely with development and product teams to identify security risks, improve application security, and implement practical security solutions throughout the development lifecycle. Why join Tipalti? Tipalti is the AI-powered platform for finance automation, elevating how finance teams operate in the global economy. We empower our customers to scale faster and smarter by removing the complexities of doing global business and accelerating their finance operations efficiency. Our platform provides a comprehensive suite of finance automation solutions designed for mid-market businesses across accounts payable, global payouts, procurement, employee expenses, corporate cards, supplier management, tax compliance, and treasury. Tipalti partners with leading financial institutions such as Citi, Wells Fargo, J.P. Morgan, and Visa, enabling over 5,000 global companies to efficiently and securely pay millions of suppliers and payees across 200+ countries and territories, in 120 currencies. At Tipalti, we pride ourselves on our collaborative culture, the quality of our product, and the capabilities of our people. Tipalti offers competitive benefits, a flexible workplace, career coaching, and an environment where diverse individuals can thrive and make an impact. Founded in Israel in 2010, Tipalti is a global business headquartered in the San Francisco Bay Area (Foster City), with offices in Tel Aviv, Plano, Toronto, Vancouver, London, Amsterdam, Tbilisi, and Medellin. In this role, you will be responsible for: • Work closely with development and product teams on application and product security throughout the software development lifecycle. • Perform hands-on security reviews of applications, APIs, services, and code. • Identify, investigate, validate, and assess product security vulnerabilities and security findings. • Provide practical remediation guidance and work with development teams through remediation. • Perform threat modeling and security analysis for new and existing product capabilities. • Work with application security tools and technologies including SAST, SCA, DAST, API Security, WAF, and related security controls. • Improve and automate Product Security processes, tooling, and security checks across the development lifecycle. • Assess security across modern application environments including web applications, APIs, microservices, containers, Kubernetes, and cloud-native services. • Support secure coding practices and provide practical security guidance to development teams. • Support vulnerability disclosure and Bug Bounty activities, including technical validation, risk assessment, and remediation follow-up. • Contribute to the continuous improvement of Product Security practices and capabilities across Tipalti’s engineering organization. About you • 5+ years of hands-on experience in Application Security, Product Security, or a closely related software security role. • Strong understanding of software development and the ability to read, understand, and review application code with .NET, JavaScript/TypeScript, or comparable modern technologies. • Hands-on experience identifying and analyzing application and API security vulnerabilities. • Experience performing threat modeling and application security reviews. • Strong understanding of authentication, authorization, session management, web security, API security and mobile security. • Strong knowledge of OWASP Top 10s and their practical remediation. • Hands-on experience with application security technologies such as SAST, SCA, DAST, API Security, WAF. • Experience with microservices, APIs, containers, Kubernetes, and cloud-native environments. • Knowledge of AWS security and/or Azure security. • Understanding of modern CI/CD and software development environments. • Strong analytical and problem-solving skills with the ability to turn security findings into practical technical recommendations. • Strong communication and collaboration skills and the ability to work effectively with engineering, product, and security teams. Advantage • Experience developing security tooling or automation. • Experience with CI/CD and software supply chain security. • Experience with fintech, payments, or security-sensitive SaaS products. • Experience with vulnerability research, Bug Bounty, or vulnerability disclosure programs. • Familiarity with AI/LLM application security, AI coding tools, MCP, or agentic systems. • Security research, open-source contributions, or other demonstrated hands-on security work. Our tech teams retain a fast-paced, start-up vibe that encourages innovation and critical thinking. At Tipalti, you’ll have the opportunity to work with a diverse, global team of engineers, developers, and product leaders who are collectively building the future of our best-in-class product suite as we transform financial operations for the future. About Our Tel Aviv Offices: Hybrid Work Model - Tipalti offers a hybrid work model, with two days per week working from home and three days per week from our beautiful offices in North Tel Aviv. Shuttle Services - Shuttle services are available from the nearest train station and across Tel Aviv to the office. Parking - Parking is available for all employees. Snacks & Treats - Enjoy a selection of snacks and treats available on every floor. #LI-hybrid Transparency Note: While you'll see three Product Security listings on our careers board, we are actually looking to fill a single open seat. The job descriptions are identical- only the seniority levels differ. We believe great talent comes in different shapes, and we value practical skills and capability over rigid experience requirements. Wherever you are in your career journey, if you have the right drive and expertise, feel free to apply to the level that fits you best- we’d love to hear from you. Our Mission Our mission is to elevate how finance teams operate in the global economy. We empower our customers to scale faster and smarter by removing the complexities of doing global business and accelerating their finance operations efficiency. We are the AI-powered platform that automates finance. Tipalti is fueled by a commitment to our customers and a desire to build lasting connections. Our client portfolio includes high-velocity businesses such as Amazon Twitch, GoDaddy, Roku, WordPress.com, and ZipRecruiter. We work hard for our 99% customer retention rate which is built on trust, reliability and innovation. Tipalti means we handled it" - a mission to which we are constantly committed. Accommodations Tipalti champions inclusive teams, in which every voice counts. We are committed to recruiting diverse candidates with varied personal experiences and abilities. We welcome applications from candidates belonging to historically underrepresented or disadvantaged groups, and maintain an equitable Talent Acquisition process that is free from discrimination. As an equal opportunities employer, Tipalti complies with employment and human rights laws across the various jurisdictions in which we operate. Should you require reasonable adjustments or accommodations during the recruitment process, including access to alternate formats of materials, meeting spaces, or other accommodations that could better enable your full participation, please reach out to [email protected] for assistance. AI Use We may use artificial intelligence and automated systems (collectively "AI") to screen, assess, and select candidates during our recruitment process. This includes resume screening, skills assessment, and candidate matching. You have the right to request human review of any automated decision. For more information about how we collect and use personal data and information during recruitment, please refer to our Job Candidate Privacy Notice. For additional questions about our use of AI during our recruitment process, you can contact [email protected]. Privacy We are committed to protecting the privacy interests of job applicants and candidates. For more information about our privacy practices during our Talent Acquisition process, please refer to our Job Candidate Privacy Notice below: Job Candidate Privacy Notice | Tipalti www.tipalti.com/privacy/job-candidate-privacy-notice/

Product Security Engineer We are looking for a Product Security Engineer to join Tipalti’s Product Security team and help strengthen security across our products and software development lifecycle. The role is hands-on and engineering-focused, working closely with development and product teams to identify security risks, improve application security, and implement practical security solutions throughout the development lifecycle. Why join Tipalti? Tipalti is the AI-powered platform for finance automation, elevating how finance teams operate in the global economy. We empower our customers to scale faster and smarter by removing the complexities of doing global business and accelerating their finance operations efficiency. Our platform provides a comprehensive suite of finance automation solutions designed for mid-market businesses across accounts payable, global payouts, procurement, employee expenses, corporate cards, supplier management, tax compliance, and treasury. Tipalti partners with leading financial institutions such as Citi, Wells Fargo, J.P. Morgan, and Visa, enabling over 5,000 global companies to efficiently and securely pay millions of suppliers and payees across 200+ countries and territories, in 120 currencies. At Tipalti, we pride ourselves on our collaborative culture, the quality of our product, and the capabilities of our people. Tipalti offers competitive benefits, a flexible workplace, career coaching, and an environment where diverse individuals can thrive and make an impact. Founded in Israel in 2010, Tipalti is a global business headquartered in the San Francisco Bay Area (Foster City), with offices in Tel Aviv, Plano, Toronto, Vancouver, London, Amsterdam, Tbilisi, and Medellin. In this role, you will be responsible for: • Work closely with development and product teams on application and product security throughout the software development lifecycle. • Perform hands-on security reviews of applications, APIs, services, and code. • Identify, investigate, validate, and assess product security vulnerabilities and security findings. • Provide practical remediation guidance and work with development teams through remediation. • Perform threat modeling and security analysis for new and existing product capabilities. • Work with application security tools and technologies including SAST, SCA, DAST, API Security, WAF, and related security controls. • Improve and automate Product Security processes, tooling, and security checks across the development lifecycle. • Assess security across modern application environments including web applications, APIs, microservices, containers, Kubernetes, and cloud-native services. • Support secure coding practices and provide practical security guidance to development teams. • Support vulnerability disclosure and Bug Bounty activities, including technical validation, risk assessment, and remediation follow-up. • Contribute to the continuous improvement of Product Security practices and capabilities across Tipalti’s engineering organization. About you • 3+ years of hands-on experience in Application Security, Product Security, or a closely related software security role. • Strong understanding of software development and the ability to read, understand, and review application code with .NET, JavaScript/TypeScript, or comparable modern technologies. • Hands-on experience identifying and analyzing application and API security vulnerabilities. • Experience performing threat modeling and application security reviews. • Strong understanding of authentication, authorization, session management, web security, API security and mobile security. • Strong knowledge of OWASP Top 10s and their practical remediation. • Hands-on experience with application security technologies such as SAST, SCA, DAST, API Security, WAF. • Experience with microservices, APIs, containers, Kubernetes, and cloud-native environments. • Knowledge of AWS security and/or Azure security. • Understanding of modern CI/CD and software development environments. • Strong analytical and problem-solving skills with the ability to turn security findings into practical technical recommendations. • Strong communication and collaboration skills and the ability to work effectively with engineering, product, and security teams. Advantage • Experience developing security tooling or automation. • Experience with CI/CD and software supply chain security. • Experience with fintech, payments, or security-sensitive SaaS products. • Experience with vulnerability research, Bug Bounty, or vulnerability disclosure programs. • Familiarity with AI/LLM application security, AI coding tools, MCP, or agentic systems. • Security research, open-source contributions, or other demonstrated hands-on security work. Our tech teams retain a fast-paced, start-up vibe that encourages innovation and critical thinking. At Tipalti, you’ll have the opportunity to work with a diverse, global team of engineers, developers, and product leaders who are collectively building the future of our best-in-class product suite as we transform financial operations for the future. About Our Tel Aviv Offices Hybrid Work Model - Tipalti offers a hybrid work model, with two days per week working from home and three days per week from our beautiful offices in North Tel Aviv. Shuttle Services - Shuttle services are available from the nearest train station and across Tel Aviv to the office. Parking - Parking is available for all employees. Snacks & Treats - Enjoy a selection of snacks and treats available on every floor. #LI-Hybrid Transparency Note: While you'll see three Product Security listings on our careers board, we are actually looking to fill a single open seat. The job descriptions are identical- only the seniority levels differ. We believe great talent comes in different shapes, and we value practical skills and capability over rigid experience requirements. Wherever you are in your career journey, if you have the right drive and expertise, feel free to apply to the level that fits you best- we’d love to hear from you. Our Mission Our mission is to elevate how finance teams operate in the global economy. We empower our customers to scale faster and smarter by removing the complexities of doing global business and accelerating their finance operations efficiency. We are the AI-powered platform that automates finance. Tipalti is fueled by a commitment to our customers and a desire to build lasting connections. Our client portfolio includes high-velocity businesses such as Amazon Twitch, GoDaddy, Roku, WordPress.com, and ZipRecruiter. We work hard for our 99% customer retention rate which is built on trust, reliability and innovation. Tipalti means we handled it" - a mission to which we are constantly committed. Accommodations Tipalti champions inclusive teams, in which every voice counts. We are committed to recruiting diverse candidates with varied personal experiences and abilities. We welcome applications from candidates belonging to historically underrepresented or disadvantaged groups, and maintain an equitable Talent Acquisition process that is free from discrimination. As an equal opportunities employer, Tipalti complies with employment and human rights laws across the various jurisdictions in which we operate. Should you require reasonable adjustments or accommodations during the recruitment process, including access to alternate formats of materials, meeting spaces, or other accommodations that could better enable your full participation, please reach out to [email protected] for assistance. AI Use We may use artificial intelligence and automated systems (collectively "AI") to screen, assess, and select candidates during our recruitment process. This includes resume screening, skills assessment, and candidate matching. You have the right to request human review of any automated decision. For more information about how we collect and use personal data and information during recruitment, please refer to our Job Candidate Privacy Notice. For additional questions about our use of AI during our recruitment process, you can contact [email protected]. Privacy We are committed to protecting the privacy interests of job applicants and candidates. For more information about our privacy practices during our Talent Acquisition process, please refer to our Job Candidate Privacy Notice below: Job Candidate Privacy Notice | Tipalti www.tipalti.com/privacy/job-candidate-privacy-notice/

Senior Cyber Security Engineer We seek a dynamic and experienced Cyber Security Engineer to join Tipalti! This role presents an exciting opportunity to work in a fast-growing company with great opportunities to make a difference. In this role, you will be responsible for: Design, implement, and maintain security architectures and controls across the organization's Cloud, SaaS, AI, and Corporate environments. • Secure enterprise infrastructure by strengthening cloud security, protecting sensitive data, managing identity and access, and continuously improving the organization's security posture. • Deploy, operate, and optimize enterprise security technologies across Identity, Endpoint, Network, Email, Cloud, SaaS, Data Protection, and Security Operations domains. • Identify, prioritize, and remediate security risks, vulnerabilities, cloud exposures, and SaaS security findings. • Lead end-to-end security projects across multiple teams, collaborating with Engineering, DevOps, IT, and Security Operations to implement scalable security solutions and drive automation. • Support the secure adoption of AI technologies while ensuring security controls align with industry best practices and frameworks such as ISO 27001, SOC 2, NIST CSF, and CIS Controls. About you: • 5+ years of Information Security experience, including 4+ years of hands-on Security Engineering experience implementing and operating enterprise security technologies across Identity, Endpoint, Network, Data Protection, and Secure Access domains (e.g., Firewalls, VPN, WAF, EDR/XDR, IDS/IPS, IAM, DLP, SIEM, and SASE). Must • 3+ years of IT Infrastructure or Systems Engineering experience, including Active Directory, Microsoft Entra ID, Microsoft 365, MDM, and enterprise networking. Must • Strong hands-on experience securing AWS, Azure, and GCP using modern Cloud Security platforms (e.g., CNAPP/CSPM), alongside modern SaaS environments. • Hands-on experience implementing and managing Identity & Access Management (IAM), including SSO, MFA, RBAC, PAM, Conditional Access, Zero Trust, and encryption. • Experience securing enterprise AI environments, including AI governance, security controls, and Model Context Protocol (MCP). Advantage • Familiarity with industry security frameworks, including ISO 27001, SOC 2, NIST CSF, CIS Controls, and MITRE ATT&C Nice to Have • Experience with scripting and automation using Python, PowerShell, Bash, or REST APIs to automate security processes and workflows. • Industry certifications such as CISSP, CEH, Security+, CCSP, GIAC, AWS Security Specialty, or equivalent. Why join Tipalti? Tipalti is the AI-powered platform for finance automation, elevating how finance teams operate in the global economy. We empower our customers to scale faster and smarter by removing the complexities of doing global business and accelerating their finance operations efficiency. Our platform provides a comprehensive suite of finance automation solutions designed for mid-market businesses across accounts payable, global payouts, procurement, employee expenses, corporate cards, supplier management, tax compliance, and treasury. Tipalti partners with leading financial institutions such as Citi, Wells Fargo, J.P. Morgan, and Visa, enabling over 5,000 global companies to efficiently and securely pay millions of suppliers and payees across 200+ countries and territories, in 120 currencies. At Tipalti, we pride ourselves on our collaborative culture, the quality of our product and the capabilities of our people. Tipaltians are passionate about the work they do, and keen to get the job done. Tipalti offers competitive benefits, a flexible workplace, career coaching, and an environment where diverse individuals can thrive and make an impact. Our culture ensures everyone checks their egos at the door and stands ready to reach for success together. Founded in Israel in 2010, Tipalti is a global business headquartered in the San Francisco Bay Area (Foster City) with offices in Tel Aviv, Plano, Toronto, Vancouver, London, Amsterdam, Tbilisi and Medellin. About Our Tel Aviv Offices Hybrid Work Model - Tipalti offers a hybrid work model, with two days per week working from home and three days per week from our beautiful offices in North Tel Aviv. Shuttle Services - Shuttle services are available from the nearest train station and across Tel Aviv to the office. Parking - Parking is available for all employees. Snacks & Treats - Enjoy a selection of snacks and treats available on every floor. #LI-Hybrid Our Mission Our mission is to elevate how finance teams operate in the global economy. We empower our customers to scale faster and smarter by removing the complexities of doing global business and accelerating their finance operations efficiency. We are the AI-powered platform that automates finance. Tipalti is fueled by a commitment to our customers and a desire to build lasting connections. Our client portfolio includes high-velocity businesses such as Amazon Twitch, GoDaddy, Roku, WordPress.com, and ZipRecruiter. We work hard for our 99% customer retention rate which is built on trust, reliability and innovation. Tipalti means we handled it" - a mission to which we are constantly committed. Accommodations Tipalti champions inclusive teams, in which every voice counts. We are committed to recruiting diverse candidates with varied personal experiences and abilities. We welcome applications from candidates belonging to historically underrepresented or disadvantaged groups, and maintain an equitable Talent Acquisition process that is free from discrimination. As an equal opportunities employer, Tipalti complies with employment and human rights laws across the various jurisdictions in which we operate. Should you require reasonable adjustments or accommodations during the recruitment process, including access to alternate formats of materials, meeting spaces, or other accommodations that could better enable your full participation, please reach out to [email protected] for assistance. AI Use We may use artificial intelligence and automated systems (collectively "AI") to screen, assess, and select candidates during our recruitment process. This includes resume screening, skills assessment, and candidate matching. You have the right to request human review of any automated decision. For more information about how we collect and use personal data and information during recruitment, please refer to our Job Candidate Privacy Notice. For additional questions about our use of AI during our recruitment process, you can contact [email protected]. Privacy We are committed to protecting the privacy interests of job applicants and candidates. For more information about our privacy practices during our Talent Acquisition process, please refer to our Job Candidate Privacy Notice below: Job Candidate Privacy Notice | Tipalti www.tipalti.com/privacy/job-candidate-privacy-notice/

Cyber Security Engineering Tech Lead We seek a dynamic and experienced Cyber Security Engineering Tech Lead to join Tipalti! This role presents an exciting opportunity to work in a fast-growing company with great opportunities to make a difference. In this role, you will be responsible for: Design, implement, and maintain security architectures and controls across the organization's Cloud, SaaS, AI, and Corporate environments. • Secure enterprise infrastructure by strengthening cloud security, protecting sensitive data, managing identity and access, and continuously improving the organization's security posture. • Deploy, operate, and optimize enterprise security technologies across Identity, Endpoint, Network, Email, Cloud, SaaS, Data Protection, and Security Operations domains. • Identify, prioritize, and remediate security risks, vulnerabilities, cloud exposures, and SaaS security findings. • Lead end-to-end security projects across multiple teams, collaborating with Engineering, DevOps, IT, and Security Operations to implement scalable security solutions and drive automation. • Support the secure adoption of AI technologies while ensuring security controls align with industry best practices and frameworks such as ISO 27001, SOC 2, NIST CSF, and CIS Controls. About you: • 6+ years of Information Security experience, including 4+ years of hands-on Security Engineering experience implementing and operating enterprise security technologies across Identity, Endpoint, Network, Data Protection, and Secure Access domains (e.g., Firewalls, VPN, WAF, EDR/XDR, IDS/IPS, IAM, DLP, SIEM, and SASE). Must • 3+ years of IT Infrastructure or Systems Engineering experience, including Active Directory, Microsoft Entra ID, Microsoft 365, MDM, and enterprise networking. Must • Strong hands-on experience securing AWS, Azure, and GCP using modern Cloud Security platforms (e.g., CNAPP/CSPM), alongside modern SaaS environments. • Hands-on experience implementing and managing Identity & Access Management (IAM), including SSO, MFA, RBAC, PAM, Conditional Access, Zero Trust, and encryption. • Experience securing enterprise AI environments, including AI governance, security controls, and Model Context Protocol (MCP). Advantage • Familiarity with industry security frameworks, including ISO 27001, SOC 2, NIST CSF, CIS Controls, and MITRE ATT&C Nice to Have • Experience with scripting and automation using Python, PowerShell, Bash, or REST APIs to automate security processes and workflows. • Industry certifications such as CISSP, CEH, Security+, CCSP, GIAC, AWS Security Specialty, or equivalent. Why join Tipalti? Tipalti is the AI-powered platform for finance automation, elevating how finance teams operate in the global economy. We empower our customers to scale faster and smarter by removing the complexities of doing global business and accelerating their finance operations efficiency. Our platform provides a comprehensive suite of finance automation solutions designed for mid-market businesses across accounts payable, global payouts, procurement, employee expenses, corporate cards, supplier management, tax compliance, and treasury. Tipalti partners with leading financial institutions such as Citi, Wells Fargo, J.P. Morgan, and Visa, enabling over 5,000 global companies to efficiently and securely pay millions of suppliers and payees across 200+ countries and territories, in 120 currencies. At Tipalti, we pride ourselves on our collaborative culture, the quality of our product and the capabilities of our people. Tipaltians are passionate about the work they do, and keen to get the job done. Tipalti offers competitive benefits, a flexible workplace, career coaching, and an environment where diverse individuals can thrive and make an impact. Our culture ensures everyone checks their egos at the door and stands ready to reach for success together. Founded in Israel in 2010, Tipalti is a global business headquartered in the San Francisco Bay Area (Foster City) with offices in Tel Aviv, Plano, Toronto, Vancouver, London, Amsterdam, Tbilisi and Medellin. About Our Tel Aviv Offices Hybrid Work Model - Tipalti offers a hybrid work model, with two days per week working from home and three days per week from our beautiful offices in North Tel Aviv. Shuttle Services - Shuttle services are available from the nearest train station and across Tel Aviv to the office. Parking - Parking is available for all employees. Snacks & Treats - Enjoy a selection of snacks and treats available on every floor. #LI-Hybrid Our Mission Our mission is to elevate how finance teams operate in the global economy. We empower our customers to scale faster and smarter by removing the complexities of doing global business and accelerating their finance operations efficiency. We are the AI-powered platform that automates finance. Tipalti is fueled by a commitment to our customers and a desire to build lasting connections. Our client portfolio includes high-velocity businesses such as Amazon Twitch, GoDaddy, Roku, WordPress.com, and ZipRecruiter. We work hard for our 99% customer retention rate which is built on trust, reliability and innovation. Tipalti means we handled it" - a mission to which we are constantly committed. Accommodations Tipalti champions inclusive teams, in which every voice counts. We are committed to recruiting diverse candidates with varied personal experiences and abilities. We welcome applications from candidates belonging to historically underrepresented or disadvantaged groups, and maintain an equitable Talent Acquisition process that is free from discrimination. As an equal opportunities employer, Tipalti complies with employment and human rights laws across the various jurisdictions in which we operate. Should you require reasonable adjustments or accommodations during the recruitment process, including access to alternate formats of materials, meeting spaces, or other accommodations that could better enable your full participation, please reach out to [email protected] for assistance. AI Use We may use artificial intelligence and automated systems (collectively "AI") to screen, assess, and select candidates during our recruitment process. This includes resume screening, skills assessment, and candidate matching. You have the right to request human review of any automated decision. For more information about how we collect and use personal data and information during recruitment, please refer to our Job Candidate Privacy Notice. For additional questions about our use of AI during our recruitment process, you can contact [email protected]. Privacy We are committed to protecting the privacy interests of job applicants and candidates. For more information about our privacy practices during our Talent Acquisition process, please refer to our Job Candidate Privacy Notice below: Job Candidate Privacy Notice | Tipalti www.tipalti.com/privacy/job-candidate-privacy-notice/

As a Senior Enterprise Security Engineer, you will be a foundational architect of Navan’s security posture, directly safeguarding our corporate infrastructure, sensitive financial data, and global user base. This is a highly hands-on, configuration-driven role that requires working directly with systems that power our security program in a modern, cloud-native environment. Your work will be critical in ensuring Navan becomes globally recognized for secure, unparalleled corporate travel and expense management. What You’ll Do: • Vulnerability Management & Exposure Reduction: Architect, manage, and scale the end-to-end vulnerability management program. Oversee continuous asset discovery, vulnerability scanning, threat exposure assessment, and risk-based prioritization (CVSS, EPSS, threat intelligence). Partner closely with infrastructure, engineering, and IT teams to establish SLAs, streamline patch management workflows, and validate effective remediation. • Security Incident Response & On-Call Rotation: Participate in the security engineering on-call rotation. Serve as a responder responsible for identifying, scoping, triaging, managing, and mitigating security incidents, followed by leading thorough post-incident reviews and root-cause analyses. • Detection & Automation Optimization: Help improve and maintain our existing detection pipeline by providing feedback on alert quality, reviewing current monitoring coverage, and performing direct tuning in SIEM platforms to reduce noise and increase signal fidelity. Evaluate existing SOAR playbooks and workflows, offering recommendations and performing targeted updates to streamline response processes. • Identity Governance & Access Control: Define and enforce strong IAM principles (e.g., Least Privilege, Zero Trust) and contribute to identity governance platforms to ensure secure authentication, authorization, and access across the enterprise. • Email Security: Strengthen email security by managing alerts and workflows in platforms like Material Security, reviewing post-delivery threats, and improving automated response to suspicious messages and mailbox activity. • Cross-Functional Security Leadership: Proactively partner with Engineering, IT, and Compliance teams to embed security best practices early in the lifecycle, align vulnerability SLAs with business risk objectives, and foster a culture of shared security ownership. • Process Improvement & Metrics: Establish and track key performance indicators (KPIs) for vulnerability management and incident response. Participate actively in incident and posture reviews, drive continuous operational improvements, and work with external vendors to align system capabilities and security expectations. What We’re Looking For: • 5+ years of hands-on experience in information or enterprise security, preferably within a high-growth tech environment utilizing cloud infrastructure. • Proven track record of designing, implementing, or maturing an enterprise-wide Vulnerability Management program, including expertise with modern exposure management and scanning platforms (e.g., Tenable, Qualys, Rapid7, Wiz) and vulnerability remediation workflows. • Demonstrated experience in incident response, with a willingness to participate in an on-call rotation to identify, analyze, contain, and resolve active security incidents. • Deep, up-to-date knowledge of modern attacker tactics, techniques, and procedures (TTPs), common exploit vectors, and risk prioritization frameworks (CVSS, EPSS, KEV). You excel at translating technical vulnerabilities and risks into clear business context for a range of stakeholders. • Ability to review SIEM and EDR/XDR platform outputs, provide constructive feedback on detection efficacy, and execute direct rule tuning and configuration refinements to optimize signal-to-noise ratio. • Comfort interfacing with SOAR workflows (e.g., Phantom, Demisto, XSOAR) to suggest optimizations and perform light playbook updates that improve overall team efficiency. • Demonstrated expertise in Zero Trust principles, modern identity governance, and access management solutions (e.g., Okta, Ping, or Azure AD). • Experience managing email security using platforms like Material Security, including reviewing post-delivery detections and analyzing mailbox activity. • Highly collaborative with strong ownership skills, adept at negotiating SLA timelines with engineering/IT partners and contributing actively within a small, focused security team. Navan uses AI-assisted Automated Employment Decision Tool (Metaview) to assist with evaluating resumes against job qualifications for this role. All final decisions are made by human recruiters and hiring managers. Human oversight: Metaview does not automatically reject candidates or make final hiring decisions. Our recruiters and hiring managers review all outputs and make the final hiring decision regarding every application. • Your rights: If you prefer to have your application reviewed without AI assistance, you may request a human evaluation by entering your email here. Your decision to do so will not affect how your candidacy is evaluated. Please refer to our Candidate Privacy Notice for more information about our processing of personal data, and your rights.

Fullpath by Cox Automotive is a fast-growing tech company in the automotive space with hubs across the US and Israel. We are disrupting the multi-trillion-dollar transportation industry with our advanced Customer Data Platform (CDP). Our work happens in the fast lane as we bring AI-powered, data-driven solutions to a quickly evolving industry. Our team at Fullpath is made up of curious and creative individuals who are always looking to achieve the impossible. We are bold, collaborative, and goal-driven. At our core, we believe every voice has value and can impact our bottom line. We are looking for an AI AppSec Engineer to join our team and make a real impact on our Secure Software Development Lifecycle! As an AI AppSec Engineer your mission will be to be the driving force behind our secure development lifecycle. You won't just find bugs; you will help build the systems that prevent them. You will have the opportunity to help navigate the "Agentic Era" by building autonomous security guardrails, securing LLM-based workflows, and empowering developers to move fast without breaking security. You will also be responsible for working closely under the AppSec Architect. This role is based out of our Tel-Aviv site and will report to the AppSec Architect. What you will be responsible for Build & automate: Develop and maintain internal security tooling, automated workflows, and AI security agents. Code integrity: Execute secure code reviews and provide actionable remediation guidance to engineering teams. Vulnerability management: Lead the tracking, triaging, and reporting of security flaws across all product lines. Best practice advocacy: Drive the adoption of secure coding standards, partnering with R&D and DevOps teams to embed security early and often. Extend our D&R capabilities: Build scalable solutions to identify malicious activity, triage alerts, and investigate and remediate incidents. Document: Draft requirement documents for security products and innovative technologies. Requirements 2-4 years experience as an Application Security Engineer or similar role from a Software Development Company In-depth knowledge in threat modeling, risk management, and security controls. Experience with AI Security and Security AI. Proficiency with OWASP Top 10: API, LLM, and Agentic applications. Hands-on competency integrating security tools such as SAST, DAST, SCA, and API security testing. Familiarity with CI/CD pipelines and Infrastructure as Code implementation. Practical background in software development and coding. In-depth knowledge of cloud technologies and cloud-native applications, AWS and GCP. Cybersecurity certifications such as OSCP, GPEN, CSSLP. The top candidate will also have Endless curiosity and passion for emerging technology Ability to handle prioritize and execute multiple tasks simultaneously. Ability to work collaboratively across multiple departments. Fluent in English - ability to lead meetings and present. Strong communication and collaboration skills. Why you should join us Our global team is made up of awesome forward thinking, innovative go-getters. Learning and growth opportunities within a fast-paced tech startup environment. Clear career advancement path for strong performers. We are committed to setting each other up for success. As a member of our team, you will work within an environment that encourages growth, initiative taking and continuous mutual feedback in order to reach your full potential. And of course, Wolt+ and lots of yummy treats in the kitchen :-) Does this sound like a perfect position for you or a friend? apply here: [email protected]