{"version":"0.1","company":{"name":"YubHub","url":"https://yubhub.co","jobsUrl":"https://yubhub.co/jobs/skill/software-supply-chain-security"},"x-facet":{"type":"skill","slug":"software-supply-chain-security","display":"Software Supply Chain Security","count":11},"x-feed-size-limit":100,"x-feed-sort":"enriched_at desc","x-feed-notice":"This feed contains at most 100 jobs (the most recently enriched). For the full corpus, use the paginated /stats/by-facet endpoint or /search.","x-generator":"yubhub-xml-generator","x-rights":"Free to redistribute with attribution: \"Data by YubHub (https://yubhub.co)\"","x-schema":"Each entry in `jobs` follows https://schema.org/JobPosting. YubHub-native raw fields carry `x-` prefix.","jobs":[{"@context":"https://schema.org","@type":"JobPosting","identifier":{"@type":"PropertyValue","name":"YubHub","value":"job_b5ce114e-dac"},"title":"Cloud Engineer – Factory Systems and Operational Technology","description":"<p>Anduril Industries is a defence technology company with a mission to transform U.S. and allied military capabilities with advanced technology. By bringing the expertise, technology and business model of the 21st century&#39;s most innovative companies to the defence industry, Anduril is changing how military systems are designed, built and sold.</p>\n<p>The company&#39;s family of systems is powered by Lattice OS, an AI-powered operating system that turns thousands of data streams into a real-time, 3D command and control centre.</p>\n<p>As the world enters an era of strategic competition, Anduril is committed to bringing cutting-edge autonomy, AI, computer vision, sensor fusion and networking technology to the military in months, not years.</p>\n<p>We are seeking a mission-driven Cloud Infrastructure Engineer to take a leading role in designing and implementing world-class defensive controls. This is a high-impact role with the autonomy to shape security architecture and protect the technology that is changing the future of defence.</p>\n<p>Key Responsibilities:</p>\n<ul>\n<li>Design and Own Security Architecture: Architect, build and deploy robust, scalable security controls for our corporate, development and production cloud environments (AWS, Azure, GCP).</li>\n</ul>\n<ul>\n<li>Automate Everything: Develop and automate infrastructure-as-code (IaC) to manage and scale our cloud deployments securely and efficiently.</li>\n</ul>\n<ul>\n<li>Proactively Defend: Continuously monitor, identify and remediate security weaknesses and configuration drift across our entire cloud footprint.</li>\n</ul>\n<ul>\n<li>Be a Force Multiplier: Partner with infrastructure, application and product teams to embed security best practices into their workflows and secure environments holding mission-critical data.</li>\n</ul>\n<ul>\n<li>Enable Scale and Reliability: Engineer systems and processes that ensure our platforms are highly available, resilient and prepared for rapid growth.</li>\n</ul>\n<ul>\n<li>Serve as a Cloud Security Expert: Act as the go-to subject matter expert for teams across Anduril, providing guidance, mentorship and paved-road solutions for building securely in the cloud.</li>\n</ul>\n<p>Requirements:</p>\n<ul>\n<li>Proven experience building and securing complex cloud environments, typically gained through 3+ years in a Cloud Security, DevOps or SRE role.</li>\n</ul>\n<ul>\n<li>Deep proficiency in at least one major cloud provider (AWS, Azure or GCP).</li>\n</ul>\n<ul>\n<li>Strong hands-on experience with Infrastructure as Code (e.g., Terraform, CloudFormation, Bicep).</li>\n</ul>\n<ul>\n<li>Solid programming/scripting ability in one or more languages (e.g., Python, Go, Rust).</li>\n</ul>\n<ul>\n<li>Firm understanding of public cloud networking principles (e.g., VPCs, subnets, routing, security groups).</li>\n</ul>\n<ul>\n<li>Must be a U.S. Person and eligible to obtain and maintain a U.S. Top Secret security clearance.</li>\n</ul>\n<p>Preferred Qualifications:</p>\n<ul>\n<li>Experience hardening and monitoring Kubernetes clusters (EKS, GKE, AKS).</li>\n</ul>\n<ul>\n<li>Experience with cloud security posture management (CSPM) or threat detection tooling.</li>\n</ul>\n<ul>\n<li>Familiarity with CI/CD pipelines and securing the software supply chain.</li>\n</ul>\n<ul>\n<li>Knowledge of compliance frameworks such as FedRAMP, MRL, SOC 2 or CMMC.</li>\n</ul>\n<ul>\n<li>On-premises network engineering experience.</li>\n</ul>\n<p style=\"margin-top:24px;font-size:13px;color:#666;\">XML job scraping automation by <a href=\"https://yubhub.co\">YubHub</a></p>","url":"https://yubhub.co/jobs/job_b5ce114e-dac","directApply":true,"hiringOrganization":{"@type":"Organization","name":"Anduril Industries","sameAs":"https://www.anduril.com/","logo":"https://logos.yubhub.co/anduril.com.png"},"x-apply-url":"https://job-boards.greenhouse.io/andurilindustries/jobs/5087348007","x-work-arrangement":"onsite","x-experience-level":"senior","x-job-type":"full-time","x-salary-range":"$129,000-$193,000 USD","x-skills-required":["Cloud Security","DevOps","SRE","Infrastructure as Code","Terraform","CloudFormation","Bicep","Python","Go","Rust","Public Cloud Networking","VPCs","Subnets","Routing","Security Groups"],"x-skills-preferred":["Kubernetes","Cloud Security Posture Management","Threat Detection Tooling","CI/CD Pipelines","Software Supply Chain Security","Compliance Frameworks","FedRAMP","MRL","SOC 2","CMMC","On-Premises Network Engineering"],"datePosted":"2026-04-18T15:49:59.253Z","jobLocation":{"@type":"Place","address":{"@type":"PostalAddress","addressLocality":"Costa Mesa, California, United States"}},"employmentType":"FULL_TIME","occupationalCategory":"Engineering","industry":"Technology","skills":"Cloud Security, DevOps, SRE, Infrastructure as Code, Terraform, CloudFormation, Bicep, Python, Go, Rust, Public Cloud Networking, VPCs, Subnets, Routing, Security Groups, Kubernetes, Cloud Security Posture Management, Threat Detection Tooling, CI/CD Pipelines, Software Supply Chain Security, Compliance Frameworks, FedRAMP, MRL, SOC 2, CMMC, On-Premises Network Engineering","baseSalary":{"@type":"MonetaryAmount","currency":"USD","value":{"@type":"QuantitativeValue","minValue":129000,"maxValue":193000,"unitText":"YEAR"}}},{"@context":"https://schema.org","@type":"JobPosting","identifier":{"@type":"PropertyValue","name":"YubHub","value":"job_5003c49e-cf6"},"title":"Engineering Manager, SSCS: Supply Chain","description":"<p>As an Engineering Manager, you&#39;ll guide GitLab&#39;s dedicated Software Supply Chain Security (SSCS) Add-On engineering team as it develops core capabilities including Dependency Firewall, Build Provenance, Malicious Packages detection, and Artifact Signing.</p>\n<p>This is a founding management role where you&#39;ll help shape how the team works, partner closely with the Staff Backend Engineer, Product Manager, and SSCS stage management, and turn a defined roadmap into steady, high-quality delivery for enterprise customers with strict security and compliance needs.</p>\n<p>You&#39;ll focus on developing the team, creating a healthy operating rhythm, and establishing predictable execution for the SSCS SKU.</p>\n<p>You&#39;ll join a product area where customers in regulated industries are already validating the need, and your work will help GitLab deliver software supply chain security features that customers can rely on.</p>\n<p>While technical credibility matters, your main focus will be growing a strong backend engineering team, enabling team members in their development, and creating the conditions for long-term delivery and quality.</p>\n<p>Responsibilities:</p>\n<ul>\n<li>Guide a backend engineering team building the SSCS Add-On across dependency enforcement, build provenance, malicious package detection, and artifact signing.</li>\n</ul>\n<ul>\n<li>Be responsible for driving engineering delivery for general availability milestones by aligning sequencing, scope, and dependencies with the Staff Backend Engineer and Product Manager.</li>\n</ul>\n<ul>\n<li>Develop the team by partnering with Talent Acquisition on sourcing, interview design, candidate evaluation, and hiring decisions.</li>\n</ul>\n<ul>\n<li>Run regular 1:1s, performance reviews, and career development conversations that enable growth and clear expectations.</li>\n</ul>\n<ul>\n<li>Advance engineering quality by monitoring cycle time, defect rates, and test coverage, and by addressing risks early.</li>\n</ul>\n<ul>\n<li>Coordinate quarterly planning and roadmap tradeoff discussions with SSCS stage leadership and Product.</li>\n</ul>\n<ul>\n<li>Work with Finance and other partners on headcount pacing and team planning as the Add-On scales.</li>\n</ul>\n<ul>\n<li>Represent the SSCS Add-On team within stage leadership discussions and help ensure strong communication across functions.</li>\n</ul>\n<p>Requirements:</p>\n<ul>\n<li>Over 3 years of experience guiding backend product engineering teams in security, DevOps, or platform engineering environments.</li>\n</ul>\n<ul>\n<li>Ability to hire and grow backend or security engineers in distributed team environments, with practical understanding of the talent landscape for these roles.</li>\n</ul>\n<ul>\n<li>Technical credibility to contribute to architecture discussions involving package registries, CI/CD pipeline security, and signing infrastructure.</li>\n</ul>\n<ul>\n<li>Experience managing predictable delivery across multi-quarter product roadmaps and managing cross-team dependencies.</li>\n</ul>\n<ul>\n<li>Comfort working in an asynchronous, documentation-driven organization with clear written communication.</li>\n</ul>\n<ul>\n<li>Familiarity with supply chain security, artifact management, or compliance-focused product areas, or transferable experience from related domains.</li>\n</ul>\n<ul>\n<li>Working knowledge of concepts related to frameworks and ecosystems such as SLSA and Sigstore.</li>\n</ul>\n<ul>\n<li>Ability to build credibility with engineers, product partners, and customer-facing stakeholders through clear judgment, coaching, and teamwork.</li>\n</ul>\n<p>About the team: The SSCS Add-On team is a product engineering team within GitLab&#39;s Software Supply Chain Security stage. We work on key capabilities in the SSCS Add-On SKU and collaborate closely with product and engineering partners to deliver security features for customers operating in regulated environments.</p>\n<p>You&#39;ll report to the SSCS Senior Engineering Manager and partner directly with the Staff Backend Engineer and Product Manager.</p>\n<p>As a distributed team working asynchronously across regions, we are focused on strong delivery practices, team health, and scaling the product area with clarity and accountability.</p>\n<p>For more on how related teams work, see Team Handbook Page.</p>\n<p>How GitLab Supports Full-Time Employees:</p>\n<ul>\n<li>Benefits to support your health, finances, and well-being</li>\n</ul>\n<ul>\n<li>Flexible Paid Time Off</li>\n</ul>\n<ul>\n<li>Team Member Resource Groups</li>\n</ul>\n<ul>\n<li>Equity Compensation &amp; Employee Stock Purchase Plan</li>\n</ul>\n<ul>\n<li>Growth and Development Fund</li>\n</ul>\n<ul>\n<li>Parental leave</li>\n</ul>\n<ul>\n<li>Home office support</li>\n</ul>\n<p style=\"margin-top:24px;font-size:13px;color:#666;\">XML job scraping automation by <a href=\"https://yubhub.co\">YubHub</a></p>","url":"https://yubhub.co/jobs/job_5003c49e-cf6","directApply":true,"hiringOrganization":{"@type":"Organization","name":"GitLab","sameAs":"https://about.gitlab.com/","logo":"https://logos.yubhub.co/about.gitlab.com.png"},"x-apply-url":"https://job-boards.greenhouse.io/gitlab/jobs/8478405002","x-work-arrangement":"remote","x-experience-level":"senior","x-job-type":"full-time","x-salary-range":null,"x-skills-required":["GitLab","Software Supply Chain Security","Dependency Firewall","Build Provenance","Malicious Packages detection","Artifact Signing","Backend engineering","Security","DevOps","Platform engineering","Package registries","CI/CD pipeline security","Signing infrastructure","Supply chain security","Artifact management","Compliance-focused product areas","Frameworks and ecosystems","SLSA","Sigstore"],"x-skills-preferred":[],"datePosted":"2026-04-18T15:49:15.915Z","jobLocation":{"@type":"Place","address":{"@type":"PostalAddress","addressLocality":"Remote, India"}},"jobLocationType":"TELECOMMUTE","employmentType":"FULL_TIME","occupationalCategory":"Engineering","industry":"Technology","skills":"GitLab, Software Supply Chain Security, Dependency Firewall, Build Provenance, Malicious Packages detection, Artifact Signing, Backend engineering, Security, DevOps, Platform engineering, Package registries, CI/CD pipeline security, Signing infrastructure, Supply chain security, Artifact management, Compliance-focused product areas, Frameworks and ecosystems, SLSA, Sigstore"},{"@context":"https://schema.org","@type":"JobPosting","identifier":{"@type":"PropertyValue","name":"YubHub","value":"job_44ff0179-993"},"title":"Senior Backend Engineer (RoR), SSCS: Pipeline Security","description":"<p>As a Senior Backend Engineer on the Pipeline Security team, you&#39;ll take technical ownership of GitLab&#39;s native Secrets Manager, a production system built on OpenBao that helps secure sensitive credentials across GitLab CI/CD pipelines.</p>\n<p>You&#39;ll work at the intersection of backend engineering and infrastructure, shaping architecture in Ruby on Rails and Go, guiding decisions around role-based access control (RBAC), GraphQL APIs, and Kubernetes deployment configuration.</p>\n<p>In your first year, you&#39;ll help move Secrets Manager toward general availability, establish technical patterns the team can build on, and represent the team&#39;s point of view in cross-functional discussions.</p>\n<p>You&#39;ll have end-to-end ownership, from design through production operations, with room to identify what should be built next and improve how the team delivers secure, reliable features.</p>\n<p><strong>Responsibilities</strong></p>\n<ul>\n<li>Build and maintain secure, readable backend code primarily in Ruby on Rails, with some development in Go for targeted components.</li>\n</ul>\n<ul>\n<li>Design backend architecture for complex security features, including secrets access control, pipeline security enforcement, and OpenBao integration.</li>\n</ul>\n<ul>\n<li>Lead the development of role-based access control models, GraphQL APIs, and supporting application patterns for features owned by the team.</li>\n</ul>\n<ul>\n<li>Own features end to end, from technical design and implementation through deployment, validation, and production support.</li>\n</ul>\n<ul>\n<li>Collaborate with Product, security partners, and other engineering teams to document tradeoffs, align on direction, and deliver iteratively in a distributed environment.</li>\n</ul>\n<ul>\n<li>Improve code quality, maintainability, security, and performance through code review, design iteration, and internal standards for a high-scale web environment.</li>\n</ul>\n<ul>\n<li>Build and maintain Helm charts, including configuration, tuning, documentation, and automated testing for Kubernetes-based deployments.</li>\n</ul>\n<ul>\n<li>Validate features in Kubernetes environments, including GitLab Cloud Native and Cloud Native Hybrid deployments, using GitLab testing and performance testing frameworks.</li>\n</ul>\n<p><strong>Requirements</strong></p>\n<ul>\n<li>Experience building and maintaining backend features with a focus on secure design, data handling, and production reliability.</li>\n</ul>\n<ul>\n<li>Ability to write production-quality code in Ruby on Rails, including use of framework security patterns and review for common application risks.</li>\n</ul>\n<ul>\n<li>Working knowledge of CI/CD concepts and the ways pipelines can be misconfigured, abused, or expose sensitive data.</li>\n</ul>\n<ul>\n<li>Familiarity with secrets management approaches and security practices for handling credentials in CI environments; experience with tools such as HashiCorp Vault or similar systems is helpful.</li>\n</ul>\n<ul>\n<li>Comfort collaborating across Product and engineering teams in an asynchronous, distributed environment and communicating technical tradeoffs clearly in writing.</li>\n</ul>\n<ul>\n<li>Ability to review merge requests with a security-first mindset and improve solutions through feedback and iteration.</li>\n</ul>\n<ul>\n<li>Experience debugging production issues, including investigation of security-related behavior and proposing practical fixes.</li>\n</ul>\n<ul>\n<li>Openness to learning adjacent domains and tools, including Go, container security, and software supply chain security; we welcome transferable experience from different technical backgrounds.</li>\n</ul>\n<p><strong>About the Team</strong></p>\n<p>The Pipeline Security team builds features that make GitLab CI pipelines more secure and trustworthy for teams running sensitive workloads. We own key parts of pipeline security within GitLab&#39;s CI/CD experience, with our current focus on native secrets management for CI pipelines and Supply-chain Levels for Software Artifacts (SLSA) Level 3 capabilities to strengthen software supply chain security.</p>\n<p style=\"margin-top:24px;font-size:13px;color:#666;\">XML job scraping automation by <a href=\"https://yubhub.co\">YubHub</a></p>","url":"https://yubhub.co/jobs/job_44ff0179-993","directApply":true,"hiringOrganization":{"@type":"Organization","name":"GitLab","sameAs":"https://about.gitlab.com/","logo":"https://logos.yubhub.co/about.gitlab.com.png"},"x-apply-url":"https://job-boards.greenhouse.io/gitlab/jobs/8432221002","x-work-arrangement":"remote","x-experience-level":"senior","x-job-type":"full-time","x-salary-range":"$117,600-$252,000 USD","x-skills-required":["Ruby on Rails","Go","OpenBao","Role-Based Access Control (RBAC)","GraphQL APIs","Kubernetes deployment configuration","Helm charts","CI/CD concepts","Secrets management approaches","Security practices for handling credentials in CI environments"],"x-skills-preferred":["Container security","Software supply chain security"],"datePosted":"2026-04-18T15:45:33.847Z","jobLocation":{"@type":"Place","address":{"@type":"PostalAddress","addressLocality":"Remote, Canada; Remote, Ireland; Remote, Israel; Remote, Netherlands; Remote, United Kingdom; Remote, US"}},"jobLocationType":"TELECOMMUTE","employmentType":"FULL_TIME","occupationalCategory":"Engineering","industry":"Technology","skills":"Ruby on Rails, Go, OpenBao, Role-Based Access Control (RBAC), GraphQL APIs, Kubernetes deployment configuration, Helm charts, CI/CD concepts, Secrets management approaches, Security practices for handling credentials in CI environments, Container security, Software supply chain security","baseSalary":{"@type":"MonetaryAmount","currency":"USD","value":{"@type":"QuantitativeValue","minValue":117600,"maxValue":252000,"unitText":"YEAR"}}},{"@context":"https://schema.org","@type":"JobPosting","identifier":{"@type":"PropertyValue","name":"YubHub","value":"job_a3a1df2f-184"},"title":"Principal Engineer, Software Supply Chain Security","description":"<p>As the Principal Engineer, Software Supply Chain Security, you&#39;ll own the technical strategy that secures how software is built and delivered on GitLab&#39;s DevSecOps platform. You&#39;ll provide architectural leadership across multiple engineering teams.</p>\n<p>Your work will shape GitLab&#39;s enterprise security posture in the rapidly growing software supply chain security market. You&#39;ll focus on SLSA Level 3 compliance, secrets management, CI/CD security hardening, and the foundations of GitLab&#39;s global zero trust architecture.</p>\n<p>Some examples of our projects:</p>\n<ul>\n<li>SLSA Level 3 compliance and provenance attestation across GitLab&#39;s CI/CD platform</li>\n<li>Integrated secrets management and runner security for container-isolated, secure pipelines</li>\n</ul>\n<p>You&#39;ll lead the end-to-end software supply chain security architecture for GitLab&#39;s CI/CD platform, including SLSA Level 3 implementation and CI infrastructure hardening. You&#39;ll drive cross-team technical strategy and decisions across our Software Supply Chain Security (SSCS) stage teams, aligning engineering work to SSCS strategic plans.</p>\n<p>You&#39;ll collaborate with infrastructure and CI/CD teams to design and land long-term initiatives for secure, scalable runner architecture, container isolation, and pipeline security at scale. You&#39;ll propose and validate technical implementations that support architectural changes to improve CI/CD scaling and performance on critical paths.</p>\n<p>You&#39;ll teach, mentor, and coach Staff Engineers and individual contributors, raising the bar on supply chain threat modeling, secrets management, artifact signing, and SBOM lifecycle practices.</p>\n<p>You&#39;ll partner with Engineering Managers and senior leadership to define roadmaps, break down complex initiatives, and enable Staff Engineers to lead sub-department-wide efforts.</p>\n<p>You&#39;ll engage with customers and external stakeholders as a technical consultant and spokesperson for GitLab&#39;s software supply chain security capabilities and roadmap.</p>\n<p>You&#39;ll collaborate with product, security, and compliance stakeholders to ensure features meet enterprise security, governance, and regulatory expectations in the software supply chain security market.</p>\n<p>Key responsibilities include:</p>\n<ul>\n<li>Providing architectural leadership across multiple engineering teams</li>\n<li>Shaping GitLab&#39;s enterprise security posture in the rapidly growing software supply chain security market</li>\n<li>Focusing on SLSA Level 3 compliance, secrets management, CI/CD security hardening, and the foundations of GitLab&#39;s global zero trust architecture</li>\n</ul>\n<p>Key requirements include:</p>\n<ul>\n<li>Deep expertise in software supply chain security, including threat modeling for supply chain attack vectors, SLSA implementation and attestation systems, and SBOM generation and lifecycle management</li>\n<li>Strong knowledge of artifact signing and verification using the Sigstore ecosystem, including Cosign, Fulcio, Rekor, and in-toto attestations</li>\n<li>Experience designing and hardening CI/CD security, such as runner isolation, pipeline security controls, and secrets management in large-scale environments</li>\n</ul>\n<p>Preferred qualifications include:</p>\n<ul>\n<li>Background in distributed systems and infrastructure, including building resilient CI/CD platforms that process high pipeline volumes and optimizing performance for critical paths</li>\n<li>Practical experience with container security and Kubernetes security, including admission controllers, policy controllers, workload isolation, and registry hardening</li>\n<li>Proficiency in Go or Rust in a production environment, combined with expert-level understanding of CI/CD workflows and DevSecOps best practices</li>\n<li>Experience operating as a Principal or Staff Engineer across multiple development teams, providing architectural leadership and partnering with Engineering Managers and senior leaders</li>\n<li>Demonstrated capacity to clearly communicate complex problems and solutions</li>\n</ul>\n<p>Our Software Supply Chain Security stage engineering teams are responsible for authentication and access within GitLab. We also build features that help customers manage vulnerabilities, dependencies, security policies, and compliance frameworks across their organizations.</p>\n<p>The base salary range for this role&#39;s listed level is currently for residents of the United States only. This range is intended to reflect the role&#39;s base salary rate in locations throughout the US. Grade level and salary ranges are determined through interviews and a review of education, experience, knowledge, skills, abilities of the applicant, equity with other team members, alignment with market data, and geographic location. The base salary range does not include any bonuses, equity, or benefits.</p>\n<p style=\"margin-top:24px;font-size:13px;color:#666;\">XML job scraping automation by <a href=\"https://yubhub.co\">YubHub</a></p>","url":"https://yubhub.co/jobs/job_a3a1df2f-184","directApply":true,"hiringOrganization":{"@type":"Organization","name":"GitLab","sameAs":"https://about.gitlab.com/","logo":"https://logos.yubhub.co/about.gitlab.com.png"},"x-apply-url":"https://job-boards.greenhouse.io/gitlab/jobs/8373553002","x-work-arrangement":"remote","x-experience-level":"staff","x-job-type":"full-time","x-salary-range":"$157,900-$338,400 USD","x-skills-required":["software supply chain security","threat modeling","SLSA implementation","attestation systems","SBOM generation","lifecycle management","artifact signing","verification","Sigstore ecosystem","Cosign","Fulcio","Rekor","in-toto attestations","CI/CD security","runner isolation","pipeline security controls","secrets management","distributed systems","infrastructure","container security","Kubernetes security","admission controllers","policy controllers","workload isolation","registry hardening","Go","Rust","CI/CD workflows","DevSecOps best practices"],"x-skills-preferred":["background in distributed systems and infrastructure","practical experience with container security and Kubernetes security","proficiency in Go or Rust in a production environment","expert-level understanding of CI/CD workflows and DevSecOps best practices","experience operating as a Principal or Staff Engineer across multiple development teams"],"datePosted":"2026-04-18T15:45:22.426Z","jobLocation":{"@type":"Place","address":{"@type":"PostalAddress","addressLocality":"Remote, Canada; Remote, Israel; Remote, Netherlands; Remote, United Kingdom; Remote, US"}},"jobLocationType":"TELECOMMUTE","employmentType":"FULL_TIME","occupationalCategory":"Engineering","industry":"Technology","skills":"software supply chain security, threat modeling, SLSA implementation, attestation systems, SBOM generation, lifecycle management, artifact signing, verification, Sigstore ecosystem, Cosign, Fulcio, Rekor, in-toto attestations, CI/CD security, runner isolation, pipeline security controls, secrets management, distributed systems, infrastructure, container security, Kubernetes security, admission controllers, policy controllers, workload isolation, registry hardening, Go, Rust, CI/CD workflows, DevSecOps best practices, background in distributed systems and infrastructure, practical experience with container security and Kubernetes security, proficiency in Go or Rust in a production environment, expert-level understanding of CI/CD workflows and DevSecOps best practices, experience operating as a Principal or Staff Engineer across multiple development teams","baseSalary":{"@type":"MonetaryAmount","currency":"USD","value":{"@type":"QuantitativeValue","minValue":157900,"maxValue":338400,"unitText":"YEAR"}}},{"@context":"https://schema.org","@type":"JobPosting","identifier":{"@type":"PropertyValue","name":"YubHub","value":"job_8fc80897-0ec"},"title":"Intermediate Backend Engineer,  SSCS: Supply Chain","description":"<p>As an Intermediate Backend Engineer on the SSCS Add-On team at GitLab, you&#39;ll help build a dedicated software supply chain security feature for regulated enterprise organisations.</p>\n<p>In this role, you&#39;ll contribute to capabilities that help customers control software dependencies, verify artifact integrity, and identify malicious packages before they reach production.</p>\n<p>Your work will sit at the intersection of backend engineering, product integration, and security-focused development.</p>\n<p>You&#39;ll build in Ruby on Rails, work alongside Go services as needed, and help connect Add-On functionality with GitLab&#39;s existing security scanning experience so findings are surfaced consistently for users.</p>\n<p>Because the team is small, you&#39;ll have meaningful influence on implementation details, team practices, and the product experience.</p>\n<p>This role is part of GitLab&#39;s all-remote, async-first, values-driven environment, where clear written communication and thoughtful coordination across time zones are essential.</p>\n<p><strong>Responsibilities</strong></p>\n<ul>\n<li>Implement well-scoped backend features across the Add-On&#39;s supply chain security product, including package policy integrations, ingestion pipeline improvements, signing and verification support, and reliability-focused work, delivering maintainable code on agreed timelines and meeting team-defined delivery commitments.</li>\n</ul>\n<ul>\n<li>Build and maintain integrations between Add-On functionality and GitLab&#39;s existing software composition analysis scanning infrastructure so findings appear consistently and accurately in merge request security reports, reducing integration issues and supporting a reliable user experience.</li>\n</ul>\n<ul>\n<li>Write and maintain comprehensive automated test coverage, including RSpec and integration tests, to improve test reliability, reduce regressions, and support safe, consistent releases as the codebase grows.</li>\n</ul>\n<ul>\n<li>Take on work across multiple feature areas as priorities evolve, contributing as a generalist where the team needs support most.</li>\n</ul>\n<ul>\n<li>Participate actively in code review by giving thoughtful, actionable feedback and incorporating feedback constructively into your own work to help maintain code quality and reduce rework.</li>\n</ul>\n<ul>\n<li>Contribute clear internal documentation for the features and behavior you ship so teammates can support, extend, and troubleshoot the product effectively.</li>\n</ul>\n<ul>\n<li>Coordinate with adjacent Software Supply Chain Security teams, including Dependency Firewall and Malware Database, as the Add-On brings together capabilities from across GitLab, helping deliver aligned functionality and smoother cross-team execution.</li>\n</ul>\n<ul>\n<li>Collaborate effectively in an async-first environment across global time zones, including occasional off-hours overlap when needed, to keep work moving and decisions documented clearly.</li>\n</ul>\n<p><strong>Requirements</strong></p>\n<ul>\n<li>Backend development experience with the ability to deliver maintainable production code.</li>\n</ul>\n<ul>\n<li>Solid proficiency in Ruby on Rails and strong PostgreSQL fundamentals.</li>\n</ul>\n<ul>\n<li>Familiarity with Golang, or a willingness to learn and work across both Ruby on Rails and Go.</li>\n</ul>\n<ul>\n<li>Strong testing discipline, including experience with RSpec or an equivalent testing framework.</li>\n</ul>\n<ul>\n<li>Clear, direct written communication skills and experience collaborating with distributed teammates in asynchronous workflows.</li>\n</ul>\n<ul>\n<li>Ability to manage scoped work independently, communicate progress clearly, and adjust as team priorities shift.</li>\n</ul>\n<ul>\n<li>Interest in package ecosystems such as npm, Maven, PyPI, or OCI containers, or adjacent experience that helps you ramp in this domain.</li>\n</ul>\n<ul>\n<li>Interest in software supply chain security, dependency management, DevSecOps, or security-adjacent product development, with the ability to apply security considerations in backend development work.</li>\n</ul>\n<p><strong>About the Team</strong></p>\n<p>The SSCS Add-On team is part of GitLab&#39;s Software Supply Chain Security stage and is focused on building a commercial offering that addresses real supply chain security challenges for enterprise customers.</p>\n<p>The team works on capabilities that combine multiple parts of the GitLab product into a more complete security solution for organisations with strong compliance and risk management needs.</p>\n<p>The work is both technically interesting and strategically important.</p>\n<p>The team is building in a space shaped by fast-moving threats, evolving customer requirements, and close coordination with nearby teams across the broader security area.</p>\n<p>That combination creates an environment where engineers can contribute to product direction while solving practical backend challenges in a visible part of GitLab&#39;s platform.</p>\n<p>For more on how related teams work, see Team Handbook Page.</p>\n<p><strong>How GitLab Supports Full-Time Employees</strong></p>\n<ul>\n<li>Benefits to support your health, finances, and well-being</li>\n</ul>\n<ul>\n<li>Flexible Paid Time Off</li>\n</ul>\n<ul>\n<li>Team Member Resource Groups</li>\n</ul>\n<ul>\n<li>Equity Compensation &amp; Employee Stock Purchase Plan</li>\n</ul>\n<ul>\n<li>Growth and Development Fund</li>\n</ul>\n<ul>\n<li>Parental leave</li>\n</ul>\n<ul>\n<li>Home office support</li>\n</ul>\n<p style=\"margin-top:24px;font-size:13px;color:#666;\">XML job scraping automation by <a href=\"https://yubhub.co\">YubHub</a></p>","url":"https://yubhub.co/jobs/job_8fc80897-0ec","directApply":true,"hiringOrganization":{"@type":"Organization","name":"GitLab","sameAs":"https://about.gitlab.com/","logo":"https://logos.yubhub.co/about.gitlab.com.png"},"x-apply-url":"https://job-boards.greenhouse.io/gitlab/jobs/8480565002","x-work-arrangement":"remote","x-experience-level":"mid","x-job-type":"full-time","x-salary-range":null,"x-skills-required":["Ruby on Rails","Golang","PostgreSQL","RSpec","testing discipline"],"x-skills-preferred":["package ecosystems","software supply chain security","dependency management","DevSecOps","security-adjacent product development"],"datePosted":"2026-04-18T15:43:56.533Z","jobLocation":{"@type":"Place","address":{"@type":"PostalAddress","addressLocality":"Remote, India"}},"jobLocationType":"TELECOMMUTE","employmentType":"FULL_TIME","occupationalCategory":"Engineering","industry":"Technology","skills":"Ruby on Rails, Golang, PostgreSQL, RSpec, testing discipline, package ecosystems, software supply chain security, dependency management, DevSecOps, security-adjacent product development"},{"@context":"https://schema.org","@type":"JobPosting","identifier":{"@type":"PropertyValue","name":"YubHub","value":"job_cbaf9906-291"},"title":"Platform Hardware Security","description":"<p>We&#39;re seeking a Platform Hardware Security Engineer to design and implement security architectures for bare-metal infrastructure. You&#39;ll work with teams across Anthropic to build firmware, bootloaders, operating systems, and attestation systems to ensure the integrity of our infrastructure from the ground up.</p>\n<p>This role requires expertise in low-level systems security and the ability to architect solutions that balance security requirements with the performance demands of training AI models across our massive fleet.</p>\n<p>Responsibilities:</p>\n<ul>\n<li>Design and implement secure boot chains from firmware through OS initialization for diverse hardware platforms (CPUs, BMCs, switches, peripherals, and embedded microcontrollers)</li>\n</ul>\n<ul>\n<li>Architect attestation systems that provide cryptographic proof of system state from hardware root of trust through application layer</li>\n</ul>\n<ul>\n<li>Develop measured boot implementations and runtime integrity monitoring</li>\n</ul>\n<ul>\n<li>Create reference architectures and security requirements for bare-metal deployments</li>\n</ul>\n<ul>\n<li>Integrate security controls with infrastructure teams without impacting training performance</li>\n</ul>\n<ul>\n<li>Prototype and validate security mechanisms before production deployment</li>\n</ul>\n<ul>\n<li>Conduct firmware vulnerability assessments and penetration testing</li>\n</ul>\n<ul>\n<li>Build firmware analysis pipelines for continuous security monitoring</li>\n</ul>\n<ul>\n<li>Document security architectures and maintain threat models</li>\n</ul>\n<ul>\n<li>Collaborate with software and hardware vendors to ensure security capabilities meet our requirements</li>\n</ul>\n<p>Who you are:</p>\n<ul>\n<li>8+ years of experience in systems security, with at least 5 years focused on firmware and hardware security (firmware, bootloaders, and OS-level security)</li>\n</ul>\n<ul>\n<li>Hands-on experience with secure boot, measured boot, and attestation technologies (TPM, Intel TXT, AMD SEV, ARM TrustZone)</li>\n</ul>\n<ul>\n<li>Strong understanding of cryptographic protocols and hardware security modules</li>\n</ul>\n<ul>\n<li>Experience with UEFI/BIOS or embedded firmware security, bootloader hardening, and chain of trust implementation</li>\n</ul>\n<ul>\n<li>Proficiency in low-level programming (C, Rust, Assembly) and systems programming</li>\n</ul>\n<ul>\n<li>Knowledge of firmware vulnerability assessment and threat modeling</li>\n</ul>\n<ul>\n<li>Track record of designing security architectures for complex, distributed systems</li>\n</ul>\n<ul>\n<li>Experience with supply chain security</li>\n</ul>\n<ul>\n<li>Ability to work effectively across hardware and software boundaries</li>\n</ul>\n<ul>\n<li>Knowledge of NIST firmware security guidelines and hardware security frameworks</li>\n</ul>\n<p>Strong candidates may also have:</p>\n<ul>\n<li>Experience with confidential computing technologies and hardware-based TEEs</li>\n</ul>\n<ul>\n<li>Knowledge of SLSA framework and software supply chain security standards</li>\n</ul>\n<ul>\n<li>Experience securing large-scale HPC or cloud infrastructure</li>\n</ul>\n<ul>\n<li>Contributions to open-source security projects (coreboot, CHIPSEC, etc.)</li>\n</ul>\n<ul>\n<li>Background in formal verification or security proof techniques</li>\n</ul>\n<ul>\n<li>Experience with silicon root of trust implementations</li>\n</ul>\n<ul>\n<li>Experience working with building foundational technical designs, operational leadership, and vendor collaboration</li>\n</ul>\n<ul>\n<li>Previous work with AI/ML infrastructure security</li>\n</ul>\n<p>Annual Salary: $405,000-$485,000 USD</p>\n<p>Logistics:</p>\n<ul>\n<li>Minimum education: Bachelor’s degree or an equivalent combination of education, training, and/or experience</li>\n</ul>\n<ul>\n<li>Required field of study: A field relevant to the role as demonstrated through coursework, training, or professional experience</li>\n</ul>\n<ul>\n<li>Minimum years of experience: Years of experience required will correlate with the internal job level requirements for the position</li>\n</ul>\n<ul>\n<li>Location-based hybrid policy: Currently, we expect all staff to be in one of our offices at least 25% of the time. However, some roles may require more time in our offices.</li>\n</ul>\n<ul>\n<li>Visa sponsorship: We do sponsor visas! However, we aren&#39;t able to successfully sponsor visas for every role and every candidate. But if we make you an offer, we will make every reasonable effort to get you a visa, and we retain an immigration lawyer to help with this.</li>\n</ul>\n<p>Why work with us?</p>\n<ul>\n<li>Competitive compensation and benefits</li>\n</ul>\n<ul>\n<li>Optional equity donation matching</li>\n</ul>\n<ul>\n<li>Generous vacation and parental leave</li>\n</ul>\n<ul>\n<li>Flexible working hours</li>\n</ul>\n<ul>\n<li>Lovely office space in which to collaborate with colleagues</li>\n</ul>\n<p>Guidance on Candidates&#39; AI Usage: Learn about our policy for using AI in our application process</p>\n<p style=\"margin-top:24px;font-size:13px;color:#666;\">XML job scraping automation by <a href=\"https://yubhub.co\">YubHub</a></p>","url":"https://yubhub.co/jobs/job_cbaf9906-291","directApply":true,"hiringOrganization":{"@type":"Organization","name":"Anthropic","sameAs":"https://www.anthropic.com/","logo":"https://logos.yubhub.co/anthropic.com.png"},"x-apply-url":"https://job-boards.greenhouse.io/anthropic/jobs/4929689008","x-work-arrangement":"hybrid","x-experience-level":"senior","x-job-type":"full-time","x-salary-range":"$405,000-$485,000 USD","x-skills-required":["Secure boot","Measured boot","Attestation technologies","Cryptographic protocols","Hardware security modules","UEFI/BIOS or embedded firmware security","Bootloader hardening","Chain of trust implementation","Low-level programming","Systems programming","Firmware vulnerability assessment","Threat modeling","Supply chain security","NIST firmware security guidelines","Hardware security frameworks"],"x-skills-preferred":["Confidential computing technologies","Hardware-based TEEs","SLSA framework","Software supply chain security standards","Large-scale HPC or cloud infrastructure","Open-source security projects","Formal verification","Security proof techniques","Silicon root of trust implementations","Vendor collaboration","AI/ML infrastructure security"],"datePosted":"2026-04-18T15:43:00.394Z","jobLocation":{"@type":"Place","address":{"@type":"PostalAddress","addressLocality":"New York City, NY | Seattle, WA; San Francisco, CA | New York City, NY | Seattle, WA; Washington, DC"}},"employmentType":"FULL_TIME","occupationalCategory":"Engineering","industry":"Technology","skills":"Secure boot, Measured boot, Attestation technologies, Cryptographic protocols, Hardware security modules, UEFI/BIOS or embedded firmware security, Bootloader hardening, Chain of trust implementation, Low-level programming, Systems programming, Firmware vulnerability assessment, Threat modeling, Supply chain security, NIST firmware security guidelines, Hardware security frameworks, Confidential computing technologies, Hardware-based TEEs, SLSA framework, Software supply chain security standards, Large-scale HPC or cloud infrastructure, Open-source security projects, Formal verification, Security proof techniques, Silicon root of trust implementations, Vendor collaboration, AI/ML infrastructure security","baseSalary":{"@type":"MonetaryAmount","currency":"USD","value":{"@type":"QuantitativeValue","minValue":405000,"maxValue":485000,"unitText":"YEAR"}}},{"@context":"https://schema.org","@type":"JobPosting","identifier":{"@type":"PropertyValue","name":"YubHub","value":"job_05b1c668-59d"},"title":"Director, Product Security Architecture","description":"<p>We are seeking a Director, Product Security Architecture to lead our Security Architecture function within the Security Platforms &amp; Architecture (SPA) sub-department and to serve as a strategic security partner to key product and engineering leadership groups across GitLab.\\n\\nIn this role, you will manage and grow a team of Product Security Architects and our closely-aligned risk and metrics engineer who are each dedicated to major product areas of Security, AI, and Core DevOps. Your team will focus on turning product security risks, requirements, and insights into clear architectural guidance, &quot;paved roads,&quot; and multi-quarter risk reduction programs that align with how Product and Engineering actually plan and deliver.\\n\\nYou will operate in an environment where feature delivery and platform capabilities are accelerating, architectures and technologies are evolving, and teams are continually balancing ambitious product goals with a strong security posture. In this context, you will help Product Security:\\n\\n- Maximize risk reduction by identifying strategic opportunities that fit naturally into existing R&amp;D work\\n- Ensure that material product security risks and tradeoffs are surfaced, acknowledged, and decided at the right leadership levels\\n- Lead SPA/AppSec scaling strategies that increase coverage and support non-linear developer gains, with a clear focus on enabling developer velocity with minimal friction\\n\\nWhile many strong candidates will come from a deep product security background, this role is also an excellent fit for experienced software or architecture leaders who have consistently delivered secure, resilient systems in complex R&amp;D environments and are excited to lead security outcomes in close partnership with engineering.\\n\\nKey Responsibilities:\\n\\n- Lead, develop, and mentor a team of Product Security Architects and closely-aligned specialists who are dedicated to major product functional areas (e.g., Sec Section, AI, Core DevOps)\\n- Own and continuously evolve the Product Security Architecture strategy and partnership model, shifting architects from embedded consultants to accelerators of secure architecture delivery, and serve as a strategic partner to Product and Engineering Directors/VPs\\n- Oversee and mature the Product Security Risk Register, ensuring systemic product security risks are clearly articulated, prioritized with Product and Engineering, and paired with multi-quarter risk reduction plans that reduce long-term product security debt.\\n- Operate Product Security Architecture in a risk-aligned, business-enabling way that focuses Security Architects on the highest-impact, hardest-to-change architectural decisions, helping teams make clear, informed tradeoffs without slowing delivery.\\n- Define and drive security visions, standards, &quot;paved roads,&quot; and secure-by-default platform behaviors and configurations that enable product teams to make sound security decisions with minimal overhead, including evolving existing behaviors over time to strengthen the baseline security posture.\\n- Lead the Product Security AI strategy for scaling, including adoption of AI-assisted and platform-level investments that expand security review coverage, reduce toil, and support non-linear developer gains while enabling developer velocity.\\n- Partner with Application Security, Infrastructure Security, Security Research, Security Operations, Security Risk, and Security Compliance on end-to-end risk reduction, including security-related controls, quality standards, and integration of research and operational learnings into architectures.\\n- Define and track meaningful architecture-related metrics and Key Risk Indicators, and represent Product Security in cross-functional forums, clearly articulating risk, tradeoffs, and recommended paths forward.\\n\\nRequirements:\\n\\n- Significant experience (typically 10+ years) leading software, architecture, or application security initiatives in high-velocity R&amp;D organizations, with a strong grounding in building and evolving complex software systems\\n- Strong application security and secure design literacy, whether from direct AppSec roles or from owning secure delivery of large-scale systems, including familiarity with common vulnerability classes, modern software architectures, and practical mitigation patterns\\n- Deep understanding of systemic product security risks in large-scale platforms, with expertise in at least some of: CI/CD and pipeline security, software supply chain security, identity and access management (AuthN/Z), AI/ML security, or multi-tenant SaaS architectures\\n- Proven ability to operate effectively in constrained environments: balancing business goals and risk reduction, focusing attention on the highest-impact, hardest-to-reverse decisions, and framing options in terms of risk, cost, and customer impact rather than absolutes.\\n- Demonstrated success building trust with Product and Engineering Directors/VPs, influencing multi-quarter roadmaps, and co-owning outcomes rather than acting solely as a gate.\\n- Experience designing and rolling out scalable security patterns,standards, &quot;paved roads,&quot; and secure-by-default configurations,that reduce risk while minimizing additional toil for product and engineering teams.\\n- Experience collaborating with Compliance, Audit, and Security Operations on the definition, implementation, and demonstration of security controls and security-related quality standards, and translating technical designs into clear language for auditors, engineers, and senior leaders.\\n- Experience supporting organizations through significant technology and architectural change (e.g., adoption of new languages and frameworks, or evolution from monoliths toward microservices or domain-oriented architectures) while maintaining or improving security posture.\\n- Ability to operate at multiple altitudes,from executive-level strategy and stakeholder alignment down to detailed technical design discussions when necessary,with excellent written and verbal communication in an all-remote, asynchronous environment.\\n- Comfort with AI-augmented workflows and enthusiasm for leveraging tools like GitLab Duo to scale the Product Security Architecture function, along with strong alignment to GitLab’s values and a track record of thriving in a highly collaborative, remote-first culture.\\n- Nice to have: Experience with security requirements and frameworks relevant to GitLab’s customers (e.g., FedRAMP, ISO 27001, SOC 2, PCI-DSS);</p>\n<p style=\"margin-top:24px;font-size:13px;color:#666;\">XML job scraping automation by <a href=\"https://yubhub.co\">YubHub</a></p>","url":"https://yubhub.co/jobs/job_05b1c668-59d","directApply":true,"hiringOrganization":{"@type":"Organization","name":"GitLab","sameAs":"https://about.gitlab.com/","logo":"https://logos.yubhub.co/about.gitlab.com.png"},"x-apply-url":"https://job-boards.greenhouse.io/gitlab/jobs/8461323002","x-work-arrangement":"remote","x-experience-level":"senior","x-job-type":"full-time","x-salary-range":null,"x-skills-required":["Application Security","Secure Design","CI/CD and Pipeline Security","Software Supply Chain Security","Identity and Access Management","AI/ML Security","Multi-Tenant SaaS Architectures"],"x-skills-preferred":[],"datePosted":"2026-04-18T15:42:42.048Z","jobLocation":{"@type":"Place","address":{"@type":"PostalAddress","addressLocality":"Remote, Canada; Remote, EMEA; Remote, US"}},"jobLocationType":"TELECOMMUTE","employmentType":"FULL_TIME","occupationalCategory":"Engineering","industry":"Technology","skills":"Application Security, Secure Design, CI/CD and Pipeline Security, Software Supply Chain Security, Identity and Access Management, AI/ML Security, Multi-Tenant SaaS Architectures"},{"@context":"https://schema.org","@type":"JobPosting","identifier":{"@type":"PropertyValue","name":"YubHub","value":"job_9bf55fe3-b2b"},"title":"Detection & Response Engineer","description":"<p>We are seeking a skilled and proactive Detection &amp; Response Engineer to join our security team. In this critical role, you will be responsible for detecting, investigating, and responding to security incidents across our cloud-native and AI-focused infrastructure.</p>\n<p><strong>Responsibilities</strong></p>\n<ul>\n<li>Monitor and analyse security alerts and logs to identify potential threats and anomalies</li>\n<li>Develop, implement, and maintain detection rules and correlation logic in our SIEM platform</li>\n<li>Conduct thorough investigations of security incidents, performing root cause analysis and impact assessments</li>\n<li>Lead incident response efforts, coordinating with relevant teams to contain and mitigate threats</li>\n<li>Create and maintain incident response playbooks and runbooks</li>\n<li>Perform regular threat hunting activities to proactively identify potential security risks</li>\n<li>Develop and refine metrics and reporting to track the effectiveness of detection and response capabilities</li>\n<li>Collaborate with other security teams to improve overall security posture and incident handling processes</li>\n<li>Stay current with emerging threats, attack techniques, and defensive strategies in the cloud-native and AI domains</li>\n</ul>\n<p><strong>Basic Qualifications</strong></p>\n<ul>\n<li>Bachelor&#39;s degree in Computer Science, Cybersecurity, or a related field</li>\n<li>3-5 years of experience in security operations, incident response, or a similar role</li>\n<li>Strong understanding of cybersecurity principles, attack techniques, and defensive strategies</li>\n<li>Proficiency in at least one scripting language (e.g., Python, Rust) for automation and tool development</li>\n<li>Experience with SIEM platforms and log analysis tools</li>\n<li>Familiarity with cloud environments (e.g., AWS, GCP, Azure) and their security features</li>\n<li>Knowledge of network protocols, system administration, and common attack vectors</li>\n<li>Strong analytical and problem-solving skills with attention to detail</li>\n<li>Excellent communication skills and ability to work effectively under pressure</li>\n</ul>\n<p><strong>Preferred Skills and Experience</strong></p>\n<ul>\n<li>Relevant security certifications (e.g., GCIH, GCIA, SANS)</li>\n<li>Experience with threat intelligence platforms and their integration into detection processes</li>\n<li>Familiarity with AI/ML security implications, particularly those outlined in the OWASP LLM Top 10</li>\n<li>Knowledge of software supply chain security and SBOM analysis</li>\n<li>Experience with containerized environments and Kubernetes security</li>\n<li>Experience in building custom security tools or integrations to enhance detection and response capabilities</li>\n<li>Interest in leveraging AI to improve threat detection and automate response processes</li>\n<li>Contributions to open-source security projects or threat research</li>\n<li>Experience with digital forensics and malware analysis</li>\n</ul>\n<p><strong>Compensation and Benefits</strong></p>\n<p>$200,000 - $340,000 USD</p>\n<p>Base salary is just one part of our total rewards package at xAI, which also includes equity, comprehensive medical, vision, and dental coverage, access to a 401(k) retirement plan, short &amp; long-term disability insurance, life insurance, and various other discounts and perks.</p>\n<p style=\"margin-top:24px;font-size:13px;color:#666;\">XML job scraping automation by <a href=\"https://yubhub.co\">YubHub</a></p>","url":"https://yubhub.co/jobs/job_9bf55fe3-b2b","directApply":true,"hiringOrganization":{"@type":"Organization","name":"xAI","sameAs":"https://www.xai.com/","logo":"https://logos.yubhub.co/xai.com.png"},"x-apply-url":"https://job-boards.greenhouse.io/xai/jobs/4559148007","x-work-arrangement":"onsite","x-experience-level":"mid","x-job-type":"full-time","x-salary-range":"$200,000 - $340,000 USD","x-skills-required":["cybersecurity principles","attack techniques","defensive strategies","scripting language","SIEM platforms","log analysis tools","cloud environments","network protocols","system administration","common attack vectors"],"x-skills-preferred":["relevant security certifications","threat intelligence platforms","AI/ML security implications","software supply chain security","containerized environments","Kubernetes security","custom security tools","digital forensics","malware analysis"],"datePosted":"2026-04-18T15:23:47.430Z","jobLocation":{"@type":"Place","address":{"@type":"PostalAddress","addressLocality":"Palo Alto, CA"}},"employmentType":"FULL_TIME","occupationalCategory":"Engineering","industry":"Technology","skills":"cybersecurity principles, attack techniques, defensive strategies, scripting language, SIEM platforms, log analysis tools, cloud environments, network protocols, system administration, common attack vectors, relevant security certifications, threat intelligence platforms, AI/ML security implications, software supply chain security, containerized environments, Kubernetes security, custom security tools, digital forensics, malware analysis","baseSalary":{"@type":"MonetaryAmount","currency":"USD","value":{"@type":"QuantitativeValue","minValue":200000,"maxValue":340000,"unitText":"YEAR"}}},{"@context":"https://schema.org","@type":"JobPosting","identifier":{"@type":"PropertyValue","name":"YubHub","value":"job_6d2bed6a-1bd"},"title":"Application Security Engineer","description":"<p>We are seeking a skilled and innovative Application Security Engineer to join our technology-driven company. In this role, you will be responsible for ensuring the security and integrity of our cloud-native applications and systems throughout the software development lifecycle, with a particular focus on code security, CI/CD pipelines, and emerging AI technologies.</p>\n<p>Responsibilities: Conduct in-depth code reviews and static analysis to identify and mitigate security vulnerabilities in our applications Design and implement secure coding guidelines and best practices for development teams Collaborate closely with development teams to integrate security practices throughout the CI/CD pipeline Perform threat modeling and risk assessments for applications, developing mitigation strategies for potential risks Manage vulnerability tracking and remediation efforts, providing guidance to development teams Support incident response activities related to application security Stay current on emerging security threats and trends in cloud-native technologies and AI, continuously enhancing our security measures Evaluate and secure software supply chains, including producing and maintaining Software Bills of Materials (SBOMs) Address security concerns specific to AI and machine learning models, with a focus on the OWASP LLM Top 10</p>\n<p>Basic Qualifications: Bachelor&#39;s degree in Computer Science, Cybersecurity, or a related field 3-5 years of experience in application security, with a strong focus on code security practices Deep understanding of secure coding practices, application security frameworks, and common vulnerabilities (e.g., OWASP Top 10) Proficiency in Python or Rust programming languages and experience with secure coding practices in these languages Experience securing CI/CD pipelines and implementing DevSecOps practices Familiarity with software supply chain security and SBOM generation tools Experience with security testing tools (e.g., Burp Suite, OWASP ZAP) and static/dynamic code analysis Understanding of AI/ML security implications, particularly those outlined in the OWASP LLM Top 10 Excellent communication skills, able to explain complex security issues to both technical and non-technical audiences</p>\n<p>Preferred Skills and Experience: Experience with cloud platforms (e.g., GCP, AWS, Azure) and their security features Relevant security certifications (e.g., CSSLP, OSWE) Background in data privacy and compliance regulations relevant to cloud-native applications and AI systems Experience with GitOps and infrastructure-as-code security Familiarity with federated learning and privacy-preserving machine learning techniques Experience in building custom security tooling to enhance and automate security processes Interest in leveraging AI to automate security tasks and improve efficiency Contributions to open-source security projects or tools Experience in securing AI/ML models and data pipelines</p>\n<p>Compensation and Benefits: $200,000 - $340,000 USD Base salary is just one part of our total rewards package at xAI, which also includes equity, comprehensive medical, vision, and dental coverage, access to a 401(k) retirement plan, short &amp; long-term disability insurance, life insurance, and various other discounts and perks.</p>\n<p style=\"margin-top:24px;font-size:13px;color:#666;\">XML job scraping automation by <a href=\"https://yubhub.co\">YubHub</a></p>","url":"https://yubhub.co/jobs/job_6d2bed6a-1bd","directApply":true,"hiringOrganization":{"@type":"Organization","name":"xAI","sameAs":"https://www.xai.com/","logo":"https://logos.yubhub.co/xai.com.png"},"x-apply-url":"https://job-boards.greenhouse.io/xai/jobs/4559147007","x-work-arrangement":"onsite","x-experience-level":"mid","x-job-type":"full-time","x-salary-range":"$200,000 - $340,000 USD","x-skills-required":["Python","Rust","Secure coding practices","Application security frameworks","Common vulnerabilities","OWASP Top 10","CI/CD pipelines","DevSecOps practices","Software supply chain security","SBOM generation tools","Security testing tools","Static/dynamic code analysis","AI/ML security implications","OWASP LLM Top 10"],"x-skills-preferred":["Cloud platforms","Security certifications","Data privacy and compliance regulations","GitOps","Infrastructure-as-code security","Federated learning","Privacy-preserving machine learning techniques","Custom security tooling","AI automation","Open-source security projects","AI/ML model security"],"datePosted":"2026-04-18T15:23:13.995Z","jobLocation":{"@type":"Place","address":{"@type":"PostalAddress","addressLocality":"Palo Alto, CA"}},"employmentType":"FULL_TIME","occupationalCategory":"Engineering","industry":"Technology","skills":"Python, Rust, Secure coding practices, Application security frameworks, Common vulnerabilities, OWASP Top 10, CI/CD pipelines, DevSecOps practices, Software supply chain security, SBOM generation tools, Security testing tools, Static/dynamic code analysis, AI/ML security implications, OWASP LLM Top 10, Cloud platforms, Security certifications, Data privacy and compliance regulations, GitOps, Infrastructure-as-code security, Federated learning, Privacy-preserving machine learning techniques, Custom security tooling, AI automation, Open-source security projects, AI/ML model security","baseSalary":{"@type":"MonetaryAmount","currency":"USD","value":{"@type":"QuantitativeValue","minValue":200000,"maxValue":340000,"unitText":"YEAR"}}},{"@context":"https://schema.org","@type":"JobPosting","identifier":{"@type":"PropertyValue","name":"YubHub","value":"job_f2ee807d-528"},"title":"Security Engineer","description":"<p>We&#39;re seeking a Security Engineer at the senior-level or above focused on software and systems security to own the security of Saronic&#39;s software platforms, build systems, and deployment infrastructure from development through production.</p>\n<p>As a Security Engineer, you will be the technical authority on how Saronic builds, ships, and runs secure software. You will lead secure code review, SAST, DAST, and fuzzing efforts, and define secure coding standards for Rust development including memory safety practices, safe FFI boundaries, and secure error handling.</p>\n<p>You will conduct threat modeling for software systems and translate findings into actionable security requirements integrated into design reviews and sprint planning. You will drive vulnerability management for software dependencies, including tracking, prioritization, and remediation of vulnerabilities in third-party crates and libraries.</p>\n<p>You will secure and harden NixOS configurations for vessel platforms and development infrastructure, leveraging Nix&#39;s reproducibility and declarative model for security enforcement. You will design system hardening profiles in NixOS including kernel hardening, service isolation, mandatory access controls, and minimal attack surface configurations.</p>\n<p>You will define and enforce package management and dependency policies within the Nix ecosystem, ensuring build closures are auditable, reproducible, and free from unauthorized or vulnerable packages. You will architect secure system update and rollback mechanisms using NixOS capabilities, ensuring fleet-wide consistency and integrity.</p>\n<p>You will design and implement security controls across the CI/CD pipeline including source integrity, build isolation, artifact signing, and deployment verification with build environments that are ephemeral, isolated, and hardened.</p>\n<p>You will build and maintain software supply chain security practices aligned to SLSA framework principles, including provenance tracking, hermetic builds, signed attestations, and SBOM generation.</p>\n<p>You will integrate security scanning (SAST, SCA, container scanning, secrets detection) into CI/CD pipelines as automated guardrails, and create self-service pipeline templates that enable teams to ship without bottlenecks.</p>\n<p>You will design secure deployment patterns for vessel software updates, including secure delivery, integrity verification, and rollback capabilities.</p>\n<p>You will implement runtime application security controls including logging, monitoring, and anomaly detection for deployed services.</p>\n<p>You will define software and systems security standards, patterns, and reference architectures that engineering teams adopt as the default secure path.</p>\n<p style=\"margin-top:24px;font-size:13px;color:#666;\">XML job scraping automation by <a href=\"https://yubhub.co\">YubHub</a></p>","url":"https://yubhub.co/jobs/job_f2ee807d-528","directApply":true,"hiringOrganization":{"@type":"Organization","name":"Saronic Technologies","sameAs":"https://www.saronictechnologies.com/","logo":"https://logos.yubhub.co/saronictechnologies.com.png"},"x-apply-url":"https://jobs.lever.co/saronic/70738ef6-22be-464f-a451-09882093482d","x-work-arrangement":"onsite","x-experience-level":"senior","x-job-type":"full-time","x-salary-range":null,"x-skills-required":["Rust","NixOS","CI/CD pipeline security","software supply chain security","SLSA framework principles","provenance tracking","hermetic builds","signed attestations","SBOM generation","security scanning","SAST","SCA","container scanning","secrets detection"],"x-skills-preferred":["NixOS experience","hands-on NixOS experience","experience securing software for embedded or resource-constrained Linux environments"],"datePosted":"2026-04-17T12:58:06.790Z","jobLocation":{"@type":"Place","address":{"@type":"PostalAddress","addressLocality":"San Francisco"}},"employmentType":"FULL_TIME","occupationalCategory":"Engineering","industry":"Technology","skills":"Rust, NixOS, CI/CD pipeline security, software supply chain security, SLSA framework principles, provenance tracking, hermetic builds, signed attestations, SBOM generation, security scanning, SAST, SCA, container scanning, secrets detection, NixOS experience, hands-on NixOS experience, experience securing software for embedded or resource-constrained Linux environments"},{"@context":"https://schema.org","@type":"JobPosting","identifier":{"@type":"PropertyValue","name":"YubHub","value":"job_fb4fa003-a73"},"title":"Platform Hardware Security Engineer","description":"<p><strong>About the Role</strong></p>\n<p>We&#39;re seeking a Platform Hardware Security Engineer to design and implement security architectures for bare-metal infrastructure. You&#39;ll work with teams across Anthropic to build firmware, bootloaders, operating systems, and attestation systems to ensure the integrity of our infrastructure from the ground up.</p>\n<p>This role requires expertise in low-level systems security and the ability to architect solutions that balance security requirements with the performance demands of training AI models across our massive fleet.</p>\n<p><strong>What you&#39;ll do:</strong></p>\n<ul>\n<li>Design and implement secure boot chains from firmware through OS initialization for diverse hardware platforms (CPUs, BMCs, switches, peripherals, and embedded microcontrollers)</li>\n<li>Architect attestation systems that provide cryptographic proof of system state from hardware root of trust through application layer</li>\n<li>Develop measured boot implementations and runtime integrity monitoring</li>\n<li>Create reference architectures and security requirements for bare-metal deployments</li>\n<li>Integrate security controls with infrastructure teams without impacting training performance</li>\n<li>Prototype and validate security mechanisms before production deployment</li>\n<li>Conduct firmware vulnerability assessments and penetration testing</li>\n<li>Build firmware analysis pipelines for continuous security monitoring</li>\n<li>Document security architectures and maintain threat models</li>\n<li>Collaborate with software and hardware vendors to ensure security capabilities meet our requirements</li>\n</ul>\n<p><strong>Who you are:</strong></p>\n<ul>\n<li>8+ years of experience in systems security, with at least 5 years focused on firmware and hardware security (firmware, bootloaders, and OS-level security)</li>\n<li>Hands-on experience with secure boot, measured boot, and attestation technologies (TPM, Intel TXT, AMD SEV, ARM TrustZone)</li>\n<li>Strong understanding of cryptographic protocols and hardware security modules</li>\n<li>Experience with UEFI/BIOS or embedded firmware security, bootloader hardening, and chain of trust implementation</li>\n<li>Proficiency in low-level programming (C, Rust, Assembly) and systems programming</li>\n<li>Knowledge of firmware vulnerability assessment and threat modeling</li>\n<li>Track record of designing security architectures for complex, distributed systems</li>\n<li>Experience with supply chain security</li>\n<li>Ability to work effectively across hardware and software boundaries</li>\n<li>Knowledge of NIST firmware security guidelines and hardware security frameworks</li>\n</ul>\n<p><strong>Strong candidates may also have:</strong></p>\n<ul>\n<li>Experience with confidential computing technologies and hardware-based TEEs</li>\n<li>Knowledge of SLSA framework and software supply chain security standards</li>\n<li>Experience securing large-scale HPC or cloud infrastructure</li>\n<li>Contributions to open-source security projects (coreboot, CHIPSEC, etc.)</li>\n<li>Background in formal verification or security proof techniques</li>\n<li>Experience with silicon root of trust implementations</li>\n<li>Experience working with building foundational technical designs, operational leadership, and vendor collaboration</li>\n<li>Previous work with AI/ML infrastructure security</li>\n</ul>\n<p><strong>Logistics</strong></p>\n<ul>\n<li>Education requirements: We require at least a Bachelor&#39;s degree in a related field or equivalent experience.</li>\n<li>Location-based hybrid policy: Currently, we expect all staff to be in one of our offices at least 25% of the time. However, some roles may require more time in our offices.</li>\n<li>Visa sponsorship: We do sponsor visas! However, we aren&#39;t able to successfully sponsor visas for every role and every candidate. But if we make you an offer, we will make every reasonable effort to get you a visa, and we retain an immigration lawyer to help with this.</li>\n</ul>\n<p><strong>We encourage you to apply even if you do not believe you meet every single qualification. Not all strong candidates will meet every single qualification as listed. Research shows that people who identify as being from underrepresented groups are more prone to experiencing imposter syndrome and doubting the strength of their candidacy, so we urge you not to exclude yourself prematurely and to submit an application if you&#39;re interested in this work.</strong></p>\n<p><strong>Your safety matters to us. To protect yourself from potential scams, remember that Anthropic recruiters only contact you from @anthropic.com email addresses. In some cases, we may partner with vetted recruiting agencies who will identify themselves as working on behalf of Anthropic. Be cautious of emails from other domains. Legitimate Anthropic recruiters will never ask for money, fees, or banking information before your first day. If you&#39;re ever unsure about a communication, don&#39;t click any links—visit anthropic.com/careers directly for confirmed position openings.</strong></p>\n<p><strong>How we&#39;re different</strong></p>\n<p>We believe that the highest-impact AI research will be big science. At Anthropic we work as a single cohesive team on just a few large-scale research efforts.</p>\n<p style=\"margin-top:24px;font-size:13px;color:#666;\">XML job scraping automation by <a href=\"https://yubhub.co\">YubHub</a></p>","url":"https://yubhub.co/jobs/job_fb4fa003-a73","directApply":true,"hiringOrganization":{"@type":"Organization","name":"Anthropic","sameAs":"https://job-boards.greenhouse.io","logo":"https://logos.yubhub.co/anthropic.com.png"},"x-apply-url":"https://job-boards.greenhouse.io/anthropic/jobs/4929689008","x-work-arrangement":"hybrid","x-experience-level":"senior","x-job-type":"full-time","x-salary-range":"$405,000 - $485,000 USD","x-skills-required":["firmware security","hardware security","secure boot","measured boot","attestation technologies","cryptographic protocols","hardware security modules","UEFI/BIOS","embedded firmware security","bootloader hardening","chain of trust implementation","low-level programming","systems programming","firmware vulnerability assessment","threat modeling","supply chain security","NIST firmware security guidelines","hardware security frameworks"],"x-skills-preferred":["confidential computing technologies","hardware-based TEEs","SLSA framework","software supply chain security standards","large-scale HPC or cloud infrastructure","open-source security projects","formal verification","security proof techniques","silicon root of trust implementations","AI/ML infrastructure security"],"datePosted":"2026-03-08T13:47:08.377Z","jobLocation":{"@type":"Place","address":{"@type":"PostalAddress","addressLocality":"New York City, NY; Seattle, WA; San Francisco, CA; Washington, DC"}},"employmentType":"FULL_TIME","occupationalCategory":"Engineering","industry":"Technology","skills":"firmware security, hardware security, secure boot, measured boot, attestation technologies, cryptographic protocols, hardware security modules, UEFI/BIOS, embedded firmware security, bootloader hardening, chain of trust implementation, low-level programming, systems programming, firmware vulnerability assessment, threat modeling, supply chain security, NIST firmware security guidelines, hardware security frameworks, confidential computing technologies, hardware-based TEEs, SLSA framework, software supply chain security standards, large-scale HPC or cloud infrastructure, open-source security projects, formal verification, security proof techniques, silicon root of trust implementations, AI/ML infrastructure security","baseSalary":{"@type":"MonetaryAmount","currency":"USD","value":{"@type":"QuantitativeValue","minValue":405000,"maxValue":485000,"unitText":"YEAR"}}}]}