{"version":"0.1","company":{"name":"YubHub","url":"https://yubhub.co","jobsUrl":"https://yubhub.co/jobs/skill/supply-chain-security"},"x-facet":{"type":"skill","slug":"supply-chain-security","display":"Supply Chain Security","count":18},"x-feed-size-limit":100,"x-feed-sort":"enriched_at desc","x-feed-notice":"This feed contains at most 100 jobs (the most recently enriched). For the full corpus, use the paginated /stats/by-facet endpoint or /search.","x-generator":"yubhub-xml-generator","x-rights":"Free to redistribute with attribution: \"Data by YubHub (https://yubhub.co)\"","x-schema":"Each entry in `jobs` follows https://schema.org/JobPosting. YubHub-native raw fields carry `x-` prefix.","jobs":[{"@context":"https://schema.org","@type":"JobPosting","identifier":{"@type":"PropertyValue","name":"YubHub","value":"job_770c5fe8-cce"},"title":"Staff Security Engineer, Vulnerability Management","description":"<p>We are seeking a Staff Security Engineer to lead the most complex technical work in CoreWeave&#39;s Vulnerability Management program.</p>\n<p>As a Staff Security Engineer, you will design and implement scalable triage, prioritization, and remediation-tracking systems across application, infrastructure, and hardware domains. You will set technical standards, drive high-impact initiatives, and mentor engineers through technical leadership, while partnering with leadership on priorities and execution risks.</p>\n<p>Key Responsibilities:</p>\n<ul>\n<li>Lead high-complexity VM technical initiatives and deliver architecture decisions for assigned program areas</li>\n<li>Design and build scalable triage automation, including integrations, decision logic, and production hardening</li>\n<li>Implement end-to-end workflow components from assessment and detection to ticket routing and remediation tracking</li>\n<li>Provide deep technical leadership on hardware-adjacent vulnerabilities (GPU firmware, DPU firmware/BlueField, and BMC surfaces)</li>\n<li>Act as senior technical responder for embargoed disclosures and zero-day events, coordinating with owner teams that deploy fixes</li>\n<li>Improve prioritization logic, severity models, and exception workflows through code, design reviews, and technical proposals</li>\n<li>Produce actionable technical metrics and risk insights for leadership consumption</li>\n<li>Lead root-cause analysis for high-impact vulnerability incidents and implement durable technical improvements</li>\n<li>Mentor IC3/IC4/IC5 engineers through design guidance, code review, and incident coaching</li>\n<li>Partner with security, engineering, and operational stakeholders to improve workflow reliability and accelerate remediation outcomes</li>\n</ul>\n<p>Requirements:</p>\n<ul>\n<li>9+ years of relevant experience with demonstrated strategic impact in vulnerability management, application security, platform security, or cloud security engineering</li>\n<li>Proven track record building and scaling security automation (SOAR workflows, AI/ML systems, detection pipelines) in production environments</li>\n<li>Deep subject matter expertise with vulnerability management best practices: CVSS, EPSS, CISA KEV, threat intelligence integration, and risk-based prioritization frameworks</li>\n<li>Excellent development background with strong coding skills in Python, Go, or similar languages for building scalable, production-grade security systems</li>\n<li>Significant experience with modern vulnerability management tooling (for example Wiz, Semgrep, Rapid7, Tenable, or equivalent)</li>\n<li>Experience with specialized infrastructure: GPU/DPU environments, firmware security, hardware vulnerabilities, or high-performance computing</li>\n<li>Demonstrated track record mentoring engineers across levels and driving cross-functional technical initiatives at organizational scale</li>\n<li>Strong business acumen and understanding of how security decisions impact engineering velocity, customer trust, and business outcomes</li>\n</ul>\n<p>Preferred Qualifications:</p>\n<ul>\n<li>Practical experience building AI/ML-powered security systems (LLM integration, automated decision-making, human-in-the-loop validation) in production</li>\n<li>Experience managing hardware vendor security partnerships (embargoed disclosures and pre-release collaboration)</li>\n<li>Production experience with security automation platforms such as TINES and serverless frameworks (AWS Lambda, GCP Cloud Functions)</li>\n<li>Strong DevOps, DevSecOps, or SRE background with deep experience in AWS/GCP/Azure cloud services and Infrastructure as Code (Terraform, CloudFormation)</li>\n<li>Deep understanding of Kubernetes security (container scanning, admission controllers, supply chain security, runtime protection)</li>\n<li>Experience leading security programs through rapid hypergrowth (10x+ infrastructure scaling) in startup or cloud-native environments</li>\n<li>Practical experience managing vulnerabilities within a FedRAMP-certified environment or similar regulatory frameworks</li>\n</ul>\n<p>Salary and Benefits: The base salary range for this role is $188,000 to $275,000. The starting salary will be determined based on job-related knowledge, skills, experience, and market location. We strive for both market alignment and internal equity when determining compensation. In addition to base salary, our total rewards package includes a discretionary bonus, equity awards, and a comprehensive benefits program (all based on eligibility).</p>\n<p>Work Environment:</p>\n<p>While we prioritize a hybrid work environment, remote work may be considered for candidates located more than 30 miles from an office, based on role requirements for specialized skill sets. New hires will be invited to attend onboarding at one of our hubs within their first month. Teams also gather quarterly to support collaboration.</p>\n<p style=\"margin-top:24px;font-size:13px;color:#666;\">XML job scraping automation by <a href=\"https://yubhub.co\">YubHub</a></p>","url":"https://yubhub.co/jobs/job_770c5fe8-cce","directApply":true,"hiringOrganization":{"@type":"Organization","name":"CoreWeave","sameAs":"https://www.coreweave.com","logo":"https://logos.yubhub.co/coreweave.com.png"},"x-apply-url":"https://job-boards.greenhouse.io/coreweave/jobs/4653130006","x-work-arrangement":"hybrid","x-experience-level":"staff","x-job-type":"full-time","x-salary-range":"$188,000 to $275,000","x-skills-required":["vulnerability management","application security","platform security","cloud security engineering","security automation","AI/ML systems","detection pipelines","Python","Go","modern vulnerability management tooling","GPU/DPU environments","firmware security","hardware vulnerabilities","high-performance computing"],"x-skills-preferred":["AI/ML-powered security systems","LLM integration","automated decision-making","human-in-the-loop validation","security automation platforms","TINES","serverless frameworks","AWS Lambda","GCP Cloud Functions","DevOps","DevSecOps","SRE","Kubernetes security","container scanning","admission controllers","supply chain security","runtime protection"],"datePosted":"2026-04-18T15:59:06.360Z","jobLocation":{"@type":"Place","address":{"@type":"PostalAddress","addressLocality":"Livingston, NJ / New York, NY / Sunnyvale, CA / Bellevue, WA"}},"employmentType":"FULL_TIME","occupationalCategory":"Engineering","industry":"Technology","skills":"vulnerability management, application security, platform security, cloud security engineering, security automation, AI/ML systems, detection pipelines, Python, Go, modern vulnerability management tooling, GPU/DPU environments, firmware security, hardware vulnerabilities, high-performance computing, AI/ML-powered security systems, LLM integration, automated decision-making, human-in-the-loop validation, security automation platforms, TINES, serverless frameworks, AWS Lambda, GCP Cloud Functions, DevOps, DevSecOps, SRE, Kubernetes security, container scanning, admission controllers, supply chain security, runtime protection","baseSalary":{"@type":"MonetaryAmount","currency":"USD","value":{"@type":"QuantitativeValue","minValue":188000,"maxValue":275000,"unitText":"YEAR"}}},{"@context":"https://schema.org","@type":"JobPosting","identifier":{"@type":"PropertyValue","name":"YubHub","value":"job_aec0a354-6fe"},"title":"Staff Backend Engineer,  SSCS: Supply Chain","description":"<p>As a Staff Backend Engineer at GitLab, you will help shape a major investment in our Software Supply Chain Security offering. In this role, you&#39;ll serve as a senior technical leader for backend systems that help customers secure how software is built, verified, and delivered inside the GitLab platform.</p>\n<p>You&#39;ll work on foundational capabilities across package policy enforcement, build provenance, artifact signing, and malicious package detection, with a strong focus on enterprise-grade security and performance. You&#39;ll define architecture before systems are built, write clear technical proposals, and guide implementation across interconnected parts of GitLab such as CI/CD, dependency management, and security workflows.</p>\n<p>This role is a strong fit for someone who enjoys solving complex backend problems, influencing technical direction across teams, and building security features that matter to customers facing real threats. You&#39;ll do this in GitLab&#39;s remote, asynchronous, and values-driven environment, where written communication, ownership, and teamwork are central to how we work.</p>\n<p>Some examples of our projects:</p>\n<ul>\n<li>Dependency Firewall for package policy enforcement across supported registries</li>\n<li>Artifact attestation and signing using supply chain security standards and the Sigstore ecosystem</li>\n</ul>\n<p>Responsibilities:</p>\n<ul>\n<li>Define and drive the technical architecture for the SSCS Add-On, including backend systems for package policy enforcement, provenance generation, artifact signing, and malicious package detection.</li>\n<li>Lead design and implementation work for Supply-chain Levels for Software Artifacts (SLSA) Level 2 and Level 3 capabilities within GitLab CI/CD.</li>\n<li>Architect integrations with Sigstore services such as Cosign, Fulcio, and Rekor, including approaches for signing workflows, verification, and trust boundaries.</li>\n<li>Design backend services and request paths that support allow, deny, and quarantine package policies with strong performance and reliability expectations.</li>\n<li>Review merge requests with a focus on security, architectural consistency, maintainability, and test quality.</li>\n<li>Mentor Backend Engineers across experience levels, helping raise the technical bar through design guidance, feedback, and hiring participation.</li>\n<li>Partner with Product, Infrastructure, Authentication, Authorization, and Security counterparts on cross-team technical decisions.</li>\n<li>Contribute to relevant open source and industry conversations, including working groups related to software supply chain security where appropriate.</li>\n</ul>\n<p>Requirements:</p>\n<ul>\n<li>Strong experience building backend applications with Ruby on Rails in a high-scale production environment.</li>\n<li>Professional experience with Go for backend or infrastructure-oriented services.</li>\n<li>A track record of leading architecture across multiple systems and influencing technical direction through strong engineering judgment.</li>\n<li>Experience writing clear technical proposals, request for comments documents, and decision records in an async, documentation-first environment.</li>\n<li>A solid security mindset and comfort working on products where trust, risk reduction, and secure defaults are central requirements.</li>\n<li>Familiarity with software supply chain security concepts such as build provenance, artifact signing, dependency security, or software bill of materials.</li>\n<li>Strong teamwork and communication skills, with the ability to work effectively across distributed teams and functions.</li>\n<li>Interest in GitLab&#39;s values and in building secure, scalable product capabilities that help customers ship software with confidence.</li>\n</ul>\n<p>About the team:</p>\n<p>The SSCS Add-On team is part of GitLab&#39;s Software Supply Chain Security stage and is focused on building a commercial offering that addresses real supply chain security challenges for enterprise customers. The team works on capabilities that combine multiple parts of the GitLab product into a more complete security solution for organisations with strong compliance and risk management needs.</p>\n<p>The work is both technically interesting and strategically important. The team is building in a space shaped by fast-moving threats, evolving customer requirements, and close coordination with nearby teams across the broader security area. That combination creates an environment where engineers can contribute to product direction while solving practical backend challenges in a visible part of GitLab&#39;s platform.</p>\n<p>For more on how related teams work, see Team Handbook Page.</p>\n<p style=\"margin-top:24px;font-size:13px;color:#666;\">XML job scraping automation by <a href=\"https://yubhub.co\">YubHub</a></p>","url":"https://yubhub.co/jobs/job_aec0a354-6fe","directApply":true,"hiringOrganization":{"@type":"Organization","name":"GitLab","sameAs":"https://about.gitlab.com/","logo":"https://logos.yubhub.co/about.gitlab.com.png"},"x-apply-url":"https://job-boards.greenhouse.io/gitlab/jobs/8480559002","x-work-arrangement":"remote","x-experience-level":"staff","x-job-type":"full-time","x-salary-range":null,"x-skills-required":["Ruby on Rails","Go","Backend applications","Architecture","Technical leadership","Security","Supply chain security","Software development"],"x-skills-preferred":[],"datePosted":"2026-04-18T15:55:35.423Z","jobLocation":{"@type":"Place","address":{"@type":"PostalAddress","addressLocality":"Remote, India"}},"jobLocationType":"TELECOMMUTE","employmentType":"FULL_TIME","occupationalCategory":"Engineering","industry":"Technology","skills":"Ruby on Rails, Go, Backend applications, Architecture, Technical leadership, Security, Supply chain security, Software development"},{"@context":"https://schema.org","@type":"JobPosting","identifier":{"@type":"PropertyValue","name":"YubHub","value":"job_b5ce114e-dac"},"title":"Cloud Engineer – Factory Systems and Operational Technology","description":"<p>Anduril Industries is a defence technology company with a mission to transform U.S. and allied military capabilities with advanced technology. By bringing the expertise, technology and business model of the 21st century&#39;s most innovative companies to the defence industry, Anduril is changing how military systems are designed, built and sold.</p>\n<p>The company&#39;s family of systems is powered by Lattice OS, an AI-powered operating system that turns thousands of data streams into a real-time, 3D command and control centre.</p>\n<p>As the world enters an era of strategic competition, Anduril is committed to bringing cutting-edge autonomy, AI, computer vision, sensor fusion and networking technology to the military in months, not years.</p>\n<p>We are seeking a mission-driven Cloud Infrastructure Engineer to take a leading role in designing and implementing world-class defensive controls. This is a high-impact role with the autonomy to shape security architecture and protect the technology that is changing the future of defence.</p>\n<p>Key Responsibilities:</p>\n<ul>\n<li>Design and Own Security Architecture: Architect, build and deploy robust, scalable security controls for our corporate, development and production cloud environments (AWS, Azure, GCP).</li>\n</ul>\n<ul>\n<li>Automate Everything: Develop and automate infrastructure-as-code (IaC) to manage and scale our cloud deployments securely and efficiently.</li>\n</ul>\n<ul>\n<li>Proactively Defend: Continuously monitor, identify and remediate security weaknesses and configuration drift across our entire cloud footprint.</li>\n</ul>\n<ul>\n<li>Be a Force Multiplier: Partner with infrastructure, application and product teams to embed security best practices into their workflows and secure environments holding mission-critical data.</li>\n</ul>\n<ul>\n<li>Enable Scale and Reliability: Engineer systems and processes that ensure our platforms are highly available, resilient and prepared for rapid growth.</li>\n</ul>\n<ul>\n<li>Serve as a Cloud Security Expert: Act as the go-to subject matter expert for teams across Anduril, providing guidance, mentorship and paved-road solutions for building securely in the cloud.</li>\n</ul>\n<p>Requirements:</p>\n<ul>\n<li>Proven experience building and securing complex cloud environments, typically gained through 3+ years in a Cloud Security, DevOps or SRE role.</li>\n</ul>\n<ul>\n<li>Deep proficiency in at least one major cloud provider (AWS, Azure or GCP).</li>\n</ul>\n<ul>\n<li>Strong hands-on experience with Infrastructure as Code (e.g., Terraform, CloudFormation, Bicep).</li>\n</ul>\n<ul>\n<li>Solid programming/scripting ability in one or more languages (e.g., Python, Go, Rust).</li>\n</ul>\n<ul>\n<li>Firm understanding of public cloud networking principles (e.g., VPCs, subnets, routing, security groups).</li>\n</ul>\n<ul>\n<li>Must be a U.S. Person and eligible to obtain and maintain a U.S. Top Secret security clearance.</li>\n</ul>\n<p>Preferred Qualifications:</p>\n<ul>\n<li>Experience hardening and monitoring Kubernetes clusters (EKS, GKE, AKS).</li>\n</ul>\n<ul>\n<li>Experience with cloud security posture management (CSPM) or threat detection tooling.</li>\n</ul>\n<ul>\n<li>Familiarity with CI/CD pipelines and securing the software supply chain.</li>\n</ul>\n<ul>\n<li>Knowledge of compliance frameworks such as FedRAMP, MRL, SOC 2 or CMMC.</li>\n</ul>\n<ul>\n<li>On-premises network engineering experience.</li>\n</ul>\n<p style=\"margin-top:24px;font-size:13px;color:#666;\">XML job scraping automation by <a href=\"https://yubhub.co\">YubHub</a></p>","url":"https://yubhub.co/jobs/job_b5ce114e-dac","directApply":true,"hiringOrganization":{"@type":"Organization","name":"Anduril Industries","sameAs":"https://www.anduril.com/","logo":"https://logos.yubhub.co/anduril.com.png"},"x-apply-url":"https://job-boards.greenhouse.io/andurilindustries/jobs/5087348007","x-work-arrangement":"onsite","x-experience-level":"senior","x-job-type":"full-time","x-salary-range":"$129,000-$193,000 USD","x-skills-required":["Cloud Security","DevOps","SRE","Infrastructure as Code","Terraform","CloudFormation","Bicep","Python","Go","Rust","Public Cloud Networking","VPCs","Subnets","Routing","Security Groups"],"x-skills-preferred":["Kubernetes","Cloud Security Posture Management","Threat Detection Tooling","CI/CD Pipelines","Software Supply Chain Security","Compliance Frameworks","FedRAMP","MRL","SOC 2","CMMC","On-Premises Network Engineering"],"datePosted":"2026-04-18T15:49:59.253Z","jobLocation":{"@type":"Place","address":{"@type":"PostalAddress","addressLocality":"Costa Mesa, California, United States"}},"employmentType":"FULL_TIME","occupationalCategory":"Engineering","industry":"Technology","skills":"Cloud Security, DevOps, SRE, Infrastructure as Code, Terraform, CloudFormation, Bicep, Python, Go, Rust, Public Cloud Networking, VPCs, Subnets, Routing, Security Groups, Kubernetes, Cloud Security Posture Management, Threat Detection Tooling, CI/CD Pipelines, Software Supply Chain Security, Compliance Frameworks, FedRAMP, MRL, SOC 2, CMMC, On-Premises Network Engineering","baseSalary":{"@type":"MonetaryAmount","currency":"USD","value":{"@type":"QuantitativeValue","minValue":129000,"maxValue":193000,"unitText":"YEAR"}}},{"@context":"https://schema.org","@type":"JobPosting","identifier":{"@type":"PropertyValue","name":"YubHub","value":"job_5003c49e-cf6"},"title":"Engineering Manager, SSCS: Supply Chain","description":"<p>As an Engineering Manager, you&#39;ll guide GitLab&#39;s dedicated Software Supply Chain Security (SSCS) Add-On engineering team as it develops core capabilities including Dependency Firewall, Build Provenance, Malicious Packages detection, and Artifact Signing.</p>\n<p>This is a founding management role where you&#39;ll help shape how the team works, partner closely with the Staff Backend Engineer, Product Manager, and SSCS stage management, and turn a defined roadmap into steady, high-quality delivery for enterprise customers with strict security and compliance needs.</p>\n<p>You&#39;ll focus on developing the team, creating a healthy operating rhythm, and establishing predictable execution for the SSCS SKU.</p>\n<p>You&#39;ll join a product area where customers in regulated industries are already validating the need, and your work will help GitLab deliver software supply chain security features that customers can rely on.</p>\n<p>While technical credibility matters, your main focus will be growing a strong backend engineering team, enabling team members in their development, and creating the conditions for long-term delivery and quality.</p>\n<p>Responsibilities:</p>\n<ul>\n<li>Guide a backend engineering team building the SSCS Add-On across dependency enforcement, build provenance, malicious package detection, and artifact signing.</li>\n</ul>\n<ul>\n<li>Be responsible for driving engineering delivery for general availability milestones by aligning sequencing, scope, and dependencies with the Staff Backend Engineer and Product Manager.</li>\n</ul>\n<ul>\n<li>Develop the team by partnering with Talent Acquisition on sourcing, interview design, candidate evaluation, and hiring decisions.</li>\n</ul>\n<ul>\n<li>Run regular 1:1s, performance reviews, and career development conversations that enable growth and clear expectations.</li>\n</ul>\n<ul>\n<li>Advance engineering quality by monitoring cycle time, defect rates, and test coverage, and by addressing risks early.</li>\n</ul>\n<ul>\n<li>Coordinate quarterly planning and roadmap tradeoff discussions with SSCS stage leadership and Product.</li>\n</ul>\n<ul>\n<li>Work with Finance and other partners on headcount pacing and team planning as the Add-On scales.</li>\n</ul>\n<ul>\n<li>Represent the SSCS Add-On team within stage leadership discussions and help ensure strong communication across functions.</li>\n</ul>\n<p>Requirements:</p>\n<ul>\n<li>Over 3 years of experience guiding backend product engineering teams in security, DevOps, or platform engineering environments.</li>\n</ul>\n<ul>\n<li>Ability to hire and grow backend or security engineers in distributed team environments, with practical understanding of the talent landscape for these roles.</li>\n</ul>\n<ul>\n<li>Technical credibility to contribute to architecture discussions involving package registries, CI/CD pipeline security, and signing infrastructure.</li>\n</ul>\n<ul>\n<li>Experience managing predictable delivery across multi-quarter product roadmaps and managing cross-team dependencies.</li>\n</ul>\n<ul>\n<li>Comfort working in an asynchronous, documentation-driven organization with clear written communication.</li>\n</ul>\n<ul>\n<li>Familiarity with supply chain security, artifact management, or compliance-focused product areas, or transferable experience from related domains.</li>\n</ul>\n<ul>\n<li>Working knowledge of concepts related to frameworks and ecosystems such as SLSA and Sigstore.</li>\n</ul>\n<ul>\n<li>Ability to build credibility with engineers, product partners, and customer-facing stakeholders through clear judgment, coaching, and teamwork.</li>\n</ul>\n<p>About the team: The SSCS Add-On team is a product engineering team within GitLab&#39;s Software Supply Chain Security stage. We work on key capabilities in the SSCS Add-On SKU and collaborate closely with product and engineering partners to deliver security features for customers operating in regulated environments.</p>\n<p>You&#39;ll report to the SSCS Senior Engineering Manager and partner directly with the Staff Backend Engineer and Product Manager.</p>\n<p>As a distributed team working asynchronously across regions, we are focused on strong delivery practices, team health, and scaling the product area with clarity and accountability.</p>\n<p>For more on how related teams work, see Team Handbook Page.</p>\n<p>How GitLab Supports Full-Time Employees:</p>\n<ul>\n<li>Benefits to support your health, finances, and well-being</li>\n</ul>\n<ul>\n<li>Flexible Paid Time Off</li>\n</ul>\n<ul>\n<li>Team Member Resource Groups</li>\n</ul>\n<ul>\n<li>Equity Compensation &amp; Employee Stock Purchase Plan</li>\n</ul>\n<ul>\n<li>Growth and Development Fund</li>\n</ul>\n<ul>\n<li>Parental leave</li>\n</ul>\n<ul>\n<li>Home office support</li>\n</ul>\n<p style=\"margin-top:24px;font-size:13px;color:#666;\">XML job scraping automation by <a href=\"https://yubhub.co\">YubHub</a></p>","url":"https://yubhub.co/jobs/job_5003c49e-cf6","directApply":true,"hiringOrganization":{"@type":"Organization","name":"GitLab","sameAs":"https://about.gitlab.com/","logo":"https://logos.yubhub.co/about.gitlab.com.png"},"x-apply-url":"https://job-boards.greenhouse.io/gitlab/jobs/8478405002","x-work-arrangement":"remote","x-experience-level":"senior","x-job-type":"full-time","x-salary-range":null,"x-skills-required":["GitLab","Software Supply Chain Security","Dependency Firewall","Build Provenance","Malicious Packages detection","Artifact Signing","Backend engineering","Security","DevOps","Platform engineering","Package registries","CI/CD pipeline security","Signing infrastructure","Supply chain security","Artifact management","Compliance-focused product areas","Frameworks and ecosystems","SLSA","Sigstore"],"x-skills-preferred":[],"datePosted":"2026-04-18T15:49:15.915Z","jobLocation":{"@type":"Place","address":{"@type":"PostalAddress","addressLocality":"Remote, India"}},"jobLocationType":"TELECOMMUTE","employmentType":"FULL_TIME","occupationalCategory":"Engineering","industry":"Technology","skills":"GitLab, Software Supply Chain Security, Dependency Firewall, Build Provenance, Malicious Packages detection, Artifact Signing, Backend engineering, Security, DevOps, Platform engineering, Package registries, CI/CD pipeline security, Signing infrastructure, Supply chain security, Artifact management, Compliance-focused product areas, Frameworks and ecosystems, SLSA, Sigstore"},{"@context":"https://schema.org","@type":"JobPosting","identifier":{"@type":"PropertyValue","name":"YubHub","value":"job_44ff0179-993"},"title":"Senior Backend Engineer (RoR), SSCS: Pipeline Security","description":"<p>As a Senior Backend Engineer on the Pipeline Security team, you&#39;ll take technical ownership of GitLab&#39;s native Secrets Manager, a production system built on OpenBao that helps secure sensitive credentials across GitLab CI/CD pipelines.</p>\n<p>You&#39;ll work at the intersection of backend engineering and infrastructure, shaping architecture in Ruby on Rails and Go, guiding decisions around role-based access control (RBAC), GraphQL APIs, and Kubernetes deployment configuration.</p>\n<p>In your first year, you&#39;ll help move Secrets Manager toward general availability, establish technical patterns the team can build on, and represent the team&#39;s point of view in cross-functional discussions.</p>\n<p>You&#39;ll have end-to-end ownership, from design through production operations, with room to identify what should be built next and improve how the team delivers secure, reliable features.</p>\n<p><strong>Responsibilities</strong></p>\n<ul>\n<li>Build and maintain secure, readable backend code primarily in Ruby on Rails, with some development in Go for targeted components.</li>\n</ul>\n<ul>\n<li>Design backend architecture for complex security features, including secrets access control, pipeline security enforcement, and OpenBao integration.</li>\n</ul>\n<ul>\n<li>Lead the development of role-based access control models, GraphQL APIs, and supporting application patterns for features owned by the team.</li>\n</ul>\n<ul>\n<li>Own features end to end, from technical design and implementation through deployment, validation, and production support.</li>\n</ul>\n<ul>\n<li>Collaborate with Product, security partners, and other engineering teams to document tradeoffs, align on direction, and deliver iteratively in a distributed environment.</li>\n</ul>\n<ul>\n<li>Improve code quality, maintainability, security, and performance through code review, design iteration, and internal standards for a high-scale web environment.</li>\n</ul>\n<ul>\n<li>Build and maintain Helm charts, including configuration, tuning, documentation, and automated testing for Kubernetes-based deployments.</li>\n</ul>\n<ul>\n<li>Validate features in Kubernetes environments, including GitLab Cloud Native and Cloud Native Hybrid deployments, using GitLab testing and performance testing frameworks.</li>\n</ul>\n<p><strong>Requirements</strong></p>\n<ul>\n<li>Experience building and maintaining backend features with a focus on secure design, data handling, and production reliability.</li>\n</ul>\n<ul>\n<li>Ability to write production-quality code in Ruby on Rails, including use of framework security patterns and review for common application risks.</li>\n</ul>\n<ul>\n<li>Working knowledge of CI/CD concepts and the ways pipelines can be misconfigured, abused, or expose sensitive data.</li>\n</ul>\n<ul>\n<li>Familiarity with secrets management approaches and security practices for handling credentials in CI environments; experience with tools such as HashiCorp Vault or similar systems is helpful.</li>\n</ul>\n<ul>\n<li>Comfort collaborating across Product and engineering teams in an asynchronous, distributed environment and communicating technical tradeoffs clearly in writing.</li>\n</ul>\n<ul>\n<li>Ability to review merge requests with a security-first mindset and improve solutions through feedback and iteration.</li>\n</ul>\n<ul>\n<li>Experience debugging production issues, including investigation of security-related behavior and proposing practical fixes.</li>\n</ul>\n<ul>\n<li>Openness to learning adjacent domains and tools, including Go, container security, and software supply chain security; we welcome transferable experience from different technical backgrounds.</li>\n</ul>\n<p><strong>About the Team</strong></p>\n<p>The Pipeline Security team builds features that make GitLab CI pipelines more secure and trustworthy for teams running sensitive workloads. We own key parts of pipeline security within GitLab&#39;s CI/CD experience, with our current focus on native secrets management for CI pipelines and Supply-chain Levels for Software Artifacts (SLSA) Level 3 capabilities to strengthen software supply chain security.</p>\n<p style=\"margin-top:24px;font-size:13px;color:#666;\">XML job scraping automation by <a href=\"https://yubhub.co\">YubHub</a></p>","url":"https://yubhub.co/jobs/job_44ff0179-993","directApply":true,"hiringOrganization":{"@type":"Organization","name":"GitLab","sameAs":"https://about.gitlab.com/","logo":"https://logos.yubhub.co/about.gitlab.com.png"},"x-apply-url":"https://job-boards.greenhouse.io/gitlab/jobs/8432221002","x-work-arrangement":"remote","x-experience-level":"senior","x-job-type":"full-time","x-salary-range":"$117,600-$252,000 USD","x-skills-required":["Ruby on Rails","Go","OpenBao","Role-Based Access Control (RBAC)","GraphQL APIs","Kubernetes deployment configuration","Helm charts","CI/CD concepts","Secrets management approaches","Security practices for handling credentials in CI environments"],"x-skills-preferred":["Container security","Software supply chain security"],"datePosted":"2026-04-18T15:45:33.847Z","jobLocation":{"@type":"Place","address":{"@type":"PostalAddress","addressLocality":"Remote, Canada; Remote, Ireland; Remote, Israel; Remote, Netherlands; Remote, United Kingdom; Remote, US"}},"jobLocationType":"TELECOMMUTE","employmentType":"FULL_TIME","occupationalCategory":"Engineering","industry":"Technology","skills":"Ruby on Rails, Go, OpenBao, Role-Based Access Control (RBAC), GraphQL APIs, Kubernetes deployment configuration, Helm charts, CI/CD concepts, Secrets management approaches, Security practices for handling credentials in CI environments, Container security, Software supply chain security","baseSalary":{"@type":"MonetaryAmount","currency":"USD","value":{"@type":"QuantitativeValue","minValue":117600,"maxValue":252000,"unitText":"YEAR"}}},{"@context":"https://schema.org","@type":"JobPosting","identifier":{"@type":"PropertyValue","name":"YubHub","value":"job_a3a1df2f-184"},"title":"Principal Engineer, Software Supply Chain Security","description":"<p>As the Principal Engineer, Software Supply Chain Security, you&#39;ll own the technical strategy that secures how software is built and delivered on GitLab&#39;s DevSecOps platform. You&#39;ll provide architectural leadership across multiple engineering teams.</p>\n<p>Your work will shape GitLab&#39;s enterprise security posture in the rapidly growing software supply chain security market. You&#39;ll focus on SLSA Level 3 compliance, secrets management, CI/CD security hardening, and the foundations of GitLab&#39;s global zero trust architecture.</p>\n<p>Some examples of our projects:</p>\n<ul>\n<li>SLSA Level 3 compliance and provenance attestation across GitLab&#39;s CI/CD platform</li>\n<li>Integrated secrets management and runner security for container-isolated, secure pipelines</li>\n</ul>\n<p>You&#39;ll lead the end-to-end software supply chain security architecture for GitLab&#39;s CI/CD platform, including SLSA Level 3 implementation and CI infrastructure hardening. You&#39;ll drive cross-team technical strategy and decisions across our Software Supply Chain Security (SSCS) stage teams, aligning engineering work to SSCS strategic plans.</p>\n<p>You&#39;ll collaborate with infrastructure and CI/CD teams to design and land long-term initiatives for secure, scalable runner architecture, container isolation, and pipeline security at scale. You&#39;ll propose and validate technical implementations that support architectural changes to improve CI/CD scaling and performance on critical paths.</p>\n<p>You&#39;ll teach, mentor, and coach Staff Engineers and individual contributors, raising the bar on supply chain threat modeling, secrets management, artifact signing, and SBOM lifecycle practices.</p>\n<p>You&#39;ll partner with Engineering Managers and senior leadership to define roadmaps, break down complex initiatives, and enable Staff Engineers to lead sub-department-wide efforts.</p>\n<p>You&#39;ll engage with customers and external stakeholders as a technical consultant and spokesperson for GitLab&#39;s software supply chain security capabilities and roadmap.</p>\n<p>You&#39;ll collaborate with product, security, and compliance stakeholders to ensure features meet enterprise security, governance, and regulatory expectations in the software supply chain security market.</p>\n<p>Key responsibilities include:</p>\n<ul>\n<li>Providing architectural leadership across multiple engineering teams</li>\n<li>Shaping GitLab&#39;s enterprise security posture in the rapidly growing software supply chain security market</li>\n<li>Focusing on SLSA Level 3 compliance, secrets management, CI/CD security hardening, and the foundations of GitLab&#39;s global zero trust architecture</li>\n</ul>\n<p>Key requirements include:</p>\n<ul>\n<li>Deep expertise in software supply chain security, including threat modeling for supply chain attack vectors, SLSA implementation and attestation systems, and SBOM generation and lifecycle management</li>\n<li>Strong knowledge of artifact signing and verification using the Sigstore ecosystem, including Cosign, Fulcio, Rekor, and in-toto attestations</li>\n<li>Experience designing and hardening CI/CD security, such as runner isolation, pipeline security controls, and secrets management in large-scale environments</li>\n</ul>\n<p>Preferred qualifications include:</p>\n<ul>\n<li>Background in distributed systems and infrastructure, including building resilient CI/CD platforms that process high pipeline volumes and optimizing performance for critical paths</li>\n<li>Practical experience with container security and Kubernetes security, including admission controllers, policy controllers, workload isolation, and registry hardening</li>\n<li>Proficiency in Go or Rust in a production environment, combined with expert-level understanding of CI/CD workflows and DevSecOps best practices</li>\n<li>Experience operating as a Principal or Staff Engineer across multiple development teams, providing architectural leadership and partnering with Engineering Managers and senior leaders</li>\n<li>Demonstrated capacity to clearly communicate complex problems and solutions</li>\n</ul>\n<p>Our Software Supply Chain Security stage engineering teams are responsible for authentication and access within GitLab. We also build features that help customers manage vulnerabilities, dependencies, security policies, and compliance frameworks across their organizations.</p>\n<p>The base salary range for this role&#39;s listed level is currently for residents of the United States only. This range is intended to reflect the role&#39;s base salary rate in locations throughout the US. Grade level and salary ranges are determined through interviews and a review of education, experience, knowledge, skills, abilities of the applicant, equity with other team members, alignment with market data, and geographic location. The base salary range does not include any bonuses, equity, or benefits.</p>\n<p style=\"margin-top:24px;font-size:13px;color:#666;\">XML job scraping automation by <a href=\"https://yubhub.co\">YubHub</a></p>","url":"https://yubhub.co/jobs/job_a3a1df2f-184","directApply":true,"hiringOrganization":{"@type":"Organization","name":"GitLab","sameAs":"https://about.gitlab.com/","logo":"https://logos.yubhub.co/about.gitlab.com.png"},"x-apply-url":"https://job-boards.greenhouse.io/gitlab/jobs/8373553002","x-work-arrangement":"remote","x-experience-level":"staff","x-job-type":"full-time","x-salary-range":"$157,900-$338,400 USD","x-skills-required":["software supply chain security","threat modeling","SLSA implementation","attestation systems","SBOM generation","lifecycle management","artifact signing","verification","Sigstore ecosystem","Cosign","Fulcio","Rekor","in-toto attestations","CI/CD security","runner isolation","pipeline security controls","secrets management","distributed systems","infrastructure","container security","Kubernetes security","admission controllers","policy controllers","workload isolation","registry hardening","Go","Rust","CI/CD workflows","DevSecOps best practices"],"x-skills-preferred":["background in distributed systems and infrastructure","practical experience with container security and Kubernetes security","proficiency in Go or Rust in a production environment","expert-level understanding of CI/CD workflows and DevSecOps best practices","experience operating as a Principal or Staff Engineer across multiple development teams"],"datePosted":"2026-04-18T15:45:22.426Z","jobLocation":{"@type":"Place","address":{"@type":"PostalAddress","addressLocality":"Remote, Canada; Remote, Israel; Remote, Netherlands; Remote, United Kingdom; Remote, US"}},"jobLocationType":"TELECOMMUTE","employmentType":"FULL_TIME","occupationalCategory":"Engineering","industry":"Technology","skills":"software supply chain security, threat modeling, SLSA implementation, attestation systems, SBOM generation, lifecycle management, artifact signing, verification, Sigstore ecosystem, Cosign, Fulcio, Rekor, in-toto attestations, CI/CD security, runner isolation, pipeline security controls, secrets management, distributed systems, infrastructure, container security, Kubernetes security, admission controllers, policy controllers, workload isolation, registry hardening, Go, Rust, CI/CD workflows, DevSecOps best practices, background in distributed systems and infrastructure, practical experience with container security and Kubernetes security, proficiency in Go or Rust in a production environment, expert-level understanding of CI/CD workflows and DevSecOps best practices, experience operating as a Principal or Staff Engineer across multiple development teams","baseSalary":{"@type":"MonetaryAmount","currency":"USD","value":{"@type":"QuantitativeValue","minValue":157900,"maxValue":338400,"unitText":"YEAR"}}},{"@context":"https://schema.org","@type":"JobPosting","identifier":{"@type":"PropertyValue","name":"YubHub","value":"job_8fc80897-0ec"},"title":"Intermediate Backend Engineer,  SSCS: Supply Chain","description":"<p>As an Intermediate Backend Engineer on the SSCS Add-On team at GitLab, you&#39;ll help build a dedicated software supply chain security feature for regulated enterprise organisations.</p>\n<p>In this role, you&#39;ll contribute to capabilities that help customers control software dependencies, verify artifact integrity, and identify malicious packages before they reach production.</p>\n<p>Your work will sit at the intersection of backend engineering, product integration, and security-focused development.</p>\n<p>You&#39;ll build in Ruby on Rails, work alongside Go services as needed, and help connect Add-On functionality with GitLab&#39;s existing security scanning experience so findings are surfaced consistently for users.</p>\n<p>Because the team is small, you&#39;ll have meaningful influence on implementation details, team practices, and the product experience.</p>\n<p>This role is part of GitLab&#39;s all-remote, async-first, values-driven environment, where clear written communication and thoughtful coordination across time zones are essential.</p>\n<p><strong>Responsibilities</strong></p>\n<ul>\n<li>Implement well-scoped backend features across the Add-On&#39;s supply chain security product, including package policy integrations, ingestion pipeline improvements, signing and verification support, and reliability-focused work, delivering maintainable code on agreed timelines and meeting team-defined delivery commitments.</li>\n</ul>\n<ul>\n<li>Build and maintain integrations between Add-On functionality and GitLab&#39;s existing software composition analysis scanning infrastructure so findings appear consistently and accurately in merge request security reports, reducing integration issues and supporting a reliable user experience.</li>\n</ul>\n<ul>\n<li>Write and maintain comprehensive automated test coverage, including RSpec and integration tests, to improve test reliability, reduce regressions, and support safe, consistent releases as the codebase grows.</li>\n</ul>\n<ul>\n<li>Take on work across multiple feature areas as priorities evolve, contributing as a generalist where the team needs support most.</li>\n</ul>\n<ul>\n<li>Participate actively in code review by giving thoughtful, actionable feedback and incorporating feedback constructively into your own work to help maintain code quality and reduce rework.</li>\n</ul>\n<ul>\n<li>Contribute clear internal documentation for the features and behavior you ship so teammates can support, extend, and troubleshoot the product effectively.</li>\n</ul>\n<ul>\n<li>Coordinate with adjacent Software Supply Chain Security teams, including Dependency Firewall and Malware Database, as the Add-On brings together capabilities from across GitLab, helping deliver aligned functionality and smoother cross-team execution.</li>\n</ul>\n<ul>\n<li>Collaborate effectively in an async-first environment across global time zones, including occasional off-hours overlap when needed, to keep work moving and decisions documented clearly.</li>\n</ul>\n<p><strong>Requirements</strong></p>\n<ul>\n<li>Backend development experience with the ability to deliver maintainable production code.</li>\n</ul>\n<ul>\n<li>Solid proficiency in Ruby on Rails and strong PostgreSQL fundamentals.</li>\n</ul>\n<ul>\n<li>Familiarity with Golang, or a willingness to learn and work across both Ruby on Rails and Go.</li>\n</ul>\n<ul>\n<li>Strong testing discipline, including experience with RSpec or an equivalent testing framework.</li>\n</ul>\n<ul>\n<li>Clear, direct written communication skills and experience collaborating with distributed teammates in asynchronous workflows.</li>\n</ul>\n<ul>\n<li>Ability to manage scoped work independently, communicate progress clearly, and adjust as team priorities shift.</li>\n</ul>\n<ul>\n<li>Interest in package ecosystems such as npm, Maven, PyPI, or OCI containers, or adjacent experience that helps you ramp in this domain.</li>\n</ul>\n<ul>\n<li>Interest in software supply chain security, dependency management, DevSecOps, or security-adjacent product development, with the ability to apply security considerations in backend development work.</li>\n</ul>\n<p><strong>About the Team</strong></p>\n<p>The SSCS Add-On team is part of GitLab&#39;s Software Supply Chain Security stage and is focused on building a commercial offering that addresses real supply chain security challenges for enterprise customers.</p>\n<p>The team works on capabilities that combine multiple parts of the GitLab product into a more complete security solution for organisations with strong compliance and risk management needs.</p>\n<p>The work is both technically interesting and strategically important.</p>\n<p>The team is building in a space shaped by fast-moving threats, evolving customer requirements, and close coordination with nearby teams across the broader security area.</p>\n<p>That combination creates an environment where engineers can contribute to product direction while solving practical backend challenges in a visible part of GitLab&#39;s platform.</p>\n<p>For more on how related teams work, see Team Handbook Page.</p>\n<p><strong>How GitLab Supports Full-Time Employees</strong></p>\n<ul>\n<li>Benefits to support your health, finances, and well-being</li>\n</ul>\n<ul>\n<li>Flexible Paid Time Off</li>\n</ul>\n<ul>\n<li>Team Member Resource Groups</li>\n</ul>\n<ul>\n<li>Equity Compensation &amp; Employee Stock Purchase Plan</li>\n</ul>\n<ul>\n<li>Growth and Development Fund</li>\n</ul>\n<ul>\n<li>Parental leave</li>\n</ul>\n<ul>\n<li>Home office support</li>\n</ul>\n<p style=\"margin-top:24px;font-size:13px;color:#666;\">XML job scraping automation by <a href=\"https://yubhub.co\">YubHub</a></p>","url":"https://yubhub.co/jobs/job_8fc80897-0ec","directApply":true,"hiringOrganization":{"@type":"Organization","name":"GitLab","sameAs":"https://about.gitlab.com/","logo":"https://logos.yubhub.co/about.gitlab.com.png"},"x-apply-url":"https://job-boards.greenhouse.io/gitlab/jobs/8480565002","x-work-arrangement":"remote","x-experience-level":"mid","x-job-type":"full-time","x-salary-range":null,"x-skills-required":["Ruby on Rails","Golang","PostgreSQL","RSpec","testing discipline"],"x-skills-preferred":["package ecosystems","software supply chain security","dependency management","DevSecOps","security-adjacent product development"],"datePosted":"2026-04-18T15:43:56.533Z","jobLocation":{"@type":"Place","address":{"@type":"PostalAddress","addressLocality":"Remote, India"}},"jobLocationType":"TELECOMMUTE","employmentType":"FULL_TIME","occupationalCategory":"Engineering","industry":"Technology","skills":"Ruby on Rails, Golang, PostgreSQL, RSpec, testing discipline, package ecosystems, software supply chain security, dependency management, DevSecOps, security-adjacent product development"},{"@context":"https://schema.org","@type":"JobPosting","identifier":{"@type":"PropertyValue","name":"YubHub","value":"job_cbaf9906-291"},"title":"Platform Hardware Security","description":"<p>We&#39;re seeking a Platform Hardware Security Engineer to design and implement security architectures for bare-metal infrastructure. You&#39;ll work with teams across Anthropic to build firmware, bootloaders, operating systems, and attestation systems to ensure the integrity of our infrastructure from the ground up.</p>\n<p>This role requires expertise in low-level systems security and the ability to architect solutions that balance security requirements with the performance demands of training AI models across our massive fleet.</p>\n<p>Responsibilities:</p>\n<ul>\n<li>Design and implement secure boot chains from firmware through OS initialization for diverse hardware platforms (CPUs, BMCs, switches, peripherals, and embedded microcontrollers)</li>\n</ul>\n<ul>\n<li>Architect attestation systems that provide cryptographic proof of system state from hardware root of trust through application layer</li>\n</ul>\n<ul>\n<li>Develop measured boot implementations and runtime integrity monitoring</li>\n</ul>\n<ul>\n<li>Create reference architectures and security requirements for bare-metal deployments</li>\n</ul>\n<ul>\n<li>Integrate security controls with infrastructure teams without impacting training performance</li>\n</ul>\n<ul>\n<li>Prototype and validate security mechanisms before production deployment</li>\n</ul>\n<ul>\n<li>Conduct firmware vulnerability assessments and penetration testing</li>\n</ul>\n<ul>\n<li>Build firmware analysis pipelines for continuous security monitoring</li>\n</ul>\n<ul>\n<li>Document security architectures and maintain threat models</li>\n</ul>\n<ul>\n<li>Collaborate with software and hardware vendors to ensure security capabilities meet our requirements</li>\n</ul>\n<p>Who you are:</p>\n<ul>\n<li>8+ years of experience in systems security, with at least 5 years focused on firmware and hardware security (firmware, bootloaders, and OS-level security)</li>\n</ul>\n<ul>\n<li>Hands-on experience with secure boot, measured boot, and attestation technologies (TPM, Intel TXT, AMD SEV, ARM TrustZone)</li>\n</ul>\n<ul>\n<li>Strong understanding of cryptographic protocols and hardware security modules</li>\n</ul>\n<ul>\n<li>Experience with UEFI/BIOS or embedded firmware security, bootloader hardening, and chain of trust implementation</li>\n</ul>\n<ul>\n<li>Proficiency in low-level programming (C, Rust, Assembly) and systems programming</li>\n</ul>\n<ul>\n<li>Knowledge of firmware vulnerability assessment and threat modeling</li>\n</ul>\n<ul>\n<li>Track record of designing security architectures for complex, distributed systems</li>\n</ul>\n<ul>\n<li>Experience with supply chain security</li>\n</ul>\n<ul>\n<li>Ability to work effectively across hardware and software boundaries</li>\n</ul>\n<ul>\n<li>Knowledge of NIST firmware security guidelines and hardware security frameworks</li>\n</ul>\n<p>Strong candidates may also have:</p>\n<ul>\n<li>Experience with confidential computing technologies and hardware-based TEEs</li>\n</ul>\n<ul>\n<li>Knowledge of SLSA framework and software supply chain security standards</li>\n</ul>\n<ul>\n<li>Experience securing large-scale HPC or cloud infrastructure</li>\n</ul>\n<ul>\n<li>Contributions to open-source security projects (coreboot, CHIPSEC, etc.)</li>\n</ul>\n<ul>\n<li>Background in formal verification or security proof techniques</li>\n</ul>\n<ul>\n<li>Experience with silicon root of trust implementations</li>\n</ul>\n<ul>\n<li>Experience working with building foundational technical designs, operational leadership, and vendor collaboration</li>\n</ul>\n<ul>\n<li>Previous work with AI/ML infrastructure security</li>\n</ul>\n<p>Annual Salary: $405,000-$485,000 USD</p>\n<p>Logistics:</p>\n<ul>\n<li>Minimum education: Bachelor’s degree or an equivalent combination of education, training, and/or experience</li>\n</ul>\n<ul>\n<li>Required field of study: A field relevant to the role as demonstrated through coursework, training, or professional experience</li>\n</ul>\n<ul>\n<li>Minimum years of experience: Years of experience required will correlate with the internal job level requirements for the position</li>\n</ul>\n<ul>\n<li>Location-based hybrid policy: Currently, we expect all staff to be in one of our offices at least 25% of the time. However, some roles may require more time in our offices.</li>\n</ul>\n<ul>\n<li>Visa sponsorship: We do sponsor visas! However, we aren&#39;t able to successfully sponsor visas for every role and every candidate. But if we make you an offer, we will make every reasonable effort to get you a visa, and we retain an immigration lawyer to help with this.</li>\n</ul>\n<p>Why work with us?</p>\n<ul>\n<li>Competitive compensation and benefits</li>\n</ul>\n<ul>\n<li>Optional equity donation matching</li>\n</ul>\n<ul>\n<li>Generous vacation and parental leave</li>\n</ul>\n<ul>\n<li>Flexible working hours</li>\n</ul>\n<ul>\n<li>Lovely office space in which to collaborate with colleagues</li>\n</ul>\n<p>Guidance on Candidates&#39; AI Usage: Learn about our policy for using AI in our application process</p>\n<p style=\"margin-top:24px;font-size:13px;color:#666;\">XML job scraping automation by <a href=\"https://yubhub.co\">YubHub</a></p>","url":"https://yubhub.co/jobs/job_cbaf9906-291","directApply":true,"hiringOrganization":{"@type":"Organization","name":"Anthropic","sameAs":"https://www.anthropic.com/","logo":"https://logos.yubhub.co/anthropic.com.png"},"x-apply-url":"https://job-boards.greenhouse.io/anthropic/jobs/4929689008","x-work-arrangement":"hybrid","x-experience-level":"senior","x-job-type":"full-time","x-salary-range":"$405,000-$485,000 USD","x-skills-required":["Secure boot","Measured boot","Attestation technologies","Cryptographic protocols","Hardware security modules","UEFI/BIOS or embedded firmware security","Bootloader hardening","Chain of trust implementation","Low-level programming","Systems programming","Firmware vulnerability assessment","Threat modeling","Supply chain security","NIST firmware security guidelines","Hardware security frameworks"],"x-skills-preferred":["Confidential computing technologies","Hardware-based TEEs","SLSA framework","Software supply chain security standards","Large-scale HPC or cloud infrastructure","Open-source security projects","Formal verification","Security proof techniques","Silicon root of trust implementations","Vendor collaboration","AI/ML infrastructure security"],"datePosted":"2026-04-18T15:43:00.394Z","jobLocation":{"@type":"Place","address":{"@type":"PostalAddress","addressLocality":"New York City, NY | Seattle, WA; San Francisco, CA | New York City, NY | Seattle, WA; Washington, DC"}},"employmentType":"FULL_TIME","occupationalCategory":"Engineering","industry":"Technology","skills":"Secure boot, Measured boot, Attestation technologies, Cryptographic protocols, Hardware security modules, UEFI/BIOS or embedded firmware security, Bootloader hardening, Chain of trust implementation, Low-level programming, Systems programming, Firmware vulnerability assessment, Threat modeling, Supply chain security, NIST firmware security guidelines, Hardware security frameworks, Confidential computing technologies, Hardware-based TEEs, SLSA framework, Software supply chain security standards, Large-scale HPC or cloud infrastructure, Open-source security projects, Formal verification, Security proof techniques, Silicon root of trust implementations, Vendor collaboration, AI/ML infrastructure security","baseSalary":{"@type":"MonetaryAmount","currency":"USD","value":{"@type":"QuantitativeValue","minValue":405000,"maxValue":485000,"unitText":"YEAR"}}},{"@context":"https://schema.org","@type":"JobPosting","identifier":{"@type":"PropertyValue","name":"YubHub","value":"job_05b1c668-59d"},"title":"Director, Product Security Architecture","description":"<p>We are seeking a Director, Product Security Architecture to lead our Security Architecture function within the Security Platforms &amp; Architecture (SPA) sub-department and to serve as a strategic security partner to key product and engineering leadership groups across GitLab.\\n\\nIn this role, you will manage and grow a team of Product Security Architects and our closely-aligned risk and metrics engineer who are each dedicated to major product areas of Security, AI, and Core DevOps. Your team will focus on turning product security risks, requirements, and insights into clear architectural guidance, &quot;paved roads,&quot; and multi-quarter risk reduction programs that align with how Product and Engineering actually plan and deliver.\\n\\nYou will operate in an environment where feature delivery and platform capabilities are accelerating, architectures and technologies are evolving, and teams are continually balancing ambitious product goals with a strong security posture. In this context, you will help Product Security:\\n\\n- Maximize risk reduction by identifying strategic opportunities that fit naturally into existing R&amp;D work\\n- Ensure that material product security risks and tradeoffs are surfaced, acknowledged, and decided at the right leadership levels\\n- Lead SPA/AppSec scaling strategies that increase coverage and support non-linear developer gains, with a clear focus on enabling developer velocity with minimal friction\\n\\nWhile many strong candidates will come from a deep product security background, this role is also an excellent fit for experienced software or architecture leaders who have consistently delivered secure, resilient systems in complex R&amp;D environments and are excited to lead security outcomes in close partnership with engineering.\\n\\nKey Responsibilities:\\n\\n- Lead, develop, and mentor a team of Product Security Architects and closely-aligned specialists who are dedicated to major product functional areas (e.g., Sec Section, AI, Core DevOps)\\n- Own and continuously evolve the Product Security Architecture strategy and partnership model, shifting architects from embedded consultants to accelerators of secure architecture delivery, and serve as a strategic partner to Product and Engineering Directors/VPs\\n- Oversee and mature the Product Security Risk Register, ensuring systemic product security risks are clearly articulated, prioritized with Product and Engineering, and paired with multi-quarter risk reduction plans that reduce long-term product security debt.\\n- Operate Product Security Architecture in a risk-aligned, business-enabling way that focuses Security Architects on the highest-impact, hardest-to-change architectural decisions, helping teams make clear, informed tradeoffs without slowing delivery.\\n- Define and drive security visions, standards, &quot;paved roads,&quot; and secure-by-default platform behaviors and configurations that enable product teams to make sound security decisions with minimal overhead, including evolving existing behaviors over time to strengthen the baseline security posture.\\n- Lead the Product Security AI strategy for scaling, including adoption of AI-assisted and platform-level investments that expand security review coverage, reduce toil, and support non-linear developer gains while enabling developer velocity.\\n- Partner with Application Security, Infrastructure Security, Security Research, Security Operations, Security Risk, and Security Compliance on end-to-end risk reduction, including security-related controls, quality standards, and integration of research and operational learnings into architectures.\\n- Define and track meaningful architecture-related metrics and Key Risk Indicators, and represent Product Security in cross-functional forums, clearly articulating risk, tradeoffs, and recommended paths forward.\\n\\nRequirements:\\n\\n- Significant experience (typically 10+ years) leading software, architecture, or application security initiatives in high-velocity R&amp;D organizations, with a strong grounding in building and evolving complex software systems\\n- Strong application security and secure design literacy, whether from direct AppSec roles or from owning secure delivery of large-scale systems, including familiarity with common vulnerability classes, modern software architectures, and practical mitigation patterns\\n- Deep understanding of systemic product security risks in large-scale platforms, with expertise in at least some of: CI/CD and pipeline security, software supply chain security, identity and access management (AuthN/Z), AI/ML security, or multi-tenant SaaS architectures\\n- Proven ability to operate effectively in constrained environments: balancing business goals and risk reduction, focusing attention on the highest-impact, hardest-to-reverse decisions, and framing options in terms of risk, cost, and customer impact rather than absolutes.\\n- Demonstrated success building trust with Product and Engineering Directors/VPs, influencing multi-quarter roadmaps, and co-owning outcomes rather than acting solely as a gate.\\n- Experience designing and rolling out scalable security patterns,standards, &quot;paved roads,&quot; and secure-by-default configurations,that reduce risk while minimizing additional toil for product and engineering teams.\\n- Experience collaborating with Compliance, Audit, and Security Operations on the definition, implementation, and demonstration of security controls and security-related quality standards, and translating technical designs into clear language for auditors, engineers, and senior leaders.\\n- Experience supporting organizations through significant technology and architectural change (e.g., adoption of new languages and frameworks, or evolution from monoliths toward microservices or domain-oriented architectures) while maintaining or improving security posture.\\n- Ability to operate at multiple altitudes,from executive-level strategy and stakeholder alignment down to detailed technical design discussions when necessary,with excellent written and verbal communication in an all-remote, asynchronous environment.\\n- Comfort with AI-augmented workflows and enthusiasm for leveraging tools like GitLab Duo to scale the Product Security Architecture function, along with strong alignment to GitLab’s values and a track record of thriving in a highly collaborative, remote-first culture.\\n- Nice to have: Experience with security requirements and frameworks relevant to GitLab’s customers (e.g., FedRAMP, ISO 27001, SOC 2, PCI-DSS);</p>\n<p style=\"margin-top:24px;font-size:13px;color:#666;\">XML job scraping automation by <a href=\"https://yubhub.co\">YubHub</a></p>","url":"https://yubhub.co/jobs/job_05b1c668-59d","directApply":true,"hiringOrganization":{"@type":"Organization","name":"GitLab","sameAs":"https://about.gitlab.com/","logo":"https://logos.yubhub.co/about.gitlab.com.png"},"x-apply-url":"https://job-boards.greenhouse.io/gitlab/jobs/8461323002","x-work-arrangement":"remote","x-experience-level":"senior","x-job-type":"full-time","x-salary-range":null,"x-skills-required":["Application Security","Secure Design","CI/CD and Pipeline Security","Software Supply Chain Security","Identity and Access Management","AI/ML Security","Multi-Tenant SaaS Architectures"],"x-skills-preferred":[],"datePosted":"2026-04-18T15:42:42.048Z","jobLocation":{"@type":"Place","address":{"@type":"PostalAddress","addressLocality":"Remote, Canada; Remote, EMEA; Remote, US"}},"jobLocationType":"TELECOMMUTE","employmentType":"FULL_TIME","occupationalCategory":"Engineering","industry":"Technology","skills":"Application Security, Secure Design, CI/CD and Pipeline Security, Software Supply Chain Security, Identity and Access Management, AI/ML Security, Multi-Tenant SaaS Architectures"},{"@context":"https://schema.org","@type":"JobPosting","identifier":{"@type":"PropertyValue","name":"YubHub","value":"job_9bf55fe3-b2b"},"title":"Detection & Response Engineer","description":"<p>We are seeking a skilled and proactive Detection &amp; Response Engineer to join our security team. In this critical role, you will be responsible for detecting, investigating, and responding to security incidents across our cloud-native and AI-focused infrastructure.</p>\n<p><strong>Responsibilities</strong></p>\n<ul>\n<li>Monitor and analyse security alerts and logs to identify potential threats and anomalies</li>\n<li>Develop, implement, and maintain detection rules and correlation logic in our SIEM platform</li>\n<li>Conduct thorough investigations of security incidents, performing root cause analysis and impact assessments</li>\n<li>Lead incident response efforts, coordinating with relevant teams to contain and mitigate threats</li>\n<li>Create and maintain incident response playbooks and runbooks</li>\n<li>Perform regular threat hunting activities to proactively identify potential security risks</li>\n<li>Develop and refine metrics and reporting to track the effectiveness of detection and response capabilities</li>\n<li>Collaborate with other security teams to improve overall security posture and incident handling processes</li>\n<li>Stay current with emerging threats, attack techniques, and defensive strategies in the cloud-native and AI domains</li>\n</ul>\n<p><strong>Basic Qualifications</strong></p>\n<ul>\n<li>Bachelor&#39;s degree in Computer Science, Cybersecurity, or a related field</li>\n<li>3-5 years of experience in security operations, incident response, or a similar role</li>\n<li>Strong understanding of cybersecurity principles, attack techniques, and defensive strategies</li>\n<li>Proficiency in at least one scripting language (e.g., Python, Rust) for automation and tool development</li>\n<li>Experience with SIEM platforms and log analysis tools</li>\n<li>Familiarity with cloud environments (e.g., AWS, GCP, Azure) and their security features</li>\n<li>Knowledge of network protocols, system administration, and common attack vectors</li>\n<li>Strong analytical and problem-solving skills with attention to detail</li>\n<li>Excellent communication skills and ability to work effectively under pressure</li>\n</ul>\n<p><strong>Preferred Skills and Experience</strong></p>\n<ul>\n<li>Relevant security certifications (e.g., GCIH, GCIA, SANS)</li>\n<li>Experience with threat intelligence platforms and their integration into detection processes</li>\n<li>Familiarity with AI/ML security implications, particularly those outlined in the OWASP LLM Top 10</li>\n<li>Knowledge of software supply chain security and SBOM analysis</li>\n<li>Experience with containerized environments and Kubernetes security</li>\n<li>Experience in building custom security tools or integrations to enhance detection and response capabilities</li>\n<li>Interest in leveraging AI to improve threat detection and automate response processes</li>\n<li>Contributions to open-source security projects or threat research</li>\n<li>Experience with digital forensics and malware analysis</li>\n</ul>\n<p><strong>Compensation and Benefits</strong></p>\n<p>$200,000 - $340,000 USD</p>\n<p>Base salary is just one part of our total rewards package at xAI, which also includes equity, comprehensive medical, vision, and dental coverage, access to a 401(k) retirement plan, short &amp; long-term disability insurance, life insurance, and various other discounts and perks.</p>\n<p style=\"margin-top:24px;font-size:13px;color:#666;\">XML job scraping automation by <a href=\"https://yubhub.co\">YubHub</a></p>","url":"https://yubhub.co/jobs/job_9bf55fe3-b2b","directApply":true,"hiringOrganization":{"@type":"Organization","name":"xAI","sameAs":"https://www.xai.com/","logo":"https://logos.yubhub.co/xai.com.png"},"x-apply-url":"https://job-boards.greenhouse.io/xai/jobs/4559148007","x-work-arrangement":"onsite","x-experience-level":"mid","x-job-type":"full-time","x-salary-range":"$200,000 - $340,000 USD","x-skills-required":["cybersecurity principles","attack techniques","defensive strategies","scripting language","SIEM platforms","log analysis tools","cloud environments","network protocols","system administration","common attack vectors"],"x-skills-preferred":["relevant security certifications","threat intelligence platforms","AI/ML security implications","software supply chain security","containerized environments","Kubernetes security","custom security tools","digital forensics","malware analysis"],"datePosted":"2026-04-18T15:23:47.430Z","jobLocation":{"@type":"Place","address":{"@type":"PostalAddress","addressLocality":"Palo Alto, CA"}},"employmentType":"FULL_TIME","occupationalCategory":"Engineering","industry":"Technology","skills":"cybersecurity principles, attack techniques, defensive strategies, scripting language, SIEM platforms, log analysis tools, cloud environments, network protocols, system administration, common attack vectors, relevant security certifications, threat intelligence platforms, AI/ML security implications, software supply chain security, containerized environments, Kubernetes security, custom security tools, digital forensics, malware analysis","baseSalary":{"@type":"MonetaryAmount","currency":"USD","value":{"@type":"QuantitativeValue","minValue":200000,"maxValue":340000,"unitText":"YEAR"}}},{"@context":"https://schema.org","@type":"JobPosting","identifier":{"@type":"PropertyValue","name":"YubHub","value":"job_6d2bed6a-1bd"},"title":"Application Security Engineer","description":"<p>We are seeking a skilled and innovative Application Security Engineer to join our technology-driven company. In this role, you will be responsible for ensuring the security and integrity of our cloud-native applications and systems throughout the software development lifecycle, with a particular focus on code security, CI/CD pipelines, and emerging AI technologies.</p>\n<p>Responsibilities: Conduct in-depth code reviews and static analysis to identify and mitigate security vulnerabilities in our applications Design and implement secure coding guidelines and best practices for development teams Collaborate closely with development teams to integrate security practices throughout the CI/CD pipeline Perform threat modeling and risk assessments for applications, developing mitigation strategies for potential risks Manage vulnerability tracking and remediation efforts, providing guidance to development teams Support incident response activities related to application security Stay current on emerging security threats and trends in cloud-native technologies and AI, continuously enhancing our security measures Evaluate and secure software supply chains, including producing and maintaining Software Bills of Materials (SBOMs) Address security concerns specific to AI and machine learning models, with a focus on the OWASP LLM Top 10</p>\n<p>Basic Qualifications: Bachelor&#39;s degree in Computer Science, Cybersecurity, or a related field 3-5 years of experience in application security, with a strong focus on code security practices Deep understanding of secure coding practices, application security frameworks, and common vulnerabilities (e.g., OWASP Top 10) Proficiency in Python or Rust programming languages and experience with secure coding practices in these languages Experience securing CI/CD pipelines and implementing DevSecOps practices Familiarity with software supply chain security and SBOM generation tools Experience with security testing tools (e.g., Burp Suite, OWASP ZAP) and static/dynamic code analysis Understanding of AI/ML security implications, particularly those outlined in the OWASP LLM Top 10 Excellent communication skills, able to explain complex security issues to both technical and non-technical audiences</p>\n<p>Preferred Skills and Experience: Experience with cloud platforms (e.g., GCP, AWS, Azure) and their security features Relevant security certifications (e.g., CSSLP, OSWE) Background in data privacy and compliance regulations relevant to cloud-native applications and AI systems Experience with GitOps and infrastructure-as-code security Familiarity with federated learning and privacy-preserving machine learning techniques Experience in building custom security tooling to enhance and automate security processes Interest in leveraging AI to automate security tasks and improve efficiency Contributions to open-source security projects or tools Experience in securing AI/ML models and data pipelines</p>\n<p>Compensation and Benefits: $200,000 - $340,000 USD Base salary is just one part of our total rewards package at xAI, which also includes equity, comprehensive medical, vision, and dental coverage, access to a 401(k) retirement plan, short &amp; long-term disability insurance, life insurance, and various other discounts and perks.</p>\n<p style=\"margin-top:24px;font-size:13px;color:#666;\">XML job scraping automation by <a href=\"https://yubhub.co\">YubHub</a></p>","url":"https://yubhub.co/jobs/job_6d2bed6a-1bd","directApply":true,"hiringOrganization":{"@type":"Organization","name":"xAI","sameAs":"https://www.xai.com/","logo":"https://logos.yubhub.co/xai.com.png"},"x-apply-url":"https://job-boards.greenhouse.io/xai/jobs/4559147007","x-work-arrangement":"onsite","x-experience-level":"mid","x-job-type":"full-time","x-salary-range":"$200,000 - $340,000 USD","x-skills-required":["Python","Rust","Secure coding practices","Application security frameworks","Common vulnerabilities","OWASP Top 10","CI/CD pipelines","DevSecOps practices","Software supply chain security","SBOM generation tools","Security testing tools","Static/dynamic code analysis","AI/ML security implications","OWASP LLM Top 10"],"x-skills-preferred":["Cloud platforms","Security certifications","Data privacy and compliance regulations","GitOps","Infrastructure-as-code security","Federated learning","Privacy-preserving machine learning techniques","Custom security tooling","AI automation","Open-source security projects","AI/ML model security"],"datePosted":"2026-04-18T15:23:13.995Z","jobLocation":{"@type":"Place","address":{"@type":"PostalAddress","addressLocality":"Palo Alto, CA"}},"employmentType":"FULL_TIME","occupationalCategory":"Engineering","industry":"Technology","skills":"Python, Rust, Secure coding practices, Application security frameworks, Common vulnerabilities, OWASP Top 10, CI/CD pipelines, DevSecOps practices, Software supply chain security, SBOM generation tools, Security testing tools, Static/dynamic code analysis, AI/ML security implications, OWASP LLM Top 10, Cloud platforms, Security certifications, Data privacy and compliance regulations, GitOps, Infrastructure-as-code security, Federated learning, Privacy-preserving machine learning techniques, Custom security tooling, AI automation, Open-source security projects, AI/ML model security","baseSalary":{"@type":"MonetaryAmount","currency":"USD","value":{"@type":"QuantitativeValue","minValue":200000,"maxValue":340000,"unitText":"YEAR"}}},{"@context":"https://schema.org","@type":"JobPosting","identifier":{"@type":"PropertyValue","name":"YubHub","value":"job_2c812f80-7cc"},"title":"Director of Quality","description":"<p>Meet Yubico, the creator of the most secure passkeys and leading provider of hardware authentication security keys. Our company&#39;s mission is to make secure login easy and available for everyone.</p>\n<p>We are a global company with a strong company culture and employees located in over 14 countries. Yubico&#39;s headquarters are based in Stockholm, Sweden and Santa Clara, CA.</p>\n<p>The Role</p>\n<p>We are seeking a strategic and hands-on Director of Quality to architect and drive the Quality Management System for our global YubiKey production, warehousing, and fulfillment operations. In this pivotal role, you will move beyond standard quality checks to establish a multi-layered prevention model that mirrors our security philosophy.</p>\n<p>Tasks &amp; Responsibilities:</p>\n<p>Quality Strategy:</p>\n<ul>\n<li><p>Architect and drive the implementation of a scalable Quality Management System (QMS) according to ISO 9001 standards.</p>\n</li>\n<li><p>Accelerate and structure the ongoing transition from tribal knowledge to documented, auditable, and repeatable process to support QMS.</p>\n</li>\n<li><p>Establish a multi-tier quality framework where failures are caught by overlapping layers of defense, including supplier quality, incoming inspection, in-process automated gating, and final outgoing audit.</p>\n</li>\n</ul>\n<p>Internal Education Program:</p>\n<ul>\n<li><p>Build and lead an internal Quality Academy to drive QMS delivery.</p>\n</li>\n<li><p>Collaborate with Engineering to push for rigorous DFMEA and tool requirements, recognizing them as the supplier of manufacturing capabilities while educating Operators on SOPs/OCAPs and Leadership on quality metrics.</p>\n</li>\n</ul>\n<p>Quality Operations:</p>\n<ul>\n<li><p>Partner closely with Engineering during the Design phase to drive Design Failure Mode and Effects Analysis (DFMEA).</p>\n</li>\n<li><p>Provide requirements and drive execution to ensure &#39;design gating&#39; - preventing products from moving to production without a clear quality plan.</p>\n</li>\n</ul>\n<p>Process Resilience (PFMEA):</p>\n<ul>\n<li><p>Lead the execution of risk-based Process Failure Mode and Effects Analysis (PFMEA) during the Production and Fulfillment phase.</p>\n</li>\n<li><p>Make these technical documents &#39;readable&#39; and actionable for floor staff to prevent errors in configuration, warehouse, packaging, and fulfillment.</p>\n</li>\n</ul>\n<p>Develop and maintain rigorous Control Plans that specify exactly how quality is monitored at every step.</p>\n<p>Implement detection methods, including new inspection methods and functional testing.</p>\n<p>Material Review Board (MRB) Leadership:</p>\n<ul>\n<li><p>Chair the MRB and manage the deviation/waiver process.</p>\n</li>\n<li><p>Ensure rigorous engineering validation is performed before any out-of-spec material is approved for production runs.</p>\n</li>\n</ul>\n<p>Out of Control Action Plans (Rectify):</p>\n<ul>\n<li><p>Define clear, readable &#39;Out of Control Action Plans&#39; (OCAP).</p>\n</li>\n<li><p>Transform reactive firefighting into systematic rectification by ensuring production teams know exactly when to Stop, Call, Wait, or Adjust when metrics drift.</p>\n</li>\n</ul>\n<p>Supply Chain Counterfeit Prevention Program:</p>\n<ul>\n<li><p>Own and execute the Counterfeit Prevention Program.</p>\n</li>\n<li><p>Implement strict controls over component sourcing and chain of custody to protect the security integrity of YubiKeys.</p>\n</li>\n</ul>\n<p>Supplier Quality Management:</p>\n<ul>\n<li>Enforce rigorous quality standards for raw material suppliers and contract manufacturers, ensuring compliance with our security and reliability requirements.</li>\n</ul>\n<p>Basic Requirements:</p>\n<ul>\n<li><p>10+ years of progressive experience in global Quality Assurance (supporting global supply chain (e.g., North America, EMEA, APJ) within hardware production, customization and fulfillment with significant leadership experience.</p>\n</li>\n<li><p>Quality Management Systems: Proven track record of architecting and implementing a QMS from the ground up or upgrading one to ISO 9001 standards.</p>\n</li>\n<li><p>Ability to facilitate workshops and drive these processes with internal audiences.</p>\n</li>\n<li><p>Security Mindset: Familiar with and able to execute on Counterfeit Prevention Programs (e.g., AS9100/9120) and supply chain security protocols.</p>\n</li>\n<li><p>Education: Bachelor&#39;s degree in Engineering, Quality Management, or related technical field</p>\n</li>\n</ul>\n<p style=\"margin-top:24px;font-size:13px;color:#666;\">XML job scraping automation by <a href=\"https://yubhub.co\">YubHub</a></p>","url":"https://yubhub.co/jobs/job_2c812f80-7cc","directApply":true,"hiringOrganization":{"@type":"Organization","name":"Yubico","sameAs":"https://www.yubico.com/","logo":"https://logos.yubhub.co/yubico.com.png"},"x-apply-url":"https://jobs.lever.co/yubico/dde84684-68c5-4a06-865c-39d1e1e2f656","x-work-arrangement":"onsite","x-experience-level":"senior","x-job-type":"full-time","x-salary-range":"$185,000-$210,000 per year","x-skills-required":["Quality Management Systems","ISO 9001","Advanced Product Quality Planning","DFMEA","PFMEA","Control Plans","Counterfeit Prevention Programs","Supply Chain Security Protocols"],"x-skills-preferred":[],"datePosted":"2026-04-17T13:11:58.406Z","jobLocation":{"@type":"Place","address":{"@type":"PostalAddress","addressLocality":"Santa Clara"}},"employmentType":"FULL_TIME","occupationalCategory":"Engineering","industry":"Technology","skills":"Quality Management Systems, ISO 9001, Advanced Product Quality Planning, DFMEA, PFMEA, Control Plans, Counterfeit Prevention Programs, Supply Chain Security Protocols","baseSalary":{"@type":"MonetaryAmount","currency":"USD","value":{"@type":"QuantitativeValue","minValue":185000,"maxValue":210000,"unitText":"YEAR"}}},{"@context":"https://schema.org","@type":"JobPosting","identifier":{"@type":"PropertyValue","name":"YubHub","value":"job_eec951b9-d96"},"title":"Security Engineer","description":"<p>We&#39;re seeking a Security Engineer at the senior-level or above to own the product security and authorization lifecycle for Saronic&#39;s autonomous surface vessels. You will serve as the responsible security engineer for one or more vessel programs, owning the security posture from design through production, authorization, and operational deployment.</p>\n<p>This is a hands-on security engineering role; not a GRC or project management role. You&#39;ll identify the frameworks that apply, architect the vessel&#39;s security to satisfy them, and drive authorization to completion. Where standards don&#39;t yet exist, you&#39;ll define them.</p>\n<p>Key Responsibilities:</p>\n<ul>\n<li>Own the security posture for one or more vessel programs from architecture through fielding, serving as the responsible security engineer for the product</li>\n<li>Drive threat modeling across vessel subsystems including embedded compute, communications, navigation, propulsion controls, sensor fusion, and C2 interfaces and define security architectures, trust boundaries, and segmentation strategies based on findings</li>\n<li>Identify and mitigate security risks unique to autonomous maritime platforms, including GPS/GNSS spoofing, RF interference, sensor manipulation, supply chain compromise, and physical access threats</li>\n<li>Own the end-to-end authorization lifecycle for vessel programs, from initial security planning through ATO or equivalent customer authorization milestones</li>\n<li>Navigate DoD cybersecurity authorization frameworks including RMF, CSRMC, and service-specific requirements across Navy, Coast Guard, Marine Corps, and joint programs</li>\n<li>Prepare and maintain authorization artifacts, security documentation, and evidence packages that satisfy Authorizing Officials and program offices</li>\n<li>Identify and map applicable compliance frameworks for each vessel and customer segment including NIST SP 800-53, NIST SP 800-171, CMMC 2.0, FedRAMP, IEC 62443, IMO MASS Code, and IACS UR E26/E27 and proactively define Saronic&#39;s compliance posture where standards are still emerging</li>\n<li>Engage directly with government program offices, Authorizing Officials, DOT&amp;E evaluators, and classification societies as a credible technical representative of Saronic&#39;s security posture</li>\n<li>Support cybersecurity testing and evaluation efforts, including preparation for operational test events, red team assessments, and cooperative vulnerability assessments</li>\n<li>Partner with supply chain and manufacturing teams to address hardware provenance, firmware integrity, and anti-tamper requirements for production vessels</li>\n<li>Work with Legal and Contracts to ensure security and compliance requirements are accurately reflected in customer agreements, proposals, and contract deliverables</li>\n</ul>\n<p>Required Qualifications:</p>\n<ul>\n<li>6+ years of hands-on experience in product security, systems security engineering, authorization engineering, or a closely related security engineering role for defense or high-assurance platforms</li>\n<li>Strong understanding of DoD cybersecurity authorization processes (RMF, ATO/IATT, CSRMC, continuous ATO) with experience contributing to or driving systems through authorization</li>\n<li>Working knowledge of NIST SP 800-53, NIST SP 800-171, and CMMC 2.0 and their application to weapons systems, autonomous platforms, or similarly complex defense products</li>\n<li>Experience with threat modeling, security architecture, or risk assessment for cyber-physical systems, embedded systems, or operational technology environments</li>\n<li>Strong technical foundation, able to read architecture diagrams, evaluate security controls at a systems level, and hold credible technical conversations with hardware, software, and cloud engineers</li>\n<li>Ability to clearly communicate with both technical and non-technical stakeholders, including production of security documentation and authorization artifacts</li>\n<li>Ownership mindset with the ability to operate in ambiguity, define the path forward, and move work to completion across teams</li>\n<li>Ability to obtain and maintain a security clearance</li>\n</ul>\n<p>Preferred Qualifications:</p>\n<ul>\n<li>Experience as a product security lead, systems security engineer, or authorization lead for a defense platform or program of record</li>\n<li>Direct experience engaging with government Authorizing Officials, program offices, or DOT&amp;E as a technical security representative</li>\n<li>Experience in defense technology startups, DARPA programs, or organizations that move at speed within the defense acquisition system</li>\n<li>Familiarity with maritime-specific frameworks including IMO MASS Code, IACS UR E26/E27, IEC 62443, or classification society autonomous vessel rules</li>\n<li>Understanding of autonomous systems security challenges including communications security, electronic warfare hardening, GPS/GNSS resilience, and AI/ML system security</li>\n<li>Experience with ITAR/EAR compliance, supply chain security, or manufacturing security for defense products</li>\n<li>Familiarity with the defense acquisition lifecycle and how authorization milestones integrate into program schedules</li>\n</ul>\n<p>Additional Information:</p>\n<ul>\n<li>Benefits: Medical Insurance, Dental and Vision Insurance, Time Off, Parental Leave, Competitive Salary, Retirement Plan, Stock Options, Life and Disability Insurance, Pet Insurance</li>\n<li>This role requires access to export-controlled information or items that require “U.S. Person” status.</li>\n</ul>\n<p style=\"margin-top:24px;font-size:13px;color:#666;\">XML job scraping automation by <a href=\"https://yubhub.co\">YubHub</a></p>","url":"https://yubhub.co/jobs/job_eec951b9-d96","directApply":true,"hiringOrganization":{"@type":"Organization","name":"Saronic Technologies","sameAs":"https://www.saronictech.com/","logo":"https://logos.yubhub.co/saronictech.com.png"},"x-apply-url":"https://jobs.lever.co/saronic/6e800df8-6173-4f13-863e-b8803017f317","x-work-arrangement":"onsite","x-experience-level":"senior","x-job-type":"full-time","x-salary-range":null,"x-skills-required":["product security","systems security engineering","authorization engineering","threat modeling","security architecture","risk assessment","cyber-physical systems","embedded systems","operational technology environments","NIST SP 800-53","NIST SP 800-171","CMMC 2.0","RMF","CSRMC","ATO/IATT","continuous ATO","FedRAMP","IEC 62443","IMO MASS Code","IACS UR E26/E27"],"x-skills-preferred":["product security lead","systems security engineer","authorization lead","defense platform","program of record","government Authorizing Officials","program offices","DOT&E","technical security representative","defense technology startups","DARPA programs","organizations","defense acquisition system","maritime-specific frameworks","ITAR/EAR compliance","supply chain security","manufacturing security"],"datePosted":"2026-04-17T12:58:42.019Z","employmentType":"FULL_TIME","occupationalCategory":"Engineering","industry":"Technology","skills":"product security, systems security engineering, authorization engineering, threat modeling, security architecture, risk assessment, cyber-physical systems, embedded systems, operational technology environments, NIST SP 800-53, NIST SP 800-171, CMMC 2.0, RMF, CSRMC, ATO/IATT, continuous ATO, FedRAMP, IEC 62443, IMO MASS Code, IACS UR E26/E27, product security lead, systems security engineer, authorization lead, defense platform, program of record, government Authorizing Officials, program offices, DOT&E, technical security representative, defense technology startups, DARPA programs, organizations, defense acquisition system, maritime-specific frameworks, ITAR/EAR compliance, supply chain security, manufacturing security"},{"@context":"https://schema.org","@type":"JobPosting","identifier":{"@type":"PropertyValue","name":"YubHub","value":"job_f2ee807d-528"},"title":"Security Engineer","description":"<p>We&#39;re seeking a Security Engineer at the senior-level or above focused on software and systems security to own the security of Saronic&#39;s software platforms, build systems, and deployment infrastructure from development through production.</p>\n<p>As a Security Engineer, you will be the technical authority on how Saronic builds, ships, and runs secure software. You will lead secure code review, SAST, DAST, and fuzzing efforts, and define secure coding standards for Rust development including memory safety practices, safe FFI boundaries, and secure error handling.</p>\n<p>You will conduct threat modeling for software systems and translate findings into actionable security requirements integrated into design reviews and sprint planning. You will drive vulnerability management for software dependencies, including tracking, prioritization, and remediation of vulnerabilities in third-party crates and libraries.</p>\n<p>You will secure and harden NixOS configurations for vessel platforms and development infrastructure, leveraging Nix&#39;s reproducibility and declarative model for security enforcement. You will design system hardening profiles in NixOS including kernel hardening, service isolation, mandatory access controls, and minimal attack surface configurations.</p>\n<p>You will define and enforce package management and dependency policies within the Nix ecosystem, ensuring build closures are auditable, reproducible, and free from unauthorized or vulnerable packages. You will architect secure system update and rollback mechanisms using NixOS capabilities, ensuring fleet-wide consistency and integrity.</p>\n<p>You will design and implement security controls across the CI/CD pipeline including source integrity, build isolation, artifact signing, and deployment verification with build environments that are ephemeral, isolated, and hardened.</p>\n<p>You will build and maintain software supply chain security practices aligned to SLSA framework principles, including provenance tracking, hermetic builds, signed attestations, and SBOM generation.</p>\n<p>You will integrate security scanning (SAST, SCA, container scanning, secrets detection) into CI/CD pipelines as automated guardrails, and create self-service pipeline templates that enable teams to ship without bottlenecks.</p>\n<p>You will design secure deployment patterns for vessel software updates, including secure delivery, integrity verification, and rollback capabilities.</p>\n<p>You will implement runtime application security controls including logging, monitoring, and anomaly detection for deployed services.</p>\n<p>You will define software and systems security standards, patterns, and reference architectures that engineering teams adopt as the default secure path.</p>\n<p style=\"margin-top:24px;font-size:13px;color:#666;\">XML job scraping automation by <a href=\"https://yubhub.co\">YubHub</a></p>","url":"https://yubhub.co/jobs/job_f2ee807d-528","directApply":true,"hiringOrganization":{"@type":"Organization","name":"Saronic Technologies","sameAs":"https://www.saronictechnologies.com/","logo":"https://logos.yubhub.co/saronictechnologies.com.png"},"x-apply-url":"https://jobs.lever.co/saronic/70738ef6-22be-464f-a451-09882093482d","x-work-arrangement":"onsite","x-experience-level":"senior","x-job-type":"full-time","x-salary-range":null,"x-skills-required":["Rust","NixOS","CI/CD pipeline security","software supply chain security","SLSA framework principles","provenance tracking","hermetic builds","signed attestations","SBOM generation","security scanning","SAST","SCA","container scanning","secrets detection"],"x-skills-preferred":["NixOS experience","hands-on NixOS experience","experience securing software for embedded or resource-constrained Linux environments"],"datePosted":"2026-04-17T12:58:06.790Z","jobLocation":{"@type":"Place","address":{"@type":"PostalAddress","addressLocality":"San Francisco"}},"employmentType":"FULL_TIME","occupationalCategory":"Engineering","industry":"Technology","skills":"Rust, NixOS, CI/CD pipeline security, software supply chain security, SLSA framework principles, provenance tracking, hermetic builds, signed attestations, SBOM generation, security scanning, SAST, SCA, container scanning, secrets detection, NixOS experience, hands-on NixOS experience, experience securing software for embedded or resource-constrained Linux environments"},{"@context":"https://schema.org","@type":"JobPosting","identifier":{"@type":"PropertyValue","name":"YubHub","value":"job_c629a0da-f6c"},"title":"Security Engineer","description":"<p>We&#39;re seeking a Security Engineer at the senior-level or above focused on hardware, embedded systems, and firmware security to own the security posture of Saronic&#39;s vessel hardware platforms from silicon to system.</p>\n<p>You will be the technical authority on hardware root of trust, secure boot, firmware integrity, embedded system hardening, and the security of third-party hardware integrations. Your work ensures that every component on the vessel is resilient against tampering, exploitation, and supply chain compromise, designed in from the start and maintained across the fleet lifecycle.</p>\n<p>Key Responsibilities:</p>\n<ul>\n<li><p>Conduct hardware security assessments including fault injection, side-channel analysis, interface evaluation, and bus protocol analysis across Saronic-built and third-party hardware including sensors, radios, navigation systems, propulsion controllers, and communication modules</p>\n</li>\n<li><p>Evaluate and harden physical interfaces, debug ports, maintenance access points, and removable media interfaces on vessel hardware</p>\n</li>\n<li><p>Evaluate supply chain security risks for hardware components and recommend provenance validation, anti-tamper, and attestation controls</p>\n</li>\n<li><p>Develop and maintain a hardware security testing capability including tooling, methodology, and repeatable test procedures</p>\n</li>\n<li><p>Design and implement secure boot chains establishing hardware root of trust from power-on through application launch, integrating TPM, secure elements, and HSMs for device identity, key storage, measured boot, and remote attestation</p>\n</li>\n<li><p>Design and implement secure firmware update mechanisms including signed updates, rollback protection, and verified delivery across the fleet</p>\n</li>\n<li><p>Own the cryptographic key lifecycle for hardware-bound keys, including provisioning, rotation, revocation, and escrow</p>\n</li>\n<li><p>Harden embedded Linux systems on vessel platforms, including kernel configuration, mandatory access controls, secure IPC, and attack surface reduction</p>\n</li>\n<li><p>Secure operational technology protocols and interfaces used in vessel control systems, propulsion, navigation, and sensor fusion including CAN bus, NMEA, and maritime/industrial communication protocols</p>\n</li>\n<li><p>Define security boundaries, trust zones, and segmentation strategies for vessel-internal compute and communication architectures</p>\n</li>\n<li><p>Drive threat modeling across vessel hardware subsystems and translate findings into actionable engineering requirements</p>\n</li>\n<li><p>Produce secure-by-design reference architectures and define hardware and firmware security standards, testing requirements, and acceptance criteria integrated into engineering workflows</p>\n</li>\n</ul>\n<p>Required Qualifications:</p>\n<ul>\n<li><p>6+ years of hands-on experience in hardware security, embedded systems security, firmware security, or a closely related security engineering role</p>\n</li>\n<li><p>Deep expertise in hardware hacking techniques including fault injection, side-channel attacks, JTAG/SWD exploitation, bus sniffing/injection, and physical security assessments</p>\n</li>\n<li><p>Demonstrated experience designing and implementing secure boot chains, hardware root of trust, and secure firmware update mechanisms in production systems</p>\n</li>\n<li><p>Strong experience assessing third-party hardware integrations and evaluating supply chain security risks</p>\n</li>\n<li><p>Deep knowledge of embedded Linux security hardening, kernel security, and mandatory access control frameworks</p>\n</li>\n<li><p>Experience with operational technology security, industrial protocols, or control system security</p>\n</li>\n<li><p>Proficiency in C, C++, Python, or Rust in the context of firmware, embedded, or systems-level security work, and with hardware security testing tools</p>\n</li>\n<li><p>Ability to obtain and maintain a security clearance</p>\n</li>\n</ul>\n<p>Preferred Qualifications:</p>\n<ul>\n<li><p>Experience in defense, aerospace, robotics, autonomy, maritime, or other high-assurance environments</p>\n</li>\n<li><p>Experience with autonomous systems, unmanned vehicles, or safety-critical embedded platforms</p>\n</li>\n<li><p>Experience with RTOS, microcontroller security, or resource-constrained device environments</p>\n</li>\n<li><p>Knowledge of CAN bus, NMEA protocols, maritime communication systems, RF/GPS/GNSS security, or ICS security standards</p>\n</li>\n<li><p>Familiarity with defense or safety-critical compliance frameworks (NIST SP 800-53, IEC 62443, Common Criteria, or equivalent)</p>\n</li>\n<li><p>Relevant certifications such as OSEE, GXPN, GSE, or hardware-focused credentials</p>\n</li>\n</ul>\n<p style=\"margin-top:24px;font-size:13px;color:#666;\">XML job scraping automation by <a href=\"https://yubhub.co\">YubHub</a></p>","url":"https://yubhub.co/jobs/job_c629a0da-f6c","directApply":true,"hiringOrganization":{"@type":"Organization","name":"Saronic Technologies","sameAs":"https://www.saronictechnologies.com/","logo":"https://logos.yubhub.co/saronictechnologies.com.png"},"x-apply-url":"https://jobs.lever.co/saronic/4b15b1b4-3c34-47ad-b964-dbcf0f8a3dc4","x-work-arrangement":"onsite","x-experience-level":"senior","x-job-type":"full-time","x-salary-range":null,"x-skills-required":["Hardware security","Embedded systems security","Firmware security","Fault injection","Side-channel analysis","Interface evaluation","Bus protocol analysis","Physical security assessments","Secure boot chains","Hardware root of trust","Firmware integrity","Embedded system hardening","Third-party hardware integrations","Supply chain security risks","Provenance validation","Anti-tamper","Attestation controls","Hardware security testing","Tooling","Methodology","Repeatable test procedures","Device identity","Key storage","Measured boot","Remote attestation","Signed updates","Rollback protection","Verified delivery","Cryptographic key lifecycle","Provisioning","Rotation","Revocation","Escrow","Embedded Linux systems","Kernel configuration","Mandatory access controls","Secure IPC","Attack surface reduction","Operational technology protocols","Industrial protocols","Control system security","CAN bus","NMEA","Maritime/industrial communication protocols","Security boundaries","Trust zones","Segmentation strategies","Threat modeling","Actionable engineering requirements","Secure-by-design reference architectures","Hardware and firmware security standards","Testing requirements","Acceptance criteria","Engineering workflows","C","C++","Python","Rust","Hardware security testing tools"],"x-skills-preferred":["Defense","Aerospace","Robotics","Autonomy","Maritime","High-assurance environments","Autonomous systems","Unmanned vehicles","Safety-critical embedded platforms","RTOS","Microcontroller security","Resource-constrained device environments","NMEA protocols","Maritime communication systems","RF/GPS/GNSS security","ICS security standards","Defense or safety-critical compliance frameworks","OSEE","GXPN","GSE","Hardware-focused credentials"],"datePosted":"2026-04-17T12:57:49.070Z","jobLocation":{"@type":"Place","address":{"@type":"PostalAddress","addressLocality":"San Francisco"}},"employmentType":"FULL_TIME","occupationalCategory":"Engineering","industry":"Technology","skills":"Hardware security, Embedded systems security, Firmware security, Fault injection, Side-channel analysis, Interface evaluation, Bus protocol analysis, Physical security assessments, Secure boot chains, Hardware root of trust, Firmware integrity, Embedded system hardening, Third-party hardware integrations, Supply chain security risks, Provenance validation, Anti-tamper, Attestation controls, Hardware security testing, Tooling, Methodology, Repeatable test procedures, Device identity, Key storage, Measured boot, Remote attestation, Signed updates, Rollback protection, Verified delivery, Cryptographic key lifecycle, Provisioning, Rotation, Revocation, Escrow, Embedded Linux systems, Kernel configuration, Mandatory access controls, Secure IPC, Attack surface reduction, Operational technology protocols, Industrial protocols, Control system security, CAN bus, NMEA, Maritime/industrial communication protocols, Security boundaries, Trust zones, Segmentation strategies, Threat modeling, Actionable engineering requirements, Secure-by-design reference architectures, Hardware and firmware security standards, Testing requirements, Acceptance criteria, Engineering workflows, C, C++, Python, Rust, Hardware security testing tools, Defense, Aerospace, Robotics, Autonomy, Maritime, High-assurance environments, Autonomous systems, Unmanned vehicles, Safety-critical embedded platforms, RTOS, Microcontroller security, Resource-constrained device environments, NMEA protocols, Maritime communication systems, RF/GPS/GNSS security, ICS security standards, Defense or safety-critical compliance frameworks, OSEE, GXPN, GSE, Hardware-focused credentials"},{"@context":"https://schema.org","@type":"JobPosting","identifier":{"@type":"PropertyValue","name":"YubHub","value":"job_fb4fa003-a73"},"title":"Platform Hardware Security Engineer","description":"<p><strong>About the Role</strong></p>\n<p>We&#39;re seeking a Platform Hardware Security Engineer to design and implement security architectures for bare-metal infrastructure. You&#39;ll work with teams across Anthropic to build firmware, bootloaders, operating systems, and attestation systems to ensure the integrity of our infrastructure from the ground up.</p>\n<p>This role requires expertise in low-level systems security and the ability to architect solutions that balance security requirements with the performance demands of training AI models across our massive fleet.</p>\n<p><strong>What you&#39;ll do:</strong></p>\n<ul>\n<li>Design and implement secure boot chains from firmware through OS initialization for diverse hardware platforms (CPUs, BMCs, switches, peripherals, and embedded microcontrollers)</li>\n<li>Architect attestation systems that provide cryptographic proof of system state from hardware root of trust through application layer</li>\n<li>Develop measured boot implementations and runtime integrity monitoring</li>\n<li>Create reference architectures and security requirements for bare-metal deployments</li>\n<li>Integrate security controls with infrastructure teams without impacting training performance</li>\n<li>Prototype and validate security mechanisms before production deployment</li>\n<li>Conduct firmware vulnerability assessments and penetration testing</li>\n<li>Build firmware analysis pipelines for continuous security monitoring</li>\n<li>Document security architectures and maintain threat models</li>\n<li>Collaborate with software and hardware vendors to ensure security capabilities meet our requirements</li>\n</ul>\n<p><strong>Who you are:</strong></p>\n<ul>\n<li>8+ years of experience in systems security, with at least 5 years focused on firmware and hardware security (firmware, bootloaders, and OS-level security)</li>\n<li>Hands-on experience with secure boot, measured boot, and attestation technologies (TPM, Intel TXT, AMD SEV, ARM TrustZone)</li>\n<li>Strong understanding of cryptographic protocols and hardware security modules</li>\n<li>Experience with UEFI/BIOS or embedded firmware security, bootloader hardening, and chain of trust implementation</li>\n<li>Proficiency in low-level programming (C, Rust, Assembly) and systems programming</li>\n<li>Knowledge of firmware vulnerability assessment and threat modeling</li>\n<li>Track record of designing security architectures for complex, distributed systems</li>\n<li>Experience with supply chain security</li>\n<li>Ability to work effectively across hardware and software boundaries</li>\n<li>Knowledge of NIST firmware security guidelines and hardware security frameworks</li>\n</ul>\n<p><strong>Strong candidates may also have:</strong></p>\n<ul>\n<li>Experience with confidential computing technologies and hardware-based TEEs</li>\n<li>Knowledge of SLSA framework and software supply chain security standards</li>\n<li>Experience securing large-scale HPC or cloud infrastructure</li>\n<li>Contributions to open-source security projects (coreboot, CHIPSEC, etc.)</li>\n<li>Background in formal verification or security proof techniques</li>\n<li>Experience with silicon root of trust implementations</li>\n<li>Experience working with building foundational technical designs, operational leadership, and vendor collaboration</li>\n<li>Previous work with AI/ML infrastructure security</li>\n</ul>\n<p><strong>Logistics</strong></p>\n<ul>\n<li>Education requirements: We require at least a Bachelor&#39;s degree in a related field or equivalent experience.</li>\n<li>Location-based hybrid policy: Currently, we expect all staff to be in one of our offices at least 25% of the time. However, some roles may require more time in our offices.</li>\n<li>Visa sponsorship: We do sponsor visas! However, we aren&#39;t able to successfully sponsor visas for every role and every candidate. But if we make you an offer, we will make every reasonable effort to get you a visa, and we retain an immigration lawyer to help with this.</li>\n</ul>\n<p><strong>We encourage you to apply even if you do not believe you meet every single qualification. Not all strong candidates will meet every single qualification as listed. Research shows that people who identify as being from underrepresented groups are more prone to experiencing imposter syndrome and doubting the strength of their candidacy, so we urge you not to exclude yourself prematurely and to submit an application if you&#39;re interested in this work.</strong></p>\n<p><strong>Your safety matters to us. To protect yourself from potential scams, remember that Anthropic recruiters only contact you from @anthropic.com email addresses. In some cases, we may partner with vetted recruiting agencies who will identify themselves as working on behalf of Anthropic. Be cautious of emails from other domains. Legitimate Anthropic recruiters will never ask for money, fees, or banking information before your first day. If you&#39;re ever unsure about a communication, don&#39;t click any links—visit anthropic.com/careers directly for confirmed position openings.</strong></p>\n<p><strong>How we&#39;re different</strong></p>\n<p>We believe that the highest-impact AI research will be big science. At Anthropic we work as a single cohesive team on just a few large-scale research efforts.</p>\n<p style=\"margin-top:24px;font-size:13px;color:#666;\">XML job scraping automation by <a href=\"https://yubhub.co\">YubHub</a></p>","url":"https://yubhub.co/jobs/job_fb4fa003-a73","directApply":true,"hiringOrganization":{"@type":"Organization","name":"Anthropic","sameAs":"https://job-boards.greenhouse.io","logo":"https://logos.yubhub.co/anthropic.com.png"},"x-apply-url":"https://job-boards.greenhouse.io/anthropic/jobs/4929689008","x-work-arrangement":"hybrid","x-experience-level":"senior","x-job-type":"full-time","x-salary-range":"$405,000 - $485,000 USD","x-skills-required":["firmware security","hardware security","secure boot","measured boot","attestation technologies","cryptographic protocols","hardware security modules","UEFI/BIOS","embedded firmware security","bootloader hardening","chain of trust implementation","low-level programming","systems programming","firmware vulnerability assessment","threat modeling","supply chain security","NIST firmware security guidelines","hardware security frameworks"],"x-skills-preferred":["confidential computing technologies","hardware-based TEEs","SLSA framework","software supply chain security standards","large-scale HPC or cloud infrastructure","open-source security projects","formal verification","security proof techniques","silicon root of trust implementations","AI/ML infrastructure security"],"datePosted":"2026-03-08T13:47:08.377Z","jobLocation":{"@type":"Place","address":{"@type":"PostalAddress","addressLocality":"New York City, NY; Seattle, WA; San Francisco, CA; Washington, DC"}},"employmentType":"FULL_TIME","occupationalCategory":"Engineering","industry":"Technology","skills":"firmware security, hardware security, secure boot, measured boot, attestation technologies, cryptographic protocols, hardware security modules, UEFI/BIOS, embedded firmware security, bootloader hardening, chain of trust implementation, low-level programming, systems programming, firmware vulnerability assessment, threat modeling, supply chain security, NIST firmware security guidelines, hardware security frameworks, confidential computing technologies, hardware-based TEEs, SLSA framework, software supply chain security standards, large-scale HPC or cloud infrastructure, open-source security projects, formal verification, security proof techniques, silicon root of trust implementations, AI/ML infrastructure security","baseSalary":{"@type":"MonetaryAmount","currency":"USD","value":{"@type":"QuantitativeValue","minValue":405000,"maxValue":485000,"unitText":"YEAR"}}},{"@context":"https://schema.org","@type":"JobPosting","identifier":{"@type":"PropertyValue","name":"YubHub","value":"job_23a792a8-cc4"},"title":"Vendor Security Program Manager","description":"<p><strong>Job Posting</strong></p>\n<p><strong>Vendor Security Program Manager</strong></p>\n<p><strong>Location</strong></p>\n<p>San Francisco; New York City; Seattle; Washington, DC</p>\n<p><strong>Employment Type</strong></p>\n<p>Full time</p>\n<p><strong>Location Type</strong></p>\n<p>Hybrid</p>\n<p><strong>Department</strong></p>\n<p>Security</p>\n<p><strong>Compensation</strong></p>\n<ul>\n<li>SF, Seattle and NYC: $207K – $335K • Offers Equity</li>\n<li>Zone A: $186K – $301.5K • Offers Equity</li>\n<li>Zone B: $165.6K – $268K • Offers Equity</li>\n</ul>\n<p>The base pay offered may vary depending on multiple individualized factors, including market location, job-related knowledge, skills, and experience. If the role is non-exempt, overtime pay will be provided consistent with applicable laws. In addition to the salary range listed above, total compensation also includes generous equity, performance-related bonus(es) for eligible employees, and the following benefits.</p>\n<ul>\n<li>Medical, dental, and vision insurance for you and your family, with employer contributions to Health Savings Accounts</li>\n</ul>\n<ul>\n<li>Pre-tax accounts for Health FSA, Dependent Care FSA, and commuter expenses (parking and transit)</li>\n</ul>\n<ul>\n<li>401(k) retirement plan with employer match</li>\n</ul>\n<ul>\n<li>Paid parental leave (up to 24 weeks for birth parents and 20 weeks for non-birthing parents), plus paid medical and caregiver leave (up to 8 weeks)</li>\n</ul>\n<ul>\n<li>Paid time off: flexible PTO for exempt employees and up to 15 days annually for non-exempt employees</li>\n</ul>\n<ul>\n<li>13+ paid company holidays, and multiple paid coordinated company office closures throughout the year for focus and recharge, plus paid sick or safe time (1 hour per 30 hours worked, or more, as required by applicable state or local law)</li>\n</ul>\n<ul>\n<li>Mental health and wellness support</li>\n</ul>\n<ul>\n<li>Employer-paid basic life and disability coverage</li>\n</ul>\n<ul>\n<li>Annual learning and development stipend to fuel your professional growth</li>\n</ul>\n<ul>\n<li>Daily meals in our offices, and meal delivery credits as eligible</li>\n</ul>\n<ul>\n<li>Relocation support for eligible employees</li>\n</ul>\n<ul>\n<li>Additional taxable fringe benefits, such as charitable donation matching and wellness stipends, may also be provided.</li>\n</ul>\n<p>More details about our benefits are available to candidates during the hiring process.</p>\n<p>This role is at-will and OpenAI reserves the right to modify base pay and other compensation components at any time based on individual performance, team or company results, or market conditions.</p>\n<p><strong>About the Team</strong></p>\n<p>The Vendor Security team sits at the core of our mission to ensure our technology benefits humanity safely and securely. We provide security assurances and robust compliance frameworks for our technology, people, and products. Our mission is to build trust with the world in our products and company. Our work is technical yet highly operational, strategically aligning with security and engineering teams to navigate and mitigate risks proactively. We prioritize impact, enable innovation, and foster a culture of continuous compliance and security awareness.</p>\n<p><strong>About the Role</strong></p>\n<p>As a Program Manager within the Vendor Security team, you will play a crucial role in protecting our organisation against external risks posed by suppliers, vendors, partners, and hardware manufacturers. Your responsibilities will include conducting comprehensive security assessments, building a program to manage global supply chain and vendor risks, and driving security initiatives across all of our third-party relationships. You will be analytical, detail-oriented, and proactive, capable of translating complex security evaluations into clear, actionable strategies.</p>\n<p>The role is expected to operate with a strong point of view on risk. You will be responsible not only for identifying and documenting vendor and supply-chain risk, but for helping the company make informed trade-offs between speed, scale, and security. This role requires exceptional organisational skills, the ability to effectively communicate across different business functions, and a strong commitment to operational excellence in a dynamic environment.</p>\n<p>This role may be based out of one of our US offices (San Francisco, Seattle, NYC or DC.) We use a hybrid work model of 3 days in the office per week and offer relocation assistance to new employees.</p>\n<p><strong>In this role, you will:</strong></p>\n<ul>\n<li>Be the interface for Security to the rest of the organisation for vendors.</li>\n</ul>\n<ul>\n<li>Own vendor security risk decisions and escalation paths, including clearly documenting risk acceptance, mitigation plans, and executive-level trade-offs when security requirements cannot be fully met.</li>\n</ul>\n<ul>\n<li>Conduct deep, evidence-based security assessments of third parties, including review of architectures, configurations, controls, logs, and operational practices - moving beyond questionnaires and attestations to validate real-world security posture of vendors.</li>\n</ul>\n<ul>\n<li>Assess and manage security risk across a diverse vendor landscape, including SaaS providers, cloud and infrastructure partners, hardware manufacturers, chip suppliers, and other strategic or high-impact suppliers.</li>\n</ul>\n<ul>\n<li>Develop, build, and continuously improve the vendor security program and security supply chain risk management function at OpenAI.</li>\n</ul>\n<ul>\n<li>Develop, propose, and implement effective controls to mitigate identified vendor risks.</li>\n</ul>\n<ul>\n<li>Build and maintain collaborative partnerships with key internal stakeholders including Infrastructure Security, Product, Engineering, Legal, Procurement, and Threat Intelligence to ensure comprehensive security coverage of the vendor and third-party supply chain.</li>\n</ul>\n<ul>\n<li>Streamline and automate vendor and supply chain security processes to increase efficiency and reduce manual overhead.</li>\n</ul>\n<p><strong>You might thrive in this role if you have:</strong></p>\n<ul>\n<li>Proven experience conducting third-party or supply chain security assessments, including building and scaling a vendor management security program.</li>\n</ul>\n<ul>\n<li>An in-depth understanding of information security principles and controls, including data protection, access management, proactive and reactive security measures, and application security.</li>\n</ul>\n<ul>\n<li>Comfort operating in ambiguity, with the ability to form defensible security opinions even when information is incomplete or uncertain.</li>\n</ul>\n<ul>\n<li>Strong analytical and problem-solving skills, with the ability to identify and mitigate complex security risks.</li>\n</ul>\n<ul>\n<li>Excellent communication and interpersonal skills, with the ability to effectively collaborate with cross-functional teams and stakeholders.</li>\n</ul>\n<ul>\n<li>Strong organisational and project management skills, with the ability to prioritise tasks and manage multiple projects simultaneously.</li>\n</ul>\n<ul>\n<li>A strong commitment to operational excellence and continuous improvement, with a focus on delivering high-quality results in a dynamic environment.</li>\n</ul>\n<ul>\n<li>A passion for security and a desire to make a meaningful impact in the field.</li>\n</ul>\n<p style=\"margin-top:24px;font-size:13px;color:#666;\">XML job scraping automation by <a href=\"https://yubhub.co\">YubHub</a></p>","url":"https://yubhub.co/jobs/job_23a792a8-cc4","directApply":true,"hiringOrganization":{"@type":"Organization","name":"OpenAI","sameAs":"https://jobs.ashbyhq.com","logo":"https://logos.yubhub.co/openai.com.png"},"x-apply-url":"https://jobs.ashbyhq.com/openai/fb1e823e-cfcc-4293-8893-cc77e467c561","x-work-arrangement":"hybrid","x-experience-level":"senior","x-job-type":"full-time","x-salary-range":"$207K – $335K • Offers Equity","x-skills-required":["information security principles and controls","data protection","access management","proactive and reactive security measures","application security","third-party or supply chain security assessments","vendor management security program","security risk management","compliance frameworks","security awareness","operational excellence","project management","communication and interpersonal skills"],"x-skills-preferred":["cloud security","infrastructure security","threat intelligence","security analytics","incident response","security testing","penetration testing","security consulting","security training","security awareness training"],"datePosted":"2026-03-06T18:37:35.209Z","jobLocation":{"@type":"Place","address":{"@type":"PostalAddress","addressLocality":"San Francisco; New York City; Seattle; Washington, DC"}},"employmentType":"FULL_TIME","occupationalCategory":"Engineering","industry":"Technology","skills":"information security principles and controls, data protection, access management, proactive and reactive security measures, application security, third-party or supply chain security assessments, vendor management security program, security risk management, compliance frameworks, security awareness, operational excellence, project management, communication and interpersonal skills, cloud security, infrastructure security, threat intelligence, security analytics, incident response, security testing, penetration testing, security consulting, security training, security awareness training","baseSalary":{"@type":"MonetaryAmount","currency":"USD","value":{"@type":"QuantitativeValue","minValue":207000,"maxValue":335000,"unitText":"YEAR"}}},{"@context":"https://schema.org","@type":"JobPosting","identifier":{"@type":"PropertyValue","name":"YubHub","value":"job_bc395d84-515"},"title":"Senior Global Security Investigator","description":"<p><strong>Senior Global Security Investigator</strong></p>\n<p><strong>About the Team</strong></p>\n<p>Security is at the foundation of OpenAI’s mission to ensure that artificial general intelligence benefits all of humanity.</p>\n<p>The Security team protects OpenAI’s technology, people, and products. We are technical in what we build but are operational in how we do our work, and are committed to supporting all products and research at OpenAI. Our Security team tenets include: prioritizing for impact, enabling researchers, preparing for future transformative technologies, and engaging a robust security culture.</p>\n<p><strong>About the Role</strong></p>\n<p>We are seeking a senior Global Security Investigator with a technical background to lead complex, long-running security investigations involving a full spectrum of threats – whether originating from internal employees, external threat actors, or supply chain partners. This role is about seeing the full chessboard and independently driving complex, multi-month cases across cyber, physical, and human domains.</p>\n<p><strong>In this role you will:</strong></p>\n<ul>\n<li>Independently conduct comprehensive security investigations from initial detection to resolution, including cases involving insiders, external actors, and supply chain and third-party risks.</li>\n</ul>\n<ul>\n<li>Lead proactive, data-driven threat-hunting efforts that weave together disparate signals to surface undetected insider or external threats before they escalate into incidents.</li>\n</ul>\n<ul>\n<li>Perform comprehensive technical analysis of complex hardware, software, and supplier supply chains to identify, enumerate, and mitigate risks.</li>\n</ul>\n<ul>\n<li>Partner closely with cross-functional teams, including Human Resources, Legal, Security, and IT, and external stakeholders or law enforcement when necessary.</li>\n</ul>\n<ul>\n<li>Collaborate with technical counterparts to enhance detections, resolve telemetry gaps, and implement new capabilities to identify security issues involving cyber, physical, and human domains.</li>\n</ul>\n<ul>\n<li>Collect, preserve, and analyze evidence from a variety of sources, including log data, digital forensics, subject interviews, access records, threat intelligence, and open-source intelligence (OSINT), to support investigative findings.</li>\n</ul>\n<ul>\n<li>Continuously improve investigative procedures and security controls based on investigations and lessons learned.</li>\n</ul>\n<p><strong>You might thrive in this role if you have:</strong></p>\n<ul>\n<li>Bachelor’s degree in Criminal Justice, Cybersecurity, or a related field (or equivalent experience) and 8+ years of investigative experience in counterintelligence, insider risk, forensic investigations, cybersecurity, supply chain security, or related domains.</li>\n</ul>\n<ul>\n<li>Unimpeachable integrity, sound judgment, and the ability to handle confidential matters with discretion.</li>\n</ul>\n<ul>\n<li>An active US security clearance, or willingness and eligibility to obtain one.</li>\n</ul>\n<ul>\n<li>Deep specialization in geopolitical threat domains, with hands-on experience identifying, assessing, and mitigating adversarial risks through tailored countermeasures.</li>\n</ul>\n<ul>\n<li>Expert knowledge of common security tooling, including EDR, DLP, UEBA, SIEM, SOAR and other related platforms.</li>\n</ul>\n<ul>\n<li>Demonstrated ability to independently write complex queries, automate data workflows, and analyze structured datasets.</li>\n</ul>\n<ul>\n<li>Excellent written and verbal communication skills, including the ability to distill complex findings into clear, actionable reports and explain technical issues to non-technical stakeholders.</li>\n</ul>\n<ul>\n<li>Exceptional collaboration skills with the ability to work across diverse teams (HR, Legal, IT, etc.) to lead projects and investigations with minimal guidance.</li>\n</ul>\n<p><strong>Compensation</strong></p>\n<ul>\n<li>San Francisco, Seattle or New York: $288K – $500K • Offers Equity</li>\n</ul>\n<ul>\n<li>Zone B: $230.4K – $500K • Offers Equity</li>\n</ul>\n<p>The base pay offered may vary depending on multiple individualized factors, including market location, job-related knowledge, skills, and experience. If the role is non-exempt, overtime pay will be provided consistent with applicable laws. In addition to the salary range listed above, total compensation also includes generous equity, performance-related bonus for eligible employees and benefits.</p>\n<p><strong>Benefits</strong></p>\n<ul>\n<li>Medical, dental, and vision insurance for you and your family, with employer contributions to Health Savings Accounts</li>\n</ul>\n<ul>\n<li>Pre-tax accounts for Health FSA, Dependent Care FSA, and commuter expenses (parking and transit)</li>\n</ul>\n<ul>\n<li>401(k) retirement plan with employer match</li>\n</ul>\n<ul>\n<li>Paid parental leave (up to 24 weeks for birth parents and 20 weeks for non-birthing parents), plus paid medical and caregiver leave (up to 8 weeks)</li>\n</ul>\n<ul>\n<li>Paid time off: flexible PTO for exempt employees and up to 15 days annually for non-exempt employees</li>\n</ul>\n<ul>\n<li>13+ paid company holidays, and multiple paid coordinated company office closures throughout the year for focus and recharge, plus paid sick and safe time (1 hour per 30 hours worked)</li>\n</ul>\n<ul>\n<li>Mental health and wellness support</li>\n</ul>\n<ul>\n<li>Employer-paid basic life and disability coverage</li>\n</ul>\n<ul>\n<li>Annual learning and development stipend to fuel your professional growth</li>\n</ul>\n<ul>\n<li>Daily meals in our offices, and meal delivery credits as eligible</li>\n</ul>\n<ul>\n<li>Relocation support for eligible employees</li>\n</ul>\n<ul>\n<li>Additional taxable fringe benefits, such as charitable donation matching and wellness stipends, may also be provided.</li>\n</ul>\n<p>More details about our benefits are available to candidates during the hiring process.</p>\n<p style=\"margin-top:24px;font-size:13px;color:#666;\">XML job scraping automation by <a href=\"https://yubhub.co\">YubHub</a></p>","url":"https://yubhub.co/jobs/job_bc395d84-515","directApply":true,"hiringOrganization":{"@type":"Organization","name":"OpenAI","sameAs":"https://jobs.ashbyhq.com","logo":"https://logos.yubhub.co/openai.com.png"},"x-apply-url":"https://jobs.ashbyhq.com/openai/8b2e1585-dbcc-4739-9dc5-3980697d6659","x-work-arrangement":"hybrid","x-experience-level":"senior","x-job-type":"full-time","x-salary-range":"$288K – $500K • Offers Equity","x-skills-required":["Bachelor’s degree in Criminal Justice, Cybersecurity, or a related field","8+ years of investigative experience in counterintelligence, insider risk, forensic investigations, cybersecurity, supply chain security, or related domains","Unimpeachable integrity, sound judgment, and the ability to handle confidential matters with discretion","An active US security clearance, or willingness and eligibility to obtain one","Deep specialization in geopolitical threat domains, with hands-on experience identifying, assessing, and mitigating adversarial risks through tailored countermeasures","Expert knowledge of common security tooling, including EDR, DLP, UEBA, SIEM, SOAR and other related platforms","Demonstrated ability to independently write complex queries, automate data workflows, and analyze structured datasets","Excellent written and verbal communication skills, including the ability to distill complex findings into clear, actionable reports and explain technical issues to non-technical stakeholders","Exceptional collaboration skills with the ability to work across diverse teams (HR, Legal, IT, etc.) to lead projects and investigations with minimal guidance"],"x-skills-preferred":["EDR","DLP","UEBA","SIEM","SOAR","Cybersecurity","Supply chain security","Forensic investigations","Counterintelligence","Insider risk"],"datePosted":"2026-03-06T18:28:30.579Z","jobLocation":{"@type":"Place","address":{"@type":"PostalAddress","addressLocality":"San Francisco; New York City; Seattle; Washington, DC"}},"employmentType":"FULL_TIME","occupationalCategory":"Engineering","industry":"Technology","skills":"Bachelor’s degree in Criminal Justice, Cybersecurity, or a related field, 8+ years of investigative experience in counterintelligence, insider risk, forensic investigations, cybersecurity, supply chain security, or related domains, Unimpeachable integrity, sound judgment, and the ability to handle confidential matters with discretion, An active US security clearance, or willingness and eligibility to obtain one, Deep specialization in geopolitical threat domains, with hands-on experience identifying, assessing, and mitigating adversarial risks through tailored countermeasures, Expert knowledge of common security tooling, including EDR, DLP, UEBA, SIEM, SOAR and other related platforms, Demonstrated ability to independently write complex queries, automate data workflows, and analyze structured datasets, Excellent written and verbal communication skills, including the ability to distill complex findings into clear, actionable reports and explain technical issues to non-technical stakeholders, Exceptional collaboration skills with the ability to work across diverse teams (HR, Legal, IT, etc.) to lead projects and investigations with minimal guidance, EDR, DLP, UEBA, SIEM, SOAR, Cybersecurity, Supply chain security, Forensic investigations, Counterintelligence, Insider risk","baseSalary":{"@type":"MonetaryAmount","currency":"USD","value":{"@type":"QuantitativeValue","minValue":288000,"maxValue":500000,"unitText":"YEAR"}}}]}