MEET CASA

Casa is the secure home for your bitcoin. We’re the leading provider of Bitcoin self-custody solutions, the ultimate blend of security, privacy, and control. Our team combines deep security expertise, human-focused design, and exceptional customer service to empower our clients and build lifelong relationships.

THE ROLE

Casa is looking for a DevSecOps Engineer to help secure our customers, their data, and our company. As a member of our Security team, you will report to our Chief Security Officer and play a crucial role in overseeing our security architecture and culture. It will also be a unique opportunity to help develop an evolving security program consisting of efficient processes, training materials, and methodologies for all employees.

The successful candidate has experience developing scalable security controls and approaches in accordance with industry standards.

Compensation: $125,000-155,000 USD

WHAT YOU’LL DO:

• Handle internal security requests and make sure employees have the tools and access they need without over-provisioning
• Ensure that employees have access to the tools and systems they need while maintaining least privilege access principles
• Onboard and offboard employees across internal systems
• Oversee our MDM system and stay on top of alerts
• Review and assess new technologies (tools, code frameworks, third-party providers, internal apps) through a security lens
• Help shape and refine security best practices across the org
• Triage and work through vulnerabilities surfaced by pen testing, static analysis, responsible disclosures, and automated alerts
• Keep security documentation and training materials fresh and useful
• Automate security processes and alerts wherever you can find the leverage
• Participate in a shared on-call rotation for critical production security issues
• Stay abreast of the latest security events and trends
• Participate in regular security training and certification acquisition
• Ensure our software development lifecycle remains secure as we continue to evolve its processes.
• Write infrastructure-as-code to automate deployment and management using Terraform, Ansible, or similar tools
• Stay current on emerging threats, security trends, and what’s happening across our stack and industry
• Investigate and resolve infrastructure incidents to keep things running smoothly

WHO YOU ARE:

• You have security certifications or equivalent real-world experience
• You think like an attacker, and a hacker mindset is genuinely how you approach problems
• Deep background across multiple facets of security
• 5+ years implementing security in Linux-based infrastructures, AWS, and code
• Comfortable with open-source tooling, cloud environments, and multiple operating systems
• Experience building security solutions that actually scale
• Hands-on with one or more of: penetration testing, threat modeling, code analysis, system hardening, distributed patching, vulnerability scanning
• Familiar with hardening AI tooling to prevent security incidents
• Strong communicator who can present findings to both technical and non-technical audiences
• Bonus points for experience or genuine interest in cryptocurrency / cryptography

WHY CASA?

At Casa, our mission is to empower individuals to secure their digital sovereignty, and we empower our employees to do their best work.

• Ownership. Private key management is the beginning of a future you can truly own, and at Casa, everyone has a role. We offer equity opportunities so our employees can benefit from what we are building together
• Community. Inclusivity is important to us.We value each other and our contributions. Our team, known as the Casa Space Fleet, brings out the best in everyone while having plenty of fun along the way
• Rest and Relaxation. We believe in the power of personal time, so we offer as much flexible time as you need. We encourage you to take at least 3 weeks off a year
• Health Benefits. We provide medical coverage with FSA options, dental, vision, and access to mental health providers
• Setup for Remote Success. Our team is both decentralized and effective. We reimburse up to $400 for anything you need to set up your home office
• Investment Avenues. We partner with resources so you can invest a portion of your paycheck in Bitcoin, and we also have the more traditional 401(k) option
• Maternity/Paternity Leave. We provide 12 weeks for maternity / 4 weeks for paternity

*As Casa is a fully remote company hiring candidates around the world, our perks and benefit packages may adjust based on your location

Casa is an Equal Employment Opportunity (EEO) employer and welcomes all qualified applicants. Applicants will receive fair and impartial consideration without regard to race, sex, color, religion, national origin, age, disability, veteran status, genetic data, or other legally protected status

MEET CASA

Casa is the secure home for your bitcoin. We’re the leading provider of Bitcoin self-custody solutions, the ultimate blend of security, privacy, and control. Our team combines deep security expertise, human-focused design, and exceptional customer service to empower our clients and build lifelong relationships.

THE ROLE

Casa is looking for a DevSecOps Engineer to help secure our customers, their data, and our company. As a member of our Security team, you will report to our Chief Security Officer and play a crucial role in overseeing our security architecture and culture. It will also be a unique opportunity to help develop an evolving security program consisting of efficient processes, training materials, and methodologies for all employees.

The successful candidate has experience developing scalable security controls and approaches in accordance with industry standards.

Compensation: $125,000-155,000 USD

WHAT YOU’LL DO:

• Handle internal security requests and make sure employees have the tools and access they need without over-provisioning
• Ensure that employees have access to the tools and systems they need while maintaining least privilege access principles
• Onboard and offboard employees across internal systems
• Oversee our MDM system and stay on top of alerts
• Review and assess new technologies (tools, code frameworks, third-party providers, internal apps) through a security lens
• Help shape and refine security best practices across the org
• Triage and work through vulnerabilities surfaced by pen testing, static analysis, responsible disclosures, and automated alerts
• Keep security documentation and training materials fresh and useful
• Automate security processes and alerts wherever you can find the leverage
• Participate in a shared on-call rotation for critical production security issues
• Stay abreast of the latest security events and trends
• Participate in regular security training and certification acquisition
• Ensure our software development lifecycle remains secure as we continue to evolve its processes.
• Write infrastructure-as-code to automate deployment and management using Terraform, Ansible, or similar tools
• Stay current on emerging threats, security trends, and what’s happening across our stack and industry
• Investigate and resolve infrastructure incidents to keep things running smoothly

WHO YOU ARE:

• You have security certifications or equivalent real-world experience
• You think like an attacker, and a hacker mindset is genuinely how you approach problems
• Deep background across multiple facets of security
• 5+ years implementing security in Linux-based infrastructures, AWS, and code
• Comfortable with open-source tooling, cloud environments, and multiple operating systems
• Experience building security solutions that actually scale
• Hands-on with one or more of: penetration testing, threat modeling, code analysis, system hardening, distributed patching, vulnerability scanning
• Familiar with hardening AI tooling to prevent security incidents
• Strong communicator who can present findings to both technical and non-technical audiences
• Bonus points for experience or genuine interest in cryptocurrency / cryptography

WHY CASA?

At Casa, our mission is to empower individuals to secure their digital sovereignty, and we empower our employees to do their best work.

• Ownership. Private key management is the beginning of a future you can truly own, and at Casa, everyone has a role. We offer equity opportunities so our employees can benefit from what we are building together
• Community. Inclusivity is important to us.We value each other and our contributions. Our team, known as the Casa Space Fleet, brings out the best in everyone while having plenty of fun along the way
• Rest and Relaxation. We believe in the power of personal time, so we offer as much flexible time as you need. We encourage you to take at least 3 weeks off a year
• Health Benefits. We provide medical coverage with FSA options, dental, vision, and access to mental health providers
• Setup for Remote Success. Our team is both decentralized and effective. We reimburse up to $400 for anything you need to set up your home office
• Investment Avenues. We partner with resources so you can invest a portion of your paycheck in Bitcoin, and we also have the more traditional 401(k) option
• Maternity/Paternity Leave. We provide 12 weeks for maternity / 4 weeks for paternity

*As Casa is a fully remote company hiring candidates around the world, our perks and benefit packages may adjust based on your location

Casa is an Equal Employment Opportunity (EEO) employer and welcomes all qualified applicants. Applicants will receive fair and impartial consideration without regard to race, sex, color, religion, national origin, age, disability, veteran status, genetic data, or other legally protected status

Overall del rolBuscamos un/a Arquitecto/a SASE/SSE con fuerte orientación a cliente para incorporarse a consultora especialista en infraestructura, networking, cloud y ciberseguridad (partner de Cisco y Microsoft, reconocida como Cybersecurity Partner of the Year 2023 y Partner of the Year 2024).

We are Bugcrowd. Since 2012, we’ve been empowering organizations to take back control and stay ahead of threat actors by uniting the collective ingenuity and expertise of our customers and trusted alliance of elite hackers, with our patented data and AI-powered Security Knowledge Platform™. Our network of hackers brings diverse expertise to uncover hidden weaknesses, adapting swiftly to evolving threats, even against zero-day exploits. With unmatched scalability and adaptability, our data and AI-driven CrowdMatch™ technology in our platform finds the perfect talent for your unique fight. We aim to create a new era of modern crowdsourced security that outpaces threat actors. Unleash the ingenuity of the hacker community with Bugcrowd, visit www.bugcrowd.com. Based in San Francisco and New Hampshire, Bugcrowd is supported by General Catalyst, Rally Ventures, Costanoa Ventures, and others.

Job Summary

At Bugcrowd, we handle application security assessment at an epic scale. As an Application Security Engineer (ASE) you will curate and manage the incoming security vulnerability submissions to some of the world’s biggest companies’ bug bounty programs. Here are just a few of the reasons why we are the best:

• A tenure at Bugcrowd often means you have worked on not only one company’s security program but potentially on hundreds.
• As an ASE at Bugcrowd you will be exposed to the Internet’s best security researchers and their cutting-edge security testing methodologies. Our ASEs quickly become technically fluent in obscure/complex XSS, SQLi, XXE, IDOR, SSTI, SSRF, and many other vulnerability types. There is no other organization that offers the learning opportunity that Bugcrowd does.
• You will be exposed to things outside of your comfort zone. We routinely run security programs for cars, IoT devices, embedded systems, mobile applications, and more!
• We have an awesome team and tons of perks. We’ve even been selected as one of “The 10 Coolest Security Startups Of 2016” by crn.com.

Essential Duties & Responsibilities

An ASE is responsible for the ongoing triage and validation services of Bugcrowd managed programs. Under the direction of the Director of Technical Operations, you will take incoming submission data and curate it for validity, accuracy, and severity as well as communicate directly with Bugcrowd’s clients or researchers when additional information is required. ASEs also handle Incident Response – escalating and communicating about the highest severity bugs to clients. ASEs need to have strong knowledge of OWASP Top Ten type vulnerabilities. They also usually require a strong skill set in one scripting/development language, often to assist with the design or development of tooling for improving the triage/validation process.  The ASE position is perfect for security professionals looking to take their skills to the next level.

Education, Experience, Skills, & Abilities

• Bachelor’s degree or previous security consulting experience
• Published and demonstrated passion for security assessment research
• High proficiency with Burp Suite (or any other interception proxy) and a working level of experience with other industry standard tools (nmap, sqlmap, anything included in Kali Linux)
• Ability to execute on individual projects but still contribute to the team
• Ability to complete tasks on time
• Strong organization, influencing, and communication skills

Working Conditions

The ideal candidate must be able to complete all physical requirements of the job with or without reasonable accommodation.

Sitting and/or standing - Must be able to remain in a stationary position 50% of the time

Carrying and /or lifting - Must be able to carry / move laptop as needed throughout the work day.

Environment - remote, work-from-home 100% of the time.

ADA Statement

Bugcrowd is committed to the full inclusion of all qualified individuals. In keeping with our commitment, Bugcrowd will take the steps to assure that people with disabilities are provided reasonable accommodations. Accordingly, if reasonable accommodation is required to fully participate in the job application or interview process, to perform the essential functions of the position, and/or to receive all other benefits and privileges of employment, please contact HR at ada@bugcrowd.com.

Culture

• At Bugcrowd, we understand that diversity in the workplace is vital to a company’s success and growth. We strive to make sure that people are included and have a sense of being part of making Bugcrowd not only a great product but a great place to work.
• We regularly hear from both customers and researchers that Bugcrowd feels like a family, and we strive to maintain that internally as well.
• Our team consists of a broad range of people: musicians, adventure sports junkies, nature lovers, parents, cereal enthusiasts, night owls, cyclists, artists—you get the point.

At Bugcrowd, we are solving security threats and vulnerabilities that are relevant to everyone, therefore we believe solving these problems takes all kinds of backgrounds. We value the perspectives and experiences people from underrepresented backgrounds bring.

Disclaimer

This position has access to highly confidential, sensitive information relating to the technologies of Bugcrowd. It is essential that the applicant possess the requisite integrity to maintain the information in the strictest confidence.

The company is authorized to obtain background checks for employment purposes under state and federal law. Background checks will be conducted for positions that involve access to confidential or proprietary information (including trade secrets).

Background checks may include Social Security verification, prior employment verification, personal and professional references, educational verification, and criminal history. Applicants with conviction histories will not be excluded from consideration to the extent required bylaw.

Any personal data you submit in connection with your application will be processed in compliance with Bugcrowd’s Privacy Policy, which you may review here: https://www.bugcrowd.com/privacy.

Equal Employment Opportunity:

Bugcrowd is EOE, Disability/Age Employer.

Individuals seeking employment at Bugcrowd are considered without regards to race, color, religion, national origin, age, sex, marital status, ancestry, physical or mental disability, veteran status, gender identity, or sexual orientation.

Bugcrowd is committed to the full inclusion of all qualified individuals. In keeping with our commitment, Bugcrowd will take the steps to assure that people with disabilities are provided reasonable accommodations. Accordingly, if reasonable accommodation is required to fully participate in the job application or interview process, to perform the essential functions of the position, and/or to receive all other benefits and privileges of employment, please contact HR at ADA at bugcrowd.com.

Apply at: https://www.bugcrowd.com/about/careers/

We are Bugcrowd. Since 2012, we’ve been empowering organizations to take back control and stay ahead of threat actors by uniting the collective ingenuity and expertise of our customers and trusted alliance of elite hackers, with our patented data and AI-powered Security Knowledge Platform™. Our network of hackers brings diverse expertise to uncover hidden weaknesses, adapting swiftly to evolving threats, even against zero-day exploits. With unmatched scalability and adaptability, our data and AI-driven CrowdMatch™ technology in our platform finds the perfect talent for your unique fight. We aim to create a new era of modern crowdsourced security that outpaces threat actors. Unleash the ingenuity of the hacker community with Bugcrowd, visit www.bugcrowd.com. Based in San Francisco and New Hampshire, Bugcrowd is supported by General Catalyst, Rally Ventures, Costanoa Ventures, and others.

Job Summary

At Bugcrowd, we handle application security assessment at an epic scale. As an Application Security Engineer (ASE) you will curate and manage the incoming security vulnerability submissions to some of the world’s biggest companies’ bug bounty programs. Here are just a few of the reasons why we are the best:

• A tenure at Bugcrowd often means you have worked on not only one company’s security program but potentially on hundreds.
• As an ASE at Bugcrowd you will be exposed to the Internet’s best security researchers and their cutting-edge security testing methodologies. Our ASEs quickly become technically fluent in obscure/complex XSS, SQLi, XXE, IDOR, SSTI, SSRF, and many other vulnerability types. There is no other organization that offers the learning opportunity that Bugcrowd does.
• You will be exposed to things outside of your comfort zone. We routinely run security programs for cars, IoT devices, embedded systems, mobile applications, and more!
• We have an awesome team and tons of perks. We’ve even been selected as one of “The 10 Coolest Security Startups Of 2016” by crn.com.

Essential Duties & Responsibilities

An ASE is responsible for the ongoing triage and validation services of Bugcrowd managed programs. Under the direction of the Director of Technical Operations, you will take incoming submission data and curate it for validity, accuracy, and severity as well as communicate directly with Bugcrowd’s clients or researchers when additional information is required. ASEs also handle Incident Response – escalating and communicating about the highest severity bugs to clients. ASEs need to have strong knowledge of OWASP Top Ten type vulnerabilities. They also usually require a strong skill set in one scripting/development language, often to assist with the design or development of tooling for improving the triage/validation process.  The ASE position is perfect for security professionals looking to take their skills to the next level.

Education, Experience, Skills, & Abilities

• Bachelor’s degree or previous security consulting experience
• Published and demonstrated passion for security assessment research
• High proficiency with Burp Suite (or any other interception proxy) and a working level of experience with other industry standard tools (nmap, sqlmap, anything included in Kali Linux)
• Ability to execute on individual projects but still contribute to the team
• Ability to complete tasks on time
• Strong organization, influencing, and communication skills

Working Conditions

The ideal candidate must be able to complete all physical requirements of the job with or without reasonable accommodation.

Sitting and/or standing - Must be able to remain in a stationary position 50% of the time

Carrying and /or lifting - Must be able to carry / move laptop as needed throughout the work day.

Environment - remote, work-from-home 100% of the time.

ADA Statement

Bugcrowd is committed to the full inclusion of all qualified individuals. In keeping with our commitment, Bugcrowd will take the steps to assure that people with disabilities are provided reasonable accommodations. Accordingly, if reasonable accommodation is required to fully participate in the job application or interview process, to perform the essential functions of the position, and/or to receive all other benefits and privileges of employment, please contact HR at ada@bugcrowd.com.

Culture

• At Bugcrowd, we understand that diversity in the workplace is vital to a company’s success and growth. We strive to make sure that people are included and have a sense of being part of making Bugcrowd not only a great product but a great place to work.
• We regularly hear from both customers and researchers that Bugcrowd feels like a family, and we strive to maintain that internally as well.
• Our team consists of a broad range of people: musicians, adventure sports junkies, nature lovers, parents, cereal enthusiasts, night owls, cyclists, artists—you get the point.

At Bugcrowd, we are solving security threats and vulnerabilities that are relevant to everyone, therefore we believe solving these problems takes all kinds of backgrounds. We value the perspectives and experiences people from underrepresented backgrounds bring.

Disclaimer

This position has access to highly confidential, sensitive information relating to the technologies of Bugcrowd. It is essential that the applicant possess the requisite integrity to maintain the information in the strictest confidence.

The company is authorized to obtain background checks for employment purposes under state and federal law. Background checks will be conducted for positions that involve access to confidential or proprietary information (including trade secrets).

Background checks may include Social Security verification, prior employment verification, personal and professional references, educational verification, and criminal history. Applicants with conviction histories will not be excluded from consideration to the extent required bylaw.

Any personal data you submit in connection with your application will be processed in compliance with Bugcrowd’s Privacy Policy, which you may review here: https://www.bugcrowd.com/privacy.

Equal Employment Opportunity:

Bugcrowd is EOE, Disability/Age Employer.

Individuals seeking employment at Bugcrowd are considered without regards to race, color, religion, national origin, age, sex, marital status, ancestry, physical or mental disability, veteran status, gender identity, or sexual orientation.

Bugcrowd is committed to the full inclusion of all qualified individuals. In keeping with our commitment, Bugcrowd will take the steps to assure that people with disabilities are provided reasonable accommodations. Accordingly, if reasonable accommodation is required to fully participate in the job application or interview process, to perform the essential functions of the position, and/or to receive all other benefits and privileges of employment, please contact HR at ADA at bugcrowd.com.

Apply at: https://www.bugcrowd.com/about/careers/

Dark Wolf Solutions is seeking a Senior Cybersecurity Engineer / Risk Management Framework (RMF) Specialist to will lead and execute the security authorization process for our systems and applications in compliance with NIST guidelines and DoD regulations. This individual will be responsible for navigating the RMF lifecycle, developing security documentation, conducting risk assessments, and ensuring that our systems meet the highest standards of security and compliance. This position offers a critical opportunity for a motivated and detail-oriented security professional to leverage their RMF expertise, contribute to the protection of sensitive information, and play a vital role in securing our nation’s critical infrastructure.

Key Responsibilities:

• Responsible for concentrating on overall technical and operational effectiveness of capabilities in coordination with the COTR and Sponsor Staff management.
• Cyber Security teams are responsible for providing recommendations on continuous improvement of the processes and architectures supporting the overall Cyber Defense operational activities including, but not limited to: analysis, incident handling and reporting products, and the reporting lifecycle.
• Ensures the effective operations of Agency IT systems and network defenses, providing effective incident response capabilities, usable and effective reports that address overall situational awareness.
• This individual works to maximize the use of existing tools to correlate information and synthesize data into usable and actionable events.
• Identifies and provides an agile approach to the automation of any manual and inefficient processes that exist across the cyber defense program and to work with the Sponsor to recommend and implement technical solutions designed to return time to mission.

Required Qualifications:

• Bachelor’s degree in Computer Science, Information Technology, Cybersecurity, Engineering, or a related technical field
• 8 years minimum of relevant experience
• Experience in security risk assessment and management in cloud environments (GCP preferred)
• Experience building authorization packages
• US Citizenship required with an active Secret clearance or interim Secret clearance

This role is primarily remote. The compensation for this role is estimated to be between $150,000-$170,000, commensurate on experience.

We are proud to be an EEO/AA employer Minorities/Women/Veterans/Disabled and other protected categories.

In compliance with federal law, all persons hired will be required to verify identity, confirm US Citizenship, and complete the required employment eligibility verification upon hire.

Cloud / Network / Cybersecurity Engineer – Infrastructure & Security | RemotePosition Type: Full-Time, Remote Working Hours: U.

It’s a new day with a new opportunity at 8am!

About the role:

The AI Security Analyst is a hybrid role combining security operations monitoring with AI-specific risk management and governance support. The role focuses on identifying, assessing, and mitigating risks associated with AI use, particularly generative AI, LLMs, and agentic systems, across internal tools and customer-facing platforms, while contributing to traditional security monitoring. The role does not involve building or training AI models; it secures how AI is deployed, governed, monitored, and used.

Location: Czech Republic (Remote). Working hours for this role are aligned to U.S. Central Time (Austin) core business hours to ensure real-time collaboration with the U.S.-based security leadership and compliance team.

This role is hired through an Employer of Record (EOR) partner in the Czech Republic.

About us:

8am builds software that helps professionals run stronger businesses. Our platform powers payments, client experience, and operational workflows for legal, accounting, and other service-based businesses. U.S. based professionals count on our purpose-built solutions to simplify operations, ensure compliance, and fuel profitable growth, so they can focus on their clients and do more of the work that matters.

More than 250,000 professionals across the U.S. rely on our products every day. As we continue to grow, we’re investing in the next generation of our platform and are looking for experienced engineers who want to help shape its future.

What you’ll do:

• AI security and risk management: Identify and mitigate AI-specific threats: prompt injection, jailbreaking and adversarial inputs, sensitive information disclosure, insecure output handling and excessive agency, model misuse and overreliance, and supply chain vulnerabilities in third-party AI services and models.
• AI use-case review: Triage and risk-assess proposed AI use cases with Engineering, Product, Legal, and Privacy before production deployment; recommend controls and document decisions.
• Agentic governance support: Support the operation of the company’s agentic-work governance model: autonomy classification reviews, agent activity monitoring, and evidence collection for governance reviews.
• Vendor and model review: Evaluate third-party AI vendors, model providers, and AI-enabled features for security posture and data handling; maintain the approved-provider view.
• Security operations and monitoring: Perform SOC-style monitoring, alert triage, and investigation across cloud, application, and AI-enabled systems, including AI API usage and data flows; enhance detection rules and logging for AI-specific activity.
• Compliance and governance support: Support audit readiness for SOC 2 and PCI DSS and alignment with emerging AI frameworks (NIST AI RMF, OWASP LLM Top 10, ISO/IEC 42001 as the program matures); document AI security controls and risk assessments.
• Incident support: Support AI-related incident response, investigation, and post-incident analysis.

About you:

• 3+ years in security operations, security analysis, or GRC with hands-on technical exposure.

• Working understanding of LLM-specific threat classes (OWASP LLM Top 10) and AI risk frameworks (NIST AI RMF).

• Ability to read logs, write basic queries and scripts, and investigate independently.

• Strong written English and documentation discipline; comfortable in a distributed team.

• Demonstrated experience leveraging AI tools and technologies to improve workflows, enhance decision-making, or drive innovation.

• This position is preferably based in Brno, Czech Republic

Bonus points:

• Experience monitoring or governing agentic AI systems, MCP integrations, or AI developer tooling.
• Fintech, legal-tech, or other regulated-industry background.

Additional Information

The monthly gross salary range for this position is CZK 75,000 to CZK 140,000. 8am is committed to fair, objective, and non-discriminatory compensation, and actual pay may vary based on job-related knowledge, skills, experience, and education.

Why join our new 8am Brno hub?

• Founding Team Impact: Be a founding engineer of our new Brno R&D hub. After a brief 1-6 month integration with U.S. based teams, you will help form fully autonomous, locally-led squads with clear paths to Staff and leadership roles
• Drive our “AI-First” Transformation: We are building a secure, massive-scale “Unified AI Platform”. Depending on your squad, you will either help architect this core infrastructure (LLM routing, RAG, agent orchestration) or build directly on top of it.
• Build the Next Generation of Our Platform: Help shape the systems powering products used by more than 250,000 professionals. You’ll work on complex platform capabilities across payments, workflow automation, and AI-powered features as we expand into new professional service markets.

Benefits and Perks

We offer a competitive, locally relevant benefits package designed to support your life in the Czech Republic while giving you access to global opportunities:

• Performance bonus opportunities and employee referral rewards
• Flexible Time Off (FTO) and 13 paid public holidays aligned with the Czech calendar
• Paid sick leave with additional support through the Czech social security system
• Maternity, paternity, and parental leave in line with Czech regulations, plus additional paid paternity leave from 8am
• Full statutory benefits, including public health insurance, social security, pension, and work accident coverage

Grow Your Career

• Access to Coursera (including Gen AI Academy) and ongoing professional development
• Clear growth paths, regular feedback, and opportunities for advancement

What Makes 8am Different:

• International company environment with collaboration across Europe and the U.S.
• Opportunities to travel for company events (including potential U.S. visits)
• Engaging team culture with local events, outings, and community initiatives
• High-quality company swag and programs focused on wellness, learning, and connection

Diversity, equity & inclusion at 8am:

At 8am, we recognize that innovation occurs with a strong team of people who are diverse in background, personality, talent and ideas. Experience comes in many forms and ensuring a diverse and inclusive workplace where we continue to learn from each other is an integral part of our culture. We are committed to creating a welcoming and transparent environment for all that embraces those differences through education, equal access to opportunities and information, inclusionary programs, and community outreach.

Security advisory:

Our hiring teams at 8am are dedicated to recruiting top talent that share our passion for serving the professional services industry through innovative financial technology.  As such, our Talent Acquisition Team only follows legitimate hiring practices.  We will always communicate with our candidates using emails with the 8am domain and will never ask for sensitive/personal data during the application process.  All interviews take place over phone call, Zoom/Google Meet or in person.  All offers are communicated verbally by our Talent Acquisition Specialists with a written offer letter as a follow up.

Applicant Data Privacy Notice:

Your personal data will be collected and retained by Controller as long as Controller determines it is necessary to evaluate your application for employment. Under the GDPR, you have the right to request access to your personal data, to request that your personal data be rectified or erased, and to request that processing of your personal data be restricted. You also have the right to data portability. In addition, you may lodge a complaint with an EU supervisory authority.  Full policy linked here.

It’s a new day with a new opportunity at 8am!

About the role:

As we evolve our security posture to meet growth and regulatory expectations, we are seeking a transformational Senior Information Security Manager to lead our technical security team and operationalize security capabilities that are measurable, effective, and aligned with business priorities. This is a hands-on leadership role: you will lead the day-to-day execution of the security program and directly manage the security engineering and analyst team, while partnering closely with the U.S.-based VP of Information Security and the compliance and privacy operations team.

Location: Czech Republic (Remote). Working hours for this role are aligned to U.S. Central Time (Austin) core business hours to ensure real-time collaboration with the U.S.-based security leadership and compliance team.

This role is hired through an Employer of Record (EOR) partner in the Czech Republic.

About us:

8am builds software that helps professionals run stronger businesses. Our platform powers payments, client experience, and operational workflows for legal, accounting, and other service-based businesses. U.S. based professionals count on our purpose-built solutions to simplify operations, ensure compliance, and fuel profitable growth, so they can focus on their clients and do more of the work that matters.

More than 250,000 professionals across the U.S. rely on our products every day. As we continue to grow, we’re investing in the next generation of our platform and are looking for experienced engineers who want to help shape its future.

What you’ll do:

• Team leadership: Lead and develop the security engineering/analyst team — delivery, prioritization, coaching, performance
• Security operations: Own security platforms (EDR, SIEM, compliance automation, vulnerability management, CSPM) and detection/response workflows
• Metrics & reporting: Own security metrics pipeline (remediation velocity, control assurance, coverage) for quarterly business reviews
• AI security: Drive AI adoption in tooling for better detection, and define/enforce security standards for AI/agentic systems (LLM integrations, orchestration, governance)
• Incident & compliance leadership: Lead incident response (EU hours, US coordination), post-incident reviews, and partner on compliance audits (SOC 2, PCI DSS, EU regs)
• Security design reviews: Lead design reviews across product lines with risk ratings, SLAs, and documented standards
• Threat intel & detection engineering: Monitor relevant threat intel and convert into actionable detections
• Fraud/attack investigation: Partner cross-functionally to investigate attacks (card testing, fraud, abuse), turning findings into detections and hardening recommendations

About you:

• 7+ years in information security, including 2+ years leading technical security staff.

• Hands-on depth in cloud security operations (AWS preferred), SIEM/log analytics, EDR platforms, and vulnerability management programs.

• Track record of building measurable, metrics-driven security programs in a compliance-heavy environment (PCI DSS, SOC 2, or equivalent).

• Experience operating in distributed, cross-timezone teams; excellent written communication.

• Fluent professional English.

• Demonstrated experience leveraging AI tools and technologies to improve workflows, enhance decision-making, or drive innovation.

• This position is preferably based in Brno, Czech Republic

Bonus points:

• Experience securing or governing AI/LLM systems and agentic tooling.
• Familiarity with EU regulatory landscape (GDPR) and fintech or legal-tech domains.

Additional Information

The monthly gross salary range for this position is CZK 95,000 to CZK 175,000. 8am is committed to fair, objective, and non-discriminatory compensation, and actual pay may vary based on job-related knowledge, skills, experience, and education.

Why join our new 8am Brno hub?

• Founding Team Impact: Be a founding engineer of our new Brno R&D hub. After a brief 1-6 month integration with U.S. based teams, you will help form fully autonomous, locally-led squads with clear paths to Staff and leadership roles
• Drive our “AI-First” Transformation: We are building a secure, massive-scale “Unified AI Platform”. Depending on your squad, you will either help architect this core infrastructure (LLM routing, RAG, agent orchestration) or build directly on top of it.
• Build the Next Generation of Our Platform: Help shape the systems powering products used by more than 250,000 professionals. You’ll work on complex platform capabilities across payments, workflow automation, and AI-powered features as we expand into new professional service markets.

Benefits and Perks

We offer a competitive, locally relevant benefits package designed to support your life in the Czech Republic while giving you access to global opportunities:

• Performance bonus opportunities and employee referral rewards
• Flexible Time Off (FTO) and 13 paid public holidays aligned with the Czech calendar
• Paid sick leave with additional support through the Czech social security system
• Maternity, paternity, and parental leave in line with Czech regulations, plus additional paid paternity leave from 8am
• Full statutory benefits, including public health insurance, social security, pension, and work accident coverage

Grow Your Career

• Access to Coursera (including Gen AI Academy) and ongoing professional development
• Clear growth paths, regular feedback, and opportunities for advancement

What Makes 8am Different:

• International company environment with collaboration across Europe and the U.S.
• Opportunities to travel for company events (including potential U.S. visits)
• Engaging team culture with local events, outings, and community initiatives
• High-quality company swag and programs focused on wellness, learning, and connection

Diversity, equity & inclusion at 8am:

At 8am, we recognize that innovation occurs with a strong team of people who are diverse in background, personality, talent and ideas. Experience comes in many forms and ensuring a diverse and inclusive workplace where we continue to learn from each other is an integral part of our culture. We are committed to creating a welcoming and transparent environment for all that embraces those differences through education, equal access to opportunities and information, inclusionary programs, and community outreach.

Security advisory:

Our hiring teams at 8am are dedicated to recruiting top talent that share our passion for serving the professional services industry through innovative financial technology.  As such, our Talent Acquisition Team only follows legitimate hiring practices.  We will always communicate with our candidates using emails with the 8am domain and will never ask for sensitive/personal data during the application process.  All interviews take place over phone call, Zoom/Google Meet or in person.  All offers are communicated verbally by our Talent Acquisition Specialists with a written offer letter as a follow up.

Applicant Data Privacy Notice:

Your personal data will be collected and retained by Controller as long as Controller determines it is necessary to evaluate your application for employment. Under the GDPR, you have the right to request access to your personal data, to request that your personal data be rectified or erased, and to request that processing of your personal data be restricted. You also have the right to data portability. In addition, you may lodge a complaint with an EU supervisory authority.  Full policy linked here.

It’s a new day with a new opportunity at 8am!

About the role:

The Information Security Engineer ensures the security and integrity of 8am’s systems, with a focus on cloud security operations, detection engineering, incident response, and data protection. This role is the hands-on technical backbone of the security program: you will operate and improve our detection and response stack, lead technical investigation of security events, and partner with engineering teams to embed security across our platforms.

Location: Czech Republic (Remote). Working hours for this role are aligned to U.S. Central Time (Austin) core business hours to ensure real-time collaboration with the U.S.-based security leadership and compliance team.

This role is hired through an Employer of Record (EOR) partner in the Czech Republic.

About us:

8am builds software that helps professionals run stronger businesses. Our platform powers payments, client experience, and operational workflows for legal, accounting, and other service-based businesses. U.S. based professionals count on our purpose-built solutions to simplify operations, ensure compliance, and fuel profitable growth, so they can focus on their clients and do more of the work that matters.

More than 250,000 professionals across the U.S. rely on our products every day. As we continue to grow, we’re investing in the next generation of our platform and are looking for experienced engineers who want to help shape its future.

What you’ll do:

• AWS security operations: Manage AWS security posture — identify vulnerabilities, triage findings (GuardDuty, Security Hub), drive remediation with owning teams
• Detection engineering: Operate/extend EDR and SIEM — maintain endpoint coverage, author detection queries/dashboards, tune alerts, investigate suspicious activity
• Incident response & forensics: Lead hands-on IR — investigation, containment, forensic analysis, remediation, and post-incident reviews
• Vulnerability management: Run operational cadence — scanner curation, severity SLAs, remediation tracking, code/secret scanning triage
• Security awareness & internal ops: Manage KnowBe4 phishing tests/training with Compliance
• Platform security: Support WAF monitoring, IaC security review, and cloud account hygiene across multi-account environment
• Data privacy & compliance support: Collaborate on data mapping/DLP/classification, and on compliance controls (PCI ASV scans, Vanta tests)
• Product security & documentation: Advise on customer-facing/product security questions; maintain runbooks so work is reproducible by any teammate

About you:

• 4+ years in security engineering or security operations, with real incident response experience.
• Strong AWS security knowledge (IAM, logging, GuardDuty/Security Hub, multi-account patterns).
• Proficiency with SIEM query languages, detection tuning, and at least one scripting language (Python

preferred).

• Experience with vulnerability management tooling and remediation SLA programs.

• Comfortable operating independently in a distributed team; strong written English.

• Demonstrated experience leveraging AI tools and technologies to improve workflows, enhance decision-making, or drive innovation.

• This position is preferably based in Brno, Czech Republic

Bonus points:

• PCI DSS or SOC 2 environment experience; ASV scan operations.
• Terraform/IaC security review experience.
• Exposure to securing AI-assisted development or agentic tooling.

Additional Information

The monthly gross salary range for this position is CZK 90,000 to CZK 160,000. 8am is committed to fair, objective, and non-discriminatory compensation, and actual pay may vary based on job-related knowledge, skills, experience, and education.

Why join our new 8am Brno hub?

• Founding Team Impact: Be a founding engineer of our new Brno R&D hub. After a brief 1-6 month integration with U.S. based teams, you will help form fully autonomous, locally-led squads with clear paths to Staff and leadership roles
• Drive our “AI-First” Transformation: We are building a secure, massive-scale “Unified AI Platform”. Depending on your squad, you will either help architect this core infrastructure (LLM routing, RAG, agent orchestration) or build directly on top of it.
• Build the Next Generation of Our Platform: Help shape the systems powering products used by more than 250,000 professionals. You’ll work on complex platform capabilities across payments, workflow automation, and AI-powered features as we expand into new professional service markets.

Benefits and Perks

We offer a competitive, locally relevant benefits package designed to support your life in the Czech Republic while giving you access to global opportunities:

• Performance bonus opportunities and employee referral rewards
• Flexible Time Off (FTO) and 13 paid public holidays aligned with the Czech calendar
• Paid sick leave with additional support through the Czech social security system
• Maternity, paternity, and parental leave in line with Czech regulations, plus additional paid paternity leave from 8am
• Full statutory benefits, including public health insurance, social security, pension, and work accident coverage

Grow Your Career

• Access to Coursera (including Gen AI Academy) and ongoing professional development
• Clear growth paths, regular feedback, and opportunities for advancement

What Makes 8am Different:

• International company environment with collaboration across Europe and the U.S.
• Opportunities to travel for company events (including potential U.S. visits)
• Engaging team culture with local events, outings, and community initiatives
• High-quality company swag and programs focused on wellness, learning, and connection

Diversity, equity & inclusion at 8am:

At 8am, we recognize that innovation occurs with a strong team of people who are diverse in background, personality, talent and ideas. Experience comes in many forms and ensuring a diverse and inclusive workplace where we continue to learn from each other is an integral part of our culture. We are committed to creating a welcoming and transparent environment for all that embraces those differences through education, equal access to opportunities and information, inclusionary programs, and community outreach.

Security advisory:

Our hiring teams at 8am are dedicated to recruiting top talent that share our passion for serving the professional services industry through innovative financial technology.  As such, our Talent Acquisition Team only follows legitimate hiring practices.  We will always communicate with our candidates using emails with the 8am domain and will never ask for sensitive/personal data during the application process.  All interviews take place over phone call, Zoom/Google Meet or in person.  All offers are communicated verbally by our Talent Acquisition Specialists with a written offer letter as a follow up.

Applicant Data Privacy Notice:

Your personal data will be collected and retained by Controller as long as Controller determines it is necessary to evaluate your application for employment. Under the GDPR, you have the right to request access to your personal data, to request that your personal data be rectified or erased, and to request that processing of your personal data be restricted. You also have the right to data portability. In addition, you may lodge a complaint with an EU supervisory authority.  Full policy linked here.

It’s a new day with a new opportunity at 8am!

About the role:

The AI Security Analyst is a hybrid role combining security operations monitoring with AI-specific risk management and governance support. The role focuses on identifying, assessing, and mitigating risks associated with AI use, particularly generative AI, LLMs, and agentic systems, across internal tools and customer-facing platforms, while contributing to traditional security monitoring. The role does not involve building or training AI models; it secures how AI is deployed, governed, monitored, and used.

Location: Czech Republic (Remote). Working hours for this role are aligned to U.S. Central Time (Austin) core business hours to ensure real-time collaboration with the U.S.-based security leadership and compliance team.

This role is hired through an Employer of Record (EOR) partner in the Czech Republic.

About us:

8am builds software that helps professionals run stronger businesses. Our platform powers payments, client experience, and operational workflows for legal, accounting, and other service-based businesses. U.S. based professionals count on our purpose-built solutions to simplify operations, ensure compliance, and fuel profitable growth, so they can focus on their clients and do more of the work that matters.

More than 250,000 professionals across the U.S. rely on our products every day. As we continue to grow, we’re investing in the next generation of our platform and are looking for experienced engineers who want to help shape its future.

What you’ll do:

• AI security and risk management: Identify and mitigate AI-specific threats: prompt injection, jailbreaking and adversarial inputs, sensitive information disclosure, insecure output handling and excessive agency, model misuse and overreliance, and supply chain vulnerabilities in third-party AI services and models.
• AI use-case review: Triage and risk-assess proposed AI use cases with Engineering, Product, Legal, and Privacy before production deployment; recommend controls and document decisions.
• Agentic governance support: Support the operation of the company’s agentic-work governance model: autonomy classification reviews, agent activity monitoring, and evidence collection for governance reviews.
• Vendor and model review: Evaluate third-party AI vendors, model providers, and AI-enabled features for security posture and data handling; maintain the approved-provider view.
• Security operations and monitoring: Perform SOC-style monitoring, alert triage, and investigation across cloud, application, and AI-enabled systems, including AI API usage and data flows; enhance detection rules and logging for AI-specific activity.
• Compliance and governance support: Support audit readiness for SOC 2 and PCI DSS and alignment with emerging AI frameworks (NIST AI RMF, OWASP LLM Top 10, ISO/IEC 42001 as the program matures); document AI security controls and risk assessments.
• Incident support: Support AI-related incident response, investigation, and post-incident analysis.

About you:

• 3+ years in security operations, security analysis, or GRC with hands-on technical exposure.

• Working understanding of LLM-specific threat classes (OWASP LLM Top 10) and AI risk frameworks (NIST AI RMF).

• Ability to read logs, write basic queries and scripts, and investigate independently.

• Strong written English and documentation discipline; comfortable in a distributed team.

• Demonstrated experience leveraging AI tools and technologies to improve workflows, enhance decision-making, or drive innovation.

• This position is preferably based in Brno, Czech Republic

Bonus points:

• Experience monitoring or governing agentic AI systems, MCP integrations, or AI developer tooling.
• Fintech, legal-tech, or other regulated-industry background.

Additional Information

The monthly gross salary range for this position is CZK 75,000 to CZK 140,000. 8am is committed to fair, objective, and non-discriminatory compensation, and actual pay may vary based on job-related knowledge, skills, experience, and education.

Why join our new 8am Brno hub?

• Founding Team Impact: Be a founding engineer of our new Brno R&D hub. After a brief 1-6 month integration with U.S. based teams, you will help form fully autonomous, locally-led squads with clear paths to Staff and leadership roles
• Drive our “AI-First” Transformation: We are building a secure, massive-scale “Unified AI Platform”. Depending on your squad, you will either help architect this core infrastructure (LLM routing, RAG, agent orchestration) or build directly on top of it.
• Build the Next Generation of Our Platform: Help shape the systems powering products used by more than 250,000 professionals. You’ll work on complex platform capabilities across payments, workflow automation, and AI-powered features as we expand into new professional service markets.

Benefits and Perks

We offer a competitive, locally relevant benefits package designed to support your life in the Czech Republic while giving you access to global opportunities:

• Performance bonus opportunities and employee referral rewards
• Flexible Time Off (FTO) and 13 paid public holidays aligned with the Czech calendar
• Paid sick leave with additional support through the Czech social security system
• Maternity, paternity, and parental leave in line with Czech regulations, plus additional paid paternity leave from 8am
• Full statutory benefits, including public health insurance, social security, pension, and work accident coverage

Grow Your Career

• Access to Coursera (including Gen AI Academy) and ongoing professional development
• Clear growth paths, regular feedback, and opportunities for advancement

What Makes 8am Different:

• International company environment with collaboration across Europe and the U.S.
• Opportunities to travel for company events (including potential U.S. visits)
• Engaging team culture with local events, outings, and community initiatives
• High-quality company swag and programs focused on wellness, learning, and connection

Diversity, equity & inclusion at 8am:

At 8am, we recognize that innovation occurs with a strong team of people who are diverse in background, personality, talent and ideas. Experience comes in many forms and ensuring a diverse and inclusive workplace where we continue to learn from each other is an integral part of our culture. We are committed to creating a welcoming and transparent environment for all that embraces those differences through education, equal access to opportunities and information, inclusionary programs, and community outreach.

Security advisory:

Our hiring teams at 8am are dedicated to recruiting top talent that share our passion for serving the professional services industry through innovative financial technology.  As such, our Talent Acquisition Team only follows legitimate hiring practices.  We will always communicate with our candidates using emails with the 8am domain and will never ask for sensitive/personal data during the application process.  All interviews take place over phone call, Zoom/Google Meet or in person.  All offers are communicated verbally by our Talent Acquisition Specialists with a written offer letter as a follow up.

Applicant Data Privacy Notice:

Your personal data will be collected and retained by Controller as long as Controller determines it is necessary to evaluate your application for employment. Under the GDPR, you have the right to request access to your personal data, to request that your personal data be rectified or erased, and to request that processing of your personal data be restricted. You also have the right to data portability. In addition, you may lodge a complaint with an EU supervisory authority.  Full policy linked here.

It’s a new day with a new opportunity at 8am!

About the role:

The AI Security Analyst is a hybrid role combining security operations monitoring with AI-specific risk management and governance support. The role focuses on identifying, assessing, and mitigating risks associated with AI use, particularly generative AI, LLMs, and agentic systems, across internal tools and customer-facing platforms, while contributing to traditional security monitoring. The role does not involve building or training AI models; it secures how AI is deployed, governed, monitored, and used.

Location: Czech Republic (Remote). Working hours for this role are aligned to U.S. Central Time (Austin) core business hours to ensure real-time collaboration with the U.S.-based security leadership and compliance team.

This role is hired through an Employer of Record (EOR) partner in the Czech Republic.

About us:

8am builds software that helps professionals run stronger businesses. Our platform powers payments, client experience, and operational workflows for legal, accounting, and other service-based businesses. U.S. based professionals count on our purpose-built solutions to simplify operations, ensure compliance, and fuel profitable growth, so they can focus on their clients and do more of the work that matters.

More than 250,000 professionals across the U.S. rely on our products every day. As we continue to grow, we’re investing in the next generation of our platform and are looking for experienced engineers who want to help shape its future.

What you’ll do:

• AI security and risk management: Identify and mitigate AI-specific threats: prompt injection, jailbreaking and adversarial inputs, sensitive information disclosure, insecure output handling and excessive agency, model misuse and overreliance, and supply chain vulnerabilities in third-party AI services and models.
• AI use-case review: Triage and risk-assess proposed AI use cases with Engineering, Product, Legal, and Privacy before production deployment; recommend controls and document decisions.
• Agentic governance support: Support the operation of the company’s agentic-work governance model: autonomy classification reviews, agent activity monitoring, and evidence collection for governance reviews.
• Vendor and model review: Evaluate third-party AI vendors, model providers, and AI-enabled features for security posture and data handling; maintain the approved-provider view.
• Security operations and monitoring: Perform SOC-style monitoring, alert triage, and investigation across cloud, application, and AI-enabled systems, including AI API usage and data flows; enhance detection rules and logging for AI-specific activity.
• Compliance and governance support: Support audit readiness for SOC 2 and PCI DSS and alignment with emerging AI frameworks (NIST AI RMF, OWASP LLM Top 10, ISO/IEC 42001 as the program matures); document AI security controls and risk assessments.
• Incident support: Support AI-related incident response, investigation, and post-incident analysis.

About you:

• 3+ years in security operations, security analysis, or GRC with hands-on technical exposure.

• Working understanding of LLM-specific threat classes (OWASP LLM Top 10) and AI risk frameworks (NIST AI RMF).

• Ability to read logs, write basic queries and scripts, and investigate independently.

• Strong written English and documentation discipline; comfortable in a distributed team.

• Demonstrated experience leveraging AI tools and technologies to improve workflows, enhance decision-making, or drive innovation.

• This position is preferably based in Brno, Czech Republic

Bonus points:

• Experience monitoring or governing agentic AI systems, MCP integrations, or AI developer tooling.
• Fintech, legal-tech, or other regulated-industry background.

Additional Information

The monthly gross salary range for this position is CZK 75,000 to CZK 140,000. 8am is committed to fair, objective, and non-discriminatory compensation, and actual pay may vary based on job-related knowledge, skills, experience, and education.

Why join our new 8am Brno hub?

• Founding Team Impact: Be a founding engineer of our new Brno R&D hub. After a brief 1-6 month integration with U.S. based teams, you will help form fully autonomous, locally-led squads with clear paths to Staff and leadership roles
• Drive our “AI-First” Transformation: We are building a secure, massive-scale “Unified AI Platform”. Depending on your squad, you will either help architect this core infrastructure (LLM routing, RAG, agent orchestration) or build directly on top of it.
• Build the Next Generation of Our Platform: Help shape the systems powering products used by more than 250,000 professionals. You’ll work on complex platform capabilities across payments, workflow automation, and AI-powered features as we expand into new professional service markets.

Benefits and Perks

We offer a competitive, locally relevant benefits package designed to support your life in the Czech Republic while giving you access to global opportunities:

• Performance bonus opportunities and employee referral rewards
• Flexible Time Off (FTO) and 13 paid public holidays aligned with the Czech calendar
• Paid sick leave with additional support through the Czech social security system
• Maternity, paternity, and parental leave in line with Czech regulations, plus additional paid paternity leave from 8am
• Full statutory benefits, including public health insurance, social security, pension, and work accident coverage

Grow Your Career

• Access to Coursera (including Gen AI Academy) and ongoing professional development
• Clear growth paths, regular feedback, and opportunities for advancement

What Makes 8am Different:

• International company environment with collaboration across Europe and the U.S.
• Opportunities to travel for company events (including potential U.S. visits)
• Engaging team culture with local events, outings, and community initiatives
• High-quality company swag and programs focused on wellness, learning, and connection

Diversity, equity & inclusion at 8am:

At 8am, we recognize that innovation occurs with a strong team of people who are diverse in background, personality, talent and ideas. Experience comes in many forms and ensuring a diverse and inclusive workplace where we continue to learn from each other is an integral part of our culture. We are committed to creating a welcoming and transparent environment for all that embraces those differences through education, equal access to opportunities and information, inclusionary programs, and community outreach.

Security advisory:

Our hiring teams at 8am are dedicated to recruiting top talent that share our passion for serving the professional services industry through innovative financial technology.  As such, our Talent Acquisition Team only follows legitimate hiring practices.  We will always communicate with our candidates using emails with the 8am domain and will never ask for sensitive/personal data during the application process.  All interviews take place over phone call, Zoom/Google Meet or in person.  All offers are communicated verbally by our Talent Acquisition Specialists with a written offer letter as a follow up.

Applicant Data Privacy Notice:

Your personal data will be collected and retained by Controller as long as Controller determines it is necessary to evaluate your application for employment. Under the GDPR, you have the right to request access to your personal data, to request that your personal data be rectified or erased, and to request that processing of your personal data be restricted. You also have the right to data portability. In addition, you may lodge a complaint with an EU supervisory authority.  Full policy linked here.

It’s a new day with a new opportunity at 8am!

About the role:

As we evolve our security posture to meet growth and regulatory expectations, we are seeking a transformational Senior Information Security Manager to lead our technical security team and operationalize security capabilities that are measurable, effective, and aligned with business priorities. This is a hands-on leadership role: you will lead the day-to-day execution of the security program and directly manage the security engineering and analyst team, while partnering closely with the U.S.-based VP of Information Security and the compliance and privacy operations team.

Location: Czech Republic (Remote). Working hours for this role are aligned to U.S. Central Time (Austin) core business hours to ensure real-time collaboration with the U.S.-based security leadership and compliance team.

This role is hired through an Employer of Record (EOR) partner in the Czech Republic.

About us:

8am builds software that helps professionals run stronger businesses. Our platform powers payments, client experience, and operational workflows for legal, accounting, and other service-based businesses. U.S. based professionals count on our purpose-built solutions to simplify operations, ensure compliance, and fuel profitable growth, so they can focus on their clients and do more of the work that matters.

More than 250,000 professionals across the U.S. rely on our products every day. As we continue to grow, we’re investing in the next generation of our platform and are looking for experienced engineers who want to help shape its future.

What you’ll do:

• Team leadership: Lead and develop the security engineering/analyst team — delivery, prioritization, coaching, performance
• Security operations: Own security platforms (EDR, SIEM, compliance automation, vulnerability management, CSPM) and detection/response workflows
• Metrics & reporting: Own security metrics pipeline (remediation velocity, control assurance, coverage) for quarterly business reviews
• AI security: Drive AI adoption in tooling for better detection, and define/enforce security standards for AI/agentic systems (LLM integrations, orchestration, governance)
• Incident & compliance leadership: Lead incident response (EU hours, US coordination), post-incident reviews, and partner on compliance audits (SOC 2, PCI DSS, EU regs)
• Security design reviews: Lead design reviews across product lines with risk ratings, SLAs, and documented standards
• Threat intel & detection engineering: Monitor relevant threat intel and convert into actionable detections
• Fraud/attack investigation: Partner cross-functionally to investigate attacks (card testing, fraud, abuse), turning findings into detections and hardening recommendations

About you:

• 7+ years in information security, including 2+ years leading technical security staff.

• Hands-on depth in cloud security operations (AWS preferred), SIEM/log analytics, EDR platforms, and vulnerability management programs.

• Track record of building measurable, metrics-driven security programs in a compliance-heavy environment (PCI DSS, SOC 2, or equivalent).

• Experience operating in distributed, cross-timezone teams; excellent written communication.

• Fluent professional English.

• Demonstrated experience leveraging AI tools and technologies to improve workflows, enhance decision-making, or drive innovation.

• This position is preferably based in Brno, Czech Republic

Bonus points:

• Experience securing or governing AI/LLM systems and agentic tooling.
• Familiarity with EU regulatory landscape (GDPR) and fintech or legal-tech domains.

Additional Information

The monthly gross salary range for this position is CZK 95,000 to CZK 175,000. 8am is committed to fair, objective, and non-discriminatory compensation, and actual pay may vary based on job-related knowledge, skills, experience, and education.

Why join our new 8am Brno hub?

• Founding Team Impact: Be a founding engineer of our new Brno R&D hub. After a brief 1-6 month integration with U.S. based teams, you will help form fully autonomous, locally-led squads with clear paths to Staff and leadership roles
• Drive our “AI-First” Transformation: We are building a secure, massive-scale “Unified AI Platform”. Depending on your squad, you will either help architect this core infrastructure (LLM routing, RAG, agent orchestration) or build directly on top of it.
• Build the Next Generation of Our Platform: Help shape the systems powering products used by more than 250,000 professionals. You’ll work on complex platform capabilities across payments, workflow automation, and AI-powered features as we expand into new professional service markets.

Benefits and Perks

We offer a competitive, locally relevant benefits package designed to support your life in the Czech Republic while giving you access to global opportunities:

• Performance bonus opportunities and employee referral rewards
• Flexible Time Off (FTO) and 13 paid public holidays aligned with the Czech calendar
• Paid sick leave with additional support through the Czech social security system
• Maternity, paternity, and parental leave in line with Czech regulations, plus additional paid paternity leave from 8am
• Full statutory benefits, including public health insurance, social security, pension, and work accident coverage

Grow Your Career

• Access to Coursera (including Gen AI Academy) and ongoing professional development
• Clear growth paths, regular feedback, and opportunities for advancement

What Makes 8am Different:

• International company environment with collaboration across Europe and the U.S.
• Opportunities to travel for company events (including potential U.S. visits)
• Engaging team culture with local events, outings, and community initiatives
• High-quality company swag and programs focused on wellness, learning, and connection

Diversity, equity & inclusion at 8am:

At 8am, we recognize that innovation occurs with a strong team of people who are diverse in background, personality, talent and ideas. Experience comes in many forms and ensuring a diverse and inclusive workplace where we continue to learn from each other is an integral part of our culture. We are committed to creating a welcoming and transparent environment for all that embraces those differences through education, equal access to opportunities and information, inclusionary programs, and community outreach.

Security advisory:

Our hiring teams at 8am are dedicated to recruiting top talent that share our passion for serving the professional services industry through innovative financial technology.  As such, our Talent Acquisition Team only follows legitimate hiring practices.  We will always communicate with our candidates using emails with the 8am domain and will never ask for sensitive/personal data during the application process.  All interviews take place over phone call, Zoom/Google Meet or in person.  All offers are communicated verbally by our Talent Acquisition Specialists with a written offer letter as a follow up.

Applicant Data Privacy Notice:

Your personal data will be collected and retained by Controller as long as Controller determines it is necessary to evaluate your application for employment. Under the GDPR, you have the right to request access to your personal data, to request that your personal data be rectified or erased, and to request that processing of your personal data be restricted. You also have the right to data portability. In addition, you may lodge a complaint with an EU supervisory authority.  Full policy linked here.

It’s a new day with a new opportunity at 8am!

About the role:

The Information Security Engineer ensures the security and integrity of 8am’s systems, with a focus on cloud security operations, detection engineering, incident response, and data protection. This role is the hands-on technical backbone of the security program: you will operate and improve our detection and response stack, lead technical investigation of security events, and partner with engineering teams to embed security across our platforms.

Location: Czech Republic (Remote). Working hours for this role are aligned to U.S. Central Time (Austin) core business hours to ensure real-time collaboration with the U.S.-based security leadership and compliance team.

This role is hired through an Employer of Record (EOR) partner in the Czech Republic.

About us:

8am builds software that helps professionals run stronger businesses. Our platform powers payments, client experience, and operational workflows for legal, accounting, and other service-based businesses. U.S. based professionals count on our purpose-built solutions to simplify operations, ensure compliance, and fuel profitable growth, so they can focus on their clients and do more of the work that matters.

More than 250,000 professionals across the U.S. rely on our products every day. As we continue to grow, we’re investing in the next generation of our platform and are looking for experienced engineers who want to help shape its future.

What you’ll do:

• AWS security operations: Manage AWS security posture — identify vulnerabilities, triage findings (GuardDuty, Security Hub), drive remediation with owning teams
• Detection engineering: Operate/extend EDR and SIEM — maintain endpoint coverage, author detection queries/dashboards, tune alerts, investigate suspicious activity
• Incident response & forensics: Lead hands-on IR — investigation, containment, forensic analysis, remediation, and post-incident reviews
• Vulnerability management: Run operational cadence — scanner curation, severity SLAs, remediation tracking, code/secret scanning triage
• Security awareness & internal ops: Manage KnowBe4 phishing tests/training with Compliance
• Platform security: Support WAF monitoring, IaC security review, and cloud account hygiene across multi-account environment
• Data privacy & compliance support: Collaborate on data mapping/DLP/classification, and on compliance controls (PCI ASV scans, Vanta tests)
• Product security & documentation: Advise on customer-facing/product security questions; maintain runbooks so work is reproducible by any teammate

About you:

• 4+ years in security engineering or security operations, with real incident response experience.
• Strong AWS security knowledge (IAM, logging, GuardDuty/Security Hub, multi-account patterns).
• Proficiency with SIEM query languages, detection tuning, and at least one scripting language (Python

preferred).

• Experience with vulnerability management tooling and remediation SLA programs.

• Comfortable operating independently in a distributed team; strong written English.

• Demonstrated experience leveraging AI tools and technologies to improve workflows, enhance decision-making, or drive innovation.

• This position is preferably based in Brno, Czech Republic

Bonus points:

• PCI DSS or SOC 2 environment experience; ASV scan operations.
• Terraform/IaC security review experience.
• Exposure to securing AI-assisted development or agentic tooling.

Additional Information

The monthly gross salary range for this position is CZK 90,000 to CZK 160,000. 8am is committed to fair, objective, and non-discriminatory compensation, and actual pay may vary based on job-related knowledge, skills, experience, and education.

Why join our new 8am Brno hub?

• Founding Team Impact: Be a founding engineer of our new Brno R&D hub. After a brief 1-6 month integration with U.S. based teams, you will help form fully autonomous, locally-led squads with clear paths to Staff and leadership roles
• Drive our “AI-First” Transformation: We are building a secure, massive-scale “Unified AI Platform”. Depending on your squad, you will either help architect this core infrastructure (LLM routing, RAG, agent orchestration) or build directly on top of it.
• Build the Next Generation of Our Platform: Help shape the systems powering products used by more than 250,000 professionals. You’ll work on complex platform capabilities across payments, workflow automation, and AI-powered features as we expand into new professional service markets.

Benefits and Perks

We offer a competitive, locally relevant benefits package designed to support your life in the Czech Republic while giving you access to global opportunities:

• Performance bonus opportunities and employee referral rewards
• Flexible Time Off (FTO) and 13 paid public holidays aligned with the Czech calendar
• Paid sick leave with additional support through the Czech social security system
• Maternity, paternity, and parental leave in line with Czech regulations, plus additional paid paternity leave from 8am
• Full statutory benefits, including public health insurance, social security, pension, and work accident coverage

Grow Your Career

• Access to Coursera (including Gen AI Academy) and ongoing professional development
• Clear growth paths, regular feedback, and opportunities for advancement

What Makes 8am Different:

• International company environment with collaboration across Europe and the U.S.
• Opportunities to travel for company events (including potential U.S. visits)
• Engaging team culture with local events, outings, and community initiatives
• High-quality company swag and programs focused on wellness, learning, and connection

Diversity, equity & inclusion at 8am:

At 8am, we recognize that innovation occurs with a strong team of people who are diverse in background, personality, talent and ideas. Experience comes in many forms and ensuring a diverse and inclusive workplace where we continue to learn from each other is an integral part of our culture. We are committed to creating a welcoming and transparent environment for all that embraces those differences through education, equal access to opportunities and information, inclusionary programs, and community outreach.

Security advisory:

Our hiring teams at 8am are dedicated to recruiting top talent that share our passion for serving the professional services industry through innovative financial technology.  As such, our Talent Acquisition Team only follows legitimate hiring practices.  We will always communicate with our candidates using emails with the 8am domain and will never ask for sensitive/personal data during the application process.  All interviews take place over phone call, Zoom/Google Meet or in person.  All offers are communicated verbally by our Talent Acquisition Specialists with a written offer letter as a follow up.

Applicant Data Privacy Notice:

Your personal data will be collected and retained by Controller as long as Controller determines it is necessary to evaluate your application for employment. Under the GDPR, you have the right to request access to your personal data, to request that your personal data be rectified or erased, and to request that processing of your personal data be restricted. You also have the right to data portability. In addition, you may lodge a complaint with an EU supervisory authority.  Full policy linked here.

About the Team Security is at the foundation of OpenAI’s mission to ensure that artificial general intelligence benefits all of humanity. The Security team protects OpenAI’s technology, people, and products....

About GoodLeap:

GoodLeap is a technology company delivering best-in-class financing and software products for sustainable solutions, from solar panels and batteries to energy-efficient HVAC, heat pumps, roofing, windows, and more. Over 1 million homeowners have benefited from our simple, fast, and frictionless technology that makes the adoption of these products more affordable, accessible, and easier to understand. Thousands of professionals deploying home efficiency and solar solutions rely on GoodLeap’s proprietary, AI-powered applications and developer tools to drive more transparent customer communication, deeper business intelligence, and streamlined payment and operations. Our platform has led to more than $30 billion in financing for sustainable solutions since 2018.

GoodLeap is also proud to support our award-winning nonprofit, GivePower, which is building and deploying life-saving water and clean electricity systems, changing the lives of more than 1.6 million people across Africa, Asia, and South America.

GoodLeap’s security team safeguards the organization’s information assets while enabling the business — spanning product safety and resilience, security paved roads, customer and regulatory trust, and technology governance. As a Senior Product Security Engineer, you’ll partner with product and engineering teams to make what we ship safe by default, splitting your time between building production security services and reviewing what other teams build: designs before code exists, pull requests before merge, and running systems before someone else finds the problem. You’ll be the primary security partner for one or more business units — GRC, security operations, and monitoring carry their own parts of the mandate, but you own the product security outcome.

GoodLeap builds in TypeScript, Node.js, .NET, and Python, and you’ll work across all of it — we care that you can move between stacks, not that you’ve spent your career in one. We’re also shipping LLM-backed and agentic features into a regulated consumer-finance product; adversarially testing those systems (prompt injection, jailbreaks, tool abuse, exfiltration) and helping define what’s “safe enough to launch” is core to this role. You don’t need years of AI security experience — you need to show you can take an unfamiliar system, reason about how it fails, and produce findings a product team will act on.

Essential Job Duties and Responsibilities

• Adversarially test our AI and LLM-backed features. Design and run attacks against LLM-backed applications and agents — prompt injection, jailbreaks, tool abuse, data exfiltration — and turn findings into pass/fail criteria product teams will act on.
• Build and operate production security services. Backend services and internal tooling — APIs, streaming transports, proxy/CLI/chat interfaces — in whichever of TypeScript, Node.js, .NET, or Python fits the problem, held to the same bar as any other production service: test coverage, CI, dependency management.
• Find new ways to automate the work. Notice when something we do by hand has become automatable, prototype it, and make the case— even when it means replacing a tool we bought last year.
• Review pull request vulnerability findings. Triage what scanning and AI-assisted review surface across our stacks, separating real findings from noise. Go deep by hand on auth paths and high-risk changes, and feed what you learn back into the tooling.
• Threat model from product designs. Review PRDs and technical designs before code exists, infer trust boundaries and data flows in unfamiliar domains, and raise security questions while the design is still cheap to change.
• Test by hand and validate what you find. Manual testing of web applications and APIs, triage for real exploitability, and retest fixes. Support the red team’s bug bounty and continuous penetration testing programs.
• Keep the AppSec tooling estate running and low-friction. SAST/dependency scanning tuning, finding triage and routing, SSO and access management, and automating the repetitive parts so the program scales without headcount.
• Secure the infrastructure your tooling runs on. IAM least-privilege scoping, secrets management, and container/network lifecycle — as infrastructure as code, with automated drift checks.
• Enable engineers to do the right thing. Build security training and documentation engineers will actually use.
• Evaluate tools and help set the AI bar. Run structured bake-offs of security products against defined requirements and help set the standards AI/agent systems must satisfy before reaching production.
• Back up the rest of the security team. Support investigations, threat hunting, and incident response for the products you cover, and contribute to the vulnerability management lifecycle and security analytics platform.

Required Skills, Knowledge, and Abilities

• You ship production code. Strong backend engineering in at least one modern language, with at least one service you built that others depend on — async patterns, HTTP APIs, and streaming transports are familiar ground. We work across TypeScript, Node.js, .NET, and Python; depth in one plus the willingness to move between them matters more than any particular stack on your résumé.
• You can read code you didn’t write, across more than one language and stack, well enough to judge whether a reported finding is real, catch the ones tooling missed, and propose a fix the engineer can act on.
• You know how identity and authorization actually fail: token exchange and scope handling, session lifetime and revocation, request signing, OAuth pitfalls, and network-layer issues like SSRF and DNS rebinding. We’re looking for reasoning that finds real bugs, not checklist recall.
• You understand API standards and how to secure them: REST and GraphQL in practice, OpenAPI and schema contracts, input validation, rate limiting, gateway-level auth, and webhook and service-to-service verification.
• Hands-on testing of web applications and APIs — manual, not just scanner-driven — plus the triage, the clear write-up, and the retest.
• Threat modeling from written designs. You can read a PRD in an unfamiliar domain, infer trust boundaries and data flows, and ask the right questions while the answer is still cheap.
• Working AWS and infrastructure-as-code competence: IAM scoping, secrets management, container/compute lifecycle, network egress control, and infrastructure defined as code.
• Practical exposure to AI/LLM security. You have attacked an LLM-backed application or agent — at work, in a CTF, in published research, or in your own lab — and can tell us what you found and why it worked.
• You write and speak for people who are not in security. Findings engineers act on, documentation they use, and explanations that hold up in front of a product manager, an executive, or Legal.

Preferred:

• Having owned an AppSec tooling estate: SAST/SCA tuning, finding routing, false-positive reduction
• Running structured vendor evaluations or proofs of concept
• Contributing to security policy or standards, including for AI systems
• Delivering security training or building hands-on learning environments
• Depth in cryptography and key management
• Detection engineering, incident response, or threat hunting exposure
• An understanding of how SaaS products get built — roadmaps, prioritization, why the ship date exists. Prior product or engineering management experience is a plus, not an expectation.

$146,000 - $185,000 a year

In addition to the above salary, this role may be eligible for a bonus.

Additional Information Regarding Job Duties and Job Descriptions:

Job duties include additional responsibilities as assigned by one’s supervisor or other managers related to the position/department. This job description is meant to describe the general nature and level of work being performed; it is not intended to be construed as an exhaustive list of all responsibilities, duties and other skills required for the position. The Company reserves the right at any time with or without notice to alter or change job responsibilities, reassign or transfer job position or assign additional job responsibilities, subject to applicable law. The Company shall provide reasonable accommodations of known disabilities to enable a qualified applicant or employee to apply for employment, perform the essential functions of the job, or enjoy the benefits and privileges of employment as required by the law.

If you are an extraordinary professional who thrives in a collaborative work culture and values a rewarding career, then we want to work with you!  Apply today!

We are committed to protecting your privacy. To learn more about how we collect, use, and safeguard your personal information during the application process, please review our Employment Privacy Policy and Recruiting Policy on AI.

We may use artificial intelligence (AI) tools to support parts of the hiring process, such as reviewing applications, analyzing resumes, or assessing responses and identifying potential inconsistencies or verification signals in application materials based on available information. These tools assist our recruitment team but do not replace human judgment. Final hiring decisions are ultimately made by humans. If you would like more information about how your data is processed, please contact us.

About GoodLeap:

GoodLeap is a technology company delivering best-in-class financing and software products for sustainable solutions, from solar panels and batteries to energy-efficient HVAC, heat pumps, roofing, windows, and more. Over 1 million homeowners have benefited from our simple, fast, and frictionless technology that makes the adoption of these products more affordable, accessible, and easier to understand. Thousands of professionals deploying home efficiency and solar solutions rely on GoodLeap’s proprietary, AI-powered applications and developer tools to drive more transparent customer communication, deeper business intelligence, and streamlined payment and operations. Our platform has led to more than $30 billion in financing for sustainable solutions since 2018.

GoodLeap is also proud to support our award-winning nonprofit, GivePower, which is building and deploying life-saving water and clean electricity systems, changing the lives of more than 1.6 million people across Africa, Asia, and South America.

GoodLeap’s security team safeguards the organization’s information assets while enabling the business — spanning product safety and resilience, security paved roads, customer and regulatory trust, and technology governance. As a Senior Product Security Engineer, you’ll partner with product and engineering teams to make what we ship safe by default, splitting your time between building production security services and reviewing what other teams build: designs before code exists, pull requests before merge, and running systems before someone else finds the problem. You’ll be the primary security partner for one or more business units — GRC, security operations, and monitoring carry their own parts of the mandate, but you own the product security outcome.

GoodLeap builds in TypeScript, Node.js, .NET, and Python, and you’ll work across all of it — we care that you can move between stacks, not that you’ve spent your career in one. We’re also shipping LLM-backed and agentic features into a regulated consumer-finance product; adversarially testing those systems (prompt injection, jailbreaks, tool abuse, exfiltration) and helping define what’s “safe enough to launch” is core to this role. You don’t need years of AI security experience — you need to show you can take an unfamiliar system, reason about how it fails, and produce findings a product team will act on.

Essential Job Duties and Responsibilities

• Adversarially test our AI and LLM-backed features. Design and run attacks against LLM-backed applications and agents — prompt injection, jailbreaks, tool abuse, data exfiltration — and turn findings into pass/fail criteria product teams will act on.
• Build and operate production security services. Backend services and internal tooling — APIs, streaming transports, proxy/CLI/chat interfaces — in whichever of TypeScript, Node.js, .NET, or Python fits the problem, held to the same bar as any other production service: test coverage, CI, dependency management.
• Find new ways to automate the work. Notice when something we do by hand has become automatable, prototype it, and make the case— even when it means replacing a tool we bought last year.
• Review pull request vulnerability findings. Triage what scanning and AI-assisted review surface across our stacks, separating real findings from noise. Go deep by hand on auth paths and high-risk changes, and feed what you learn back into the tooling.
• Threat model from product designs. Review PRDs and technical designs before code exists, infer trust boundaries and data flows in unfamiliar domains, and raise security questions while the design is still cheap to change.
• Test by hand and validate what you find. Manual testing of web applications and APIs, triage for real exploitability, and retest fixes. Support the red team’s bug bounty and continuous penetration testing programs.
• Keep the AppSec tooling estate running and low-friction. SAST/dependency scanning tuning, finding triage and routing, SSO and access management, and automating the repetitive parts so the program scales without headcount.
• Secure the infrastructure your tooling runs on. IAM least-privilege scoping, secrets management, and container/network lifecycle — as infrastructure as code, with automated drift checks.
• Enable engineers to do the right thing. Build security training and documentation engineers will actually use.
• Evaluate tools and help set the AI bar. Run structured bake-offs of security products against defined requirements and help set the standards AI/agent systems must satisfy before reaching production.
• Back up the rest of the security team. Support investigations, threat hunting, and incident response for the products you cover, and contribute to the vulnerability management lifecycle and security analytics platform.

Required Skills, Knowledge, and Abilities

• You ship production code. Strong backend engineering in at least one modern language, with at least one service you built that others depend on — async patterns, HTTP APIs, and streaming transports are familiar ground. We work across TypeScript, Node.js, .NET, and Python; depth in one plus the willingness to move between them matters more than any particular stack on your résumé.
• You can read code you didn’t write, across more than one language and stack, well enough to judge whether a reported finding is real, catch the ones tooling missed, and propose a fix the engineer can act on.
• You know how identity and authorization actually fail: token exchange and scope handling, session lifetime and revocation, request signing, OAuth pitfalls, and network-layer issues like SSRF and DNS rebinding. We’re looking for reasoning that finds real bugs, not checklist recall.
• You understand API standards and how to secure them: REST and GraphQL in practice, OpenAPI and schema contracts, input validation, rate limiting, gateway-level auth, and webhook and service-to-service verification.
• Hands-on testing of web applications and APIs — manual, not just scanner-driven — plus the triage, the clear write-up, and the retest.
• Threat modeling from written designs. You can read a PRD in an unfamiliar domain, infer trust boundaries and data flows, and ask the right questions while the answer is still cheap.
• Working AWS and infrastructure-as-code competence: IAM scoping, secrets management, container/compute lifecycle, network egress control, and infrastructure defined as code.
• Practical exposure to AI/LLM security. You have attacked an LLM-backed application or agent — at work, in a CTF, in published research, or in your own lab — and can tell us what you found and why it worked.
• You write and speak for people who are not in security. Findings engineers act on, documentation they use, and explanations that hold up in front of a product manager, an executive, or Legal.

Preferred:

• Having owned an AppSec tooling estate: SAST/SCA tuning, finding routing, false-positive reduction
• Running structured vendor evaluations or proofs of concept
• Contributing to security policy or standards, including for AI systems
• Delivering security training or building hands-on learning environments
• Depth in cryptography and key management
• Detection engineering, incident response, or threat hunting exposure
• An understanding of how SaaS products get built — roadmaps, prioritization, why the ship date exists. Prior product or engineering management experience is a plus, not an expectation.

$146,000 - $185,000 a year

In addition to the above salary, this role may be eligible for a bonus.

Additional Information Regarding Job Duties and Job Descriptions:

Job duties include additional responsibilities as assigned by one’s supervisor or other managers related to the position/department. This job description is meant to describe the general nature and level of work being performed; it is not intended to be construed as an exhaustive list of all responsibilities, duties and other skills required for the position. The Company reserves the right at any time with or without notice to alter or change job responsibilities, reassign or transfer job position or assign additional job responsibilities, subject to applicable law. The Company shall provide reasonable accommodations of known disabilities to enable a qualified applicant or employee to apply for employment, perform the essential functions of the job, or enjoy the benefits and privileges of employment as required by the law.

If you are an extraordinary professional who thrives in a collaborative work culture and values a rewarding career, then we want to work with you!  Apply today!

We are committed to protecting your privacy. To learn more about how we collect, use, and safeguard your personal information during the application process, please review our Employment Privacy Policy and Recruiting Policy on AI.

We may use artificial intelligence (AI) tools to support parts of the hiring process, such as reviewing applications, analyzing resumes, or assessing responses and identifying potential inconsistencies or verification signals in application materials based on available information. These tools assist our recruitment team but do not replace human judgment. Final hiring decisions are ultimately made by humans. If you would like more information about how your data is processed, please contact us.

About GoodLeap:

GoodLeap is a technology company delivering best-in-class financing and software products for sustainable solutions, from solar panels and batteries to energy-efficient HVAC, heat pumps, roofing, windows, and more. Over 1 million homeowners have benefited from our simple, fast, and frictionless technology that makes the adoption of these products more affordable, accessible, and easier to understand. Thousands of professionals deploying home efficiency and solar solutions rely on GoodLeap’s proprietary, AI-powered applications and developer tools to drive more transparent customer communication, deeper business intelligence, and streamlined payment and operations. Our platform has led to more than $30 billion in financing for sustainable solutions since 2018.

GoodLeap is also proud to support our award-winning nonprofit, GivePower, which is building and deploying life-saving water and clean electricity systems, changing the lives of more than 1.6 million people across Africa, Asia, and South America.

GoodLeap’s security team safeguards the organization’s information assets while enabling the business — spanning product safety and resilience, security paved roads, customer and regulatory trust, and technology governance. As a Senior Product Security Engineer, you’ll partner with product and engineering teams to make what we ship safe by default, splitting your time between building production security services and reviewing what other teams build: designs before code exists, pull requests before merge, and running systems before someone else finds the problem. You’ll be the primary security partner for one or more business units — GRC, security operations, and monitoring carry their own parts of the mandate, but you own the product security outcome.

GoodLeap builds in TypeScript, Node.js, .NET, and Python, and you’ll work across all of it — we care that you can move between stacks, not that you’ve spent your career in one. We’re also shipping LLM-backed and agentic features into a regulated consumer-finance product; adversarially testing those systems (prompt injection, jailbreaks, tool abuse, exfiltration) and helping define what’s “safe enough to launch” is core to this role. You don’t need years of AI security experience — you need to show you can take an unfamiliar system, reason about how it fails, and produce findings a product team will act on.

Essential Job Duties and Responsibilities

• Adversarially test our AI and LLM-backed features. Design and run attacks against LLM-backed applications and agents — prompt injection, jailbreaks, tool abuse, data exfiltration — and turn findings into pass/fail criteria product teams will act on.
• Build and operate production security services. Backend services and internal tooling — APIs, streaming transports, proxy/CLI/chat interfaces — in whichever of TypeScript, Node.js, .NET, or Python fits the problem, held to the same bar as any other production service: test coverage, CI, dependency management.
• Find new ways to automate the work. Notice when something we do by hand has become automatable, prototype it, and make the case— even when it means replacing a tool we bought last year.
• Review pull request vulnerability findings. Triage what scanning and AI-assisted review surface across our stacks, separating real findings from noise. Go deep by hand on auth paths and high-risk changes, and feed what you learn back into the tooling.
• Threat model from product designs. Review PRDs and technical designs before code exists, infer trust boundaries and data flows in unfamiliar domains, and raise security questions while the design is still cheap to change.
• Test by hand and validate what you find. Manual testing of web applications and APIs, triage for real exploitability, and retest fixes. Support the red team’s bug bounty and continuous penetration testing programs.
• Keep the AppSec tooling estate running and low-friction. SAST/dependency scanning tuning, finding triage and routing, SSO and access management, and automating the repetitive parts so the program scales without headcount.
• Secure the infrastructure your tooling runs on. IAM least-privilege scoping, secrets management, and container/network lifecycle — as infrastructure as code, with automated drift checks.
• Enable engineers to do the right thing. Build security training and documentation engineers will actually use.
• Evaluate tools and help set the AI bar. Run structured bake-offs of security products against defined requirements and help set the standards AI/agent systems must satisfy before reaching production.
• Back up the rest of the security team. Support investigations, threat hunting, and incident response for the products you cover, and contribute to the vulnerability management lifecycle and security analytics platform.

Required Skills, Knowledge, and Abilities

• You ship production code. Strong backend engineering in at least one modern language, with at least one service you built that others depend on — async patterns, HTTP APIs, and streaming transports are familiar ground. We work across TypeScript, Node.js, .NET, and Python; depth in one plus the willingness to move between them matters more than any particular stack on your résumé.
• You can read code you didn’t write, across more than one language and stack, well enough to judge whether a reported finding is real, catch the ones tooling missed, and propose a fix the engineer can act on.
• You know how identity and authorization actually fail: token exchange and scope handling, session lifetime and revocation, request signing, OAuth pitfalls, and network-layer issues like SSRF and DNS rebinding. We’re looking for reasoning that finds real bugs, not checklist recall.
• You understand API standards and how to secure them: REST and GraphQL in practice, OpenAPI and schema contracts, input validation, rate limiting, gateway-level auth, and webhook and service-to-service verification.
• Hands-on testing of web applications and APIs — manual, not just scanner-driven — plus the triage, the clear write-up, and the retest.
• Threat modeling from written designs. You can read a PRD in an unfamiliar domain, infer trust boundaries and data flows, and ask the right questions while the answer is still cheap.
• Working AWS and infrastructure-as-code competence: IAM scoping, secrets management, container/compute lifecycle, network egress control, and infrastructure defined as code.
• Practical exposure to AI/LLM security. You have attacked an LLM-backed application or agent — at work, in a CTF, in published research, or in your own lab — and can tell us what you found and why it worked.
• You write and speak for people who are not in security. Findings engineers act on, documentation they use, and explanations that hold up in front of a product manager, an executive, or Legal.

Preferred:

• Having owned an AppSec tooling estate: SAST/SCA tuning, finding routing, false-positive reduction
• Running structured vendor evaluations or proofs of concept
• Contributing to security policy or standards, including for AI systems
• Delivering security training or building hands-on learning environments
• Depth in cryptography and key management
• Detection engineering, incident response, or threat hunting exposure
• An understanding of how SaaS products get built — roadmaps, prioritization, why the ship date exists. Prior product or engineering management experience is a plus, not an expectation.

$146,000 - $185,000 a year

In addition to the above salary, this role may be eligible for a bonus.

Additional Information Regarding Job Duties and Job Descriptions:

Job duties include additional responsibilities as assigned by one’s supervisor or other managers related to the position/department. This job description is meant to describe the general nature and level of work being performed; it is not intended to be construed as an exhaustive list of all responsibilities, duties and other skills required for the position. The Company reserves the right at any time with or without notice to alter or change job responsibilities, reassign or transfer job position or assign additional job responsibilities, subject to applicable law. The Company shall provide reasonable accommodations of known disabilities to enable a qualified applicant or employee to apply for employment, perform the essential functions of the job, or enjoy the benefits and privileges of employment as required by the law.

If you are an extraordinary professional who thrives in a collaborative work culture and values a rewarding career, then we want to work with you!  Apply today!

We are committed to protecting your privacy. To learn more about how we collect, use, and safeguard your personal information during the application process, please review our Employment Privacy Policy and Recruiting Policy on AI.

We may use artificial intelligence (AI) tools to support parts of the hiring process, such as reviewing applications, analyzing resumes, or assessing responses and identifying potential inconsistencies or verification signals in application materials based on available information. These tools assist our recruitment team but do not replace human judgment. Final hiring decisions are ultimately made by humans. If you would like more information about how your data is processed, please contact us.

What You'll Do We are looking for apassionate and drivenVulnerability Engineerto join our Vulnerability Management team.

About the TeamAt DoorDash we’re building the industry’s most scalable and reliable delivery network to support our three-sided marketplace of consumers, merchants, and Dashers.