Source Job

• Get involved early in new products and features, using threat modeling and security design reviews to find problems before they reach production.
• Dig into application architecture, APIs, authentication, authorization, data flows, cloud services, and third-party integrations to understand how systems could be attacked.
• Own and improve security tooling across the development lifecycle, including SAST, DAST, dependency scanning, and secret scanning.

YipitData is a leading market research and analytics firm for the disruptive economy, raising $475M from The Carlyle Group at a valuation over $1B. They operate globally with offices in the US, APAC, and India, and have been recognized by Inc. as a Best Workplace for three consecutive years, emphasizing transparency, ownership, and continuous mastery.

• Proactively identify and drive security improvements across the product and platform.
• Partner with engineering teams to threat model new features and review designs early in development.
• Build and improve security tooling, libraries, and workflows to make secure development the default path.

Fellow is an AI meeting assistant that helps teams record, transcribe, summarise, and act on their meetings. We are a Series A company backed by major venture firms, with a remote-first culture and a growing team.

• Protect applications trusted by millions of users in the Web3 ecosystem.
• Combine hands-on security engineering with threat modeling, code reviews, and developer enablement.
• Embed security throughout the software development lifecycle to build resilient products.

This company builds products and infrastructure for the Web3 ecosystem, focusing on digital assets, identities, and blockchain technology. It is a globally distributed, remote-first team with a culture of security, autonomy, and innovation.

• Lead threat modeling and security architecture reviews with engineering teams by translating security risks into concrete development actions.
• Architect, build, and maintain security tooling and integrations that make secure development the default in our CI/CD pipelines.
• Design and deploy automated security testing to identify vulnerabilities early in the development process.

Abnormal Security protects the humans behind the world's most critical organizations from AI-powered cybercrime. More than 4,500 enterprises trust its behavioral AI platform.

• Own threat modeling and secure code reviews for new products and features.
• Maintain and tune AppSec tooling, and run the bug bounty program.
• Design and evolve the secure SDLC, and partner with engineering teams to implement secure-by-default patterns.

Ondo Finance is building institutional-grade financial infrastructure for tokenized real-world assets. The company operates at the intersection of traditional finance and on-chain systems, with a focus on security and innovation.

• Threat model new product features and integrations, hardening systems with effective controls.
• Operate and evolve the application security toolchain, keeping it high-signal for developers.
• Own day-to-day security operations across the detection stack, triaging and resolving incidents.

Gauntlet builds the financial systems of the future, operating across the entire onchain finance stack to offer vault products for institutional clients. They serve over $1.5B in client TVL and combine traditional finance with crypto-native expertise.

• Conduct third-party security assessments and evaluate vendor security controls to manage risk.
• Build and maintain automation using Python and agentic coding tools to replace manual GRC workflows.
• Partner with cross-functional teams including Procurement, Legal, Engineering, and Compliance on risk-informed decisions.

Affirm is a financial technology company that reinvents credit to make it more honest and friendly, giving consumers the flexibility to buy now and pay later without hidden fees. It is a remote-first company with a culture focused on innovation and engineering-driven security.

• Embed security into the software development lifecycle through threat modeling, secure design reviews, and secure-coding guidance that engineers actually adopt.
• Own application security testing (code review, SAST/DAST, and triage) and drive issues to remediation, not just filing them.
• Harden the software supply chain, build and automate security tooling, and serve as the internal security SME on product and workflow decisions.

Cogent is an Applied AI Lab building the next generation of AI agents for cybersecurity, using AI to assess petabytes of enterprise data and remediate critical breaches. We're backed by Greylock, have experienced rapid growth, and our team includes top minds from Stanford, Deepmind, and leading tech companies.

• Act as an Application Security SME, partnering with Engineering and Product teams to embed security throughout the SDLC.
• Lead application security reviews, threat modeling, code reviews, and penetration testing to identify and mitigate risks.
• Design and automate security controls across CI/CD pipelines, including SAST, SCA, and other AppSec tooling.

Job&Talent is a world-leading, AI-powered workforce management platform for frontline industries. Headquartered in Madrid, the company operates in 10 countries across Europe, the US, and Latin America, backed by leading investors, and places millions of workers.

• Conduct third-party security assessments, reviewing vendor questionnaires and evaluating security controls.
• Build and maintain automation using Python and agentic coding tools to reduce manual GRC workflows.
• Partner with Procurement, Legal, Engineering, and other teams on risk reviews and risk-informed decisions.

Affirm is a financial technology company that offers buy now, pay later services. The company values security as critical to its success and has a culture focused on engineering-driven risk management.

• Develop and maintain backend features for GitLab's vulnerability management workflows, primarily using Ruby on Rails.
• Collaborate with frontend engineers and contribute across the stack when needed, focusing on performance and reliability.
• Participate in on-call rotations to assist with troubleshooting product operations and security issues.

GitLab is the intelligent orchestration platform for DevSecOps, enabling organizations to increase developer productivity and reduce security risk. With over 50 million registered users and more than 50% of the Fortune 100 as customers, GitLab fosters a high-performance culture driven by values and continuous knowledge exchange.

• Champion a secure by default culture, building defense in depth into frameworks and processes.
• Develop security requirements and work directly with teams to build them into new applications.
• Run security risk assessments, hands-on penetration testing, and threat modeling.

Grow Therapy is a three-sided marketplace that empowers therapists and patients by providing technology and insurance support. The company has raised over $328M in funding, employs roughly 145 engineers, and values a mission-driven culture.

• Design and implement security controls across applications, cloud infrastructure, and development environments.
• Conduct architecture reviews, threat modeling, and security assessments for new products.
• Identify, prioritize, and remediate vulnerabilities across the technology stack.

SignalFire partners with top early-stage startups that are shaping the future of technology. They have a portfolio of over 200 innovative companies across AI, cybersecurity, healthtech, fintech, developer tools, and enterprise SaaS.

• Integrate security into the SDLC through automation, testing, and continuous improvement.
• Identify, investigate, and remediate application and infrastructure vulnerabilities.
• Develop tools and automation in Python, Go, or Terraform to improve security and developer productivity.

Corbalt is a technology company that partners with federal agencies to modernize and operate complex technology ecosystems, building shared platforms and reusable services. They are a remote-first team that values curiosity, kindness, ownership, and continuous learning, with roots in the Healthcare.gov recovery effort.

• Conduct thorough security assessments and penetration testing to identify vulnerabilities in web and mobile applications.
• Collaborate with development teams to integrate security best practices and design secure application architectures.
• Lead incident response and ensure compliance with security standards and regulations.

Moniepoint Inc. is an all-in-one African financial platform serving 20 million businesses with payments, banking, and tools. As Nigeria's largest merchant acquirer, it processes over $250 billion annually and fosters a culture of innovation and teamwork.

• Hunt for and close security vulnerabilities across Counterpart Assistant using custom tooling and AI-driven frameworks.
• Harden systems, services, and endpoints while establishing strong security monitoring and safeguarding PHI.
• Raise the security bar by reviewing critical pull requests, running training, and mentoring engineers on secure coding practices.

Counterpart Health, a subsidiary of Clover Health, builds an AI-enabled primary care tool called Counterpart Assistant that helps physicians diagnose and manage chronic conditions earlier. The company employs a remote-first culture with a diverse and inclusive team focused on transforming healthcare at scale.

• Own the vulnerability management lifecycle across Glean's technology stack, from discovery through remediation and reporting.
• Harden base OS images and secure open-source dependencies and the broader software supply chain.
• Integrate SAST, DAST, dependency scanning, and automated security validation into CI/CD pipelines.

Glean is the Work AI platform that helps everyone work smarter with AI. With over 1,000 employees across more than 25 countries, we foster a diverse, inclusive workplace and are recognized as one of the world's most innovative companies.

• Embed security into every phase of the SDLC and champion secure design for Gen AI and agentic AI tools.
• Perform secure code reviews, threat modeling, and establish secure API patterns across engineering teams.
• Operate the application vulnerability management lifecycle and communicate risk to engineering and business leaders.

GameChanger builds a platform for youth sports, helping families elevate the next generation through community and technology. They are a remote-first, dynamic tech company based in New York City, solving major challenges in youth sports.

• Lead and evolve the company's application security strategy, roadmap, and day-to-day operations.
• Manage and optimize AppSec tooling including GitHub Advanced Security, Invicti, Hadrian, and Cloudflare WAF.
• Build secure development standards, conduct security reviews, and partner with engineering teams on design and code review.

Beyond Finance helps everyday Americans escape debt and achieve financial freedom through compassionate, individualized care and customized solutions. The company is rapidly growing, has helped over 1 million clients, and fosters a forward-thinking culture focused on compliance and ethics.

• Drive application security initiatives across the SDLC, partnering with engineering teams to promote secure coding and security-by-design.
• Integrate security testing tools into CI/CD pipelines and automate security processes using modern AppSec and DevSecOps tools.
• Perform vulnerability analysis, source code review, and support threat modeling and secure design reviews.

Devoteam Cyber Trust is the cybersecurity arm of the Devoteam Group, offering end-to-end cyber resilience and managed security services. With 800+ experts across EMEA, they are ISO 27001 certified and serve clients in over 20 countries.