Own application and product security, including threat modeling, secure code review, and access-control and secrets-exposure flaws.
Design and implement security architecture for an agentic AI software development lifecycle with out-of-band controls.
Secure AWS environment, manage non-human identities, and enforce security tooling across GitHub and SaaS estate.
Oshi Health is a fully remote, cloud-native healthcare platform dedicated to helping people manage chronic GI conditions. It is a growing company with a small cross-functional team, emphasizing a remote-first culture and equity-based compensation.
Support application security programs including threat modeling and security reviews for web and AI/LLM systems.
Triage SCA/SAST/DAST/CSPM findings and coordinate remediation with engineering teams.
Develop automation scripts and tools to integrate security solutions and streamline vulnerability management.
G-P is a leading SaaS-based Global Employment Platform that enables companies to expand into over 180 countries without establishing local entities. With a diverse, remote-first culture, G-P empowers its Dream Team with flexibility and resources to foster innovation and growth.
Secure Drivetrain's cloud infrastructure (AWS) including IAM, network security, and monitoring.
Embed security into the SDLC via threat modeling, secure code reviews, and automated scanning.
Lead vulnerability management, incident response, and compliance programs such as SOC 2 and ISO 27001.
Drivetrain is a financial planning & decision-making platform that helps companies scale and achieve targets predictably. Founded in 2021 by ex-Googlers, it is a remote-first, fast-growing startup backed by leading venture capital firms with a culture focused on autonomy, transparency, and customer-centricity.
Partner with product teams to ensure security is embedded throughout the product development lifecycle.
Conduct threat modeling, architecture reviews, and source code analysis to identify and mitigate vulnerabilities.
Automate security processes and drive cross-team projects to closure.
Affirm exists to give people a clear, predictable way to pay over time with no hidden fees, building honest financial products. It is a remote-first company that values information security, transparency, and flexibility, with a strong culture of care.
Shape and execute application security and cloud security posture, driving secure-by-design practices and threat modeling across services and infrastructure.
Partner with product engineering to embed security throughout the SDLC and integrate developer-friendly security tooling into CI/CD pipelines.
Establish cloud security controls, automate threat detection, and build a security champion network to scale secure practices.
Clutch is a vertical SaaS company, backed by Andreessen Horowitz, that helps credit unions become FinTech lenders and improve members' financial well-being. It is a fast-paced fintech startup building a security-first engineering culture and leveraging AI to amplify innovation.
Lead the process to build security into the Dscout SaaS environment throughout the software development lifecycle.
Collaborate with Engineering to plan and implement cybersecurity controls, including securing AWS resources and improving monitoring with SIEM and logging.
Assess evolving threats, respond to incidents, and provide recommendations to mitigate risk and improve security policies.
Dscout builds a flexible and powerful UX research platform trusted by top brands to understand the humans behind their products. The company is a remote-first team of passionate, empathetic, and curious professionals recognized as a leader in experience research technology.
Serve as mentor to other Security Engineers and lead application security reviews and threat modeling.
Drive automated security testing and bug bounty program to position 6sense as an industry leader.
Collaborate with engineering teams to reproduce, triage, and address application security vulnerabilities.
6sense's mission is to multiply growth, retention, and efficiency for companies. They have a growth mindset culture with values like Win as One Team and Stay Curious, and offer numerous learning and development initiatives.
Set the technical vision for security stack across endpoint, email, data loss prevention, vulnerability management, network, application, and data security.
Define long-term cloud and identity security strategy across AWS and Microsoft Azure, including privileged access, phishing-resistant MFA, and governance of non-human identities.
Lead security architecture review, threat modeling, DevSecOps strategy, and serve as senior escalation point for complex security incidents.
Imagine Pediatrics is a tech-enabled, pediatrician-led medical group reimagining care for children with special health care needs. They deliver 24/7 virtual-first and in-home medical, behavioral, and social care, working alongside families and providers to break down barriers to quality care.
Lead security architecture across cloud, platform, and AI systems.
Drive threat modeling, vulnerability management, and incident response.
Embed automated security testing into CI/CD and infrastructure-as-code.
Axios is a respected media company delivering trustworthy, award-winning news in an audience-first format known as Smart Brevity. The company fosters an open, inclusive culture, invests in AI literacy, and supports employees with flexibility and development stipends.
Conduct security assessments using SAST, DAST, and SCA tools.
Perform code reviews and provide secure coding guidance to development teams.
Implement and maintain GitHub Advanced Security and CI/CD security integration.
Hims & Hers is a health and wellness platform providing personalized care to help people feel great. They are a public company with a talent-first flexible/remote work culture, committed to diversity, ethics, and belonging.
Architect and build multi-cloud security controls, including VPC segmentation and IAM policy design.
Build policy-as-code and IaC security guardrails integrated into CI/CD for pre-merge and pre-deploy gates.
Own vulnerability management and act as technical escalation point for incidents, leading forensics and remediation.
Coupa provides a community-generated AI and total spend management platform for businesses. The company has a global network of 10M+ buyers and suppliers and fosters a collaborative, transparent culture.
Build and improve vulnerability management tooling and workflows across applications, dependencies, containers, and infrastructure.
Integrate security checks and policy controls into CI/CD and developer workflows.
Partner with engineers to design secure-by-default patterns and translate security risks into remediation plans.
ITHAKA is a nonprofit that expands access to knowledge and education through services like JSTOR, Portico, and Ithaka S+R. It values belonging, evidence, speed, teamwork, and trust, with staff across the United States.
Lead cloud security architecture and posture management across large multi-subscription Azure and AWS environments.
Design policy-as-code guardrails and automated controls to prevent misconfigured infrastructure from reaching production.
Partner with engineering teams to integrate security into CI/CD, threat modeling, and vulnerability management.
HealthEquity empowers healthcare consumers by providing health savings accounts and related financial solutions. They are a large, mission-driven company focused on connecting health and wealth, with a culture that values belonging and innovation.
Embed security into every stage of the SDLC ensuring secure-by-design systems.
Lead secure code reviews across TypeScript/Node.js services and modern frontend stacks.
Drive threat modeling and own the vulnerability management lifecycle.
SpinQuest is a social casino platform that blends social gaming with innovative currency mechanics. Founded in 2025, we have grown into a recognized name in social gaming with a community-first approach and original content.
Design and operate secure AWS infrastructure with DevSecOps focus, including automation and compliance controls.
Develop Terraform modules and CI/CD pipelines for secure, scalable, and repeatable deployments.
Integrate security monitoring, threat detection, and incident response across hybrid environments.
CPI Card Group provides secure payment card solutions and services. With a focus on technology and security, the company operates with a size that values engineering collaboration and continuous improvement.
Plan and run offensive security testing (red/purple team, pen testing) against TypeScript apps, APIs, and AWS infrastructure, focusing on OWASP Top 10 and API Top 10 threats.
Write and ship remediation PRs in TypeScript/Node.js and React/Next.js, including fixing vulnerable dependencies and building secure-by-default libraries.
Triage Bugcrowd submissions, improve SAST/DAST/SCA tooling, and report on exploitable findings and time to remediate.
Weight Watchers is the global leader in science-backed weight management, offering an integrated support system that combines scientific expertise, medication, technology, and human connection. With over 60 years of experience and a team of about 1000+ employees, they foster a diverse and inclusive culture focused on healthy habits.
Own multiple security domains end-to-end, including application security, threat intelligence, and cloud security posture.
Lead architectural reviews and threat modeling for high-risk projects, enforcing secure-by-design standards.
Drive resolution of complex vulnerabilities and incidents, coordinating multiple engineering teams.
Wellhub revolutionizes workplace wellness by connecting employees to fitness, mindfulness, therapy, nutrition, and sleep partners. Headquartered in NYC with a global team, they value wellbeing, collaboration, and diverse perspectives.
Operate and maintain application security scanning tools including SAST, SCA, secrets scanning, and container scanning throughout the SDLC.
Review and triage security findings, validate true positives, and collaborate with engineering teams to prioritize remediation activities.
Support onboarding of new repositories, maintain documentation, and assist with scripting and automation to improve security workflows.
This company is a partner organization with a collaborative security team focused on strengthening application security across a diverse portfolio of digital products and services. It fosters an inclusive, collaborative culture with employee communities and emphasizes learning and development.
You will build a recurring product security review program, threat-modeling new features and auditing high-risk areas.
You will improve application security testing by combining static analysis, dependency scanning, and dynamic testing.
You will own vulnerability intake and remediation, triaging findings from HackerOne, scanners, and internal research.
Close builds a communication-first, AI-powered CRM that automates busywork so sales teams can focus on selling. They are a bootstrapped, profitable 130-person company with a 100% remote team, focused on helping small and scaling businesses succeed.
Implement security strategies tailored to cloud environments like AWS, GCP, and Azure.
Conduct cloud security assessments to identify vulnerabilities and risks in cloud infrastructure.
Prepare security compliance reports and execute Security Controls Test plans for ATO requests.
SkyePoint Decisions is a cybersecurity architecture and engineering, IT services provider supporting federal government clients. It is an ISO-certified small business with a collaborative culture that values flexibility and professional development.