Automate security controls by integrating SAST, DAST, and SCA tools into CI/CD pipelines to catch vulnerabilities before production.
Define and drive a developer-friendly Secure SDLC, including threat modeling frameworks like STRIDE and security champions network.
Manage the private bug bounty program, triage reports, lower mean time to mitigation, and conduct code reviews for Java and Python microservices.
VGS is the world's leader in payment tokenization, providing the trust infrastructure for modern commerce and agentic payments. Trusted by Fortune 500 companies and innovative fintechs, VGS stores over 9 billion tokens and processes 10 billion monthly interactions, with a remote-first culture that values curiosity, ownership, collaboration, and continuous learning.
Partner with product and engineering teams to embed security across application design and development.
Lead threat modeling, secure code reviews, and vulnerability analysis to protect complex systems.
Build automated security guardrails and promote secure coding practices throughout the SDLC.
Quanata is building an AI-native insurance technology platform for the State Farm family of companies. It is a remote-first organization that values veteran hiring, professional growth, and a collaborative culture across the U.S.
Work with engineering teams to run security assessments and threat models for cloud-native and SaaS products.
Review cloud application architectures, build automation for security controls, and participate in incident response.
Communicate security risks to technical and non-technical audiences and champion improvements to security processes.
Atlassian provides collaboration software solutions designed to help teams work better together. The company has a global, inclusive culture where the unique contributions of all employees create success.
Conduct hands-on application security reviews threat modeling and code audits across the entire stack (backend frontend APIs infrastructure).
Build and improve security automation for vulnerability management including SAST DAST container scanning and secrets detection.
Drive remediation of findings from bug bounty scanners and audits partnering with engineering teams to prioritize and fix.
Close builds a communication-first AI-powered CRM that helps sales teams sell more and faster. With a 120-person 100% remote team they are bootstrapped profitable and focused on eliminating manual data entry for scaling businesses.
Partner with product teams to ensure security is embedded throughout the product development lifecycle.
Conduct threat modeling, architecture reviews, and source code analysis to identify and mitigate vulnerabilities.
Automate security processes and drive cross-team projects to closure.
Affirm exists to give people a clear, predictable way to pay over time with no hidden fees, building honest financial products. It is a remote-first company that values information security, transparency, and flexibility, with a strong culture of care.
Collaborate across engineering, product, and customer teams to embed security requirements throughout the product lifecycle.
Manage security assessments, third-party risk reviews, and vulnerability disclosure processes, including CVE registration.
Support AI security governance and secure development practices, including monitoring applications and services beyond core engineering.
They are a growing technology organization that develops products with a strong focus on security and responsible AI adoption. The culture is collaborative and innovation-driven, with remote work across Canada, autonomy, and continuous improvement.
Own and run bug bounty programs and external audit engagements, triaging and validating fixes.
Secure code and software supply chain, including CI/CD defenses, dependency controls, and signing.
Build anti-scam, anti-abuse, and security tooling with static/dynamic analysis and LLM-driven agents.
Mysten Labs builds foundational blockchain infrastructure and products, including Sui and Move, to advance the internet and enable the agent economy. It is a remote-first, world-class team backed by a $300M Series B from leading venture funds.
Own application security across cloud services, APIs, data pipelines, and edge-deployed systems.
Lead threat modeling, secure design reviews, and in-depth code reviews to identify and fix vulnerabilities.
Build and integrate security tooling like SAST, DAST, SCA, and CodeQL into CI/CD and mature the secure SDLC.
Quartermaster AI leverages cutting-edge AI and robotics to make the ocean a safe and sustainably managed resource. It is a fast-moving, rapidly scaling defense-tech startup with a mission-driven culture and significant autonomy for engineers.
Shape and execute application security and cloud security posture, driving secure-by-design practices and threat modeling across services and infrastructure.
Partner with product engineering to embed security throughout the SDLC and integrate developer-friendly security tooling into CI/CD pipelines.
Establish cloud security controls, automate threat detection, and build a security champion network to scale secure practices.
Clutch is a vertical SaaS company, backed by Andreessen Horowitz, that helps credit unions become FinTech lenders and improve members' financial well-being. It is a fast-paced fintech startup building a security-first engineering culture and leveraging AI to amplify innovation.
Conduct threat modeling and risk assessments across product features, AI agents, cloud infrastructure, and data systems to identify vulnerabilities.
Partner with engineering, IT, and data teams to embed security into development processes through design reviews and secure coding guidance.
Run vulnerability management, bug bounty coordination, incident readiness, and SOC 2 compliance support to build scalable security practices.
n8n is an open workflow orchestration platform for AI-powered automation, combining code freedom with no-code speed. Since 2019, it has grown to 260+ employees across Europe and the US, backed by top investors and a 650,000-developer community.
Investigate and remediate application security vulnerabilities directly in code, implementing fixes and submitting pull requests.
Deploy, configure, and optimize SAST and SCA tools across repositories and CI/CD pipelines, reducing false positives.
Triage and prioritize security findings while collaborating with engineering teams to embed secure coding practices.
Partner company is a technology firm delivering large-scale international projects with a focus on integrating application security into the software development lifecycle. They foster a collaborative, globally distributed engineering culture with an informal environment, open-door policy, and continuous learning opportunities.
Own and scale the vulnerability management program, including triage, prioritization, and remediation.
Embed security into the SDLC by integrating automated gates, threat modeling, and design reviews.
Drive cross-team security initiatives and mentor engineers to improve overall posture.
Figure is a blockchain-native capital marketplace for the origination, funding, and trading of tokenized assets. It has over 480 partners, has originated $30 billion in loans, and is recognized as a top fintech company.
Curate and validate incoming vulnerability submissions for Bugcrowd managed bug bounty programs.
Apply strong knowledge of OWASP Top Ten and tools like Burp Suite to assess severity and validity.
Communicate directly with clients and researchers, and handle incident response for high-severity bugs.
Bugcrowd is a preemptive security platform that unifies exposure discovery, assessment, and offensive testing using AI and human insight. Founded in 2012 and backed by major investors, it has a collaborative, family-like culture with a diverse team.
Operate and maintain application security scanning tools including SAST, SCA, secrets scanning, and container scanning throughout the SDLC.
Review and triage security findings, validate true positives, and collaborate with engineering teams to prioritize remediation activities.
Support onboarding of new repositories, maintain documentation, and assist with scripting and automation to improve security workflows.
This company is a partner organization with a collaborative security team focused on strengthening application security across a diverse portfolio of digital products and services. It fosters an inclusive, collaborative culture with employee communities and emphasizes learning and development.
Own the configuration, tuning, and management of our SIEM solution to diagnose unusual threats.
Perform architecture reviews, code reviews, and penetration testing on web and mobile apps.
Build and maintain vulnerability management CI/CD pipeline and collaborate with engineering teams.
Engine is the AI-native platform for intelligent travel, serving over 38,000 customers and nearly 2 million travelers. Recognized as one of Fast Company's Best Workplaces for Innovators (2025) and Built In's Best Places to Work (2020–2026), we have a culture of exponential growth and high-caliber colleagues.
Shape application security practices by integrating automated safeguards throughout the software development lifecycle.
Collaborate with Security and Engineering teams to identify vulnerabilities early and manage bug bounty programs.
Conduct threat modeling and secure code reviews for Java and Python microservices while fostering developer security ownership.
This partner company protects payment infrastructure and enables secure, scalable digital commerce. It operates as a remote-first, security-focused fintech organization with a fast-moving culture and globally distributed teams.
Set product security direction across major products and platforms, leading cross-functional initiatives.
Embed security by design into roadmaps and engineering work, with high autonomy.
Drive security assurance programs and mentor engineers across the organization.
Chainguard is the trusted source for open source, delivering hardened, secure, and production-ready builds of open source software. They are a venture-backed company with Fortune 500 clients and a remote-first culture.
Own vulnerability management across code, dependencies, images, and cloud config, automating triage and remediation.
Build and expand security gates in CI/CD pipelines, define secure cloud baselines, and drive least privilege identity.
Partner with DevOps on paved roads for secure-by-default development and lead incident response.
Aegis AI is a startup founded by ex-Google engineers who built Safe Browsing and reCAPTCHA, focused on stopping adversarial AI attacks. The team is flat, flexible, and fast, with engineers owning decisions and clear KPIs.
Take end-to-end ownership of security across a platform serving 50 million users, spanning application security, GRC, and AI security.
Collaborate closely with engineering leadership and development teams to identify vulnerabilities, strengthen controls, and drive remediation.
Protect AI-powered systems against evolving threats like prompt injection, jailbreaks, and third-party provider vulnerabilities.
They are a rapidly growing AI-powered technology platform serving over 50 million users worldwide. As a scale-up with more than 50 employees, they foster a high-autonomy, execution-focused culture with direct access to leadership.
Design and ship code security analyzers blending deterministic detection with AI-driven analysis for vulnerabilities in code and dependencies.
Own initiatives end-to-end as the directly responsible individual, from design to delivery, while mentoring intermediate engineers through review.
Extend dependency parsing, SBOM handling, and automated remediation across GitLab's security analysis platform.
GitLab is the intelligent orchestration platform for DevSecOps, enabling organizations to improve developer productivity and accelerate digital transformation. Trusted by over 50 million users and more than half of the Fortune 100, it fosters a high-performance culture driven by values, AI adoption, and continuous knowledge exchange.