Define security architecture and lead threat modeling for Flexport's products and services.
Set the bar for vulnerability management and drive remediation of systemic issues.
Mentor engineers and own security tooling consumed across global infrastructure.
Flexport makes global trade easier with innovative technology, moving over $19B in merchandise across 112 countries annually. The company is well-funded by top investors and focuses on solving supply chain challenges with a diverse, engaged workforce.
Partner with product teams to ensure security is embedded throughout the product development lifecycle.
Conduct threat modeling, architecture reviews, and source code analysis to identify and mitigate vulnerabilities.
Automate security processes and drive cross-team projects to closure.
Affirm exists to give people a clear, predictable way to pay over time with no hidden fees, building honest financial products. It is a remote-first company that values information security, transparency, and flexibility, with a strong culture of care.
Partner closely with engineering to refine architecture and drive security investment while prioritizing velocity.
Build secure 'paved roads' and tooling to eradicate entire vulnerability classes, not just fix bugs one by one.
Own cross-functional product security projects end to end, and amplify impact through automation and feedback loops.
Bugcrowd is a preemptive security platform that unifies exposure discovery and assessment, offensive testing, and AI-driven intelligence to help organizations avoid real-world risk. Founded in 2012 and based in San Francisco, Bugcrowd is a VC-backed company with a diverse, inclusive culture where people feel like family.
Manage vulnerability triage from SCA, container scanning, and external reports, collaborating with engineering on remediation.
Conduct threat modeling and security reviews with R&D teams, turning findings into prioritized actions.
Build internal security tooling, including a CVE registry and LLM-assisted code analysis workflows.
Camunda provides an enterprise platform for agentic orchestration, enabling organizations to coordinate AI agents, people, and systems across business processes. Trusted by over 700 organizations, including 9 of the top 10 US banks, Camunda is a fully remote, AI-first company named one of GP Bullhound's Top 100 Next Unicorns and a Great Place to Work.
Conduct threat modeling and risk assessments across product features, AI agents, cloud infrastructure, and data systems to identify vulnerabilities.
Partner with engineering, IT, and data teams to embed security into development processes through design reviews and secure coding guidance.
Run vulnerability management, bug bounty coordination, incident readiness, and SOC 2 compliance support to build scalable security practices.
n8n is an open workflow orchestration platform for AI-powered automation, combining code freedom with no-code speed. Since 2019, it has grown to 260+ employees across Europe and the US, backed by top investors and a 650,000-developer community.
Own application security across cloud services, APIs, data pipelines, and edge-deployed systems.
Lead threat modeling, secure design reviews, and in-depth code reviews to identify and fix vulnerabilities.
Build and integrate security tooling like SAST, DAST, SCA, and CodeQL into CI/CD and mature the secure SDLC.
Quartermaster AI leverages cutting-edge AI and robotics to make the ocean a safe and sustainably managed resource. It is a fast-moving, rapidly scaling defense-tech startup with a mission-driven culture and significant autonomy for engineers.
Collaborate with Product Engineering teams throughout the SDLC to identify vulnerabilities through threat modeling, design reviews, and secure code reviews.
Develop and implement end-to-end security solutions to mitigate risks across the product suite.
Drive improvements across Product Security tooling, automation, and the bug bounty program while experimenting with AI-based tools.
Superhuman is an AI productivity platform that integrates with over 1 million apps, offering writing, docs, inbox, and AI assistant products. Founded in 2009, it powers over 40 million people and 50,000 organizations worldwide.
You will build a recurring product security review program, threat-modeling new features and auditing high-risk areas.
You will improve application security testing by combining static analysis, dependency scanning, and dynamic testing.
You will own vulnerability intake and remediation, triaging findings from HackerOne, scanners, and internal research.
Close builds a communication-first, AI-powered CRM that automates busywork so sales teams can focus on selling. They are a bootstrapped, profitable 130-person company with a 100% remote team, focused on helping small and scaling businesses succeed.
Shape and execute application security and cloud security posture, driving secure-by-design practices and threat modeling across services and infrastructure.
Partner with product engineering to embed security throughout the SDLC and integrate developer-friendly security tooling into CI/CD pipelines.
Establish cloud security controls, automate threat detection, and build a security champion network to scale secure practices.
Clutch is a vertical SaaS company, backed by Andreessen Horowitz, that helps credit unions become FinTech lenders and improve members' financial well-being. It is a fast-paced fintech startup building a security-first engineering culture and leveraging AI to amplify innovation.
Partner with engineering and product teams to review architecture, assess security risks, and drive secure-by-default practices.
Build and maintain security tooling, automate workflows, and strengthen application security across the SDLC.
Lead cross-functional security projects, promote security awareness, and support bug bounty and vulnerability research.
They are a remote-first security company that helps organizations identify and address vulnerabilities before they become serious threats. The team is collaborative and fast-paced, valuing initiative, continuous learning, and diverse perspectives.
Own and strengthen security across the product stack, partnering with engineering throughout development.
Build security systems including secrets management, certificate infrastructure, audit logging, and vulnerability management.
Lead security reviews, threat modeling, and drive security compliance programs and incident response.
Early-stage B2B identity and access management company focused on building secure product systems. Small, collaborative team seeking its first dedicated security engineer to help grow the security function.
Serve as mentor to other Security Engineers and lead application security reviews and threat modeling.
Drive automated security testing and bug bounty program to position 6sense as an industry leader.
Collaborate with engineering teams to reproduce, triage, and address application security vulnerabilities.
6sense's mission is to multiply growth, retention, and efficiency for companies. They have a growth mindset culture with values like Win as One Team and Stay Curious, and offer numerous learning and development initiatives.
Secure Drivetrain's cloud infrastructure (AWS) including IAM, network security, and monitoring.
Embed security into the SDLC via threat modeling, secure code reviews, and automated scanning.
Lead vulnerability management, incident response, and compliance programs such as SOC 2 and ISO 27001.
Drivetrain is a financial planning & decision-making platform that helps companies scale and achieve targets predictably. Founded in 2021 by ex-Googlers, it is a remote-first, fast-growing startup backed by leading venture capital firms with a culture focused on autonomy, transparency, and customer-centricity.
Automate security controls by integrating SAST, DAST, and SCA tools into CI/CD pipelines to catch vulnerabilities before production.
Define and drive a developer-friendly Secure SDLC, including threat modeling frameworks like STRIDE and security champions network.
Manage the private bug bounty program, triage reports, lower mean time to mitigation, and conduct code reviews for Java and Python microservices.
VGS is the world's leader in payment tokenization, providing the trust infrastructure for modern commerce and agentic payments. Trusted by Fortune 500 companies and innovative fintechs, VGS stores over 9 billion tokens and processes 10 billion monthly interactions, with a remote-first culture that values curiosity, ownership, collaboration, and continuous learning.
Identify risks through security reviews, code audits, and penetration tests across applications, APIs, and integrations.
Secure our AI layer against prompt injection, excessive permissions, and unauthorized data access.
Define and update secure development practices, and support customer security calls.
Euler is an AI-native partner relationship management (PRM) platform that powers go-to-market partnerships, which drive 30-50% of company revenue. We grew 600% last year, are profitable, and have a culture of ownership and no ego.
Set product security direction across major products and platforms, leading cross-functional initiatives.
Embed security by design into roadmaps and engineering work, with high autonomy.
Drive security assurance programs and mentor engineers across the organization.
Chainguard is the trusted source for open source, delivering hardened, secure, and production-ready builds of open source software. They are a venture-backed company with Fortune 500 clients and a remote-first culture.
Architect and build multi-cloud security controls, including VPC segmentation and IAM policy design.
Build policy-as-code and IaC security guardrails integrated into CI/CD for pre-merge and pre-deploy gates.
Own vulnerability management and act as technical escalation point for incidents, leading forensics and remediation.
Coupa provides a community-generated AI and total spend management platform for businesses. The company has a global network of 10M+ buyers and suppliers and fosters a collaborative, transparent culture.
Implement and improve security controls across corporate infrastructure and AI solutions.
Develop SIEM/XDR monitoring, vulnerability management, and secure CI/CD baselines.
Validate security weaknesses and automate tasks with Python, PowerShell, and AI tools.
Toogeza is a Ukrainian recruiting company that hires talent and builds teams for tech startups worldwide. The culture values practical engineering skills, independent problem-solving, and translating governance requirements into technical implementation.
Design, build, and operate security engineering services in Go and Python on AWS and Kubernetes.
Own the event-driven NATS platform connecting security services, ensuring delivery guarantees and observability.
Build agentic security workflows and CI security gates (SAST, SCA, secret detection) that are trusted by default.
Sezzle is a fintech company that offers interest-free installment plans and aims to financially empower the next generation. It is building an innovative, dynamic team of engineers and data enthusiasts with a culture that values unique, purpose-driven individuals.
Support application security programs including threat modeling and security reviews for web and AI/LLM systems.
Triage SCA/SAST/DAST/CSPM findings and coordinate remediation with engineering teams.
Develop automation scripts and tools to integrate security solutions and streamline vulnerability management.
G-P is a leading SaaS-based Global Employment Platform that enables companies to expand into over 180 countries without establishing local entities. With a diverse, remote-first culture, G-P empowers its Dream Team with flexibility and resources to foster innovation and growth.