Top Cyber Security Jobs

Leads AI security, systems engineering, platform modernization, and developer productivity initiatives. Responsibilities include managing AI vulnerability remediation, designing secure AI applications, modernizing Java platforms, building CI/CD and DevSecOps capabilities, enabling rapid security releases, developing automation, and establishing enterprise engineering standards. The role provides technical leadership across multiple teams while partnering with architecture, security, infrastructure, and development stakeholders.

Defines enterprise security architecture strategy, roadmaps, reference architectures, and security requirements across cloud, applications, infrastructure, identity, data, networks, operations, AI, and third parties. Performs threat modeling, risk analysis, architecture reviews, and control-gap assessments. Partners with technical and executive stakeholders to guide secure implementations, evaluate technologies, resolve trade-offs, and improve security maturity. Requires 15+ years of cybersecurity or IT experience and eligibility for a U.S. government Top Secret clearance.

Maintain the security posture of government sponsor compute and cloud environments. Manage security accreditation lifecycles and workflows under ICD-503 Rev. 4, create and maintain system security plans and related documentation, apply sponsor security policies and risk management frameworks, collaborate with Information System Security Managers, and support IC reciprocity for accreditation projects.

Provides cybersecurity engineering support for government customer systems. Responsibilities include security requirements analysis, network design reviews, security testing, RMF and NIST 800-53 control implementation, vulnerability assessment, security documentation review, and authorization and accreditation guidance. The role coordinates with development teams, evaluates hardware and software security, and supports compliance with cybersecurity standards and customer information assurance processes.

Serves as the Cybersecurity and Computer and Network Defense Subject Matter Expert, overseeing the technical and operational effectiveness of capabilities in coordination with government customer representatives and sponsor staff. Requires 11 years of relevant experience, a bachelor’s degree, and an active TS/SCI clearance with Full Scope Polygraph.

Provides cybersecurity engineering support for a government customer, including security recommendations, project security requirements, network design reviews, security testing, systems security analysis, and coordination with development teams to implement network security standards. The role requires active Top Secret clearance with SCI eligibility, a favorable CI polygraph, DoD 8570 certification, and experience with crypto, COMSEC, and GEOINT.

Provides information security engineering, integration, and solution development for a government customer. Responsibilities include malicious code detection, intrusion detection, and development and integration of information security tools. Requires a bachelor’s degree, at least three years of relevant experience, and an active TS/SCI clearance with full-scope polygraph. The position is located onsite in Herndon, Virginia, with minimal travel.

Detect, investigate and remediate security incidents across corporate IT. Perform digital forensics and hunting, design and deploy corporate security controls and alerts, secure identity providers, endpoints and networks, and operate security tooling to prevent malware, phishing and unauthorized access.

Leads the cybersecurity operations program, overseeing monitoring, incident response, vulnerability management, threat intelligence, endpoint security, identity protection, and security controls. Manages security technologies, vendors, incident playbooks, compliance support, dashboards, and on-call processes while protecting regulated healthcare and financial information. Partners with IT, compliance, legal, privacy, risk, and executive teams, and leads and develops security operations personnel.

Lead ARUP's Information Security GRC program: manage risk assessments, policy and compliance (NIST, HIPAA, SOC2, FISMA), audits, SSPs/POA&Ms/SARs, vulnerability management, governance reporting, and train/mentor GRC analysts while partnering across IT and business teams.

Leads CarGurus’ cybersecurity governance, risk, and compliance program, including cyber risk management, SOC 2 Type II, SOX ITGCs, security policies, AI governance, third-party risk, customer trust, privacy compliance, executive reporting, and GRC process automation. Partners with Engineering, Product, IT, Legal, Privacy, Internal Audit, and Security Operations to improve security controls and manage organizational cyber risk.

Leads enterprise Product Security Incident Response Team operations, overseeing product-related cyber incident detection, investigation, containment, remediation, recovery, and disclosure. Defines PSIRT strategy, governance, playbooks, tooling, threat intelligence integration, and secure CI/CD controls. Partners with Product, Engineering, Legal, and Cloud Infrastructure teams; briefs executives; manages audit documentation; and builds a multidisciplinary security response team.

Own the technical win for cybersecurity sales opportunities by leading discovery, solution architecture, demos, workshops, POCs, and proof of value. Design ransomware-recovery, immutable and air-gapped vaulting, identity-resilience, and DSPM architectures. Develop executive-ready technical narratives, collaborate with specialist account executives and partners, understand customer technology environments, and provide field feedback to product teams. The role requires strong security presales architecture expertise, infrastructure knowledge, and the ability to communicate with technical and executive stakeholders.

Design, build, and operate secure, resilient distributed systems for secrets and key management across Cloudflare's global network. Re-architect and strengthen internal PKI and machine/workload identity, support and run services (including on-call), and consult with teams to ensure secure system design and usage.

Lead SAP security and GRC strategy and operations across S/4HANA, BTP, Fiori and integrated systems. Manage role design, access controls, SoD frameworks, GRC platform operations, audit readiness (SOX), SI/vendor governance, and provide security leadership during transformations and go-lives while partnering with InfoSec, Audit, and SAP functional teams.

Lead enterprise security strategy and architecture, create repeatable secure reference architectures and developer guardrails, perform threat modeling, embed Security by Design across product lifecycles, mentor senior security staff, evaluate third-party tech, and communicate technical risks to business leaders to enable secure, scalable SaaS growth.

Build and scale Petra’s AI-powered cybersecurity detection platform, including real-time signal ingestion, behavioral analysis, and AI-driven decisioning. Architect distributed systems for rapid growth, improve production reliability and correctness, and serve as a senior technical voice on a small, autonomous engineering team. The role requires experience with scalable data-intensive systems and deploying machine-learning models in production.

Work directly with major customers to identify account-compromise pain points, improve product experiences, deploy new offerings, and rapidly build product enhancements. Serve as the customer’s primary contact and internal advocate while partnering with the founding team. Translate customer feedback into incremental and longer-term platform improvements using Node, TypeScript, React, and Python in a fast-paced, autonomous environment.

Build and advance application and product security across the engineering organization. Responsibilities include establishing secure defaults, CI guardrails, security requirements, threat modeling, risk assessments, penetration testing, vulnerability remediation, secure coding education, roadmap ownership, and hands-on code review. The role partners closely with product, engineering, DevOps, and services teams to secure applications, microservices, and AI features while enabling efficient development.

Designs and operates secure multi-cloud environments across GCP, Azure, and AWS. Responsibilities include cloud and network security architecture, SIEM alert monitoring and optimization, SaaS security, IAM, compliance assessments, incident response, firewall and access reviews, security documentation, and customer presentations. The role also supports security automation, risk remediation, and governance across frameworks including GDPR, SOC 2, ISO 27001, CMMC, and CSA STAR.

Design and implement secure-by-default cloud infrastructure across AWS: build secrets management and IAM solutions, ship production backend changes, model threats and prioritize risk-based controls, guide partners on security and privacy, and participate in incident response and mitigation.

Lead the Identity Access Management team, define IAM strategy, design security controls, oversee security reviews, mentor engineers, and collaborate with stakeholders.

Owner of Vannevar's authentication and authorization platform: build tenant-isolated auth systems, self-service user/group/permission admin UI, tooling to visualize and validate access, feature-flag and platform management interfaces, and shared authorization capabilities across products.

Lead and mature Affirm's third-party security risk program by designing controls, automating GRC workflows, evaluating third-party/cloud security, building integrations and dashboards, and advising stakeholders. Drive automation using Python and agentic coding tools, operate orchestration across systems, manage a portfolio of risk reviews, and establish metrics, processes, and reporting to scale security risk management.

Lead and grow a Security Platform engineering team to design and operate centralized identity and access services (IdP integrations, SSO, authorization frameworks). Define roadmap, partner cross-functionally, and drive adoption of secure-by-default access controls across products.