Job intelligence
Staff AppSec / Product Security Engineer
Filigran
Before relying on the listing: Confirm Compensation and Application closing time with the employer or source. See verification questions
Executive opportunity brief
The decision in one screen
A compact evidence-first read of compensation, flexibility, mobility and what still needs verification. No universal quality score is used.
Fast read
Opportunity DNA
This opportunity needs a closer read before drawing a strong conclusion, especially around the pay picture is incomplete.
A financial comparison will need the approved compensation range.
The work arrangement can be assessed, although it is not among the most flexible patterns detected.
One or more material qualification requirements are stated and may narrow the realistic applicant pool.
Sponsorship and relocation support are not clear from the current listing.
Part of the application route can be assessed, but the full external process may contain additional steps.
At least one recent enabled source can still renew this vacancy.
This fingerprint summarizes what is clear, constrained or still unanswered in the current listing. It is a reading aid, not an overall job score.
Decision evidence check
3 of 5 core facts stated
This checks whether the listing states the facts that commonly change an employment decision. It measures disclosure completeness, not whether the opportunity is good or bad.
Facts already stated
- Work arrangement
- Advertised location
- Employment type
What to verify next
- Compensation: What is the approved compensation range, and what portion is guaranteed base pay rather than variable compensation?
- Application closing time: Is there a firm application deadline, a rolling review window or no stated closing date?
Advertised location is not proof of work authorization, sponsorship, or legal eligibility. Unknown information is not a negative score; verify those questions separately.
Decision levers
What could make or break the fit?
Reasons to look closer
Nothing stands out strongly enough yet to call a clear advantage. The role may still be attractive for reasons the listing does not spell out.
Trade-offs to weigh
- The pay picture is incomplete: No usable salary range is stated, so a meaningful financial comparison is not possible yet.
- The experience requirement raises the entry bar: The listing appears to require at least about 8 years of experience.
Questions worth asking before you invest more time
- Ask for the approved compensation range before comparing this opportunity financially.
- Confirm which countries employees may work from and whether payroll-country, timezone or office-attendance restrictions apply.
- Confirm whether a degree is actually required, preferred, or replaceable with equivalent experience.
- Ask whether visa sponsorship is available before investing significant time in the application.
These questions come from details the listing leaves open. An unanswered point is not treated as a disadvantage.
Opportunity neighborhood
Keep your options open
These live roles sit close enough to this opportunity to make useful comparison points. Look across several employers before deciding what pay, flexibility or access trade-offs you are willing to accept.
Security Engineer, IAM
Dropbox · USA
Why it is nearby: Same seniority band · Similar work arrangement · Same employment type
Different angle: Different country
Security Engineer
Deepgram · USA
Why it is nearby: Same seniority band · Similar work arrangement · Same employment type
Different angle: Different country
Security Engineer (Remote - Denmark)
EverAI · Denmark
Why it is nearby: Same seniority band · Similar work arrangement · Same employment type
Different angle: Different country
Staff Security Engineer (Product & Cloud)
UpGuard · Australia
Why it is nearby: Same seniority band · Similar work arrangement · Same employment type
Different angle: Different country
This neighborhood is drawn from current inventory in the same broad occupation. Similarity is based on explicit listing facts; missing details do not count against a job.
Role market context
How much current choice is visible around this kind of work?
This compares the vacancy with current High Paid Job inventory in the broad Cybersecurity roles family. It describes visible choice and disclosure, not future demand or career quality.
200 most recent current roles sampled for the disclosure measures below.
Distinct employers in the bounded current sample, not an estimate of all employers hiring in the market.
Current sampled roles stating at least four of the five Core Decision Facts.
Requires a numeric amount, explicit ISO currency and supported pay period.
Listings with explicit enough remote, hybrid or on-site evidence to classify.
Missing deadline evidence remains unknown and is not interpreted as an open-ended application window.
Currencies with explicit pay evidence in the sample: USD (60) · EUR (13) · GBP (5) · CAD (1). Raw amounts across different currencies are not compared.
This describes current visible High Paid Job inventory in the same broad occupation family. Percentages use a bounded recent sample and are not a forecast, a complete labor-market census or an employer-quality measure.
Constraint opportunity lab
What changes the size of the current opportunity pool?
Each line applies one stricter evidence-based constraint to the same bounded current role-family sample. It helps you see the trade-off in visible choice without deciding which trade-off is right for you.
Counts only affirmative or possible sponsorship evidence, or relocation explicitly offered. Unknown is not treated as no.
Uses only roles where a country is known. Roles without country evidence are excluded from this denominator.
A much stricter subset: only listings with explicit worldwide-remote evidence remain.
Shows the subset with enough stated evidence for a more informed first comparison.
Requires amount, explicit ISO currency and a supported pay period. Missing pay evidence remains unknown.
Counts roles explicitly classified as worldwide remote, region-restricted remote or remote with restrictions still unclear.
Includes roles whose seniority is genuinely unspecified rather than assuming they belong to another level.
Uses only roles with a stated employment type.
These are counterfactual filters over a bounded sample of current HPJ inventory in the same broad occupation family. They show how visible choice changes when one evidence-based constraint is applied; they do not tell you which constraint you should choose or predict hiring outcomes. The calculation uses the 200 most recent current roles from 432 visible roles in this broad family.
Salary transparency context
Is pay disclosure typical for this kind of role?
This listing does not state usable structured compensation. About 41% of the bounded current role sample does.
Compensation counts only when amount, ISO currency and supported pay period are all known.
Pay disclosure is limited in the current role sample.
This employer’s current visible listings disclose pay materially less often than the current same-role sample.
This compares salary-disclosure behavior in current visible listings. It does not compare raw salary amounts across currencies, infer undisclosed pay as zero, or rate employer quality.
Private offer & negotiation lab
Turn an offer into evidence, not guesswork
Enter an annual base offer and, if you want, your own target. HPJ compares only within one explicit currency and never chooses a target for you.
Negotiation evidence available: current same-currency market context.
Enter an annual base offer to compare it with explicit same-currency evidence. HPJ will not suggest a target for you.
Review the full package · 10 terms
Mark what is confirmed, what needs clarification and what you want to prioritize. These choices and notes stay in this browser.
The approved base-pay range is not established in the listing.
Variable compensation is mentioned; verify amount, formula, target and eligibility.
Equity or long-term incentive language is mentioned; verify grant type, vesting and valuation basis.
Retirement or pension benefits are mentioned; verify employer contribution and vesting.
Health-benefit language is mentioned; verify coverage, dependants and employee cost.
Paid-leave language is mentioned; verify the exact entitlement and carry-over rules.
A work-arrangement signal is available; verify schedule details before relying on it.
Relocation support not established
Sponsorship not established
A review cycle is mentioned; verify timing and whether compensation can change at that review.
Questions worth taking into the offer conversation
- What is the approved base-pay range for this role?
- What retirement or pension contribution does the employer provide?
- If relocation is relevant, what expenses, timing and repayment conditions are covered?
- What exact sponsorship or work-authorization conditions apply to this role?
- When is the first performance and compensation review after joining?
- What is the approved compensation range, and what portion is guaranteed base pay rather than variable compensation?
- Is there a firm application deadline, a rolling review window or no stated closing date?
Occupation intelligence
What broader career references connect to this role?
HPJ uses broad comparison families for current-market analysis. External taxonomy results are reference candidates for that broad family, not a declaration that this vacancy has been authoritatively classified into a specific occupation.
European occupation references
- cyber incident responder
- cybersecurity risk manager
- ethical hacker
- digital forensics expert
- director of compliance and information security
This service uses the ESCO classification of the European Commission.
U.S. occupation references
- Information Security Analysts 15-1212.00
- Digital Forensics Analysts 15-1299.06
- Penetration Testers 15-1299.04
- Information Security Engineers 15-1299.05
- Security Management Specialists 13-1199.07
This site incorporates information from O*NET Web Services by the U.S. Department of Labor, Employment and Training Administration (USDOL/ETA). O*NET® is a trademark of USDOL/ETA.
Career reference research
Skills worth investigating
Official occupational context, paired with exact phrases visible in this vacancy. It is not a skills test or an applicant-fit score.
ESCO · European occupation
cyber incident responder
Usually essential in this ESCO occupation
- attack vectors
- ICT security standards
- GDPR
- security engineering
- security threats
- cyber attack counter-measures
- cyber security
Context-dependent ESCO skills
- manage keys for data protection
- consult with business clients
- cloud technologies
- ICT process quality models
- troubleshoot
O*NET · U.S. occupation
Information Security Analysts
O*NET occupation skills
- Reading Comprehension
- Critical Thinking
- Active Listening
- Complex Problem Solving
- Speaking
- Writing
- Judgment and Decision Making
- Monitoring
Build my private skill preparation brief Your evidence · Practice · Interview questions
Plan how you might demonstrate or investigate occupational skills. These are broad-family reference examples, not confirmed vacancy requirements. Nothing you enter is sent to High Paid Job.
Private to this browser. Up to 20 reference skills; not a qualification assessment or hiring prediction.
Useful next question: Which of these occupational reference skills does the hiring manager actually expect for this specific role, and what evidence would demonstrate them?
These skills belong to one reference occupation selected for HPJ’s broad career family, not a verified classification of this vacancy. Text overlap only means a phrase appears in the available listing text; it does not establish an employer requirement, your proficiency, or a qualification gap. A missing mention is unknown, not a deficit.
Adjacent current roles to investigate
Embedded Software Engineer - Real-Time Systems
Quest Defense Systems & Solutions, Inc. · USA
same employment type · similar work-arrangement evidenceEmbedded Software Engineer - Multicore Platforms & Avionics Networking
Quest Defense Systems & Solutions, Inc. · USA
same employment type · similar work-arrangement evidenceEmbedded Software Engineer – Flight Management System (FMS)
Quest Defense Systems & Solutions, Inc. · USA
same employment type · similar work-arrangement evidenceAdjacent-family roles are exploration prompts from current HPJ inventory. They are not inferred qualification matches and they do not imply a promotion path.
Career move map
What sits one step away?
This listing is currently read as Leadership. Nearby roles one visible seniority step away can help you judge whether to widen the search, stretch upward or compare the responsibilities more carefully.
Broader-entry direction
Senior Security Engineer, Detection & Response
ANGI · USA
Similar work arrangement · Same employment type · Recently postedSenior Security Engineer
Akamai Technologies · Remote — Worldwide
Similar work arrangement · Same employment type · Recently postedThese are live roles one visible seniority step away in the same broad occupation family. They can reveal nearby options, but they are not a guaranteed promotion path and do not account for your personal experience.
Skill bridge
What does this role connect to?
Cybersecurity is one of the signals this listing shares with skills appearing often across current Cybersecurity roles opportunities.
Skills named in this listing
Shared with the current career sample
- Cybersecurity Seen in 49 sampled listings
- Kubernetes Seen in 25 sampled listings
- Large Language Models Seen in 26 sampled listings
- Python Seen in 58 sampled listings
Combinations also appearing together
- Large Language Models + Python appeared together in 21 sampled listings
- Cybersecurity + Python appeared together in 18 sampled listings
Additional signals in this listing: Java · Node.js · Rust
Application edge
- If these skills match your background, prepare one concrete example that shows how you used Cybersecurity, Java, and Kubernetes rather than relying on a keyword-only claim.
- The listing states about 8 years of required experience. Check that the dates and scope in your application make that experience easy to verify.
If the named skills are genuinely transferable in your own experience, the occupation map also points to adjacent current families worth researching: Software engineering roles and Data & AI roles. This is exploration context, not a qualification match.
Skill signals come from explicit text mentions. A mention is not automatically a requirement, and absence from the current top-skill list does not make a skill rare or unimportant. The current career comparison draws on 120 sampled listings; 111 contain a recognized skill signal.
Application Decision Lab
Turn the listing into a preparation plan
Separate what the listing actually states from what you still need to prepare or verify. Your selections and short notes stay in this browser and are never submitted to High Paid Job.
At least about 8 years of experience required
The available wording contains an explicit minimum/required years-of-experience signal. Preferred years are tracked separately and never promoted into the required minimum.
Cybersecurity
This skill or technology is explicitly mentioned in the available listing text. A mention is not automatically a mandatory requirement; prepare a concrete example only if it is relevant to your experience.
Java
This skill or technology is explicitly mentioned in the available listing text. A mention is not automatically a mandatory requirement; prepare a concrete example only if it is relevant to your experience.
Kubernetes
This skill or technology is explicitly mentioned in the available listing text. A mention is not automatically a mandatory requirement; prepare a concrete example only if it is relevant to your experience.
Large Language Models
This skill or technology is explicitly mentioned in the available listing text. A mention is not automatically a mandatory requirement; prepare a concrete example only if it is relevant to your experience.
Node.js
This skill or technology is explicitly mentioned in the available listing text. A mention is not automatically a mandatory requirement; prepare a concrete example only if it is relevant to your experience.
Python
This skill or technology is explicitly mentioned in the available listing text. A mention is not automatically a mandatory requirement; prepare a concrete example only if it is relevant to your experience.
Questions worth resolving before you rely on the opportunity
- Compensation: What is the approved compensation range, and what portion is guaranteed base pay rather than variable compensation?
- Application closing time: Is there a firm application deadline, a rolling review window or no stated closing date?
- Work authorization / sponsorship: If sponsorship or work authorization matters to you, what exact immigration or employer-sponsorship conditions apply to this role?
- Application process: What interview, assessment, portfolio, reference or screening stages are part of the hiring process?
Decision analysis
What the listing really tells you
The headline alone does not tell the whole story for Staff AppSec / Product Security Engineer at Filigran. The clearest decision context comes from remote flexibility can be weighed properly, the entry path is becoming clearer, and the application route gives a few useful clues.
Remote flexibility can be weighed properly
Location flexibility can be assessed here: Remote with some uncertainty or restrictions, with a Remote Freedom reading of 76/100.
The entry path is becoming clearer
At least about 8 years of experience required · 1 additional stated barrier. Unstated education or experience requirements stay open rather than being assumed.
The application route gives a few useful clues
Provider-mediated application path. The external application may contain additional steps that are not visible from the listing itself.
The listing can be traced to a current source
The opportunity currently has 1 renewable source path across 1 source classes. Multiple independent paths can strengthen continuity, but they are not a substitute for checking the application destination.
How this analysis is assembled
The brief pulls together the parts of the vacancy that can be compared reliably today. Gaps in the listing remain visible instead of being filled with assumptions.
Analysis evidence coverage
How much analysis can the current evidence support?
Comparable salary data is not available for this job yet.
Measures observable location flexibility and explicit restrictions; it does not determine whether remote work is personally desirable.
Missing compensation is not treated as negative evidence; this dimension simply remains unavailable.
The listing was posted about 2 days ago.
At least one enabled source recently observed the vacancy. The source chain is traceable, but this is not independent employer verification.
There is no universal opportunity score because pay, flexibility and access matter differently to different people. Compare Jobs lets you weight the evidence around your own priorities.
Decision checklist
What is supported, uncertain or worth checking?
This checklist separates supported strengths, visible cautions and missing evidence. It is not an overall recommendation or guarantee that the job is suitable for you.
Supported strengths
No standout strength is supported strongly enough to list here. That is not a negative rating.
Visible cautions
- The listing appears to require substantial prior experience.
- At least about 8 years of experience required
Still unknown
- There is not enough comparable salary evidence to establish this job’s current pay position.
- Visa sponsorship is not established by the available listing data.
Pay vs. barriers
Opportunity Efficiency not assessed
The current pay position is not reliable enough to weigh compensation against the stated barriers.
1 explicit required barrier is visible in the available wording.
The listing states at least about 8 years of required experience.
- Current comparable pay position is unavailable.
- Education requirement is not established.
This section weighs pay context against clearly stated barriers without collapsing unlike requirements into one universal score. Degree, experience, licensing, clearance and location limits remain separate, and missing qualification details stay unknown.
Beyond the headline
Not enough evidence for a hidden-value finding
Potential hidden value appears only when several distinct non-pay advantages are actually supported. Missing requirements or benefits are never counted as positives.
Still check: At least about 8 years of experience required · The current application path is provider-mediated rather than directly classified as an employer-authorized or official route.
Hidden Value is an experimental evidence summary, not an investment-style score or guarantee of employability. It only uses explicit current listing evidence and does not infer that an unmentioned qualification is unnecessary.
Compensation intelligence
How competitive is this pay?
Comparable salary data is not available for this job yet.
Why this analysis?
- Comparable salary data is not available for this job yet.
- Salary confidence: Not available. No disclosed salary can currently be normalized for comparison. Missing compensation is not treated as low-quality salary evidence.
- Range quality: No disclosed range.
Employer compensation communication
Pay transparency at Filigran
Limited current pay transparency
This score uses the employer’s current visible listings and combines how often pay is disclosed with how useful those ranges are. Bonus, equity and benefit mentions are shown separately and do not raise the score.
This pattern comes from the employer’s current visible vacancies. It describes hiring and pay transparency in those listings, not employee satisfaction or a permanent judgement of the employer.
Current employer intelligence
Filigran — current opportunity snapshot
Employer Evidence Profile
How often this employer’s current visible sampled vacancies state decision-critical information. These percentages describe evidence coverage, not employer quality.
Current sampled listings with advertised compensation evidence.
Current sampled listings whose work arrangement is clearer than unknown.
Current sampled listings with a supported country signal.
Current sampled listings with an explicit closing time.
Current sampled listings with a usable posting date.
Current sampled listings that explicitly indicate confirmed, possible or unavailable sponsorship evidence.
Current sampled listings with an explicit relocation signal.
Low coverage means the current visible listings state the information less often. It does not prove that the employer lacks the policy, benefit or support.
Common current occupation families: Software engineering (5) · Cybersecurity (2) · Finance Accounting (2)
Visible seniority mix: Senior / lead (5) · Leadership (6)
Current employment-type mix: Full time (11)
Most visible hiring countries in this sample: France (9) · United Kingdom (1) · Israel (1)
Other current roles from this employer
Principal Software Engineer - XTM One
France
Senior / lead · On-site / hybridSenior Platform Engineer
France
Leadership · Remote — restrictions unclearHead of Financial Controller
France
Leadership · Remote — restrictions unclearSenior Software Engineer — AI-Native Engineering (XTM Foundation)
France, Germany, Italy, Spain, UK
Leadership · Region-restricted remoteThese are other current vacancies visible from the same employer, not endorsements or evidence of future hiring plans.
There are not yet five current disclosed salaries in one currency, so an employer pay median would be too thin to be useful.
Questions worth asking this employer
- What compensation range applies to this role, and which parts of total compensation are fixed versus variable?
- If work authorization matters to you, what sponsorship policy applies to this specific role and location?
- If a move is required, is relocation assistance available for this position?
- What is the expected application and interview timeline if the listing does not state a closing date?
These questions are prompted by missing or thin evidence in the employer’s current visible vacancies. Missing evidence is not treated as a negative judgement.
This employer snapshot uses the employer’s current visible listings. Remote and sponsorship rates use only vacancies with explicit evidence, while missing information stays unknown. Salary medians are shown separately by currency and need at least five disclosed salaries. Zero confirmed sponsorship means none was explicitly found in this sample, not that sponsorship is unavailable.
This snapshot describes the employer’s current visible vacancies—things such as pay disclosure and work arrangement. It is not an employee-satisfaction or hiring-quality rating, and different currencies stay separate.
Work-location intelligence
Remote Freedom
Remote with some uncertainty or restrictions
Why this score?
- The role is remote, but the exact applicant-location restrictions are not clear.
Flexibility signals detected
- The description reinforces broad location independence.
- The description indicates scheduling flexibility that can support location independence.
Remote Freedom measures observable location flexibility only. Unknown work-location information remains unscored. Timezone wording is penalized only when it appears restrictive; general collaboration across time zones is not treated as a restriction. A score does not guarantee legal work eligibility, payroll availability or visa sponsorship.
International applicant intelligence
Visa & relocation signals
Sponsorship status is shown only when the listing provides clear enough wording. Employer history or headquarters location is not used to guess an answer.
The available listing details do not contain a clear enough sponsorship statement.
The available listing details do not contain a clear enough relocation statement.
Tradeoff check
What’s the catch?
These are visible conditions worth checking before treating the headline compensation as the whole story:
- The listing appears to require substantial prior experience.
Application-path intelligence
What can we see about the application process?
Provider-mediated application path
The current application path comes through a publisher or aggregator. The destination may still lead to an employer-authorized hiring system, but that is not clear enough to assume.
Current destination: jobicy.com · HTTPS
No additional required application step is clear in the available listing text. This does not mean the external application is one-click or friction-free.
Application effort is estimated from visible listing and source details. Optional steps are kept separate from mandatory ones, and the external form may contain additional requirements that are not visible here.
Application safety context
Application safety check
Basic application-safety context available
The current application destination has a basic transport-safety signal such as HTTPS. This does not verify the employer, vacancy, recruiter or application process.
Evidence checked: Source provenance · Application destination · Listing wording
Observable transport-safety signals
- The available application destination uses HTTPS.
Before you share money or sensitive information
- Confirm the vacancy on the employer’s official careers site when practical, especially if a recruiter contacts you outside the listed application path.
- Check that recruiter email domains and application destinations are consistent with the employer or an identifiable recruiting provider.
- Do not pay application, processing, training or equipment fees merely to be considered for a job.
- Do not send cryptocurrency, gift cards, online-banking credentials or PINs as part of an application.
- Treat unusually fast offers or interviews conducted only through informal messaging channels as reasons to verify the employer independently.
This is a limited safety screen, not employer verification and not a fraud determination. Never send money, cryptocurrency, passwords or sensitive banking credentials merely because a listing appears on a job platform.
Original listing details
The section below comes from the listing source. The decision sections above use the job’s structured pay, location, qualification, mobility and application details to give you additional context.
🌀 The Company
Founded in 2022, Filigran is a global cybersecurity company on a mission to empower defense teams to be proactive through open-source solutions that uncover threats and drive action.
Filigran stands out in the cybersecurity ecosystem through its open-source, AI-powered and threat-informed approach to Continuous Threat Exposure Management (CTEM). Our eXtended Threat Management (XTM) platform brings together threat intelligence, exposure validation and cyber risk reduction, enabling organizations to better understand their threat landscape and take action.
At the heart of Filigran is our open-source approach. Our vision is to unite defenders into a global community to make security more open, resilient and collaborative.
As Filigran continues to scale globally, we are building the organization, infrastructure and capabilities needed for our next stage of growth. How we scale matters just as much as how fast we scale: our CORE values: Cohesion, Openness, Responsibility and Equity shape how we work together, make decisions and build for the future.
🎯 The Role
We're looking for a Staff AppSec / Product Security Engineer to join our Digital Security team, and make security a built-in quality of everything we ship across the XTM platform (OpenCTI, OpenAEV, XTM One, XTM Hub). You'll work closely with the R&D team: the VP, Staff and Principal Engineers, Engineering Managers, Product Owners and the Product Manager. You'll help keep our open source and enterprise products trustworthy for the 6,000+ organizations that defend themselves with them.
This is not a solo audit role. As a Staff engineer, you advise the CISO on product security and turn their strategy into day-to-day practice in the product teams. You lead security as a cross-cutting concern, and coach engineers so they own security in their own scope. And of course, you still code: critical security fixes, PR reviews, pair programming and the shared security components that make the secure path the easy one.
💼 Your Responsibilities
-
Leverage AI tools and methodologies to boost productivity and impact
-
Contribute to building AI capabilities into internal workflows
-
Advise the CISO on product security strategy across the XTM platform, and lead its operational implementation in the product teams: turn priorities into concrete actions, and track security technical pains to resolution.
-
Lead threat modeling and security reviews in feature refinements with Product Owners: authentication and RBAC, multi-tenancy, connectors, the GraphQL API, and AI and agent features.
-
Ensure the security quality of the stack through critical PRs, fixes and code reviews, and build shared, secure-by-default components (authorization, secrets, safe outbound calls, input handling).
-
Drive secure SDLC and supply chain tooling in CI (SAST, SCA, secret and container scanning, Renovate, Snyk, SBOMs, signed releases), tuned so teams trust the results.
-
Run product vulnerability management: intake from the open source community, researchers and bug bounty, coordinated disclosure, CVEs and advisories, remediation SLAs, and the product side of security incidents.
-
Mentor engineers and grow security champions through pairing, workshops and continuous feedback. Document security architecture decisions so they stay consistent across teams.
🤝 Who You’ll Work With
-
Reports to: the CISO, as part of the Digital Security team.
-
Key collaborators: the R&D team, including Staff and Principal Engineers and Engineering Managers across the product teams, and Product Owners during refinements, Platform Engineering on infrastructure, compliance (SOC 2 Type 2, ISO 27001:2022, FedRamp) and incidents, and Customer Success on customer security questions and pentest findings.
-
Community: the OpenCTI and OpenAEV open source contributors and the security researchers who report vulnerabilities to us.
-
Mentorship: no direct reports. You'll act as the security technical reference and mentor for engineers across all teams, and grow a network of security champions.
🧬 Profile We’re Looking For
-
Strong interest in AI and its applications in cybersecurity
-
Comfortable working with and leveraging AI-powered tools (LLMs, automation, copilots, etc.) to improve workflows and productivity
-
Master degreee in computer science and or cybersecurity with 8+ years of experience in software engineering and application or product security, including at least 3 years as the security technical reference for a SaaS or enterprise product
-
Comfortable working in a remote, async-first environment
-
Strong engineering and security skills: you write production code fluently in at least two of Python, Node.js, TypeScript, Java or Rust, and you know web and API security in depth (GraphQL, OIDC/SAML, RBAC, multi-tenant isolation, SSRF, injection), CI/CD security tooling, and container and Kubernetes security
-
A track record of influence without authority: you led a cross-team security initiative, coached engineers, and got standards adopted with pragmatism and clear priorities
-
Autonomy, ownership, and team spirit
-
Bonus: AI and LLM security (prompt injection, agent permissions), open source contributions or published CVEs, bug bounty program experience, knowledge of STIX 2.1 / MITRE ATT&CK or hands-on use of OpenCTI or OpenAEV
🌱 Why Join Filigran? More than just a job.
We are a fast-growing, global and remote-first company, and we believe the best work combines purpose, impact and innovation. You’ll work alongside talented people across the world who care about what they build, how they build it, and the impact they make on the broader cybersecurity ecosystem.
⭐ Be part of something bigger
We believe we do work that matters. Our open-source approach means that work extends beyond Filigran. You’re contributing to technology and ideas that strengthen a global community of defenders and help make cybersecurity more open and collaborative.
💻 Work at the edge of what’s next
We bring together cybersecurity, open source and AI — giving you the opportunity to work with emerging technologies, experiment with new ways of working, and contribute to how they are applied in practice.
🌍 Global opportunity without borders
Be part of a fast-growing, truly international team — collaborating across Europe, North America, APJ and beyond, with the flexibility of a remote-first environment. As we grow, you’ll have opportunities to expand your scope, take ownership, learn quickly and grow with us.
🧭 A culture grounded in CORE
Cohesion, Openness, Responsibility and Equity define how we work together — with openness, ownership, collaboration and respect. These are the principles that guide how we make decisions, treat people and grow together, especially when no one’s watching.
💰 What you can expect
-
Competitive compensation + equity — everyone shares in our success
-
Remote-first flexibility — work from wherever you’re based, with flexibility built into how we operate
-
25 days PTO baseline — real time to disconnect, recharge and enjoy life outside work
-
Volunteer days — paid time to contribute to causes that matter to you
-
Set up for success — choose the equipment that works for you, with additional support for your remote work and development needs as our programs evolve
-
Two annual in-person get-togethers — one global company get-together and one team get-together, creating dedicated time to connect, collaborate and strengthen our culture beyond the screen
🌍 Equal Employment Opportunity
We enable cybersecurity through inclusion — from code to culture.
At Filigran, we are proud to be an equal opportunity employer. We believe the diversity of our people makes our products and our team stronger. We welcome talent of every background, identity and lived experience, regardless of race, color, religion, gender, gender identity or expression, sexual orientation, national origin, age, disability or veteran status.
What matters here is what you bring, not what you look like, where you’re from or how you identify.
🚀 Ready to Join Us?
Apply now and help us build the future of the cybersecurity ecosystem, together.
Listing provenance
Where did this job come from?
See where this vacancy came from and whether more than one current source can still support it. Source names help with traceability and attribution; they are not endorsements or guarantees.
At least one enabled source recently observed the vacancy. The source chain is traceable, but this is not independent employer verification.
- Continuity
- One recent renewable source
- Source-class independence
- One renewable source class
- Last source observation
- Observed in the past 3 days
This records when High Paid Job last observed the vacancy in source evidence. It confirms source presence, not that the employer edited the vacancy at that time.
- 1 enabled source recently observed this vacancy.
Source confidence is about traceability and continuity. It is separate from application safety and should not be read as an employer reputation rating.
The vacancy is supplied by an external job publisher. Source information helps show where the listing came from; it is not a guarantee about the employer or vacancy.
Listing source: Jobicy. Destination: jobicy.com. The application opens in a new tab so you can keep this report open.