דרושים » אבטחת מידע וסייבר » Technical GRC Lead - Information Security Consultant

Seeking a highly motivated IT Internal Audit Manager to join our global Corporate Internal Audit team, focusing on IT Risks, Processes, Controls, and Enterprise AI Governance. The role involves conducting audits and advisory engagements, developing AI solutions for process review, and assessing risks related to AI and IT systems to support the company's rapid transformation.
Key Responsibilities
Lead technology audit and advisory engagements across various domains, including cybersecurity, infrastructure, applications, data management, IT transformation, and AI-related risks while advising on practical ways to strengthen governance, resilience, and risk management.
Drive governance and oversight of technology programs and emerging AI risks, including model governance, data governance and quality, privacy, security, and responsible AI.
Develop and implement audit methodologies to assess risks across the entire AI lifecycle, including model design, validation, explainability (XAI), bias, and the security posture of Generative and Agentic AI systems-while ensuring compliance with emerging regulations, ethical guidelines, and industry best practices.
Drive the integration of AI risk management into existing technology audit domains by providing expert advice on control design.
Promote innovation within the internal audit function by applying new tools and techniques, such as agentic AI, data analytics, and automation.
Collaborate with cross-functional teams, including Privacy, IT, Engineering, Finance and Infosec, to identify and address audit observations with timely corrective actions.
Lead research on technology risks and controls to formulate recommendations for process improvements and innovation.

We're looking for a Senior Security Engineer to own and elevate the security posture of our
cloud-native, AI-driven SaaS platform. Reporting to the Director of DevOps, you'll be the technical
anchor for security across our product, infrastructure, and organization - combining hands-on
engineering with the strategic judgment to translate risk into clear, actionable priorities.
This is a high-ownership role for someone who can operate end to end: threat modeling a new feature
in the morning, hardening cloud infrastructure in the afternoon, and briefing leadership on risk posture
by the end of the week. As we scale our platform and deepen our use of AI/ML, you'll define how we
build, ship, and operate securely - often standing up programs and controls that don't yet exist.
You'll work cross-functionally well beyond engineering, partnering with Customer Success, Marketing,
Finance, and Legal to make security a shared, business-aware practice rather than a gate at the end of
the line.

What You'll Do
Own the day-to-day security engineering function across cloud infrastructure, application, and data
layers.
Lead threat modeling, penetration testing, and vulnerability management across the product and
platform lifecycle.
Design, implement, and continuously improve cloud security controls across AWS, GCP, and/or
Azure environments.
Assess and secure our AI/ML systems, addressing the unique risks they introduce - from data
pipelines to model and LLM behavior.
Drive compliance readiness and audit support for frameworks such as SOC 2, ISO 27001, and
GDPR.
Embed security into the SDLC and CI/CD pipelines, partnering closely with DevOps and engineering
teams.
Translate technical risk into clear business and board-level language, and advise leadership on
prioritization and trade-offs.
Partner cross-functionally with non-engineering teams (Customer Success, Marketing, Finance,
Legal) to build security awareness and practical, low-friction controls.
Lead or support incident response, including detection, containment, remediation, and post-incident
review.

You will own security end to end: strategy and execution, both. You inherit a working program, with an annual SOC 2 Type II audit, an established tool stack, and clear vendor-gating rules already in place. You will work closely with our Application Architect, our IT team, Legal, and engineering leads across Israel, the US and the UK. The role reports to a member of the executive team.

This is a player-coach role. One week you present the annual risk review to management; the next you are pulling audit evidence, tuning a cloud alert rule, or reading a vendor's risk scan yourself. If you need a large team under you to be effective, this is probably not the right fit. If you like owning the whole problem, it is a good one.

What you will do:

Own the annual SOC 2 Type II audit end to end: controls, evidence collection, external auditors and consultants. The bar we hold ourselves to is zero deviations.
Run supply-chain security: vendor risk assessments and security questionnaires, gating rules for new vendors, and contract security terms together with Legal. We do not onboard vendors without SOC 2 or ISO 27001, and critical findings block the deal.
Own application security with runtime-context prioritization: focus engineering on what is actually exploitable in production, and filter out the scanner noise.
Run day-to-day security operations: cloud security posture across AWS and GCP, EDR, email security, identity and zero-trust access, alert triage and remediation follow-up with the owning teams.
Manage the annual penetration-testing program: scoping, vendor selection, findings triage and remediation tracking with R&D.
Own incident response: keep the plan current, run it when needed, and handle notification duties toward our cyber insurer.
Run the security awareness program and the security portion of employee onboarding.
Manage the security budget, tool renewals and vendor relationships.
Set governance for AI tools used across the company: usage guidelines, risk registers, and security review of new AI vendors.

We're looking for a GRC Specialist to own and drive our compliance and authorization programs, with a strong emphasis on FedRAMP and NIST 800-53. This is a hands-on governance, risk, and compliance role for someone who can build and run a federal-grade compliance program from the ground up and manage it through continuous monitoring and reauthorization cycles.

U.S. citizenship is required for this role due to FedRAMP and federal customer requirements.

Key Responsibilities

Own the FedRAMP process end-to-end: System Security Plan (SSP) development and maintenance, POA&M tracking and remediation, control implementation statements, and continuous monitoring (ConMon) deliverables
Serve as primary point of contact for 3PAO assessments, coordinating testing, evidence collection, and finding resolution
Maintain compliance programs across SOC 2 Type II and ISO 27001
Respond to customers security questionnaires, and support sales enablement with SSPs, control narratives, and other security documentation
Partner with engineering, GTM, and leadership to ensure controls are implemented, evidenced, and operating effectively
Monitor changes to FedRAMP requirements, NIST guidance, and federal compliance obligations, and translate them into actionable program updates

We are seeking an experienced Data Protection Lead to join the Cyber Security organization.

This role combines hands-on Data Leakage Prevention (DLP) engineering with Data Security Posture Management (DSPM) to deliver end-to-end data protection across corporate, cloud, and SaaS environments. You will not only define strategy and standards - you will build, configure, tune, and operate the technical controls that enforce them.

You will own the data protection lifecycle from discovery and classification through policy enforcement and incident response. The role requires deep technical proficiency in DLP platforms and DSPM tooling, combined with the ability to collaborate with Security, IT, Engineering, Product, Privacy and GRC teams to reduce data exposure risks and embed strong data governance practices.

Your responsibilities will include:
Lead and own the organizations data protection domain, including strategy, standards, and hands-on technical implementation
Engineer, deploy, and continuously tune DLP policies across endpoints, email, SaaS, network proxies, and cloud platforms - covering both inline and API-based enforcement modes.
Design and implement DSPM solutions to gain continuous visibility into sensitive data posture, data flows, misconfigurations, and exposure risks across cloud and multi-cloud environments.
Drive data discovery initiatives to identify and inventory sensitive data across databases, SaaS applications, endpoints, and cloud storage.
Define and implement data classification frameworks, labeling standards, and data handling policies integrated with DLP and DSPM controls.
Build and maintain DLP detection rules, regular expressions, fingerprinting, and machine learning-based classifiers to minimize false positives and maximize coverage.
Integrate DSPM findings into DLP enforcement workflows to create a closed-loop data protection architecture.
Define and enforce data access governance, including least-privilege principles and monitoring of sensitive data access patterns.
Monitor, triage, and investigate DLP alerts and DSPM-identified risks, collaborating with SOC and Security teams on escalation and remediation.
Conduct risk assessments and identify gaps in data protection controls across systems, pipelines, and business processes.
Support compliance and regulatory requirements (e.g., GDPR, ISO 27001, SOC 2) related to data security and privacy.
Collaborate with Engineering, IT, Product, and GRC teams to embed data security controls into CI/CD pipelines, systems, and workflows.
Maintain documentation, runbooks, and guidelines for DLP operations, DSPM posture management, and data security practices.

We are looking for an experienced and highly driven Deputy CISO to join Sunbit's Security leadership team, reporting directly to the CISO.
This is a unique opportunity to play a key leadership role in shaping and scaling the security program of a fast-growing fintech company. As Deputy CISO, you will serve as the CISO's trusted partner, helping drive the organization's security strategy while leading day-to-day execution across multiple security domains.
Yo will oversee both the Security Operations , Security Engineering and GRC organizations, managing team leads and security professionals across Israel and abroad. This role requires a strong combination of strategic thinking, technical depth, operational excellence, and people leadership.
The ideal candidate brings experience from large-scale, cloud-native environments and has successfully led security programs spanning Security Operations, Security Engineering, Compliance, Risk Management, and Security Architecture. You will work closely with Engineering, Infrastructure, IT, Product, Legal, Compliance, and executive leadership teams to continuously strengthen Sunbit's security posture while enabling business growth.
What You'll Do:
Drive execution of strategic security initiatives across the organization
Partner closely with the CISO to define and execute Sunbit's security strategy and roadmap
Translate business objectives into scalable security programs and controls
Act as a key stakeholder in security governance, risk management, and decision-making processes
Help shape the future of Security at Sunbit, including emerging domains such as AI Security and Security Automation

We are looking for a Senior Cloud Security Engineer to help build secure-by-default cloud platforms across Azure and AWS. This is an engineering-focused role centered on preventive controls, scalable guardrails, Kubernetes security, network security, and automation, not a SOC or incident-response-first position.
Primary focus areas: cloud security guardrails, Kubernetes security, cloud network controls, and automation across Azure and AWS
What You Will Do?
You will own the security architecture, guardrails, and automation patterns, while partnering with platform and infrastructure teams on implementation.
Own and evolve Cloud Security Posture Management (CSPM) capabilities, including policies, guardrails, and automated remediation.
Engineer and maintain cloud network security controls, including network segmentation and isolation, cloud-native firewalls and security groups, Application Gateway / WAF configurations, and secure ingress and egress patterns.
Define and enforce security best practices for Kubernetes environments (AKS/EKS), including RBAC, network policies, workload isolation, and cluster hardening.
Partner with engineering teams on architecture reviews for new services, platforms, and major changes, helping teams design secure, compliant, and practical solutions.
Engineer and maintain identity and access security controls for cloud and production environments, including least privilege, workload identity, service principals, and conditional access.
Apply a security lens to FinOps, defining guardrails that balance cost optimization with security and compliance.
Develop tooling, automation, and self-service workflows that reduce manal effort and improve consistency across security programs.
Communicate complex security risks and technical recommendations clearly to engineering teams, leadership, and cross-functional stakeholders.
Mentor junior engineers and contribute to raising the overall security maturity of the organization.

We are the global booking and payment platform for the trillion-dollar freight industry. Hundreds of airlines and ocean liners, thousands of freight companies, and over ten thousand importers and exporters use our platform to move goods around the world faster and more efficiently. This matters. Efficient freight ultimately makes things cost a little bit less when you buy them in the store. We are looking for a hybrid powerhouse: a Chief Information Security Officer. In this role, you will be the guardian of our trust. You will shape and drive our cybersecurity vision, ensuring our platform, products, people, and data remain secure while enabling innovation and business growth. You are the kind of leader who builds security into everything, protecting every digital doorway without slowing down the movement of global trade. From strategic risk management and governance to incident response and security engineering, you'll foster a culture where security is a business enabler, not a roadblock.
Responsibilities:
* Develop, implement, and continuously enhance our enterprise-wide cybersecurity strategy, policies, standards, and governance framework.
* Lead our information security program to protect the confidentiality, integrity, and availability of information assets.
* Identify, assess, and manage cybersecurity risks, ensuring appropriate controls are implemented to mitigate business and technology risks.
* Oversee security operations, including threat monitoring, vulnerability management, incident response, and remediation activities.
* Direct the development and execution of incident response, disaster recovery, and business continuity plans.
* Establish and maintain security architecture and best practices across cloud infrastructure, network, endpoint, application, and data environments.
* Ensure compliance with applicable laws, regulations, contractual obligations, and industry standards, and support internal and external audits.
* Develop and maintain security policies, procedures, and awareness programs that promote a strong culture of cybersecurity across the organization.
* Advise executive leadership and the Board of Directors on cybersecurity strategy, emerging threats, risk posture, and investment priorities.
* Lead and mentor the information security team, fostering professional development, accountability, and operational excellence.
* Manage cybersecurity budgets, evaluate emerging technologies, and recommend investments that improve the organization's security capabilities.
* Oversee identity and access management, data protection, encryption, and privileged access controls.
* Collaborate with SRE, IT, R&D, legal and business leaders to integrate security into organizational processes and strategic initiatives.
* Manage third-party and vendor cybersecurity risk assessments, ensuring external partners meet organizational security requirements.
* Monitor the evolving threat landscape and implement proactive measures to address emerging cybersecurity risks and improve the organization's overall security maturity.
Hybrid:
Yes

This role focuses on designing and implementing secure architectures across corporate networks and cloud environments. You will play a key role in defining secure solutions, reviewing system designs, and ensuring security is embedded across enterprise infrastructure.

The ideal candidate brings strong hands-on expertise in network and cloud security, along with the ability to work closely with IT, Infrastructure, DevOps, and Engineering teams to drive secure and scalable implementations.

Youre welcome to work in our offices in Amsterdam.

Your responsibilities will include:

Design and implement secure architectures across corporate networks, cloud platforms, and hybrid environments.
Define and maintain security standards, guidelines, and reference architectures aligned with organizational requirements.
Review and approve architecture and design of new systems, infrastructure, and network changes.
Design and support secure enterprise network architectures, including segmentation, Zero Trust, and remote access solutions.
Define and implement controls for firewalls, ZTNA, proxies, and network access control (NAC).
Design secure cloud architectures including IAM, networking, and workload protection.
Ensure proper implementation of cloud security controls such as segmentation, encryption, and monitoring.
Define and support identity and access management controls, including SSO, MFA, and privileged access.
Contribute to endpoint security architecture, including EDR/XDR and device hardening standards.
Identify security risks and architectural gaps and recommend mitigation strategies.
Participate in architecture reviews, risk assessments, and security design discussions.
Collaborate with SOC, Vulnerability Management, IT, and Engineering teams to improve overall security posture.
Support implementation of security architecture initiatives and improvements across the organization.