Design and implement security controls, defenses, and countermeasures that protect company data, applications, and infrastructure across public cloud and internet-facing environments.
Compensation
$112,400.00 - $162,400.00 Annual
Responsibilities
Coordinate with internal teams to incorporate security requirements into cloud architecture, modernization, application onboarding, access enablement, and vendor integration efforts.
Provide security architecture review and design recommendations for public cloud platforms, internet-facing applications, APIs, workloads, and data flows to improve control consistency and reduce unmanaged exposure.
Assess cloud designs against enterprise security standards, regulatory expectations, and industry frameworks; document architecture findings, risk decisions, exception rationale, and recommended remediation options.
Advise on standardized perimeter controls, Zero Trust access patterns, private access, segmentation, secure connectivity, and identity-based access approaches for users, workloads, applications, and third parties.
Review cloud configuration, IAM, network routing, encryption, logging, monitoring, and telemetry requirements; identify gaps and coordinate practical next steps with accountable technology owners.
Requirements
Bachelor’s degree in Information Security, Computer Science, Engineering, Information Systems, or equivalent experience
Design and lead cloud identity security solutions, bridging platform, sales, and customers to deliver secure deployments and research insights.
Responsibilities
Win POCs with sales engineers, working tenant data hands‑on in SQL, Python and APIs to surface toxic combinations, over‑privileged non‑human identities and exposed AI agents, and packaging what works into query libraries and POC kits
Represent Silverfort with strategic customers, leading technical calls, workshops and roadmap sessions with identity teams, cloud architects and CISOs
Unblock deployments with customer success and engineering on the hardest deployment and data‑collection issues, and get the field ready for every new capability
Make every finding stand up: treat each one like a research claim, reproduce it, rule out false positives, then turn it into briefings and remediation plans a CISO can act on
Close the loop with product management and R&D, turning field evidence into fixes engineers can ship across exposure logic, detections and integration gaps, and prototyping them where you can
Lead the development of GCP attack capabilities for Horizon3’s NodeZero platform, driving research, design, and production of offensive security tools.
Compensation
Base salary range: $206,278 - $242,680. The exact salary will be determined based on the selected candidate’s location, qualifications, experience, and relevant skills.
Responsibilities
Lead research into GCP attack paths, identity and trust relationships, service misconfigurations, and emerging attacker techniques.
Design, implement, and validate production-quality Python attack capabilities spanning GCP IAM, service accounts, workload identities, compute, Kubernetes/GKE, storage, databases, secrets, networking, and other cloud-native services.
Chain individual weaknesses into realistic attack paths, with reliable proof of exploitability and clear, actionable customer outcomes.
Set technical direction for GCP attack coverage, identify gaps, prioritize work with Product and Engineering, and translate research and customer needs into a sequenced roadmap.
Build and maintain safe, repeatable attack logic and supporting tests; investigate failures and improve reliability, precision, and maintainability.
Requirements
Nice to have: cloud privilege escalation
Nice to have: identity attacks
Nice to have: AWS
Nice to have: Azure
Nice to have: OCI
Skills
Director, Privileged Access Management
Health Care Service Corporation · Posted Nov 6, 2026
Lead delivery and execution of Privileged Access Management services, overseeing implementation, operations, and integration of PAM platforms and tooling across the enterprise.
Locations (2)
Chicago, Illinois, United States
Richardson, Texas, United States
Compensation
Base Pay Range
$146,700.00 - $272,400.00
Exact compensation may vary based on skills, experience, and location.
Responsibilities
Lead PAM platform implementations, upgrades, or migrations
Support enterprise PAM program execution aligned to security strategy
Assist in new security tools deployment
Ensure effective operation of privileged access controls
Contribute to business cases and investment decisions related to IAM capabilities
Requirements
Bachelor's Degree
Nice to have: Bachelor's Degree in Computer Science, MIS or related field
Nice to have: Infrastructure, application, and cloud technologies requiring privileged access
Lead the security architecture for AvePoint’s identity resilience platforms, defining threat models, recovery trust criteria, and secure workflows for identity breach recovery.
Compensation
The Salary Range for this role is $180,000k - $270,000. At AvePoint, we strive to offer competitive, fair, and equitable total rewards. The listed salary range represents a good faith estimate, with final offers based on location, experience, skills, and qualifications. The listed range reflects base salary only; our total rewards include base salary, comprehensive benefits (medical, dental, vision, 401(k) with match, unlimited PTO), and depending on the role, bonuses, commissions, or equity (RSUs). We welcome compensation discussions—apply even if your expectations fall outside the range.
Responsibilities
Own the security architecture for AvePoint’s identity resilience platforms, including threat modeling, recovery trust criteria, privileged-access safeguards, secure restore guardrails, and post-recovery validation workflows across major enterprise identity providers.
Partner with platform backup and recovery architects to ensure identity restore, relationship recovery, policy recovery, and source-of-authority workflows operate safely under breach conditions, not just during normal administrative recovery.
Define the product’s Tier-0 security model, including least privilege, just-in-time elevation, credential isolation, gMSA usage, privileged access workstation expectations, break-glass handling, secure service accounts, immutable audit trails, and separation of monitoring vs. restore permissions.
Design security requirements for protecting the backup control plane: administrator roles, service app permissions, consented permissions, BYOS storage controls, network restrictions, key management, deletion approvals, retention tamper resistance, and recovery-data integrity validation.
Staff Security Engineer focused on Privileged Access and Access Automation to build Nscale’s privileged access operating model across enterprise systems, SaaS administration, infrastructure, production environments, source control, data platforms, and emergency access paths.
Locations (3)
New York, New York, United States
San Francisco, California, United States
Seattle, Washington, United States
Compensation
$175,000—$225,000 USD
Responsibilities
Build privileged access workflows across enterprise SaaS admin roles, production systems, cloud consoles, infrastructure management systems, source control, data platforms, endpoint admin, and emergency access paths
Design access patterns that support request, approval, justification, time-bound elevation, and automated revocation
Design and validate database-level security for licensed third‑party data, including authentication, authorization, auditing, and data lifecycle controls.
Responsibilities
Design and validate database-level security for licensed third‑party data
Run POCs and turn validated patterns into reusable, production‑ready designs
Assess relational database platforms, schemas, connectivity methods, interfaces, drivers, service identities, query patterns, and downstream consumption
Identify where licensed data is stored, transformed, replicated, extracted, cached, archived, or backed up
Assess current database security capabilities and identify gaps, constraints, risks, and prerequisites
Define how the product should support pre-breach recovery readiness, including known-good state documentation, critical identity object inventory, break-glass validation guidance, restore permission validation, and out-of-band communications readiness.
Requirements
Bachelor’s degree in Computer Science, Engineering, Information Systems, Cybersecurity, or a related technical field; equivalent practical experience strongly considered.
Nice to have: Experience working at or with vendors that build AD/Entra backup, recovery, ITDR, identity protection, or hybrid identity resilience products
Nice to have: Experience with Microsoft Defender for Identity, Microsoft Defender XDR, Microsoft Sentinel, Splunk, CrowdStrike, Semperis DSP, Quest, Cayosoft Guardian
Nice to have: Relevant certifications or recognition such as Microsoft Certified: Cybersecurity Architect Expert, Identity and Access Administrator, CISSP, GIAC, Microsoft MVP
Senior Attack Engineer, GCPHorizon3 · Remote, US
Principal Security Architect, Identity ResilienceAvePoint · Chicago, US
Staff Security Engineer, Privileged Access (PAM)Nscale · Remote, US+2 more
Data Security Solution EngineerVenon Solutions · Remote