Security Analyst

Proton

Join Proton and build a better internet where privacy is the default At Proton, we believe that privacy is a fundamental human right and the cornerstone of democracy. Since our inception in 2014, founded by a team of scientists from CERN, we have dedicated ourselves to providing free and open-source technology to millions worldwide, ensuring access to privacy, security, and freedom online. Our journey began with Proton Mail, the largest secure email service globally, and has since expanded to include Proton VPN, Proton Calendar, Proton Drive, and Proton Pass. These tools empower individuals and organizations to take control of their personal data, break away from Big Tech’s invasive practices, and defeat censorship. Our work impacts hundreds of millions of lives, from activists on the front lines defending freedom to leaders in governments protecting sensitive information. In some cases, Proton’s services have even been instrumental in saving lives by enabling secure and private communications in high-risk situations. Proton is a profitable company that does not rely upon VC funding, supporting over 100 million user accounts with a growing team of over 500 people from over 50 different countries, from the world's top companies and universities. We value intelligence, learning potential, and ambition in our hiring process. Adaptability is key as we navigate uncharted territories and redefine how business is conducted online. Hiring at Proton is highly selective, with less than 1% of candidates hired. We believe smaller teams of exceptional talent will always prevail over larger teams with lower talent density. You will have the opportunity work with many of the world's top minds in their fields, ranging from former international math and science olympiad winners to chess champions. We have a global mindset and big ambitions but remain a start-up at heart. We value empowerment and flexibility and keep our structure flat to keep moving fast and avoid unnecessary politics. Tired of blending into the crowd? Join us and do work you can truly be proud of. Check our open-source projects here! The Team The Security Machine Learning Engineer will play a key role in transforming our Security Operations Center (SOC) from reactive to proactive by integrating advanced machine learning and data-driven approaches into our detection and response workflows. This role bridges traditional cybersecurity operations and modern ML-driven analytics, enabling our team to automatically identify emerging threats, anomalous behaviour, and new attack patterns at scale. As a secondary focus, the role could also leverage LLMs and AI engineering to automate analyst workflows and reduce operational toil. The engineer will sit directly within the security team, ensuring that the solutions built are operationally relevant, and aligned with our security priorities, while also working closely with the internal Machine Learning team (MSA) to leverage their expertise and best practices. What you will do: * ML-Driven Detection & Automation * Design, develop, and deploy machine learning models to enhance security detection, anomaly identification, and incident response. * Integrate ML outputs into the SOC workflow to enable smarter and faster triage. * Continuously evaluate and tune models to reduce false positives and improve detection precision. * Ensure model outputs are interpretable and actionable for SOC analysts. Data Engineering for Security * Build and maintain data pipelines to collect, process, and transform security-relevant data (e.g., logs, network traffic, endpoint events) into ML-ready datasets. * Collaborate with security engineering team to ensure scalable and secure data handling (eg. parsing, processing, storage). AI Engineering & LLM-Powered Automation * Explore and build LLM-powered tools to automate repetitive SOC tasks (e.g., alert triage, evidence gathering, incident summarisation, report generation). * Apply appropriate guardrails and evaluation to ensure outputs are accurate, auditable, and safe to act on in operational contexts. Research & Innovation * Stay current on advancements in security data science, adversarial ML, and automated threat detection. * Prototype and test new ML and AI techniques (e.g., unsupervised anomaly detection, graph-based threat correlation). * Contribute to improving detection content through statistical analysis and clustering. Operations & Maintenance * Deploy models into production securely and responsibly, ensuring reliability and scalability. * Implement monitoring, alerting, and retraining mechanisms for deployed ML models. * Document methodologies and performance metrics for auditability and knowledge sharing. What we are looking for: * Required * Proven experience in machine learning engineering or data science, ideally in a cybersecurity or operations context. * Proficiency in Python, with strong knowledge of ML frameworks. * Experience with data manipulation and analysis using Pandas, NumPy or similar tools. * Familiarity with security data sources (e.g., SIEM logs, EDR telemetry, network flow, authentication logs). * Solid understanding of ML lifecycle: data preparation, model training, evaluation, deployment, and monitoring. * Experience with data pipelines and storage technologies (e.g., Airflow, Kafka, Redis, Elasticsearch, Clickhouse, etc.). * Ability to work independently and collaborate effectively with both ML and security specialists. Preferred * Prior experience in threat detection, SOC operations, or security automation. * Knowledge of adversarial ML, graph analytics, or behavioral modeling in security contexts. * Experience integrating ML models into SIEM pipelines or automated detection frameworks. * Exposure to LLMs and AI engineering (e.g., prompt engineering, RAG, agent design), and awareness of LLM-specific risks like prompt injection and data leakage. Success in This Role * SOC analysts leverage ML-powered detections to identify threats faster. * Reduction in alert fatigue and false positives through adaptive and data-driven models. * Strong collaboration established between the security and MSA ML teams, sharing expertise and best practices. * Security data becomes more accessible, structured, and usable for analytical and predictive use cases. * New, intelligent detections, enrichment, and incident response automations become part of the SOC’s standard toolkit. Even if you don’t meet all the requirements listed above, but feel you could still be a great fit, please still apply. What We Offer: * Work that Matters: millions of people trust Proton with their privacy. We answer only to our users — not advertisers, not investors with conflicting agendas, not governments. The work you do here is real, and the impact is measurable. (read more about our impact here) * Technology: you'll get the right hardware and the right software you need to do your best work. * Learning & Development: we invest in your growth because sharp people make us better. Proton is one of the fastest ways to accelerate your career because you'll be thrown into real challenges, with real ownership, from day one. * Employee Benefits: your wellbeing isn't an afterthought. We offer strong health coverage, solid retirement options, generous leave, and wellness support so you can bring your best self to work every day * Stock Options: at Proton, we all have the opportunity to be owners of the company. From day one, you have a real stake in what we're building. When Proton wins, you win. * In-Person Collaboration: Amazing things happen when passionate, smart, and purposeful people get together in the same room. With offices across Geneva, Zürich, Barcelona, London and more, you'll spend most of your time collaborating face-to-face with people who genuinely care about what they're building * Food: Lunch and snacks are on us every day in our offices so you can focus on the work and not on what's for lunch. * Transport: getting to the office shouldn't cost you. We cover public transport, bike allowances, or parking, whichever works for you. * Flexible Working: you own your schedule. Set hours that work for you and your team — because outcomes matter more than when the clock says you started. Our Commitment to Diversity and Inclusion At Proton, we believe diversity drives innovation and strengthens our mission to provide privacy as a default for all. We are committed to fostering an inclusive environment where all individuals, regardless of race, ethnicity, gender, age, sexual orientation, physical ability, or socio-economic background, feel valued and empowered. We strive to create equal opportunities, promote open dialogue, and support continuous learning to ensure every voice is heard and respected. If you need any extra support or reasonable adjustments during the hiring process, please let your talent partner know. Candidate Privacy Notice When you apply for a position, refer a candidate, or are considered for a role at Proton Technologies AG (Proton, we, us, or our), your information is stored in Greenhouse, in accordance with their Service Privacy Policy. This information is used to evaluate your suitability for the posted position. We also retain this information for consideration for future roles that you may apply for or that we believe may align with your background and skills. If we no longer have a legitimate business need to process your information, we will either delete or anonymize it. Should you have any inquiries about how we use or manage your information, or if you wish to access, correct, or delete your data, please contact our privacy team at careers@proton.ch. Proton does not accept unsolicited resumes from any sources other than directly from candidates. We will not pay a fee for any placement resulting from an unsolicited offer, even if the candidate is subsequently hired by Proton. To learn more about our privacy policy, please visit our privacy policy page.   Compensation range Paris:  46.000 - 74.000 gross annually* Other locations: Compensation will be discussed during the interview process *Final compensation will be determined based on the candidate's qualifications, skills, and previous experience   #LI-ONSITE

Proton

About Proton Join Proton and build a better internet where privacy is the default Proton was founded in 2014 by scientists from CERN on a simple truth: privacy is a fundamental human right. Since then, we’ve built the world’s largest encrypted email service (Proton Mail) and expanded into Proton VPN, Proton Drive, Proton Pass, and Proton Calendar—tools used by millions globally to protect their freedom, fight censorship, and keep their data safe. In some situations, Proton has literally helped save lives! We are profitable, independent (no VC control), and selectively hire from the top ~1% of applicants. Our 700+ team members across 50+ countries come from leading organizations and elite academic backgrounds. We move fast, keep hierarchy light, and prioritize impact over optics. If you want to do meaningful work with exceptionally high-caliber people, this is it. Join us and do work you can truly be proud of. Check our open-source projects here!   Role Overview The Identity and Access Management (IAM) Engineer will play a critical role in designing, implementing, and securing Proton's core internal identity infrastructure. As we scale globally, maintaining robust access controls and seamless identity governance is paramount to safeguarding our systems and supporting our growing team across Europe and beyond. This role bridges modern system engineering, security architecture, and identity lifecycle automation. Sitting within our technical infrastructure and security ecosystem, you will take ownership of our core IAM stack, which leverages a strong foundation of self-hosted, open-source technologies (eg. Keycloak, and midPoint) alongside key enterprise solutions like Duo. You will collaborate closely with cross-functional teams to integrate identity solutions into existing architectures, automate operational workflows, and design Proton-specific access models that strike the perfect balance between strict zero-trust security and team velocity.   What you will do IAM Architecture & Implementation * Design, implement, integrate, and maintain Proton’s core IAM solutions, ensuring high availability, security, and scalability. * Manage and maintain systems and applications built on self-hosted, and open-source environments. * Collaborate closely with cross-functional engineering teams to integrate the IAM platform seamlessly into our existing infrastructure and internal tools. User Lifecycle & Governance * Develop, implement, and maintain secure automated processes for user provisioning, de-provisioning, and overall account lifecycle management to ensure seamless onboarding and offboarding. * Design and manage identity governance processes to ensure proper management of user access rights, entitlements, and strict alignment with organizational compliance standards. * Conduct regular audits, assessments, and access re-certification campaigns to proactively discover and remediate access anomalies. Authentication & Access Control * Configure, optimize, and manage access control, authentication, and authorization mechanisms. * Develop and enforce granular policies for identity and access management in alignment with organizational security goals. * Support, maintain, and contribute to specialized infrastructure projects. Automation & Systems Engineering * Leverage your scripting and automation expertise to eliminate operational toil and streamline identity workflows. * Write high-quality, maintainable code for infrastructure automation and configuration management.   Job requirements * Proven experience as an IAM Engineer with a deep focus on identity management within a production environment. * Strong, hands-on experience working with open-source IAM solutions (e.g., FreeIPA, Keycloak, midPoint). * Deep technical understanding of core identity protocols and standards, specifically LDAP, SAML, OAuth, and OIDC. * Strong proficiency in scripting languages (e.g., Python, Bash) for automation, integration, and tooling tasks. * Solid background in system engineering, particularly with managing, deploying, and maintaining complex self-hosted solutions. * Ability to adapt quickly in a fast-paced environment. * Strong communication and interpersonal skills, with a proven track record of collaborating effectively across engineering and non-engineering teams. Preferred qualifications * Advanced proficiency in implementing, configuring, and maintaining midPoint. * Hands-on experience with configuration management and infrastructure-as-code tools (such as Ansible, Puppet). * Prior experience managing identity governance frameworks, including compliance reporting and access re-certification campaigns. * Relevant industry certifications in IAM-related technologies (e.g., CIDPRO certification). Success in This Role * Proton’s identity lifecycle processes (onboarding, offboarding, and transitions) become fully automated, secure, and seamless. * Internal open-source IAM solutions are robustly engineered, highly available, and perfectly integrated across our infrastructure. * Identity governance and re-certification campaigns are managed effectively with minimal manual overhead and clear auditability. * Authentication mechanisms and access controls are optimized to enforce strict security baselines without breaking organizational agility.   What We Offer * Work that Matters: millions of people trust Proton with their privacy. We answer only to our users — not advertisers, not investors with conflicting agendas, not governments. The work you do here is real, and the impact is measurable. (read more about our impact here) * Stock Options: at Proton, we all have the opportunity to be owners of the company. From day one, you have a real stake in what we're building. When Proton wins, you win. * Technology: you'll get the right hardware and the right software you need to do your best work. * Learning & Development: we invest in your growth because sharp people make us better. Proton is one of the fastest ways to accelerate your career because you'll be thrown into real challenges, with real ownership, from day one. * Employee Benefits: your wellbeing isn't an afterthought. We offer strong health coverage, solid retirement options, generous leave, and wellness support so you can bring your best self to work every day * In-Person Collaboration: Amazing things happen when passionate, smart, and purposeful people get together in the same room. With offices across Geneva, Zürich, Barcelona, London and more, you'll spend most of your time collaborating face-to-face with people who genuinely care about what they're building * Food: Lunch and snacks are on us every day in our offices so you can focus on the work and not on what's for lunch. * Transport: getting to the office shouldn't cost you. We cover public transport, bike allowances, or parking, whichever works for you. * Flexible Working: you own your schedule. Set hours that work for you and your team — because outcomes matter more than when the clock says you started. Our Commitment to Diversity and Inclusion At Proton, we believe diversity drives innovation and strengthens our mission to provide privacy as a default for all. We are committed to fostering an inclusive environment where all individuals, regardless of race, ethnicity, gender, age, sexual orientation, physical ability, or socio-economic background, feel valued and empowered. We strive to create equal opportunities, promote open dialogue, and support continuous learning to ensure every voice is heard and respected. If you need any extra support or reasonable adjustments during the hiring process, please let your talent partner know. Candidate Privacy Notice When you apply for a position, refer a candidate, or are considered for a role at Proton Technologies AG (Proton, we, us, or our), your information is stored in Greenhouse, in accordance with their Service Privacy Policy. This information is used to evaluate your suitability for the posted position. We also retain this information for consideration for future roles that you may apply for or that we believe may align with your background and skills. If we no longer have a legitimate business need to process your information, we will either delete or anonymize it. Should you have any inquiries about how we use or manage your information, or if you wish to access, correct, or delete your data, please contact our privacy team at careers@proton.ch. Proton does not accept unsolicited resumes from any sources other than directly from candidates. We will not pay a fee for any placement resulting from an unsolicited offer, even if the candidate is subsequently hired by Proton. To learn more about our privacy policy, please visit our privacy policy page.  Compensation range Paris:  53.000 - 80.000 gross annually* Other locations: Compensation will be discussed during the interview process *Final compensation will be determined based on the candidate's qualifications, skills, and previous experience #LI-Onsite

Vestiaire Collective

Vestiaire Collective is the leading global platform for desirable pre-loved fashion and a pioneer in transforming how people consume fashion.   Our mission is simple: make circular fashion the norm, not the exception. Through technology, expertise, and a highly engaged global community, we enable millions of people to buy and sell fashion in a more sustainable way.   Founded in Paris in 2009, Vestiaire Collective is now a globally scaled marketplace with offices in Paris, London, Berlin, New York, Singapore, and Ho Chi Minh City, and logistics hubs across Europe, Asia, and the US. Today, we are a team of around 600 people from over 50 nationalities, united by a shared ambition: to drive meaningful change in the fashion industry.   Our values, Activism, Transparency, Dedication, Greatness, and Collective, shape how we build, collaborate, and grow every day. Please upload your CVs in English    About the role :  As a Senior Security Analyst at Vestiaire Collective, you will be part of our Security team. Your objective will be to provide a safe, secure, and trustworthy experience for our users, while safeguarding their privacy and personal data, as well as protecting our company assets and internal employees. Additionally, you will ensure compliance with regulatory requirements. This role is focused on security operations, risk, and assurance: you will be the person who keeps continuous watch over our security posture — monitoring and investigating alerts, driving vulnerabilities through to remediation, supporting incident response, and producing the evidence and metrics that demonstrate our security and compliance to auditors, regulators, and leadership. Reporting to the Head of Security, you will work alongside a talented team of security engineers and collaborate closely with engineering teams and other stakeholders such as legal, finance, and corporate IT. You will work daily with our security stack: Datadog (SIEM), SentinelOne (EDR), Upwind (CSPM), Cloudflare (WAF and Cloudflare One), and Grafana/Prometheus, on top of our AWS and GCP cloud environments. What you will do :  Operate and continuously improve our security monitoring: triage and investigate alerts across our detection stack (Datadog SIEM, SentinelOne EDR, Cloudflare), tune detections to reduce noise, and escalate confirmed threats. Review and prioritize cloud security posture findings (Upwind CSPM) across our AWS and GCP environments, and drive misconfigurations through to resolution with the relevant teams. Own the vulnerability management lifecycle: consolidate findings from penetration tests, application security reviews, and our bug bounty program; validate and prioritize them; and drive remediation with engineering teams against defined SLAs. Triage incoming bug bounty submissions: reproduce and assess reported issues, determine severity, and coordinate fixes with the relevant code owners. Support incident response from detection to closure: first-line investigation, coordination during incidents, documentation, and post-incident follow-up actions. Support audit and assurance activities: prepare and maintain evidence for external audits, run periodic access reviews (joiners/movers/leavers, privileged access), and keep compliance documentation up to date. Contribute to security metrics and reporting: maintain and enrich the KPIs and dashboards (Grafana) we use to report our security posture to leadership. Assess third-party vendors and tools from a security and data-protection standpoint. Handle day-to-day security requests from across the company (reported phishing, the security inbox, employee questions) and deliver security awareness initiatives to promote a security-conscious culture. Who you are : Proven experience (3+ years) in a security analyst, SOC, or security operations role, preferably in a fast-paced startup/scaleup environment. Strong analytical and problem-solving abilities, rigorous documentation habits, and the ability to communicate clearly with both technical and non-technical stakeholders. Hands-on experience with SIEM and log analysis platforms (e.g., Datadog, Splunk, Elastic) for alert triage, threat detection, and investigation; familiarity with EDR tooling (e.g., SentinelOne, CrowdStrike) is a strong plus. Working familiarity with cloud environments (AWS and/or GCP) and cloud security fundamentals - enough to understand, prioritize, and follow up on CSPM and WAF findings. Solid understanding of vulnerability management and common application threats (e.g., OWASP Top 10) - enough to validate findings, assess real-world impact, and discuss remediation credibly with engineers. Understanding of compliance frameworks and regulations (e.g., ISO 27001, PCI DSS, SOC 2, GDPR, DSA), with the ability to translate requirements into practical controls, procedures, and audit evidence. Scripting or query skills (e.g., Python, SQL), for automating routine analysis and digging into data during investigations. Ability to adapt to a rapidly changing environment and manage multiple priorities. NICE TO HAVE: Bachelor's or Master's degree in Computer Science, Information Security, or a related field. Relevant certifications (e.g., CompTIA Security+/CySA+, GIAC GCIH/GCIA, CISA, ISO 27001 Lead Auditor/Implementer) are a plus. Our Tech Stacks includes  Datadog SIEM Upwind CSPM Cloudflare (WAF, One) SentinelOne AWS, GCP Grafana, Prometheus Snowflake Tableau