Security engineer

At Toloka AI we create data that powers leading GenAI models and innovations. We work with frontier labs, big tech, renowned AI startups, enterprises and non-profit research organizations worldwide. We use a combination of Experts + Crowd + Tech Platform to teach AI models to reason and evaluate their efficacy and safety. We have experts in more than 50 different domains - from doctors and lawyers to physicists and engineers - and boast one of the most diverse global crowds, representing over 100 countries and speaking 40+ languages.

• Own vulnerability management.
• Operate and maintain the vulnerability-management platform.
• Ensure container images are scanned and patched on a defined cadence.
• Maintain supply-chain scanning tooling and its severity-classification configuration.
• Define and enforce remediation SLAs.
• Own cloud security across multiple providers.
• AWS, GCP, and Azure hardening, logging, and service-account governance.
• Own Kubernetes and service-mesh security.
• Operate the service mesh and maintain the policy-as-code rollout so that policy is enforced automatically.
• Audit and secure infrastructure in newly added environments.
• Review build pipelines and infrastructure in newer parts of the business as they come online, and remediate findings.
• Review new integrations and internal systems, including AI agents running in production, for security risk.
• Contribute to VDI and browser-isolation initiatives as the program matures.
• Use coding agents for first-pass review of infrastructure-as-code, container configuration, and cloud policy, verifying findings against source configuration before acting on them.

• Production experience hardening cloud infrastructure
• IAM, logging, service accounts, network security, on at least one major cloud provider (multi-cloud experience is a plus).
• Kubernetes and container security
• service mesh (Cilium, Istio, or similar) and policy-as-code (Kyverno, OPA, or similar).
• Vulnerability-management experience
• SCA/SAST tooling and SLA-driven remediation practice.
• Fluency with coding agents
• experience using agentic tools for infrastructure-as-code review or investigation work, and verifying their output.
• Ability to work independently at a senior level
• defining scope and priorities without detailed direction.
• Clear written and verbal communication
• able to run design reviews and communicate risk to engineers and leadership.
• Будет плюсом: Experience securing multi-tenant or multi-identity-domain environments; supply-chain security tooling (SBOM, Socket, JFrog, or similar); secure-SDLC or AppSec experience; Terraform/IaC at scale; relevant certifications (e.g. AWS/GCP/Azure security specialties, CKS)

• Full-time independent contractor engagement through the Ontop contractor platform, either as an individual or through your own company or business entity;
• Flexible, fully remote schedule (40 hours per week);
• Work at the leading edge of AI development, alongside a dedicated and dynamic team of experts;
• Projects with customers that are AI industry leaders and well-known household names;
• Friendly community.