Join the Team Building AI-Driven Agentic Workspace Security

Summary:

A blend of Site Reliability Engineering and QA. You’ll keep the Himaya platform running reliably in production while building the automated testing that lets the team ship with confidence.

What you’ll own:

• Keep Himaya healthy across AWS and Azure: monitoring, alerting, uptime, and incident response
• Build and maintain GitHub Actions CI/CD pipelines with automated quality gates on every deploy
• Write and own unit tests across the Himaya backend and detection services, covering the threat pipeline, quarantine, and policy engine
• Investigate production issues across ECS, Redis, and PostgreSQL and drive fixes to resolution
• Own environment reliability: deployment automation, rollback safety, and release-readiness checks

Required:

• 1–3 years of software, SRE, or QA engineering experience, strong new grads welcome
• Hands-on with AWS and Azure cloud services
• Experience building CI/CD workflows in GitHub Actions
• Solid unit testing skills (pytest or equivalent) and an eye for edge cases
• Comfortable reading logs and tracing issues across a multi-service stack

Nice to have:

• Exposure to security or detection systems
• Python and FastAPI
• Infrastructure-as-code (Terraform or similar)

Summary:

You’ll help power and build out Himaya’s security detections, training our models to properly understand and identify risks and security events across cloud workspaces, and building the core detection logic behind the platform.

What you’ll own:

• Build and tune security detections for cloud workspace threats: phishing, BEC, account takeover, and data exfiltration
• Help train and evaluate our detection models to accurately understand and classify risks and security events
• Develop core detection logic and scoring signals that power the Himaya threat pipeline
• Curate labeled datasets and run precision and recall benchmarks against every detection change
• Investigate false positives and feed learnings back into detection tuning

Required:

• 1–3 years of engineering, security, or data experience, strong new grads welcome
• Python proficiency and comfort working with data and ML evaluation
• Genuine interest in cloud security, threat detection, and workspace security events
• Analytical mindset for reasoning about risk signals and detection quality

Nice to have:

• Exposure to LLMs, NLP, or agentic systems
• AWS or Azure familiarity
• Neo4j or graph data experience

Summary:

An equity-heavy founding role owning our go-to-market motion for the GCC, working remotely from India. You’ll run the full sales cycle and drive our event marketing.

What you’ll own:

• Own the full sales cycle end to end: prospecting, qualification, demos, negotiation, and close
• Build and drive our GCC go-to-market motion across the region’s enterprise and security buyers
• Plan and run event marketing: conferences, meetups, and industry events that generate pipeline
• Develop outbound campaigns and messaging tailored to GCC security and compliance needs
• Partner closely with the founders on positioning, pricing, and early customer relationships

Required:

• Experience selling B2B SaaS, ideally security or enterprise software
• Track record owning a full sales cycle and hitting targets
• Strong understanding of the GCC market and its enterprise buyers
• Willing to work remotely from India on GCC-focused hours, with travel for events
• Comfortable in a high-ownership, equity-heavy founding role

Nice to have:

• An existing network across the GCC region
• Cybersecurity or compliance domain knowledge
• Event marketing experience

You will build Himaya's product end to end, from the Python services that analyze mail and data to the React interface security teams use every day. You will ship features that customers see within days, with tests and code review as part of how the team works.

• Build product features across email security, DLP and DSPM, from the API to the interface.
• Develop backend services in Python and FastAPI, with PostgreSQL, Redis and queue-based workers.
• Build integrations with the Microsoft 365 (Graph) and Google Workspace APIs.
• Build the React and TypeScript frontend: dashboards, investigation views and admin flows.
• Write tests with every change, and keep the pytest suite, type checks and production builds green.
• Respect the permission model: mail content and configuration access stay separate in every endpoint you add.

• 1 to 3 years of software engineering experience, strong new grads welcome.
• Solid Python, and working knowledge of TypeScript and React.
• Comfortable with SQL and relational data modelling, ideally PostgreSQL.
• Experience designing and consuming REST APIs.
• You write tests as part of the work, not after it.

• FastAPI or another async Python framework.
• Experience with the Microsoft Graph or Gmail APIs.
• Interest in security products, or experience building with LLMs.

You will keep Himaya's production footprint reliable and secure across two clouds, and you will build the CI/CD that the team currently lacks. Today deploys are scripted ACR builds pushed to Azure Container Apps by hand. Your first quarter is making that a pipeline with tests, image scanning, and staged rollout.

• Own the Azure production estate: Container Apps revisions and traffic splits, ACR, Azure Database for PostgreSQL, Service Bus, Key Vault, Front Door, and the Azure OpenAI deployment.
• Own the AWS estate: ECS services, RDS, ElastiCache, SQS queues with DLQs, S3, CloudFront, and the isolated EC2 detonation-sandbox VPC.
• Build CI/CD on GitHub Actions with OIDC workload identity (no long-lived secrets), running the pytest suite, tsc, and production builds as merge gates, then deploying by revision with health checks and rollback.
• Secure the microservices and codebase: scope service principals and IAM roles to least privilege, rotate and centralise secrets, harden container images, and burn down the dependency-vulnerability backlog with a repeatable process.
• Improve observability: Sentry releases and environments per service, structured JSON logging, alerting on queue depth, scan-loop failures, and revision health.

• 1 to 3 years in infrastructure, DevOps, or backend work with real production responsibility.
• Hands-on with at least one major cloud (we run Azure and AWS; you will learn the other here).
• You have written a CI/CD pipeline from scratch, GitHub Actions or Azure DevOps, and can explain OIDC federation versus stored credentials.
• Comfortable with Docker, container registries, and debugging a failed deploy from logs alone.
• You treat IAM as a security surface: least privilege, scoped roles, no shared admin credentials.

• Postgres operations (backups, connection limits, lock contention).
• Terraform or Bicep.
• Experience running queue-based workers.
• Exposure to compliance regimes (SOC 2, UAE or KSA data residency).

Himaya is an AI-native email and SaaS security platform built for organizations in the Gulf region. We protect enterprises against phishing, BEC, malware, and data loss across email, SaaS applications, and cloud data stores, combining threat intelligence, LLM-based classification, sandbox detonation, and data security posture management (DSPM) in one platform.

Team: Security, Detection & Intelligence.

We're hiring an early-career Security Research Engineer to help build the detection brain of Himaya. You'll work on intelligence and detection logic across three pillars, SaaS security, email threat analysis, and DLP, turning real-world attacker behavior into detections that ship to production. You'll also assist with our SOC 2 certification effort and ongoing audit upkeep. High ownership, direct mentorship, and your research becomes product.

• Build and tune detection logic for email threats: phishing, BEC, credential harvesting, malware, lookalike domains, and impersonation.
• Develop SaaS security detections: OAuth app risk, posture and misconfiguration drift, anomalous admin actions, risky-user signals (M365/Google).
• Improve DLP detections: sensitive-data classification, exfiltration patterns, and policy logic that balances recall with low noise.
• Curate and operationalize threat intelligence: feeds, IOC packs, domain/IP reputation, and enrichment for the detection pipeline.
• Analyze real samples and sandbox output to close detection gaps and reduce false positives.
• Assist with SOC 2 readiness: control-evidence collection, remediation tracking, and security documentation.

• 0–2 years in security, detection engineering, threat research, or a related area. Internships, CTFs, and self-taught projects count.
• Understanding of email security fundamentals (SPF/DKIM/DMARC, header analysis, phishing/BEC tradecraft).
• Some exposure to SaaS/cloud security and/or DLP concepts.
• Comfortable writing Python and working with data.
• Analytical, evidence-driven mindset; clear written communication.

• Exposure to SOC 2 / ISO 27001, YARA, malware triage, or sandboxing.
• Familiarity with LLM-based classification.
• Arabic and Gulf-region threat-landscape awareness.

Salary: $200/month (≈ ₹17,400/month). Equity: 0.5%, vesting over 4 years.

• Ground-floor security hire: your research ships to production and protects real organizations.
• Wide surface area across email, SaaS, DLP, and DSPM, with real ownership.

Himaya is an AI-native email and SaaS security platform built for organizations in the Gulf region. We turn complex security signals, from threats and data risk to SaaS posture, into a product security teams actually enjoy using. Design is central to that mission.

We're launching a Product Design Fellowship for a designer who wants real ownership, not busywork. You'll help redesign the Himaya platform UI/UX from the ground up and rebuild our marketing website, while shaping our visual and brand language. This is a part-time (~15–20 hrs/week), 6-month fellowship with a clear path: strong fellows can convert to a full-time Product Designer.

• Platform UI/UX: enhance and re-imagine the core product, including dashboards, threat and incident views, DLP, SaaS posture, and admin flows, with a focus on clarity for security teams.
• Ground-up redesign: propose and drive a cohesive design system (components, patterns, tokens) that scales across the platform.
• Website redesign: rebuild the marketing site to reflect a modern, trustworthy security brand.
• Graphics & brand: produce visual assets, illustrations, and brand elements for product and marketing.
• Collaborate directly with founders and engineering to ship designs to production and iterate fast.

• A strong portfolio showing product UI/UX work (web apps, dashboards) and visual/graphic design range.
• Fluency with Figma and design-system thinking.
• An eye for clean, information-dense interfaces: making complex data feel simple.
• Self-directed; comfortable owning ambiguous problems end-to-end.
• Interest in security, SaaS, or complex B2B products.

• Front-end familiarity (React / Tailwind) to collaborate closely with engineers.
• Motion/illustration or brand-identity experience.
• Experience redesigning a live product or shipping a design system.

• Commitment: ~15–20 hours/week, flexible schedule.
• Term: 6 months, with potential to convert to full-time.
• Equity: 0.5%, vesting over 4 years.

• Rare chance to redesign a product from the ground up: high ownership, visible impact.
• Direct access to founders and fast shipping cycles; portfolio-defining work across product, web, and brand.