Remote Cybersecurity Jobs: Full-Time Security Roles at Async Companies
Security used to mean a badge reader, a server room, and a team that sat next to it. That world is mostly gone. The systems worth protecting now live in cloud accounts, code repositories, and build pipelines that nobody touches physically — which means the people protecting them don't need to be anywhere in particular either.
Remote cybersecurity jobs at async-first companies are full-time roles where you secure infrastructure, respond to incidents, find vulnerabilities before attackers do, and keep the company compliant — from wherever you work best. This post covers the role families, the pay, and how to get in. If you'd rather see what's open, security roles on our board sit inside the remote engineering listings.
What Remote Cybersecurity Work Looks Like at Async Companies
Security at an async-first company runs the way the rest of the company does: in writing. Threat models are documents with comment threads. Incident timelines are written up as they happen and published afterwards. Security reviews happen on the pull request, not in a meeting. For a lot of security people, that's an upgrade — the work is investigative and precise, and it rewards the time to think without interruption.
The companies hiring for it are mostly developer-tool and infrastructure companies whose customers trust them with code and data. GitLab runs one of the largest fully remote security organisations anywhere, with incident response, vulnerability operations, security research, and product security all hiring. Docker hires for supply-chain and offensive security; Tailscale and Supabase hire platform and infrastructure security engineers; PostHog and DuckDuckGo hire security engineers into small, high-ownership teams.
Types of Cybersecurity Jobs You Can Do Remotely
Five families cover almost every full-time security role on an async board.
Remote Security Engineer Jobs
Security engineers build the controls: hardened infrastructure, secrets management, identity and access, secure build pipelines. Titles vary — platform security, corporate security, cloud security, infrastructure security — but the core is engineering work that makes the secure path the default path. This is the largest family on our board, and most openings are senior or staff level.
Incident Response and Security Operations
Incident response teams detect, investigate, and contain attacks. At a global company, these teams are often split by region so someone is always on shift during their own daytime — an Australia-based responder, an EMEA-based responder — which is one of the rare places where async companies plan explicitly around time zones. It's a good fit if you like high-stakes problem-solving with a clear write-up at the end.
Remote Security Analyst Jobs and SOC Analyst Roles
Security analysts triage alerts, work vulnerability queues, and keep the tooling tuned. In a traditional company this is the SOC analyst role; at async companies it tends to be titled vulnerability operations or security analyst and sits closer to engineering. It's the most common mid-level entry point into the field.
Remote Penetration Tester Jobs and Offensive Security
Offensive security engineers and security researchers attack their own company's products to find the weaknesses first. Full-time penetration tester roles are less common in-house than at consultancies, but developer-tool companies hire offensive security engineers and researchers because their product is itself a target. Expect a strong portfolio requirement: published research, CVEs, or bug-bounty history.
Remote GRC Jobs and Security Compliance
Governance, risk, and compliance (GRC) roles keep the company's certifications — SOC 2, ISO 27001, FedRAMP for public-sector work — in good standing. It's the most writing-heavy corner of security and the most accessible from outside engineering. Demand is growing as more software companies sell to regulated customers.
Cybersecurity Salary: What Remote Security Roles Pay
Security pays well, and remote security roles at async companies pay at the upper end, because most of them are senior engineering positions. The table below is a US reference point; regional roles post regional bands.
| Role | Typical US pay band | What moves you up the band |
|---|---|---|
| Security / SOC analyst | $75,000–$115,000 | Detection engineering, scripting, cloud log fluency |
| GRC / security compliance | $85,000–$140,000 | Owning an audit end to end, public-sector frameworks |
| Security engineer (mid–senior) | $130,000–$200,000 | Cloud and supply-chain depth, shipping controls as code |
| Staff / principal security, research | $190,000–$280,000+ | Published research, org-wide architecture ownership |
A note on security engineer salary figures: at async companies they're usually set on the same ladder as software engineering, so a senior security engineer earns what a senior software engineer does. That's often above what traditional security teams pay for the same title. For the wider picture, see our list of high-paying remote jobs.
Remote Cybersecurity Jobs Entry Level: An Honest Note
Most security roles at async-first companies are senior. Small, distributed security teams need people who can own a problem without close supervision, and they rarely have the bandwidth to train a newcomer remotely. Truly entry-level remote security jobs exist, but they're scarce and heavily contested.
That doesn't mean there's no way in. It means the realistic route usually runs through an adjacent role first.
How to Get Into Cybersecurity (and Into a Remote Role)
- Come in from engineering or IT. Software engineers, SREs, and IT administrators move into security engineering far more often than people enter the field cold. If you're already in remote engineering, volunteer for the security work on your team.
- Start in GRC or analysis. Compliance and security analyst roles are the most accessible doors, and both lead into engineering-track roles later.
- Build public proof. A homelab write-up, a CTF record, a disclosed vulnerability, or a bug-bounty profile says more to a remote hiring manager than a list of courses.
- Write it all down. Async security teams hire people whose investigations can be read and verified later. A clean incident write-up is a genuine interview asset.
Cybersecurity Certifications That Help
Certifications matter less at async companies than at government contractors or large enterprises, but a few carry weight. Security+ is the standard entry credential. OSCP is well respected for offensive roles. Cloud security certifications from AWS, Google Cloud, or Azure help for platform roles. CISSP and CISA help for GRC and leadership tracks. Treat them as a supplement to demonstrable work, not a replacement for it.
Work From Home Cyber Security Jobs: The Trade-Offs
- On-call is real. Incident response and security operations roles carry an on-call rotation. Async culture changes how the work is documented, not whether an alert at 3 a.m. gets answered.
- Some roles are location-bound. Public-sector compliance and certain government-facing roles require citizenship or residence in a specific country.
- The bar is high. Because most openings are senior, competition for the few mid-level roles is intense. Apply with evidence, not just a CV.
To check how genuinely async a particular employer is before you apply, run it through our async policy rubric.
Frequently Asked Questions
Are there full-time remote cybersecurity jobs?
Yes. Async-first developer-tool and infrastructure companies such as GitLab, Docker, Tailscale, Supabase, PostHog, and DuckDuckGo hire security engineers, incident responders, security analysts, researchers, and compliance specialists as full-time remote staff.
How much do remote cybersecurity jobs pay?
In the US, security and SOC analysts typically earn $75,000–$115,000, GRC and compliance specialists $85,000–$140,000, mid-to-senior security engineers $130,000–$200,000, and staff or principal security engineers and researchers $190,000–$280,000 or more. Regional roles pay regional bands.
Can I get an entry-level remote cybersecurity job?
It's difficult. Most remote security roles at async companies are senior. The realistic routes are moving in from software engineering or IT, starting in GRC or a security analyst role, and building public proof such as CTF results, write-ups, or bug-bounty history.
Which cybersecurity certifications help for remote jobs?
Security+ is the standard entry credential, OSCP is respected for offensive roles, cloud security certifications help for platform roles, and CISSP or CISA help for GRC and leadership. Async companies weigh demonstrable work more heavily than certifications.
Do remote cybersecurity jobs involve on-call?
Incident response and security operations roles usually do, often in a follow-the-sun rotation split by region so responders cover their own daytime. Security engineering, research, and GRC roles typically have little or no on-call.
Guard the Stack From Anywhere
The systems that need protecting don't live in a building anymore, and neither do the best security teams. If you can find the weakness, build the control, or write the incident up so clearly that it never happens twice, async-first companies want you — wherever you are.
→ Browse remote security and engineering openings
→ See what GitLab's security teams are hiring for
Secure the systems. Skip the server room.