At Verda

We're building a full-stack AI cloud, covering everything from data centers and hardware to our own cloud platform that the world's leading AI teams use to do serious AI work.

We strive to make a positive mark on the world through the infrastructure we build and give leading teams a service they can truly depend on. Headquartered in Helsinki, we operate globally with offices in London and San Francisco.

Join Verda while it’s still being built - not once it’s finished.

Why Verda

• Cash and equity compensation along with various fringe benefits (healthcare, lunch, wellbeing, and more).
• Profitable operations with rapid, sustained growth.
• 40+ nationalities, with 6 different ones on the management team.
• A real chance to make an impact and work alongside world class engineers, researchers, and partners across the global AI ecosystem.

About the role

Vulnerability triage is often treated as queue work: read the report, check the scope, set a severity, move it on. We are building this role differently. As Security Triage Analyst you own the first layer of judgement on every report that reaches Verda – what is real, what matters, what needs more evidence, and what happens next – reproducing findings where it is safe to, assessing impact, and writing them up so engineers can act.

The environment is unusual: Verda runs multi-tenant GPU infrastructure, customer-facing cloud services, APIs, and management planes, so a report that looks routine elsewhere can matter more here because of tenant isolation, customer impact, or infrastructure access.

You will work closely with Security, Engineering, Infrastructure, external triage partners, and researchers, and you will help improve how vulnerability handling works as the volume grows.

Your responsibilities

• Review incoming reports from external researchers, bug bounty and vulnerability disclosure programmes, penetration tests, AI-assisted testing platforms, and internal security assessments
• Validate findings: check the affected asset, reproduce the issue where safe and appropriate, and confirm whether the described impact is realistic in Verda's environment
• Classify findings as valid vulnerability, duplicate, false positive, expected behaviour, accepted risk, out of scope, or needs more information, and make each decision understandable and defensible
• Assess severity and impact using CVSS (Common Vulnerability Scoring System) alongside Verda's own context: multi-tenancy, customer data, infrastructure access, and privilege boundaries
• Work with the offensive security team and security engineers to separate real bugs from expected product behaviour, standard cloud configuration, intentionally public assets, and findings outside Verda's threat model
• Communicate with researchers, external triage teams, and vendors professionally, including asking for clarification, explaining decisions, and handling appeals
• Turn valid findings into internal tickets engineering teams can act on: what is affected, how it was reproduced, the impact, the evidence, and the expected next step
• Keep the queue moving so high and critical reports surface quickly, duplicates are linked cleanly, and unclear reports always have a clear next action
• Improve how we run the programme as volume grows – report templates, researcher guidance, severity rules, duplication logic, workflows, and metrics on volume, time to triage, and time to resolution – treating duplicates and false positives as signal about where it needs work
• Handle sensitive material carefully, since reports can contain customer-impacting detail, internal infrastructure information, credentials, screenshots, logs, and exploit chains