Hacker Newsnew | past | comments | ask | show | jobs | submit | more tracebit's commentslogin

Tracebit | https://tracebit.com | Multiple roles | London, UK | Full-Time | On-site (5 days)

Tracebit lets security teams implement ‘assume breach’ with automated cloud based honeypots or canaries.

Off the back of a successful seed fundraise from Accel, we are actively hiring for smart people who get things done in the following positions:

   - Founding Engineer | £70-100k + equity 
   - Founding Frontend Engineer| £70-100k + equity 
On-site roles (5 days a week) in Central London.

Learn more and apply: https://tracebit.com/careers


Tracebit | https://tracebit.com | Multiple roles | London, UK | Full-Time | On-site (5 days)

Tracebit lets security teams implement ‘assume breach’ with automated cloud based honeypots or canaries.

Off the back of a successful seed fundraise from Accel, we are actively hiring for smart people who get things done in the following positions:

   - Founding Engineer | £70-100k + equity 
   - Founding Frontend Engineer| £70-100k + equity 
On-site roles (5 days a week) in Central London.

Learn more and apply: https://tracebit.com/careers


Tracebit | https://tracebit.com | Multiple roles | London, UK | Full-Time | On-site (5 days)

Tracebit lets security teams implement ‘assume breach’ with automated cloud based honeypots or canaries.

Off the back of a successful seed fundraise from tier 1 VCs, we are actively hiring for smart people who get things done in the following positions:

   - Founding Engineer | £70-100k + equity | https://tracebit.com/jobs/founding-engineer
   - Founding Frontend Engineer| £70-100k + equity | https://tracebit.com/jobs/founding-frontend-engineer
On-site roles (5 days a week) in Central London.

Learn more and apply: https://tracebit.com/careers


That's definitely aligned with what we see, we work with orgs where we're the next step after Guard Duty and some who already have more in place.

Certainly for the base usage, switching GuardDuty on can be a no brainer, as we touch on in the article - it's the additional SKUs where things a get a bit less clear.


Tracebit | https://tracebit.com | Multiple roles | London, UK | Full-Time | On-site (5 days)

Tracebit lets security teams implement ‘assume breach’ with automated cloud based honeypots or canaries.

Off the back of a successful seed fundraise from tier 1 VCs, we are actively hiring for smart people who get things done in the following positions:

   - Founding Engineer | £70-100k + equity | https://tracebit.com/jobs/founding-engineer 
On-site roles (5 days a week) in Central London.

Learn more and apply: https://tracebit.com/careers


>We think 9am-6pm will bring a great cadence to work

Any reason why you think this given that studies show knowledge workers can't be productive over that long a period?


How many founding engineers do you have / plan to hire?


4 founding engineers, this would be the 5th.


Tracebit | https://tracebit.com | Multiple roles | London, UK | Full-Time | On-site (5 days)

Tracebit lets security teams implement ‘assume breach’ with automated cloud based honeypots or canaries.

Off the back of a successful seed fundraise from tier 1 VCs, we are actively hiring for smart people who get things done in the following positions:

   - Founding Engineer | £70-100k + equity | https://tracebit.com/jobs/founding-engineer 
On-site roles (5 days a week) in Central London.

Learn more and apply: https://tracebit.com/careers


Tracebit | London, UK | Full-Time | ONSITE

Founding Engineer | £70-100k + equity

Tracebit is on a mission to reduce the global mean time to detect and contain security incidents from months to minutes. The two founders are building on their experience at Tessian to vastly improve an organisation’s cloud security (and beyond). On the back of a successful seed fundraise, we are looking to hire the first 5 engineers to join our founding team.

You'll be responsible for:

  * Working across the entire tech stack (C#, .NET Core 8, Terraform, HTMX)
  * Contributing to a scalable and secure architecture
  * Working closely with the CTO and a team of exceptional engineers
You're a great fit if you:

  * Have experience shipping software at scale
  * Enjoy working in a fast-paced, early-stage startup environment
  * A love of getting things done and having fun
Bonus points for:

  * Experience in cloud security, ideally at a Product focused company and/or working with at least 1 of the public clouds (AWS, Azure, GCP, etc.)
On-site role (5 days a week) in Central London Learn more and apply: tracebit.com/careers\


Exactly - this isn't going to open the door for someone but could add a ton of value to enumeration.

As we are very canary focused, we also think it's interesting to consider the implications of the recent research from Truffle Security w.r.t canary tokens (https://trufflesecurity.com/blog/canaries).


For those interested, we put the code online here: https://github.com/tracebit-com/find-s3-account


I am not sure this would be in agreement with these policies, or at least the spirit of them: https://aws.amazon.com/security/penetration-testing/


OP's article said they consulted with Amazon's security team before publishing, so I imagine they know what's allowed in this case.


It says he consulted but does not say what was their answer. I can't imagine it was a thumbs up, probably an embarrassed silence?


Yes, for the avoidance of doubt - we got the OK from AWS to publish this research


Reminds me of the old slogan for Kix cereal.

"Kid Tested. Mother Approved."

Kids tested it but we don't know if they approved it. We don't know if mothers tested it; we only know they approved it.


Why all the doubt? "not sure" "can't imagine"

When the source says they already did their due diligence...


The initial text was ambiguous but the author has now clarified their answer in this thread. Do you really think they were happy with this? I actually think this might open other attack vectors.

I agree that the account number just by itself is not a secret, but there is a reason why all AWS demo videos mask the account number.


They can fix the bug if they don't like it.


This is my attitude towards security disclosures. In this case, Amazon approved the disclosure. But even if they hadn't, it's better for the good guys and bad guys to know about problems when the alternative is only the bad guys knowing (or the bad guys and a few good guys at the affected company).


AWS do not define account IDs as a secret (https://docs.aws.amazon.com/accounts/latest/reference/manage...) but until now it's not been possible to do this look up.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: