remote-first · 16 open roles

Do the best work of your career.

Small pod. You own what you ship. The clients would rather fix the cause than patch the symptom. We pay for certifications and conference time, and most of the team works remotely from wherever suits them.

the whole team

How a pod is built

You'd join a small pod on each engagement. Here's who's in one and which part of the work each of them owns. Click any role to read it in full.

  1. 01 Scope

    Agree the outcome, the systems in scope and the date.

  2. 02 Map

    Turn how the business works into requirements and an access model.

  3. 03 Build

    Configure, code and integrate, with rehearsals on a copy of production.

  4. 04 Prove

    Test it the way users and auditors will, before anyone signs off.

  5. 05 Hand over

    Runbooks, pairing and a cut-over your team can run without us.

Security & Identity3

Identity governance, privileged access and the controls auditors test.

Engineering4

Applications, integrations, cloud foundations and the pipelines under them.

Data & AI3

Pipelines, warehouses, models and the agents built on top.

Enterprise Platforms1

Salesforce, ServiceNow and the other systems the business runs on.

Delivery3

Requirements, plans, testing and the cut-over weekend.

Growth2

Finding the engineers and looking after the clients they work for.

open roles

16 roles across the team

Filter by team or search by platform. Open a role for the day-to-day, the first 90 days and how we interview for it.

Senior Cybersecurity ConsultantSecurity & IdentitySenior Remote / New YorkFull-timeLead cybersecurity implementations for enterprise clients, mostly IAM and PAM work. $150–190k + equity

Own identity-security engagements for Fortune 500 clients, end to end. You'll lead a pod of 2–4 engineers from the posture assessment through SailPoint/CyberArk implementation to compliance sign-off.

what you'll do
  • Lead IAM/PAM implementations (SailPoint, CyberArk, Okta) from design to production
  • Run security posture assessments and build ranked, costed remediation roadmaps
  • Own client relationships at the architect and CISO level
  • Mentor consultants and raise the practice’s delivery bar
what you bring
  • 7+ years in cybersecurity consulting or enterprise security engineering
  • Hands-on depth in at least two: SailPoint, CyberArk, Okta, Entra ID
  • CISSP, CISM or equivalent certification
  • Comfort presenting to executives and auditors
nice to have
  • Experience with Saviynt or BeyondTrust
  • Background in a regulated industry such as banking or healthcare
your first 90 days
  1. day 30Shadow a live IAM assessment
  2. day 60Lead a workstream on an active engagement
  3. day 90Run your own client pod
you'll work inSailPointCyberArkOktaEntra IDSplunk
the practical session for this role

Talk us through how you'd sequence a SailPoint and CyberArk rollout for a client with a failed audit finding, using a sample findings report we share.

takes about five minutes
Cloud Solutions ArchitectEngineeringSenior Remote / San FranciscoFull-timeDesign and implement scalable cloud architectures for digital transformation projects. $160–200k + equity

You'll design multi-cloud landing zones and migration paths for enterprises leaving their data centers, and stay accountable through go-live, not just for the diagram.

what you'll do
  • Design AWS/Azure landing zones, network topologies and IaC standards
  • Lead migration waves with zero-downtime cutover plans
  • Set FinOps guardrails and right-sizing practices
  • Pair with client platform teams to transfer ownership
what you bring
  • 5+ years architecting on AWS or Azure at enterprise scale
  • Terraform fluency; Kubernetes in production
  • Migration experience (rehost through refactor)
  • AWS SA Professional or Azure Solutions Architect Expert
nice to have
  • Experience with OpenShift or GCP
  • FinOps reporting for a finance audience
your first 90 days
  1. day 30Review a client's current landing zone
  2. day 60Own the design for one migration wave
  3. day 90Lead a cutover weekend
you'll work inAWSAzureTerraformKubernetesGitHub Actions
the practical session for this role

Sketch a landing zone and first migration wave for a sample estate we share, then walk us through the Terraform layout you'd use.

takes about five minutes
AI/ML EngineerData & AIMid–Senior Remote / LondonFull-timeDevelop and ship machine learning models used in enterprise automation and analytics. £110–140k + equity

You'll take models out of the notebook and into monitored production. Expect recommendation systems, forecasting and LLM/RAG applications. Evaluation and cost discipline are part of the job from the start.

what you'll do
  • Build and productionize ML models and LLM/RAG applications
  • Stand up MLOps pipelines: training, evaluation, drift monitoring
  • Design evaluation harnesses before scaling any GenAI feature
  • Advise clients on model selection and token economics
what you bring
  • 4+ years shipping ML to production
  • Strong Python; PyTorch or TensorFlow
  • Experience with at least one: SageMaker, Vertex AI, Azure ML, Databricks
  • You can explain a confusion matrix to a CFO
nice to have
  • Experience with Bedrock or Vertex AI
  • Some time spent on retrieval quality and eval datasets
your first 90 days
  1. day 30Add evals to an existing RAG service
  2. day 60Ship a model change behind monitoring
  3. day 90Own one client's ML pipeline
you'll work inPyTorchDatabricksMLflowOpenAI APILangChain
the practical session for this role

Using a small dataset and a working RAG prototype we share, show us how you'd measure its answer quality and what you'd fix first.

takes about five minutes
Data Analytics SpecialistData & AIMid–Senior Remote / SydneyFull-timeTransform raw data into actionable insights using advanced analytics and visualization tools. A$140–170k + equity

You'll build the pipelines and dashboards that replace week-old reports with live answers: warehouse modeling, ELT and self-service BI that clients actually adopt.

what you'll do
  • Model warehouses and build ELT pipelines (Snowflake, dbt)
  • Ship executive dashboards and self-service BI in Power BI/Tableau
  • Implement data-quality gates and lineage
  • Train client analysts to own the platform
what you bring
  • 4+ years in analytics engineering or BI development
  • Expert SQL; dbt and one major warehouse
  • Power BI or Tableau at portfolio depth
  • Stakeholder instincts: you ask why before what
nice to have
  • Microsoft Fabric experience
  • Some Python for data quality checks
your first 90 days
  1. day 30Fix a slow dbt model on a live project
  2. day 60Ship a dashboard to a client team
  3. day 90Run a handover session for client analysts
you'll work inSnowflakedbtPower BITableauFivetran
the practical session for this role

Model a messy sales extract we share in dbt and explain how you'd turn it into a dashboard a finance lead would trust.

takes about five minutes
IAM EngineerSecurity & IdentityMid–Senior Remote or hybrid · Frisco, Warsaw, Hyderabad, Pune or SydneyFull-timeBuild and run identity governance for enterprise clients on SailPoint, Saviynt, Entra ID and Okta. Range shared on the first call

Most of your week goes into joiner, mover and leaver flows: connecting HR sources, writing provisioning rules and cleaning up roles that grew without an owner. You'll also run access certification campaigns and sit with client app owners when an account won't reconcile.

what you'll do
  • Onboard applications and HR sources into SailPoint or Saviynt
  • Build provisioning rules, workflows and role models
  • Configure SSO and conditional access in Entra ID and Okta
  • Support access reviews and fix reconciliation issues with app owners
what you bring
  • 3+ years working on an IAM platform in production
  • Hands-on with SailPoint IdentityIQ/IdentityNow or Saviynt
  • Working knowledge of SAML, OIDC, SCIM and LDAP
  • Some scripting in Java, BeanShell, PowerShell or Python
nice to have
  • SailPoint or Saviynt certification
  • Experience with Okta Workflows or Entra ID Governance
your first 90 days
  1. day 30Pair on a live SailPoint onboarding
  2. day 60Own two application connectors
  3. day 90Run a certification campaign end to end
you'll work inSailPointSaviyntMicrosoft Entra IDOkta
the practical session for this role

We share a sample HR feed with duplicate IDs and a few hundred workers missing a manager. You talk us through getting it into IdentityIQ, starting with what you'd ask HR before you write a single rule.

takes about five minutes
PAM EngineerSecurity & IdentityMid–Senior Remote or hybrid · Frisco, Warsaw, Hyderabad, Pune or SydneyFull-timeDeploy and harden privileged access on CyberArk, BeyondTrust and Delinea for enterprise clients. Range shared on the first call

You'll find the admin accounts nobody remembers creating, vault them and rotate their passwords without breaking the jobs that depend on them. A lot of the work is patient discovery with server and database teams before any onboarding starts.

what you'll do
  • Install and configure CyberArk, BeyondTrust or Delinea components
  • Discover and onboard privileged and service accounts
  • Set up session recording and just-in-time access
  • Write runbooks so client teams can operate the platform
what you bring
  • 3+ years on a PAM platform in an enterprise setting
  • Solid Windows and Linux administration
  • Understanding of Active Directory and service account dependencies
  • Comfort working through change control with infrastructure teams
nice to have
  • CyberArk Defender or Sentry certification
  • Experience with secrets for apps through Conjur or Vault
your first 90 days
  1. day 30Shadow a CyberArk health check
  2. day 60Lead a batch of account onboarding
  3. day 90Own rotation for one client platform
you'll work inCyberArkBeyondTrustDelineaActive DirectoryPowerShell
the practical session for this role

We share a list of service accounts from a sample estate, some used by overnight batch jobs. You pick which ones go into CyberArk first and talk us through rotating them without the batch failing.

takes about five minutes
Software EngineerEngineeringMid–Senior Remote or hybrid · Frisco, Warsaw, Hyderabad, Pune or SydneyFull-timeBuild full-stack applications and integrations for enterprise clients in TypeScript, Java or .NET. Range shared on the first call

Expect to split your time between building web apps with their APIs and integration work, which usually means getting a new system to talk to an old ERP or HR platform with its own ideas about data. You write the tests, review pull requests and stay on the code after release.

what you'll do
  • Build front ends in TypeScript and React
  • Design and build REST APIs in Java or .NET
  • Write integrations between client systems and third-party platforms
  • Write tests and review code with the rest of the team
what you bring
  • 3+ years building production web applications
  • Strong TypeScript plus Java or C#
  • Experience designing APIs and working with SQL databases
  • Comfort with Git, CI pipelines and code review
nice to have
  • Experience with MuleSoft or another integration platform
  • Some cloud deployment work on AWS or Azure
your first 90 days
  1. day 30Ship a small fix on a client codebase
  2. day 60Own a feature from ticket to release
  3. day 90Lead the build of one integration
you'll work inTypeScriptReactJavaC# / .NETPostgreSQLMuleSoft
the practical session for this role

We'll share a small TypeScript front end and Java API. You add an endpoint and wire it into the UI, then we talk through what you'd change with more time.

takes about five minutes
Platform / DevOps EngineerEngineeringMid–Senior Remote or hybrid · Frisco, Warsaw, Hyderabad, Pune or SydneyFull-timeBuild the infrastructure, pipelines and secrets setup that client teams deploy on every day. Range shared on the first call

You'll write Terraform modules, look after Kubernetes clusters and build the CI/CD pipelines client developers deploy through. A fair amount of time goes on Vault policies, and on making a failed deploy obvious enough that the developer can fix it without paging you.

what you'll do
  • Write and maintain Terraform modules for client environments
  • Run and upgrade Kubernetes clusters
  • Build CI/CD pipelines in GitHub Actions or GitLab
  • Manage secrets and access policies in HashiCorp Vault
what you bring
  • 3+ years in platform, DevOps or SRE roles
  • Terraform and Kubernetes in production
  • Experience building CI/CD pipelines
  • Linux and networking basics you can debug with
nice to have
  • Experience with OpenShift
  • HashiCorp Terraform or CKA certification
your first 90 days
  1. day 30Fix a flaky pipeline on a live project
  2. day 60Own a Terraform module set
  3. day 90Lead a cluster upgrade
you'll work inTerraformKubernetesHashiCorp VaultGitHub ActionsOpenShift
the practical session for this role

We share a Terraform module and pipeline config with a few problems planted in them. You find them, fix the worst one with us on the call, and say what you'd leave for later.

takes about five minutes
Data EngineerData & AIMid–Senior Remote or hybrid · Frisco, Warsaw, Hyderabad, Pune or SydneyFull-timeBuild and run data pipelines on Snowflake and Databricks with dbt and Airflow. Range shared on the first call

You'll move data from client source systems into Snowflake or Databricks and keep those loads running on schedule. Day to day that means writing dbt models, building Airflow DAGs and chasing down why last night's numbers don't match the source.

what you'll do
  • Build ingestion and transformation pipelines
  • Write and test dbt models
  • Schedule and monitor jobs in Airflow
  • Add data quality checks and document lineage
what you bring
  • 3+ years in data engineering
  • Strong SQL and Python
  • Hands-on with Snowflake or Databricks
  • Experience with dbt and an orchestrator such as Airflow
nice to have
  • Spark tuning experience
  • Some exposure to Informatica or Microsoft Fabric
your first 90 days
  1. day 30Fix a failing load on a live project
  2. day 60Own a set of dbt models
  3. day 90Build a new source pipeline end to end
you'll work inSnowflakeDatabricksdbtAirflowPython
the practical session for this role

We give you a messy CSV extract and a Snowflake trial account. You load it and build a dbt model with tests, then we talk about which bad rows you'd fix yourself and which you'd send back to the source team.

takes about five minutes
Salesforce / ServiceNow DeveloperEnterprise PlatformsMid–Senior Remote or hybrid · Frisco, Warsaw, Hyderabad, Pune or SydneyFull-timeBuild and extend Salesforce or ServiceNow for enterprise clients, from config to custom code. Range shared on the first call

You'll work in client Salesforce orgs or ServiceNow instances. Part of the job is judgment: a flow is often enough, and sometimes you need Apex or a script include. The rest is integrations with HR, identity and finance systems, plus clean releases from sandbox to production.

what you'll do
  • Configure objects, flows and workflows
  • Write Apex, Lightning components or ServiceNow scripts
  • Build integrations with REST APIs and middleware
  • Manage deployments across sandbox and production
what you bring
  • 3+ years developing on Salesforce or ServiceNow
  • Apex and LWC, or ServiceNow scripting in JavaScript
  • Experience with platform integrations
  • Understanding of release management on the platform
nice to have
  • Salesforce Platform Developer or ServiceNow CAD certification
  • Experience with MuleSoft
your first 90 days
  1. day 30Pick up stories on a live org
  2. day 60Own a feature through release
  3. day 90Lead an integration build
you'll work inSalesforceServiceNowApexJavaScriptMuleSoft
the practical session for this role

We set up a Salesforce or ServiceNow sandbox and a sample business request. You build a small fix, then we talk through where you chose config over code.

takes about five minutes
Business AnalystDeliveryMid–Senior Remote or hybrid · Frisco, Warsaw, Hyderabad, Pune or SydneyFull-timeTurn client needs into clear requirements, process maps and access models, then test what gets built. Range shared on the first call

You'll run workshops with client teams and write down how work and access really happen today, which is rarely what the process document says. On identity projects you'll build role and access models with the security team. Near the end you plan UAT and help users get to sign-off.

what you'll do
  • Run requirements workshops with client stakeholders
  • Map current and future processes
  • Write user stories, acceptance criteria and access models
  • Plan and coordinate UAT with client users
what you bring
  • 3+ years as a business analyst on technology projects
  • Clear writing and process mapping skills
  • Experience writing user stories and acceptance criteria
  • Comfort running UAT with business users
nice to have
  • Experience on IAM or ERP projects
  • Working knowledge of SQL for checking data
your first 90 days
  1. day 30Sit in on workshops for a live project
  2. day 60Own the requirements for one workstream
  3. day 90Run a UAT cycle
you'll work inJiraConfluenceVisio or LucidchartExcel
the practical session for this role

We share a transcript from a sample client meeting where two managers describe the same process differently. You write a few user stories and a rough process map, then we go through what you'd ask next.

takes about five minutes
Technical Project ManagerDeliverySenior Remote or hybrid · Frisco, Warsaw, Hyderabad, Pune or SydneyFull-timeRun technical delivery for client projects, from plan and RAID log to cut-over. Range shared on the first call

You'll own the plan for client projects, keep the RAID log honest and chase dependencies across client and Cohash teams. When go-live comes you write the cut-over plan, run the calls and decide with the client when to roll back.

what you'll do
  • Build and maintain project plans and budgets
  • Run the RAID log and weekly status with the client
  • Coordinate dependencies across teams and vendors
  • Plan and run cut-over and go-live
what you bring
  • 5+ years managing technology projects
  • Experience running cut-overs or go-lives
  • Comfort with technical detail in IAM, cloud or data work
  • Clear written status reporting
nice to have
  • PMP or PRINCE2
  • Experience with SAP or Salesforce rollouts
your first 90 days
  1. day 30Shadow a live project's status cycle
  2. day 60Take over a project plan
  3. day 90Run a cut-over
you'll work inJiraSmartsheetMS ProjectConfluence
the practical session for this role

We share a sample plan and risk log for an IAM go-live. You draft the weekend cut-over runbook, then we talk about the point where you'd call a rollback.

takes about five minutes
Scrum Master / Delivery LeadDeliveryMid–Senior Remote or hybrid · Frisco, Warsaw, Hyderabad, Pune or SydneyFull-timeRun sprints for client delivery teams and remove what's slowing them down. Range shared on the first call

You'll run planning, stand-ups and retros for one or two client teams and work the backlog with the product owner each week. When a team is stuck waiting on another team or on a decision nobody has made, it's your job to go find the person and get an answer.

what you'll do
  • Facilitate sprint planning, reviews and retros
  • Work with product owners to refine the backlog
  • Track delivery and report progress to clients
  • Chase blockers across teams
what you bring
  • 3+ years as a scrum master or delivery lead
  • Experience with Jira and agile reporting
  • Experience working with distributed teams
  • Clear, calm communication with clients
nice to have
  • PSM or CSM certification
  • Experience scaling agile across several teams
your first 90 days
  1. day 30Join a team's sprint cycle
  2. day 60Run ceremonies for one team
  3. day 90Take on delivery reporting for a client
you'll work inJiraAzure DevOpsConfluenceMiro
the practical session for this role

We'll share a sample Jira board and the last three sprint reports for a struggling team. Tell us what you think is going on and what you'd change at the next retro.

takes about five minutes
QA EngineerEngineeringMid–Senior Remote or hybrid · Frisco, Warsaw, Hyderabad, Pune or SydneyFull-timeTest client applications by hand and with automation in Playwright, Selenium and Tricentis Tosca. Range shared on the first call

Some of what you test needs a person looking at it, so you write manual cases for that and automate the regression packs that run every release. On SAP and Salesforce projects we use Tosca. Custom apps get Playwright or Selenium tests that run in the pipeline.

what you'll do
  • Write and run manual test cases
  • Build automated tests in Playwright or Selenium
  • Build Tosca test suites for SAP and Salesforce
  • Log defects clearly and track them to closure
what you bring
  • 3+ years in software testing
  • Automation experience in Playwright or Selenium
  • Some scripting in TypeScript, Java or Python
  • Experience with test management in Jira or similar
nice to have
  • Tricentis Tosca certification
  • Experience testing SAP S/4HANA
your first 90 days
  1. day 30Run regression on a live release
  2. day 60Automate a set of manual tests
  3. day 90Own the test plan for a release
you'll work inPlaywrightSeleniumTricentis ToscaJiraSAP S/4HANASalesforce
the practical session for this role

We share a sample web form with a couple of bugs in it. You write a Playwright test for the main path, then we talk about which cases you'd still check by hand and why.

takes about five minutes
Technical RecruiterGrowthMid–Senior Remote or hybrid · Frisco, Warsaw, Hyderabad, Pune or SydneyFull-timeFind and place engineers and consultants for our Mobilize Talent practice and its clients. Range shared on the first call

You'll hire IAM engineers, SAP consultants, data engineers and similar roles, for Cohash and for clients through Mobilize Talent. Most days are sourcing and screening calls, plus taking a vague request from a hiring manager and turning it into a brief you can actually search on.

what you'll do
  • Source candidates for technical roles
  • Run screening calls and assess technical fit
  • Work with hiring managers on role briefs
  • Manage candidates through offer
what you bring
  • 2+ years in technical recruiting
  • Enough technical grasp to screen engineers
  • Experience with an ATS and LinkedIn Recruiter
  • Clear, honest communication with candidates
nice to have
  • Experience recruiting for IAM or SAP roles
  • Agency or staffing background
your first 90 days
  1. day 30Shadow screens on open roles
  2. day 60Own a set of requisitions
  3. day 90Make your first placements
you'll work inLinkedIn RecruiterATSBoolean searchGitHub
the practical session for this role

Using a role brief we share, show us your search strings and run a mock screening call with one of our engineers.

takes about five minutes
Client PartnerGrowthSenior Remote or hybrid · Frisco, Warsaw, Hyderabad, Pune or SydneyFull-timeLead relationships with enterprise clients and grow the work we do with them. Range shared on the first call

You'll look after a handful of enterprise accounts and see their leaders often enough to hear about next year's problems early. You scope and price new work with practice leads, and you stay close enough to delivery that a slipping project reaches you before it reaches the client's CIO.

what you'll do
  • Own relationships across a set of client accounts
  • Find and scope new work with practice leads
  • Write proposals and statements of work
  • Run account reviews with client leadership
what you bring
  • 7+ years in IT services account management or sales
  • Experience selling consulting or delivery services
  • Comfort with technical topics like IAM, cloud or data
  • Track record of growing existing accounts
nice to have
  • Experience in financial services or healthcare
  • Background in delivery before moving to accounts
your first 90 days
  1. day 30Meet your accounts' key contacts
  2. day 60Run your first account review
  3. day 90Scope a new piece of work
you'll work inSalesforceLinkedIn Sales NavigatorPowerPointExcel
the practical session for this role

We'll share two years of history for a sample account, including one rocky project. Walk us through your plan for the next twelve months with that client.

takes about five minutes
apply

Tell us about the work you've done.

Read by a recruiter in the practice you're applying to. You'll hear back within three business days.

what helps
  • A link we can open: LinkedIn, GitHub or a portfolio.
  • Two or three things you shipped, and the part you did yourself.
  • The platforms and versions you've run in production.

Please don't include passwords, client names or anything under NDA.

$ cohash apply --newgoes to a recruiter
How you'd like to work
When you could start
your resume is attached in the next step

01Can I apply for more than one role?

Yes. Pick the closest one in the form and mention the others in your note. The recruiter who reads it will route you to the right practice.

02Do I need everything listed under what you bring?

No. If you match most of it and can show real work on the platform, apply. Tell us where you're still learning; that helps us plan your first months.

03Is the work remote?

Remote is the default. The offices in Frisco, Warsaw, Hyderabad, Pune and Sydney are where pods meet, onboard new people and hand work across time zones.

04I don't have a public portfolio. What should I send?

A short note on two or three things you built or ran: the platform, the problem, and the part you did yourself. That tells us more than a long CV.

next step

Not hiring? Hiring engineers?

We place certified engineers on client teams through our Mobilize Talent practice. Tell us the platform you need and when they should start.

useful to bring
  • The platform and the version you're on
  • Where you need to get to, and by when
  • What's custom: rules, plugins, integrations
  • Any audit finding or deadline driving it