Remote-First Senior Security Engineer — Lead Compliance & Security

Overstory; Schweiz; Remote; CHF 120,000 - 180,000; Full time

Benefits offered by this job

Home office stipend

Education budgets

Autonomy and collaboration culture

Flexible schedule

Impactful climate mission

Job summary

Overstory is seeking its inaugural Senior Security Engineer to own and evolve our security and compliance posture. You will lead vulnerability management, drive audit readiness for SOC 2 and ISO 27001, and partner with engineering, product, and business teams to implement secure-by-design systems.

The role demands deep technical expertise, strategic thinking, and the ability to translate risk into actionable guidance for both technical and non-technical stakeholders in a remote-first

Qualifications

• 5+ years in security engineering or security operations.
• Experience with SOC 2 and ISO 27001 audits.
• Cloud fluency across AWS, GCP, or Azure.
• Ability to translate security risks into clear, actionable guidance.
• Experience in remote-first environments.

Responsibilities

• Own and evolve the security program across compliance, vulnerability management and security operations.
• Partner with engineering and product to build secure-by-design systems.
• Lead audit readiness and execution for SOC 2 and ISO 27001.
• Design and improve security processes across infrastructure and applications.
• Mentor others and raise the security bar across the organization.

Skills

Security engineering

Vulnerability management

Audit & compliance

Cloud security

IAM & endpoint security

Security governance

Stakeholder communication

Tools

Drata

Vanta

Tugboat

Job description

Overstory is seeking its inaugural Senior Security Engineer to own and evolve our security and compliance posture. You will lead vulnerability management, drive audit readiness for SOC 2 and ISO 27001, and partner with engineering, product, and business teams to implement secure-by-design systems.

The role demands deep technical expertise, strategic thinking, and the ability to translate risk into actionable guidance for both technical and non-technical stakeholders in a remote-first