Principal Security Engineer (All Gender)

Zalando Group; Berlin; Hybrid; EUR 140,000 - 190,000; Full time

Benefits offered by this job

27 days of holiday

Employee shares programme

Company pension scheme

Health and wellbeing options

Relocation assistance

2 paid volunteering days

Job summary

Zalando seeks an experienced Principal Security Engineer to lead the OpSec function, bridging software engineering with regulatory compliance across e‑commerce and fintech. You will shape technical security strategy, review critical designs, and govern changes while aligning with DORA, PCI-DSS and ISO 27001 standards.

You’ll drive cross‑functional collaboration with engineering, product, and payments teams, ensuring resilient cloud security, robust cryptography, and secure SDLC practices.

Qualifications

• 8+ years of technical security engineering experience at Principal/Lead level across multi-team scopes.
• Deep understanding of DORA, PCI DSS, ISO 27001 and ICT risk management.
• Experience securing cloud-native microservices, WAF, and CI/CD pipeline security.
• Ability to align security strategy with regulatory compliance across large organizations.
• Strong communication skills to explain complex risks to executives and auditors.

Responsibilities

• Lead security architecture reviews and governance for high-criticality systems.
• Direct regulatory compliance posture and ICT risk management across Zalando platforms.
• Collaborate with engineering, product, and payments teams to align security strategy.
• Act as the primary technical authority on security posture and risk assessments.

Skills

Security architecture

Regulatory compliance

Cloud security

Risk assessment

Stakeholder management

Technical leadership

Executive communication

Tools

Web Application Firewall (WAF)

CI/CD security tooling

Cloud security tooling

Job description

We are seeking an experienced, high-impact Principal Security Engineer to join our Operational Security (OpSec) function as an individual contributor to lead our technical security strategy and regulatory compliance posture across our e-commerce and financial technology systems.

In this role, you will bridge deep software engineering and technical system design with regulatory compliance and governance (e.g., DORA, PCI-DSS, ISO 27001), operational resilience and cross-departmental alignment. You will serve as the primary technical authority on complex security architectures, change management guardrails, overall security posture and risk assessments for critical financial and cloud infrastructure.

WHAT WE’D LOVE YOU TO DO (AND LOVE DOING)

Security Architecture & Technical Change Governance

• System Design & Reviews: Function as the technical security reviewer and gatekeeper for high-criticality architecture changes. Strong understanding of network and application security, cryptographic primitives and identity and access management.
• Secure Engineering Standards: Maintain and enforce baseline configuration standards across cloud, server, and endpoint assets and secure Software Development Life Cycle (SDLC) practices.

Financial & Regulatory Compliance

• Regulatory Compliance: Direct technical alignment with regulatory standards including DORA, PCI-DSS, ISO 27001, and local regulatory frameworks. Improve the effectiveness of the ISMS and manage ICT risks from the Operational Security domain.
• Third-Party & Data Transfer Security: Evaluate security posture, CIA requirements, and Service Level Agreements (SLAs) for critical ICT outsourcing services and payment partner integrations.
• Risk Management: Familiarity with vulnerability management concepts and risk management methodologies.

Technical Leadership & Cross-Departmental Strategy

• Multi-Team Scope: Drive system designs and technical strategies spanning cross-functional multiple teams (engineering teams, product managers, and principal engineers), business units, and corporate entities (e.g., aligning Zalando Payments infrastructure with central Zalando Group tech).
• Stakeholder Management: Foster a Security first culture across departments, and bridge the gap between core engineering teams and information security operations.
• Experience: 8+ years of technical security engineering experience, with demonstrated impact at a Principal / Lead level across multi-team or department-wide scopes.
• Regulatory & Compliance Mastery: Deep technical understanding of DORA, PCI DSS, ISO 27001, and ICT risk management frameworks. Experience in financial services, payment processing, or highly regulated e-commerce environments.
• System Design & Cloud Security: Proven track record in securing cloud-native microservices, web application firewalls (WAF), and supply-chain/CI-CD pipeline security.
• Cryptography & Data Protection: Strong foundation in transport and storage encryption standards, tokenization, PGP/GPG key management, and data classification guidelines.
• Communication & Stakeholder Management: Exceptional capability to articulate complex technical security risks to executive leads, auditors, and engineering teams.

OUR OFFER

Zalando provides a range of benefits, here’s an overview of what you can expect. Ask your Talent Acquisition Partner to learn more about what we offer.

• 27 days of holiday a year to start for full-time employees (+1 day for every calendar year up to 30 days)
• 40% off fashion and beauty products sold and shipped by Zalando, 30% off Lounge by Zalando, discounts from external partners
• Family support, including counselling and dedicated services for parents and carers
• Company pension scheme
• Employee shares programme
• Health and wellbeing options, including Wellhub
• Mental health support and coaching
• Development through our training platform and biannual peer-to-peer review
• 2 paid volunteering days a year
• Relocation assistance (subject to prior agreement)

INCLUSIVE BY DESIGN

If you think you have what it takes, we encourage you to apply even if you don't meet every single requirement. You may just be the right candidate for this or other roles!

At Zalando, our vision is to be the leading European technology platform for fashion and lifestyle – one that thrives on diversity and is truly inclusive by design. We believe that diverse teams fuel innovation and creativity, and we actively seek out talent from all backgrounds.

We actively seek to reduce bias in our hiring and employment processes, focusing on your qualifications, skills, and contributions. To support this, we kindly ask that you refrain from including personal details such as your photo, age, or marital status in your CV, ensuring a fair and equitable evaluation based solely on your abilities and potential.

We are committed to providing an exceptional and accessible candidate experience for everyone. If you require any accommodations to support you throughout the hiring process, please let us know – we are here to assist you.

Discover more about our commitment to creating a diverse and inclusive workplace: https://jobs.zalando.com/en/our-culture/diversity-and-inclusion

In some cases we also work with a selection of headhunters and agencies to fill specific roles. Please note that neither Zalando nor our recruiting partners will ask for any kind of payment to apply for a job or attend an interview.

If you have any questions about our recruitment process, please take a look at our FAQ page .

About Zalando

Founded in Berlin in 2008, Zalando is the leading European technology platform for fashion and lifestyle. Connecting 62 million active customers with more than 7,000 brands across 29 markets, our operations are built on a unique AI-powered data and infrastructure platform. For our customers, our multi-app approach - comprising Zalando, ABOUT YOU, and Lounge by Zalando - delivers an inspiring, highly personalized shopping experience, serving different customers with different needs. For our partners, we are building the operating system for e-commerce. Through ZEOS, Tradebyte, and SCAYLE, we open our logistics, software, and service capabilities to brands and retailers, enabling them to seamlessly scale their businesses across borders.