Security engineer in fintech

Vinted; Greater London; Hybrid; GBP 98,000 - 169,000; Full time

Benefits offered by this job

Share options programme

Hybrid work model

Home office support

Job summary

Vinted поддерживает Pay как часть своей финансовой экосистемы и ищет Staff/Senior StaffSecurity Engineer для внедрения прочной безопасности во всех платежных архитектурах. Ваша задача — встроить защиту в дизайн, а не в тесты после развертывания, и вести риск‑менеджмент на уровне группы.

Требуется опыт работы в финтехе, знание PCI DSS и владение стеком Ruby on Rails, Go, MySQL, Temporal и AWS. Работа в гибридном формате в Великобритании с ориентиром на развитие инженерной культуры безопасности.

Qualifications

• Опыт работы в регламентированных платежах или финтехе, работа по требованиям PCI DSS и регуляторов.
• Опыт определения направления безопасности на уровне всей компании и реализации крупных инициатив.

Responsibilities

• Владение дорожной картой безопасности Vinted Pay от конца до конца; оценка активов, выделение рисков и доведение до закрытия.
• Преобразование регуляций в инженерные управляемые контроли и безопасные туннели в архитектуре.
• Проведение глубоких технических обзоров AWS-инфраструктуры, платежных пайплайнов, SIEM и инструментов уязвимостей (например Wiz).
• Владение архитектурой PCI DSS и защиты данных: изоляция платежной страницы, мониторинг скриптов, шифрование данных и минимальные привилегии в мульти‑региональных окружениях.
• Лидерство в кросс‑функциональных инициативах по безопасност�Payments Platform и Group Security.

Skills

Threat modelling

Production systems

Regulated payments/fintech experience

Influence without authority

Secure development

English proficiency

Tools

AWS

Wiz

SIEM

CSPM

Ruby on Rails

Go

MySQL

Temporal

Job description

Описание

As Staff / Senior Staff Security Engineer in Vinted Pay, you will be the staff-level security engineer inside our regulated payments business - and the person who makes Vinted Pay's security posture match its growth. Vinted Pay is a rare security problem in the best sense: a fintech scaling across multiple European licences at marketplace speed, where security cannot be a compliance checklist or an isolated engineering task - it has to be built into the core financial architecture.

Задачи

• Own the Vinted Pay security roadmap end to end: assess the estate, prioritise by real attack paths, and drive risks to closure - a multi-quarter roadmap that shapes how Vinted Pay defends its infrastructure and payment assets, rather than reacting to the next audit.
• Turn regulation into engineering: map PCI DSS, DORA, and Bank of Lithuania and FCA requirements into practical, automated security controls and engineering guardrails - compliance as a by-product of how Vinted Pay builds, not a parallel workstream.
• Find and close the operational blind spots: run deep technical reviews of our AWS infrastructure, payment pipelines, SIEM and logging, and vulnerability management tooling (e.g. Wiz), and fix what you find - prioritised by exposure, not by finding count.
• Own PCI DSS and data protection architecture: payment page isolation, script monitoring, data encryption, and least-privilege access across multi-region environments - and turn those controls into evidence that stands up to assessors and regulators.
• Lead cross-functional security initiatives across Payments Platform, Payments Engineering, and Group Security, and drive them to delivery - whether execution sits with partner teams or you have to write the code yourself.
• Act as the technical arm of Vinted Pay's security accountable: maintain the risk register, prepare mitigation-or-acceptance decisions against centrally set thresholds, and represent Vinted Pay in the group's security governance.
• Embed secure development into Payments engineering so security lands at design time rather than after deployment, and raise the security fluency of Vinted Pay engineers so risk-based decisions happen well without you in the room - security as a delivery enabler, not a gate.

Требования

• Strong hands-on security engineering experience on a real engineering foundation - you have built or run large production systems, and you can threat-model a payment flow, find the attack path yourself, and drive or build the fix.
• Experience in regulated payments or fintech - you have worked under PCI DSS and a financial regulator (FCA, Bank of Lithuania, CSSF, or equivalent) and know how their requirements become controls engineers actually run.
• A staff- or principal-level track record - you have defined, led, and delivered major, company-wide technical initiatives, and you set security direction through software design on high-scale, distributed systems rather than from the outside.
• The range to move across the four archetypes of staff engineering - tech lead, architect, solver, right hand - picking the one the domain needs together with the Director of Engineering, not the one you prefer.
• A way of working that engineers respect: evidence over assertions, attack paths over checklists, guardrails over gates.
• Demonstrated ability to influence without authority and translate technical risk into business consequence for senior audiences, internal and external.
• Comfortable in our stack - Ruby on Rails, Go, MySQL, Temporal, AWS, SIEM and CSPM tooling - or eager to learn it, with a real interest in security and privacy as a field and the appetite to keep growing as an engineer and leader.
• Excellent written and spoken English.

Будет плюсом

• Advantage: experience building and running systems at massive scale (2+ million requests per minute), deep knowledge of observability tooling (Kibana, Grafana, Prometheus), and a passion for introducing new practices;
• Advantage: AWS security depth (IAM, KMS, multi-account and multi-region architecture), or hands-on CSPM (e.g. Wiz) and SIEM engineering;
• Advantage: privacy engineering experience, or offensive security background or certifications (e.g. OSCP)

Условия

The opportunity to benefit from our share options programme 25 working days of holiday Newest MacBook models Home office support: we provide IT workstation equipment and a personal budget of up to €540 for home workplace furniture Confidential Employee Assistance Program (EAP) for you and your family Comprehensive Medical Insurance Group Life and Income Protection Insurance A matched pension scheme up to a set limit Access to a discounted gym membership plan Lunch benefit per working day Frequent team-building events A personal monthly budget for shopping on Vinted Workation policy Better balance holidays with workdays by working remotely! Up to 90 days per year in the EU, of these, 21 days can be spent globally. For non-EU citizens, it's 21 days worldwide. This can be combined with time off for vacation or personal time. Individual learning budget Each year, you’ll be given a learning budget (starting at €3,000), and a total of up to 10 working days over a 2-year period to support your personal and professional development. Hybrid work Our hybrid model, with 2 recommended office days a week, gives you and your team the flexibility to decide if and when you want to work from home, and when to catch up in person. The annual gross salary range for this position is: £97,800—£169,100 GBP