Lead Security Engineer

Catawiki; Amsterdam; Sur place; EUR 90 000 - 150 000; Plein temps

Résumé du poste

Catawiki in Amsterdam seeks a Lead Security Engineer to provide hands-on technical leadership in a small Security team within Platform Engineering. You will shape the security engineering roadmap and own the delivery of complex security initiatives, collaborating with Product and Platform Engineering to protect our marketplace, customers and data.

Our platform runs on Google Cloud and Kubernetes. You’ll focus on application and cloud security, secure software delivery and risks in internal and

Qualifications

• Substantial hands-on security engineering experience across software or cloud platforms.
• Strong knowledge of application and cloud security including IAM and secrets management.
• Led threat modelling, secure code and design reviews and remediation work.
• Ability to develop or automate in Ruby, Python, Go or similar languages.
• Experience integrating security into CI/CD and infrastructure as code.

Responsabilités

• Shape the security engineering roadmap and lead complex initiatives from assessment to operation.
• Design and build security controls and automation across apps, cloud infra, IAM, CI/CD and IaC.
• Lead threat modelling and secure code/design reviews with engineering teams.
• Investigate vulnerabilities, prioritize findings, and implement reusable controls.
• Improve security checks in engineering workflows and reduce false positives.
• Contribute to incident investigations, detection, and response tooling.
• Mentor engineers and grow security skills across product teams.
• Collaborate with Legal, IT, and Trust & Safety on controls, policies and audit evidence.
• Measure effectiveness of controls and communicate risks to stakeholders.

Connaissances

Hands-on security engineering

Threat modelling

Secure code reviews

Cloud security

Identity and access management

Secrets management

CI/CD security integration

Security tooling

Outils

Ruby

Python

Go

Description du poste

As our Lead Security Engineer, you’ll provide hands‑on technical leadership in our small Security team within Platform Engineering. You’ll shape the security engineering roadmap and own the delivery of complex security initiatives, working with Product and Platform Engineering to protect our marketplace, our customers and their data.

Our platform runs on Google Cloud and Kubernetes. You’ll focus on application and cloud security, secure software delivery and risks in internal and AI-enabled systems. You’ll combine deep technical work with influence across engineering, turning security risks into controls and practices that teams can use in their everyday workflows.

This is an individual contributor role. As the team evolves, there may be an opportunity to move into people management, based on demonstrated readiness and business needs.

What you will do

• Shape the security engineering roadmap and lead complex initiatives from assessment and design through implementation, rollout and ongoing operation.
• Design and build security controls and automation across applications, cloud infrastructure, identity and access, CI/CD and infrastructure as code.
• Lead threat modelling and secure code and design reviews. Work with engineering teams early to identify risks and agree practical changes before systems reach production.
• Investigate vulnerabilities and recurring security weaknesses. Prioritise findings based on exposure and business impact, work with system owners on remediation and build reusable controls that prevent recurrence.
• Improve security checks in engineering workflows, including dependency and secret scanning. Reduce false positives and make findings easier for developers to understand and resolve.
• Contribute to security incident investigations and response. Improve detection and response tooling and use lessons from incidents to strengthen preventive controls.
• Mentor security engineers and help product engineers build security skills through technical guidance, documentation and practical training.
• Work with Legal, IT and Trust & Safety on technical security controls, policies and audit evidence where responsibilities overlap.
• Measure the effectiveness and adoption of the controls you deliver. Communicate progress, technical decisions and remaining risks clearly to engineering and business stakeholders.

Who you are

• You have substantial hands‑on security engineering experience in a software or cloud environment and a track record of delivering security improvements across multiple teams.
• You have strong knowledge of application and cloud security, including identity and access management, secrets management and secure software development.
• You have led threat modelling, secure code and design reviews and complex remediation work, turning findings into solutions that engineers adopt.
• You can develop or automate in Ruby, Python, Go or a similar language and are comfortable reviewing backend code. You have built and operated security tooling or controls in production.
• You have integrated security into CI/CD, cloud infrastructure or infrastructure as code and can make sound trade‑offs between risk reduction and engineering effort.
• You have contributed to security incident investigations or responses and can work effectively with others under pressure.
• You have led technical initiatives and mentored engineers. You’re interested in developing your leadership skills, including potentially taking on people management in the future.
• You influence through technical credibility and collaboration, explain risks clearly to different audiences and take responsibility for seeing complex work through to completion.