security engineer for a marketplace

Catawiki; Amsterdam; Hybrid; EUR 90,000 - 130,000; Full time

Benefits offered by this job

Catavoucher при присоединении

Catavoucher на день рождения

Дополнительный выходной по важным жизн

Гибридный режим работы

Job summary

Catawiki ищет инженера по безопасности для ведения дорожной карты защиты и реализации комплексных инициатив в области безопасности. Вы будете отвечать за проектирование и автоматизацию контроля безопасности по приложениям, облаку и CI/CD, взаимодействуя с командами разработки.

Требуется опыт в моделировании угроз, обзоре кода и внедрении безопасных практик, знание Ruby/Python/Go будет преимуществом. Работа в гибридном формате с ориентиром на Амстердам.

Qualifications

• Практический опыт инженерной безопасности в ПО или облаке.
• Опыт руководства моделированием угроз и обзором безопасного кода.
• Умение развивать или автоматизировать на Ruby, Python или Go.
• Опыт внедрения безопасности в CI/CD и инфраструктуру как код.

Responsibilities

• Определять дорожную карту обеспечения безопасности и руководить инициативами от проектирования до внедрения.
• Проектировать и внедрять контрольные меры и автоматизацию в приложениях, облаке и CI/CD.
• Проводить моделирование угроз и обзоры дизайна безопасности совместно с командами разработки.
• Анализировать уязвимости, приоритезировать исправления и внедрять превентивные решения.

Skills

Security engineering

Cloud security

Threat modelling

Secure code reviews

CI/CD integration

Infra as code

Automation

Python/Ruby/Go

Vulnerability response

Tools

Google Cloud

Kubernetes

Terraform

Job description

Описание

Catawiki is a marketplace for buying and selling special objects. Each week, more than 100,000 unique items are auctioned, carefully curated by in-house experts. It has sold over 25 million unique objects and aims to become the world's most popular destination for special objects.

Задачи

• Shape the security engineering roadmap and lead complex initiatives from assessment and design through implementation, rollout, and ongoing operation
• Design and build security controls and automation across applications, cloud infrastructure, identity and access, CI/CD, and infrastructure as code
• Lead threat modelling and secure code and design reviews, identifying risks early and agreeing practical changes with engineering teams before systems reach production
• Investigate vulnerabilities and recurring security weaknesses, prioritise findings based on exposure and business impact, work with system owners on remediation, and build reusable controls to prevent recurrence
• Improve security checks in engineering workflows, including dependency and secret scanning; reduce false positives and make findings easier for developers to understand and resolve
• Contribute to security incident investigations and response, improve detection and response tooling, and use incident lessons to strengthen preventive controls
• Mentor security engineers and help product engineers develop security skills through technical guidance, documentation, and practical training
• Work with Legal, IT, and Trust & Safety on technical security controls, policies, and audit evidence where responsibilities overlap
• Measure the effectiveness and adoption of delivered controls, and communicate progress, technical decisions, and remaining risks to engineering and business stakeholders

Требования

• Substantial hands-on security engineering experience in a software or cloud environment, with a track record of delivering security improvements across multiple teams
• Strong knowledge of application and cloud security, including identity and access management, secrets management, and secure software development
• Experience leading threat modelling, secure code and design reviews, and complex remediation work, turning findings into solutions engineers adopt
• Ability to develop or automate in Ruby, Python, Go, or a similar language, and review backend code
• Experience building and operating security tooling or controls in production
• Experience integrating security into CI/CD, cloud infrastructure, or infrastructure as code, and making sound trade-offs between risk reduction and engineering effort
• Experience contributing to security incident investigations or responses and working effectively under pressure
• Experience leading technical initiatives and mentoring engineers; interest in developing leadership skills, including potentially taking on people management in the future
• Ability to influence through technical credibility and collaboration, explain risks clearly to different audiences and take responsibility for seeing complex work through to completion
• Будет плюсом: Google Cloud, Kubernetes, and Terraform or similar infrastructure tooling; experience in a marketplace, e-commerce, or another software product business, including account and API security; experience securing AI-enabled applications, agents, or data pipelines, or using AI to improve security engineering workflows

Условия

• Receive a €100 Catavoucher when joining and a €50 Catavoucher on your birthday
• One extra day off each year to "Pursue Your Passion," plus additional leave for key work anniversaries and important life events
• Benefits may vary by location
• Hybrid setup with a minimum of two days per week in the office, unless the role is explicitly stated as fully remote or fully office-based