security engineering manager for a marketplace

Catawiki; Amsterdam; On-site; EUR 120,000 - 180,000; Full time

Benefits offered by this job

Catavoucher joining

Catavoucher on birthday

Extra day off for pursuing passions

Additional leave for anniversaries

Job summary

Catawiki ищет Руководителя службы безопасности для управления командой безопасности, выработки стратегии и внедрения практик безопасной разработки. Вы будете определять приоритеты, контролировать исполнение и работать с продуктовой и инженерной командами, чтобы минимизировать риски в облачных и приложениях.

Кандидат обладает опытом в threat modelling, incident response и безопасной разработке, а также умеет объяснять бизнес-риски стейкхолдерам и добиваться поддержки изменений.

Qualifications

• Практический опыт security engineering в-продукции или облаке.
• Опыт управления инженерами: performance reviews, карьерное развитие.
• Владение дорожной картой безопасности и координацией across engineering.
• Глубокие знания cloud security: IAM, secrets management, secure SDLC.
• Опыт threat modelling и реагирования на инциденты.
• Умение развивать автоматизацию на Ruby/Python/Go.
• Умение review backend code и внедрять security controls.
• Умение объяснять риски бизнес-участникам и стейкхолдерам.
• Плюсом: Google Cloud, Kubernetes и Terraform; опыт marketplaces/e-commerce

Responsibilities

• Управлять и развивать команду безопасности через регулярные 1:1, фидбек и KPI.
• Обработку проблем с перформансом и найм.
• Владение road-map безопасности и приоритизация задач по риску.
• Строить и внедрять механизмы контроля и автоматизацию, ревью кода.
• Сотрудничество с Product/Platform Engineering на этапе дизайна; threat modelling.
• Улучшение управления уязвимостями и приоритизация remediaции.
• Улучшение checks в CI/CD и IaC, включая сканирование зависимостей/секретов.
• Снижение ложных срабатываний.
• Участие в инцидент-ответе; выводы и улучшения.
• Сотрудничество с Legal/IT/Trust & Safety по контролям и аудиту.
• Показывать прогресс по времени remediation, охвату контролей и принятию.

Skills

Security leadership

Team management

Security roadmap

Cloud security

Threat modelling

Secure code review

CI/CD security

Ruby/Python/Go

Communication

Risk translation

Tools

Ruby

Python

Go

Kubernetes

Terraform

Job description

Описание:

Catawiki is a marketplace for buying and selling special objects. Each week, more than 100,000 unique items are auctioned, carefully curated by in-house experts.

Задачи:

• Manage and develop the security team through regular one-to-ones, feedback, performance reviews and career development


• address underperformance and support hiring and onboarding


• Own the security engineering roadmap, prioritise work based on risk, business needs and team capacity, delegate effectively and remove blockers


• Build security controls and automation, review code and guide technical decisions across applications, cloud infrastructure and software delivery


• Partner with Product and Platform Engineering early in design, lead threat modelling and security reviews, and help teams choose practical secure approaches


• Improve vulnerability management by assessing findings in context, agreeing remediation priorities with system owners and tracking issues through resolution


• Improve security checks in CI/CD and infrastructure as code, including dependency and secret scanning


• reduce false positives and help engineers act on findings


• Coordinate the security team’s technical contribution to incident response and investigations, and turn lessons into improvements to detection, response and preventive controls


• Work with Legal, IT and Trust & Safety on security controls, policies and audit evidence where responsibilities overlap


• Measure and communicate progress through remediation times, control coverage and adoption


• explain risks, delivery progress and trade-offs to stakeholders

Требования:

• Substantial hands-on security engineering experience in a software or cloud environment, including implementing and operating security capabilities in production


• Previous experience managing engineers as direct reports, including performance reviews, career development and difficult feedback


• Experience owning a security roadmap or programme, translating priorities into deliverable work and coordinating implementation across engineering teams


• Strong knowledge of application and cloud security, including identity and access management, secrets management and secure software development


• Experience in threat modelling, secure code and design reviews, vulnerability prioritisation and practical incident response


• Ability to develop or automate in Ruby, Python, Go or a similar language


• comfortable reviewing backend code and integrating security controls into engineering workflows


• Clear communication with engineers and non-technical partners


• ability to explain risk in business terms and gain support when priorities compete


• Будет плюсом: Google Cloud, Kubernetes and Terraform or similar infrastructure tooling


• experience in a marketplace, e-commerce or other software product business, including account and API security


• experience securing AI-enabled applications, agents or data pipelines, or using AI to improve security engineering workflows

Условия:

• €100 Catavoucher upon joining and €50 Catavoucher on your birthday


• One extra day off each year to "Pursue Your Passion"


• additional leave for key work anniversaries and important life events

Benefits may vary by location