Staff / Senior Staff Security Engineer, Vinted Go

Vinteden; Amsterdam; Hybrid; EUR 120,000 - 170,000; Full time

Job summary

Vinted Go is seeking a Staff/Senior Staff Security Engineer to be the first dedicated security engineer inside the logistics business. You will own the security of the Vinted Go estate, building security capabilities and embedding secure development practices across partners and internal teams.

You will work with engineering leadership and the security teams to raise security fluency, drive risk-based decisions, and ensure robust defense against evolving threats in a European-scale logistics

Qualifications

• Strong hands-on security engineering experience including threat-modeling and finding attack paths.
• Experience building or maturing a security capability.
• Experience with detection and response for production systems.
• Evidence-based approach: attack paths over checklists; fixes over findings.

Responsibilities

• Own the Vinted Go security roadmap end to end: assess the estate, prioritise by real attack paths, drive risks to closure.
• Secure physical-digital surface: carrier integrations, hardware, OT, driver and warehouse apps.
• Stand up Vinted Go's Security Ops capability: detection, response, vulnerability management.
• Embed secure development into Vinted Go engineering, including external partners.
• Own third-party security across the network: carriers, vendors, outsourced engineering.
• Act as technical arm of Vinted Go security governance.
• Raise security fluency of Vinted Go engineers to enable risk-based decisions.

Skills

Hands-on security engineering

Threat modelling

Security operations (detection/resp)

Secure development lifecycle

Cross-functional collaboration

Advocacy for security as delivering en

Job description

Brief info about Vinted

Our mission is to make second-hand the first choice, and we're looking for people who want to help us get there. Every day, we work together to help our members buy and sell pre-loved clothing and lifestyle items, giving each piece a second life – or even a third.
The Vinted Group is made up of three business units that support this mission:
Vinted Marketplace is Europe’s leading platform for second-hand fashion and a go-to destination for all kinds of pre-loved items, with a growing range of categories. Our platform connects millions of members across 20+ markets, helping great items find a new life.
Vinted Go enhances the shipping experience with a vast network of over 500,000 pick-up and drop-off points, partnering with more than 60 carriers across Europe, with added services like item verification for peace of mind on high-value pieces.
Vinted Pay is the newest part of the Vinted Group, dedicated to bringing secure, reliable payments to buyers and sellers across Europe. Seamlessly integrated into the Vinted app, it helps keep every transaction safe, efficient, and easy for our members.
Founded in 2008 in Lithuania, Vinted began as a way for friends to find new homes for clothes they no longer needed. In 2019, we became Lithuania's first unicorn! Today, our headquarters remain in Vilnius, and we've grown with offices across Europe, supported by a team of over 2,000 people.

Information about the position

As Staff / Senior Staff Security Engineer in Vinted Go, you will be the first dedicated security engineer inside our logistics business - and the person who makes Vinted Go's security posture match its growth. Vinted Go is a rare security problem in the best sense: a European-scale logistics network where software, physical infrastructure, and dozens of external partners meet. Its attack surface spans shipping services and carrier APIs, a locker and PUDO network in public space, sorting facilities with real operational technology, driver and warehouse applications, and hardware and engineering partners.

Working at staff / senior staff level as an individual contributor embedded in Vinted Go engineering, you will own the security of that whole estate. Vinted Security runs a federated model: the central team sets thresholds and provides core services, while each business unit owns local execution. Vinted Go's local execution is what you will build - this is not a policy or audit role, it is an engineering role with a mandate. You will work directly with Vinted Go's engineering leadership and functionally with the Vinted Security senior team and your security peers in Marketplace and Vinted Pay.

This is a build role with room to grow: you start hands-on, closing the highest-impact gaps yourself, and as the function matures you will stand up and functionally lead a Vinted Go Security Ops capability.

In this position, you’ll

• Own the Vinted Go security roadmap end to end: assess the estate, prioritise by real attack paths, and drive risks to closure - with the explicit goal of keeping Vinted Go's resilience to external attack ahead of its growth and at the standard Vinted holds itself to.


• Secure a physical-digital surface few companies have: carrier integrations, locker and PUDO hardware, sorting-facility operational technology (conveyors, robotics, cameras), driver and warehouse applications, and electronics verification related software and hardware.


• Stand up Vinted Go's Security Ops capability - detection, response, and vulnerability management for Vinted Go-specific systems - building on central platforms rather than duplicating them.


• Embed secure development into Vinted Go engineering, including external engineering partners, so security lands at design time rather than after deployment.


• Own third-party security across the network: 40+ carriers, hardware vendors, and outsourced engineering - set the requirements, verify them, and manage the residual risk.


• Act as the technical arm of Vinted Go's security accountable: maintain the risk register, prepare mitigation-or-acceptance decisions against centrally set thresholds, and represent Vinted Go in the group's security governance.


• Raise the security fluency of Vinted Go engineers so risk-based decisions happen well without you in the room - security as a delivery enabler, not a gate.

About you

• Strong hands-on security engineering experience - you can threat-model a system, find the attack path yourself, and drive or build the fix; you've worked on both the offensive and defensive side.


• Experience building or significantly maturing a security capability.


• Experience with detection and response - you have built or operated security operations for production systems.


• A way of working that engineers respect: evidence over assertions, attack paths over checklists, fixes over findings.


• Pragmatic evangelist for all things security.


• Excellent written and spoken English.


• Advantage: experience securing logistics, supply chain, retail, manufacturing, or other environments where software and physical infrastructure overlaps.


• Advantage: third-party / supply-chain security experience across many external integrations.


• Advantage: offensive security background or certifications (e.g. OSCP), or cloud-native (Kubernetes) security depth.

Work