Platform Engineer - Security & Compliance

Validio; Stockholms kommun; Hybrid; SEK 900,000 - 1,200,000; Full time

Benefits offered by this job

Hybrid work model

Stockholm office access

Job summary

Validio is seeking a hands-on Platform Engineer focused on Security & Compliance. You will own our compliance program end to end, turning control requirements into Terraform, CI checks, and custom tests, while working alongside a tight Platform Engineering team.

You'll implement technical measures across GCP/AWS/Azure, manage security questionnaires, and drive evidence automation with Vanta or similar tools. The role is hybrid with Stockholm-office collaboration.

Qualifications

• A background in platform, DevOps, cloud, or security engineering.
• Experience owning or heavily supporting a SOC 2 and/or ISO 27001 program.
• Hands-on cloud infrastructure experience (GCP, AWS, or Azure).
• Production experience with Kubernetes, Terraform, and CI/CD.
• Go or Python for automation of platform tasks.
• Experience with a GRC automation platform (Vanta, Drata, or Secureframe).
• Clear, persuasive writing for enterprise security documentation.
• Ability to drive tasks to closure across engineering, IT, HR, and legal.

Responsibilities

• Own our compliance frameworks (SOC 2, ISO 27001, GDPR, HIPAA, DORA) and run audit cycles end to end.
• Run and automate Vanta; build tests in Go or Python and wire controls into Terraform and GitHub Actions.
• Implement technical controls across GCP, AWS, and Azure including access, logging, and secrets management.
• Own security questionnaires and our trust center, streamlining enterprise responses.
• Run vendor security reviews and DPIAs/LIAs/TRIAs with accurate risk tracking.
• Collaborate on platform and reliability improvements with the team.

Skills

Platform/DevOps background

SOC 2 / ISO 27001 program ownership

Cloud infrastructure (GCP/AWS/Azure)

Go or Python for automation

GRC automation platforms (Vanta/Drata)

Strong writing and documentation

Cross-team collaboration

Auditing liaison experience

ISO27001 Lead Implementer/Auditor cert

Education

ISO 27001 Lead Implementer / Lead Auditor certification

CISA / Security+ / CISM / CISSP certifications

Tools

Kubernetes

Terraform

CI/CD tooling

Job description

Validio is the agentic data management platform that automates data quality, lineage, and cataloging, so enterprises can finally trust the data behind their analytics, AI, and reporting. As a Platform Engineer focused on Security & Compliance, you own how we prove that trust, and you do it like an engineer, not an administrator.

As we move up-market into banking and regulated industries, a SOC 2 report, an ISO 27001 certificate, and a credible answer to "how do you protect our data" increasingly decide whether a deal closes. This is a hands-on DevSecOps role inside our Platform Engineering team. You'll own our compliance program end to end, but you'll run it from a terminal. You'll turn control requirements into Terraform, CI checks, and custom tests, so controls stay green without anyone chasing screenshots. It's not a pure cybersecurity or policy role. You'll write code and work on the platform alongside the rest of the team.

What you'll do

• Own our compliance frameworks (SOC 2, ISO 27001, GDPR, HIPAA, and DORA) and run audit cycles from evidence-gathering to the audit room
• Run our Vanta instance and automate it: build custom tests in Go or Python, automate evidence collection, and wire controls into Terraform and GitHub Actions so drift is caught in a PR, not an audit
• Implement the technical measures behind our security policies across GCP, AWS, and Azure, including access management and reviews, logging, secrets, and hardening
• Own security questionnaires and our trust center, and rebuild the answer library so a bank's 300-question questionnaire takes days, not weeks
• Run vendor security reviews and the data-protection assessments that come with them (DPIAs, LIAs, TRIAs), and keep our risk register honest
• Pitch in on platform and reliability work with the rest of the team

What you'll bring

• A background in platform, DevOps, cloud, or security engineering. You've built and run infrastructure, not just audited it
• Experience owning or heavily supporting a SOC 2 and/or ISO 27001 program, and the ability to turn a control requirement into concrete technical tasks
• Hands-on experience with cloud infrastructure, ideally GCP (strong AWS or Azure experience also works)
• Production experience with Kubernetes, Terraform, and CI/CD, and enough Go or Python to build the automation this role needs
• Experience with a GRC automation platform such as Vanta, Drata, or Secureframe (Vanta a strong plus), and a firm preference for automating evidence over collecting it by hand
• Clear, persuasive writing: questionnaire answers an enterprise security team trusts, and documentation an auditor accepts the first time
• The drive to get things to closure, including chasing control owners across engineering, IT, HR, and legal
• ISO 27001 Lead Implementer / Lead Auditor, CISA, Security+, CISM, or CISSP
• Supporting compliance for financial-services or other regulated customers

Our stack, and why

We use Vanta for compliance automation, because evidence should come from systems, not screenshots. Our infrastructure spans Google Cloud, AWS, and Azure because our customers run on all three, and our workloads run on Kubernetes across GKE, EKS, and AKS. Everything is defined in Terraform and shipped through GitHub Actions, so controls, evidence, and enforcement live in code you can read, query, and test. We write internal tooling and custom tests in Go and Python. Where the automation isn't there yet, you build it.

Why Validio

Founded in Sweden in 2019, we're trusted by data-driven enterprises like Nordea, Canva, Truecaller, Traveloka, and Deutsche Glasfaser. We raised a $30M Series A this year and grew ARR 800% in twelve months as enterprises got serious about making their data AI-ready. We're 35 people today and growing fast across Sweden, London, New York, and Amsterdam. This role is hybrid, and we expect you to work from our Stockholm office at least a couple of days per week. You'll own initiatives end to end and make the call when you're closest to the problem. We're strict about testing and documentation, and fast about decisions.

Come as you are. We hire for what you'll build with us, and we welcome applicants of every background