Platform Security Engineer

Coverflex; United States; Remote; USD 56,000 - 75,000; Full time

Job summary

Coverflex ищет инженера по безопасности платформы на уровне Senior для работы над безопасностью и устойчивостью нашей облачной платформы, удаленно из Европы. Ваша роль требует владения Kubernetes в продакшне, IAM, Secrets и CI/CD с безопасностью, а также сотрудничества с командами разработки и инфраструктуры. Ожидается владение Elixir/Phoenix и PostgreSQL, а также англ.

языком на высоком уровне. Работа удаленная с возможностью сотрудничества с командами по всему миру; основной фокус — защитить

Qualifications

• Обладание безопасностью приложений или платформы в производственной облачной среде с явным влиянием
• Сильные основы облачной безопасности: IAM и управление идентификацией (SSO/OIDC), управление секретами, наименьшие привилегии
• Сильная платформа инженерии: инфраструктура как код, CI/CD с встроенной безопасностью и наблюдаемостью
• Опыт запуска Kubernetes в продакшне, безопасность рабочих нагрузок и контроль доступа
• Сетевые аспекты в облаке и на краю: границы VPC, DNS, TLS, балансировка нагрузки, настройка WAF
• Надёжность: SLO, дежурство, моделирование инцидентов и постмортемы
• Проектирование резервного копирования, восстановления и тестирования DR
• Подход к платформе как к продукту: измерение внедрения и опыта разработчика
• Использование AI‑инструментов для ускорения разработки и интеграция их в платформу
• Чтение и правка кода для исправления проблем
• Свободный английский необходим
• Безопасность — это ворота, а не путь для прокладки
• Предпочитает аудит и отчетность надHands‑on разработкой
• Измерение прогресса через политики, а не через фактические улучшения
• Работа по готовой дорожной карте, а не по её формированию самостоятельно

Responsibilities

• Shipped your first secure-by-default workflow for production operations, with access that's controlled, auditable and easy to use
• Shaped how we run security in our delivery pipeline: priorities, response targets and automation
• Led a resilience exercise that sharpened our recovery playbooks

Skills

AWS

Kubernetes

Terraform

GitHub Actions

Ubicloud

Datadog

CI/CD security scanning

Identity management

Elixir/Phoenix

PostgreSQL

React Native

English (Fluent)

Tools

GitHub Actions

Datadog

CI/CD security scanning

Identity tooling

Job description

Описание:

Coverflex Work changed. Pay didn’t. Coverflex exists to make compensation work for everyone. Pay is still rigid, fragmented, and hard to feel. We turn compensation into choice — one platform, one card, one app — for benefits, meal allowance, insurance and more. Our platform is simple for HR and meaningful for employees. We provide choice, smarter compensation tools and empowerment.

TL;DR (The Essentials)

Role: Platform Security Engineer Seniority Level: Senior Type: Individual Contributor Languages: English (main) / Portuguese / Spanish / Italian Main Tools: AWS, Kubernetes, Terraform, GitHub Actions, Ubicloud, Datadog, CI/CD security scanning, identity and secrets management Main Stack: Elixir/Phoenix, PostgreSQL, React Native (Expo) Location: Remote (Europe only)

Задачи:

Ваша роль будет играть главную роль в нашем успехе, потому что… → Мы заботимся о преимуществах и личных данных людей в нескольких странах, поэтому доверие лежит в основе того, что мы делаем. По мере роста вы будете убедиться, что наша безопасность растет вместе с нами. Вы принесете глубокую экспертизу безопасности в DevX - команду, которая строит платформу и создала путь для наших инженеров, и вы сделаете безопасный путь самым простым путь для всех. Вы будете знать, что вы успешны, когда, после 90 дней, вы…

• Shipped your first secure-by-default workflow for production operations, with access that's controlled, auditable and easy to use


• Shaped how we run security in our delivery pipeline: priorities, response targets and automation


• Led a resilience exercise that sharpened our recovery playbooks

Main KPI 1:

More production operations running through secure, self-service and observable tooling

Main KPI 2:

Security findings caught early in the delivery pipeline and resolved quickly, with automation doing the heavy lifting

Main KPI 3:

Business continuity we can count on, with clear recovery targets that we test regularly

Secondary KPI 1:

Edge protection that adapts to our applications and keeps the user experience smooth

Secondary KPI 2:

Engineers adopt the security guardrails and are happy with them

You Must-haves (evidence, not years)

• Owned application or platform security in a production cloud environment, with clear examples of impact


• Strong cloud security fundamentals: IAM and identity plumbing (SSO/OIDC), secrets management, and least privilege in practice


• Strong platform engineering across infrastructure as code, CI/CD with security built in, and observability


• Strong experience running Kubernetes in production, including workload security and access controls


• Cloud networking and edge: VPC boundaries, DNS, TLS, load balancing, CDN and WAF tuning


• Reliability in practice: SLOs, on‑call, threat modelling, incident command, and postmortems


• Backup, restore and disaster recovery designed and actually exercised


• Treats the platform as a product: measures adoption and developer experience


• Uses AI tooling to accelerate engineering work, and builds it into the platform (agents, MCP, assisted operations)


• Reads and writes code well enough to fix problems, not just report them


• Fluent English required


• You see security as a gate to guard rather than a path to pave


• You prefer auditing and reporting to building and fixing things hands‑on


• You measure progress in policies written rather than in real improvements


• You do your best work with a ready‑made roadmap rather than shaping one yourself

Manager & Team

Meet Your Manager Hiring Manager: Rui Alves - Tech Lead, Platform Engineering Location: Portugal LinkedIn Profile: https://www.linkedin.com/in/rui-alves-ab05959

Profile Snapshot: Energy: Steady and low‑ego. I try to keep things calm, especially when priorities shift or incidents happen. Communication: Structured, transparent, and written-first when it helps. I document decisions, trade-offs, and next steps so alignment survives the meeting. Feedback Style: Direct and kind. I give feedback early and specifically, and I expect the same in return.

Key Stakeholders: Tiago Fernandes (CTO) Bruno Oliveira (VP Engineering) Luís Coelho (Quality Team Lead)

Team Rituals: Daily standup Weekly planning Bi‑weekly retrospective

Access & Belonging (Equal Opportunity)

We hire for impact and potential, not pedigree. We welcome applications from people with non-linear careers, career breaks, caregiving gaps, and those changing fields. No discrimination on the basis of age, disability, gender identity/expression, marital or family status, pregnancy, neurodivergence, race/ethnicity, religion/belief, sexual orientation, or any other protected ground. Assessment fairness: We anchor on evidence of outcomes (what you shipped, moved, or influenced). We actively de‑bias by using structured rubrics, multiple assessors, and blind screening most of the time (we won’t know your name, gender, or personal info until the interview stage).

Требования:

• ISO 27001, SOC 2 or DORA experience Fintech, payroll, or other regulated‑data background


• Detection engineering or SIEM experience


• PostgreSQL operations and safe schema migrations


• Elixir, or comfort picking up a functional language


• Cloud cost awareness and FinOps practices


• Certifications welcome, but practical evidence weighs more

Your DNA

Enabler, not a blocker: you make security the default through automation, paved‑road patterns and self‑service guardrails

Builder at heart: you'd rather ship the fix than file the report, and you work alongside engineers to raise the bar together

Pragmatic about risk: you weigh costs and benefits, explain trade‑offs clearly, and prefer small, safe changes that add up

Written‑first communicator: you write decisions down and share context early so others can move fast

Deeply curious: you dig into hard problems and incidents, then turn what you learn into tooling and better defaults

Условия:

• Base Salary: 50.000€ to 67.000€ gross yearly


• Bonus / Commissions: No


• Equity: Yes – Stock Options under our Equity Incentive Plan


• Benefits: All Coverflex benefits apply


• Contract Type: Permanent