security engineer for a marketplace

Catawiki is a marketplace for buying and selling special objects. Each week, more than 100,000 unique items are auctioned, carefully curated by in-house experts. It has sold over 25 million unique objects and aims to become the world’s most popular destination for special objects.

• Shape the security engineering roadmap and lead complex initiatives from assessment and design through implementation, rollout, and ongoing operation
• Design and build security controls and automation across applications, cloud infrastructure, identity and access, CI/CD, and infrastructure as code
• Lead threat modelling and secure code and design reviews, identifying risks early and agreeing practical changes with engineering teams before systems reach production
• Investigate vulnerabilities and recurring security weaknesses, prioritise findings based on exposure and business impact, work with system owners on remediation, and build reusable controls to prevent recurrence
• Improve security checks in engineering workflows, including dependency and secret scanning; reduce false positives and make findings easier for developers to understand and resolve
• Contribute to security incident investigations and response, improve detection and response tooling, and use incident lessons to strengthen preventive controls
• Mentor security engineers and help product engineers develop security skills through technical guidance, documentation, and practical training
• Work with Legal, IT, and Trust & Safety on technical security controls, policies, and audit evidence where responsibilities overlap
• Measure the effectiveness and adoption of delivered controls, and communicate progress, technical decisions, and remaining risks to engineering and business stakeholders

• Substantial hands-on security engineering experience in a software or cloud environment, with a track record of delivering security improvements across multiple teams
• Strong knowledge of application and cloud security, including identity and access management, secrets management, and secure software development
• Experience leading threat modelling, secure code and design reviews, and complex remediation work, turning findings into solutions engineers adopt
• Ability to develop or automate in Ruby, Python, Go, or a similar language, and review backend code
• Experience building and operating security tooling or controls in production
• Experience integrating security into CI/CD, cloud infrastructure, or infrastructure as code, and making sound trade-offs between risk reduction and engineering effort
• Experience contributing to security incident investigations or responses and working effectively under pressure
• Experience leading technical initiatives and mentoring engineers; interest in developing leadership skills, including potentially taking on people management in the future
• Ability to influence through technical credibility and collaboration, explain risks clearly to different audiences, and take responsibility for seeing complex work through to completion
• Будет плюсом: Google Cloud, Kubernetes, and Terraform or similar infrastructure tooling; experience in a marketplace, e-commerce, or another software product business, including account and API security; experience securing AI-enabled applications, agents, or data pipelines, or using AI to improve security engineering workflows

• Receive a €100 Catavoucher when joining and a €50 Catavoucher on your birthday
• One extra day off each year to “Pursue Your Passion,” plus additional leave for key work anniversaries and important life events
• Benefits may vary by location
• Hybrid setup with a minimum of two days per week in the office, unless the role is explicitly stated as fully remote or fully office-based
• Apply with an English CV and Cover Letter