Security engineer for corporate IT

Personio's intelligent HR platform helps small and medium-sized organizations unlock the power of people by making complicated, time-consuming tasks simple and efficient. Our team of 1,500 Personios is building user-friendly products that delight our 15,000+ customers and their 1.5 million employees. Ready to make an impact from day one?

• Secure our macOS fleet: Own endpoint controls including EDR, hardened baselines, device posture and patching, working with IT on MDM.
• Strengthen identity and access: Improve our Identity Provider, SSO coverage and Zero Trust access. Push for least-privilege admin access and protect against account takeover and session or token theft.
• Protect our SaaS and collaboration platforms: Keep Google Workspace, Atlassian and Slack securely configured, catch misconfiguration and drift, and introduce data-loss prevention where it matters.
• Assess third-party and AI tool risk: Evolve how we review new SaaS apps, AI tools, OAuth grants and integrations, and define practical rules for the whole company.
• Defend against email threats: Maintain and improve phishing, malware and impersonation protection, plus user reporting.
• Detect and respond to incidents: Build detections on identity, endpoint, email and SaaS telemetry with Security Operations, threat-model our corporate estate, and help respond to incidents.
• Automate and support compliance: Use scripting, APIs, Infrastructure as Code and AI-assisted workflows to automate Security and IT processes, and provide controls and evidence for ISO/IEC 27001:2022 and other audits.

• 5+ years in security or IT engineering: Background in security engineering, IT/systems engineering, identity, or endpoint/network administration, with part of it focused on security.
• Hands-on identity and endpoint security: Experience securing a cloud-first company with an Identity Provider (SSO, MFA, conditional access) and managed endpoints (macOS especially) running EDR and MDM.
• SaaS security at scale: A track record of driving organisation-wide security changes on Google Workspace, Atlassian or Slack without blocking the business.
• Attacker mindset: Solid understanding of how attackers target corporate environments (phishing, credential and session theft, OAuth abuse, misconfigured SaaS) and how to stop them.
• Practical coding skills: Comfortable with Python or similar to automate your work.
• Email security fundamentals: Working knowledge of DMARC, SPF, DKIM, phishing and account takeover protection, and data-leak prevention.
• Self-driven communication: Able to prioritise by risk, balance project and operational work, see problems through, and adapt your message for executive, technical and non-technical audiences.

• Receive a competitive reward package – reevaluated each year – that includes salary, benefits, and pre-IPO equity
• Enjoy 28 days of paid vacation, plus an additional day after 2 and 4 years
• Make an impact on the environment and society with 1 (fully paid) Impact Day
• Receive generous family leave, child support, mental health support (including 24 sessions per year with Oli for yourself and 10 sessions for a significant other), and sabbatical opportunities
• We enjoy gathering for meals, cultural initiatives, and events like local Summer Sessions and year-end celebrations. There's also healthy snacks, drinks, and a weekly catered lunch.