2 days ago
Kaunas, LithuaniaSenior / Staff+
Responsibilities
- Own Vinted Pay’s multi-quarter security roadmap, assess the estate, prioritize real attack paths, and drive risks to closure.
- Translate PCI DSS, DORA, Bank of Lithuania, and FCA requirements into automated security controls and engineering guardrails.
- Review and improve AWS infrastructure, payment pipelines, SIEM and logging, and vulnerability-management tooling.
- Own PCI DSS and data-protection architecture, including payment-page isolation, script monitoring, encryption, and least-privilege access across multi-region environments.
- Lead cross-functional security initiatives across Payments Platform, Payments Engineering, and Group Security, writing code when necessary.
- Maintain the risk register, prepare mitigation-or-acceptance decisions, and represent Vinted Pay in security governance.
- Embed secure development into Payments engineering and improve engineers’ security fluency.
Requirements
- Strong hands-on security engineering experience with large production systems, threat modeling, attack-path analysis, and remediation.
- Experience in regulated payments or fintech under PCI DSS and a financial regulator such as the FCA, Bank of Lithuania, CSSF, or equivalent.
- Staff- or principal-level experience defining, leading, and delivering major company-wide technical initiatives on high-scale distributed systems.
- Ability to operate as a technical lead, architect, solver, and right hand while influencing without authority and communicating technical risk to senior audiences.
- Familiarity with Ruby on Rails, Go, MySQL, Temporal, AWS, SIEM, and CSPM tooling, or willingness to learn them.
- Excellent written and spoken English.
- Experience with systems at massive scale, including 2+ million requests per minute, is an advantage.
- Knowledge of Kibana, Grafana, Prometheus, AWS IAM and KMS, multi-account and multi-region architecture, CSPM, SIEM engineering, privacy engineering, offensive security, or OSCP certification is advantageous.
Benefits
- Share options programme, private health insurance, confidential Employee Assistance Program, team-building events, and a personal monthly Vinted shopping budget.
- 25 working days of holiday and access to the tools and technology needed for work.
- Home-office IT equipment and up to €540 for home workplace furniture.
- Hybrid work with two recommended office days per week.
- Workation policy allowing remote work for up to 90 days per year in the EU, including up to 21 global days, with different terms for non-EU citizens.
- Annual learning budget starting at €3,000 and up to 10 working days over two years for development.
- Dog-friendly offices; Vilnius offers a gym and in-house meals, while Kaunas offers a monthly lunch allowance plus weekly lunch and breakfast.
About Vinted
Vinted runs a consumer-to-consumer marketplace and app for buying and selling second-hand fashion and related items across Europe. It monetizes through transaction-related fees, buyer protection, and shipping services, and also operates Vinted Go for logistics and Vinted Pay for payments. Founded in 2008 and headquartered in Vilnius, Lithuania, the platform serves members in 20+ European markets.