2 days ago
Amsterdam, NetherlandsStaff+
Responsibilities
- Own and execute a multi-quarter Vinted Pay security roadmap based on real attack paths and exposure.
- Translate PCI DSS, DORA, Bank of Lithuania, and FCA requirements into practical automated controls and engineering guardrails.
- Review and improve AWS infrastructure, payment pipelines, SIEM and logging, vulnerability management, and security monitoring.
- Own PCI DSS and data protection architecture, including payment-page isolation, script monitoring, encryption, and least-privilege access.
- Lead cross-functional security initiatives across Payments Platform, Payments Engineering, and Group Security, writing code when necessary.
- Maintain the security risk register, prepare mitigation or acceptance decisions, and represent Vinted Pay in security governance.
- Embed secure development practices into Payments engineering and improve engineers’ security fluency.
Requirements
- Strong hands-on security engineering experience building or operating large production systems and threat-modeling payment flows.
- Experience in regulated payments or fintech under PCI DSS and a financial regulator such as the FCA, Bank of Lithuania, CSSF, or equivalent.
- Staff- or principal-level experience defining, leading, and delivering major company-wide technical initiatives on high-scale distributed systems.
- Ability to operate across technical leadership, architecture, problem solving, and strategic partnership roles.
- Ability to influence without authority and communicate technical risk as business consequence to senior internal and external audiences.
- Experience with or willingness to learn Ruby on Rails, Go, MySQL, Temporal, AWS, SIEM, and CSPM tooling.
- Excellent written and spoken English.
- Preferred: experience with systems operating at 2+ million requests per minute and observability tools such as Kibana, Grafana, and Prometheus.
- Preferred: AWS security expertise including IAM, KMS, multi-account, and multi-region architecture, or hands-on CSPM and SIEM engineering.
- Preferred: privacy engineering, offensive security experience, or certifications such as OSCP.
Benefits
- Share options programme, 25 days of paid annual leave, newest MacBook models, and confidential Employee Assistance Program for employees and families.
- Home-office IT equipment and up to €540 for home workplace furniture, daily lunch allowance, company bike leasing, flexible benefits budget, Work from Home allowance, pension plan, Vinted shopping budget, NS mobility card, and dog-friendly office.
- Workation policy allows remote work for up to 90 days per year in the EU, including up to 21 days globally, with a separate 21-day worldwide allowance for non-EU citizens.
- Hybrid work model with two recommended office days per week.
- Annual learning budget starting at €3,000 and up to 10 working days over two years for professional development.
About Vinted
Vinted runs a consumer-to-consumer marketplace and app for buying and selling second-hand fashion and related items across Europe. It monetizes through transaction-related fees, buyer protection, and shipping services, and also operates Vinted Go for logistics and Vinted Pay for payments. Founded in 2008 and headquartered in Vilnius, Lithuania, the platform serves members in 20+ European markets.