6 days ago
Amsterdam, NetherlandsStaff+
Responsibilities
- Own and execute Vinted Pay’s multi-quarter security roadmap, prioritizing real attack paths and driving risks to closure.
- Translate PCI DSS, DORA, Bank of Lithuania, and FCA requirements into automated security controls and engineering guardrails.
- Review and improve AWS infrastructure, payment pipelines, SIEM and logging, and vulnerability management tooling such as Wiz.
- Own PCI DSS and data protection architecture, including payment-page isolation, script monitoring, encryption, and least-privilege access.
- Lead cross-functional security initiatives across Payments Platform, Payments Engineering, and Group Security, writing code when necessary.
- Maintain the risk register, prepare mitigation-or-acceptance decisions, and represent Vinted Pay in security governance.
- Embed secure development into Payments Engineering and improve engineers’ security fluency.
Requirements
- Strong hands-on security engineering experience with large production systems and the ability to threat-model payment flows and drive or build fixes.
- Experience working in regulated payments or fintech under PCI DSS and a financial regulator such as the FCA, Bank of Lithuania, or equivalent.
- Staff- or principal-level experience defining, leading, and delivering major company-wide technical initiatives.
- Ability to operate across technical leadership, architecture, problem solving, and trusted-advisor responsibilities while influencing without authority.
- Experience translating technical risk into business consequences for senior internal and external audiences.
- Familiarity with Ruby on Rails, Go, MySQL, Temporal, AWS, SIEM, and CSPM tooling, or willingness to learn them.
- Excellent written and spoken English.
- Advantageous qualifications include experience at massive scale, deep knowledge of Kibana, Grafana, and Prometheus, AWS security expertise including IAM and KMS, multi-account and multi-region architecture experience, hands-on Wiz or SIEM engineering, privacy engineering, offensive security, or OSCP certification.
Benefits
- Share options programme.
- 25 days of paid annual leave.
- Newest MacBook models.
- Confidential Employee Assistance Program for the employee and family.
- Frequent team-building events.
- Home-office IT equipment and a personal budget of up to €540 for workplace furniture.
- Daily lunch allowance, company bike leasing, flexible benefits budget, Work from Home allowance, Collective Defined Contribution Pension plan, personal monthly Vinted shopping budget, NS mobility card, and dog-friendly office.
- Workation policy allowing remote work for up to 90 days per year in the EU, including up to 21 global days, with a 21-day worldwide allowance for non-EU citizens.
- Annual learning budget starting at €3,000 and up to 10 working days over two years for development.
- Hybrid work with two recommended office days per week.
About Vinted
Vinted runs a consumer-to-consumer marketplace and app for buying and selling second-hand fashion and related items across Europe. It monetizes through transaction-related fees, buyer protection, and shipping services, and also operates Vinted Go for logistics and Vinted Pay for payments. Founded in 2008 and headquartered in Vilnius, Lithuania, the platform serves members in 20+ European markets.