8 hours ago
London, United KingdomStaff+
Responsibilities
- Own and drive Vinted Pay’s multi-quarter security roadmap based on attack paths, exposure, and risk.
- Translate PCI DSS, DORA, Bank of Lithuania, and FCA requirements into practical automated controls and engineering guardrails.
- Review and remediate AWS infrastructure, payment pipelines, SIEM and logging, and vulnerability management capabilities.
- Own PCI DSS and data protection architecture, including payment page isolation, script monitoring, encryption, and least-privilege access.
- Lead cross-functional security initiatives across Payments Platform, Payments Engineering, and Group Security, including hands-on implementation where needed.
- Maintain the security risk register, prepare mitigation or acceptance decisions, and represent Vinted Pay in security governance.
- Embed secure development practices into Payments Engineering and improve engineers’ security fluency.
Requirements
- Strong hands-on security engineering experience with large production systems, threat modeling, attack-path analysis, and remediation.
- Experience in regulated payments or fintech under PCI DSS and a financial regulator such as the FCA, Bank of Lithuania, CSSF, or equivalent.
- Staff- or principal-level experience defining, leading, and delivering major company-wide technical initiatives on high-scale distributed systems.
- Ability to operate across technical leadership, architecture, problem solving, and trusted-advisor responsibilities while influencing without authority.
- Experience translating technical risk into business consequences for senior internal and external audiences.
- Familiarity with Ruby on Rails, Go, MySQL, Temporal, AWS, SIEM, and CSPM tooling, or willingness to learn them.
- Excellent written and spoken English.
- Experience with systems operating at massive scale, including 2+ million requests per minute, is advantageous.
- Deep knowledge of Kibana, Grafana, Prometheus, AWS IAM, AWS KMS, multi-account and multi-region architecture, CSPM, SIEM engineering, privacy engineering, offensive security, or certifications such as OSCP is advantageous.
Benefits
- Share options programme.
- 25 working days of holiday.
- Newest MacBook models.
- Home-office IT equipment and up to €540 for home workplace furniture.
- Confidential Employee Assistance Program for employees and families.
- Comprehensive medical insurance.
- Group life and income protection insurance.
- Matched pension scheme up to a set limit.
- Discounted gym membership plan, lunch benefit, team-building events, and a personal monthly Vinted shopping budget.
- Remote workation of up to 90 days per year in the EU, including up to 21 global days, with different limits for non-EU citizens.
- Annual learning budget starting at €3,000 and up to 10 working days over two years for professional development.
- Hybrid work model with two recommended office days per week.
About Vinted
Vinted runs a consumer-to-consumer marketplace and app for buying and selling second-hand fashion and related items across Europe. It monetizes through transaction-related fees, buyer protection, and shipping services, and also operates Vinted Go for logistics and Vinted Pay for payments. Founded in 2008 and headquartered in Vilnius, Lithuania, the platform serves members in 20+ European markets.