About Vinted
Vinted operates a second-hand marketplace connecting members who buy and sell pre-loved clothing and lifestyle items. Its business units also provide shipping services through a network of pick-up and drop-off points and secure payment services integrated into the Vinted app.
Responsibilities
•Own the IT security roadmap, threat-model the workplace estate, prioritise risks by real attack paths, and drive them to closure
•Raise security fluency among IT engineers and the wider workforce, enabling sound risk-based decisions
•Establish hardened, managed security baselines across the Mac-first device fleet and its Windows and Linux endpoints, covering least privilege, endpoint detection and response, device trust, and the full device lifecycle
•Secure workforce identity through phishing-resistant authentication, joiner-mover-leaver automation, role-based and privileged access, four-eyes controls, and time-bound access for contractors and community support agents
•Secure the SaaS and business-application estate, including configuration baselines, OAuth and API integrations, data flows, shadow IT, and shadow AI
•Secure networks and hardware at offices, warehouses, and electronics verification centres, including remote access and the boundary with Vinted Go's security team
•Engineer security automation and solutions that improve resilience, align with business objectives, and continuously close security gaps
•Maintain the risk register, prepare mitigation-or-acceptance decisions against central thresholds, represent IT in security governance, and make evidence integral to compliance processes
Requirements
•Deep hands-on experience securing a corporate IT estate at scale, including endpoints and device management, workforce identity and access, SaaS, and business applications
•Ability to identify attack paths and drive or build fixes
•Apply an engineering mindset to IT; automate and script in Python, Go, or similar; manage identity and infrastructure as code; and build controls as products
•Ability to build a security practice from scratch within an IT or infrastructure organisation, including in a low-maturity environment
•Experience securing networks and devices at physical sites such as warehouses, labs, verification or repair centres, or willingness to do so
•Influence without authority and translate technical risk into business consequences for senior audiences
•Excellent written and spoken English
Nice to have
•Experience with Okta, Jamf, Google Workspace, Atlassian, Workato, or equivalents
•Hardware and device security, including firmware, secure boot, device attestation, peripheral and USB threats, and EDR engineering
•Offensive security or certifications such as OSCP
•Detection engineering on identity and endpoint telemetry
•ISO 27001 or NIS2 implementation in workplace scope
Conditions
•Annual gross salary: €121,600—€205,200, excluding 8% holiday pay
•Share options programme
•25 days of paid annual leave
•Newest MacBook models
•Confidential Employee Assistance Program for the employee and their family
•Frequent team-building events
•Home office equipment and a personal budget of up to €540 for home workplace furniture
•Daily lunch allowance
•Company bike leasing scheme
•Monthly budget for a flexible benefits platform
•Work from Home allowance
•Collective Defined Contribution Pension plan
•Personal monthly budget for shopping on Vinted
•NS mobility card
•Dog-friendly office
•Workation policy: up to 90 days per year in the EU, including 21 days globally; for non-EU citizens, 21 days worldwide — can be combined with vacation or personal time
•Individual learning budget starting at €3,000 per year and up to 10 working days over a 2-year period for personal and professional development
