About Catawiki
Catawiki is a marketplace for buying and selling special objects. Each week, more than 100,000 unique items are auctioned, carefully curated by in-house experts. It has sold over 25 million unique objects and aims to become the world's most popular destination for special objects.
Responsibilities
•Shape the security engineering roadmap and lead complex initiatives from assessment and design through implementation, rollout, and ongoing operation
•Design and build security controls and automation across applications, cloud infrastructure, identity and access, CI/CD, and infrastructure as code
•Lead threat modelling and secure code and design reviews, identifying risks early and agreeing practical changes with engineering teams before systems reach production
•Investigate vulnerabilities and recurring security weaknesses, prioritise findings based on exposure and business impact, work with system owners on remediation, and build reusable controls to prevent recurrence
•Improve security checks in engineering workflows, including dependency and secret scanning; reduce false positives and make findings easier for developers to understand and resolve
•Contribute to security incident investigations and response, improve detection and response tooling, and use incident lessons to strengthen preventive controls
•Mentor security engineers and help product engineers develop security skills through technical guidance, documentation, and practical training
•Work with Legal, IT, and Trust & Safety on technical security controls, policies, and audit evidence where responsibilities overlap
•Measure the effectiveness and adoption of delivered controls, and communicate progress, technical decisions, and remaining risks to engineering and business stakeholders
Requirements
•Substantial hands-on security engineering experience in a software or cloud environment, with a track record of delivering security improvements across multiple teams
•Strong knowledge of application and cloud security, including identity and access management, secrets management, and secure software development
•Experience leading threat modelling, secure code and design reviews, and complex remediation work, turning findings into solutions engineers adopt
•Ability to develop or automate in Ruby, Python, Go, or a similar language, and review backend code
•Experience building and operating security tooling or controls in production
•Experience integrating security into CI/CD, cloud infrastructure, or infrastructure as code, and making sound trade-offs between risk reduction and engineering effort
•Experience contributing to security incident investigations or responses and working effectively under pressure
•Experience leading technical initiatives and mentoring engineers; interest in developing leadership skills, including potentially taking on people management in the future
•Ability to influence through technical credibility and collaboration, explain risks clearly to different audiences, and take responsibility for seeing complex work through to completion
Nice to have
•Google Cloud, Kubernetes, and Terraform or similar infrastructure tooling
•Experience in a marketplace, e-commerce, or another software product business, including account and API security
•Experience securing AI-enabled applications, agents, or data pipelines, or using AI to improve security engineering workflows
Conditions
•Receive a €100 Catavoucher when joining and a €50 Catavoucher on your birthday
•One extra day off each year to "Pursue Your Passion," plus additional leave for key work anniversaries and important life events
•Benefits may vary by location
•Hybrid setup with a minimum of two days per week in the office, unless the role is explicitly stated as fully remote or fully office-based
•Apply with an English CV and Cover Letter
