About Catawiki
Catawiki is a marketplace for buying and selling special objects. Each week, more than 100,000 unique items are auctioned, carefully curated by in-house experts.
Responsibilities
•Manage and develop the security team through regular one-to-ones, feedback, performance reviews and career development; address underperformance and support hiring and onboarding
•Own the security engineering roadmap, prioritise work based on risk, business needs and team capacity, delegate effectively and remove blockers
•Build security controls and automation, review code and guide technical decisions across applications, cloud infrastructure and software delivery
•Partner with Product and Platform Engineering early in design, lead threat modelling and security reviews, and help teams choose practical secure approaches
•Improve vulnerability management by assessing findings in context, agreeing remediation priorities with system owners and tracking issues through resolution
•Improve security checks in CI/CD and infrastructure as code, including dependency and secret scanning; reduce false positives and help engineers act on findings
•Coordinate the security team's technical contribution to incident response and investigations, and turn lessons into improvements to detection, response and preventive controls
•Work with Legal, IT and Trust & Safety on security controls, policies and audit evidence where responsibilities overlap
•Measure and communicate progress through remediation times, control coverage and adoption; explain risks, delivery progress and trade-offs to stakeholders
Requirements
•Substantial hands-on security engineering experience in a software or cloud environment, including implementing and operating security capabilities in production
•Previous experience managing engineers as direct reports, including performance reviews, career development and difficult feedback
•Experience owning a security roadmap or programme, translating priorities into deliverable work and coordinating implementation across engineering teams
•Strong knowledge of application and cloud security, including identity and access management, secrets management and secure software development
•Experience in threat modelling, secure code and design reviews, vulnerability prioritisation and practical incident response
•Ability to develop or automate in Ruby, Python, Go or a similar language; comfortable reviewing backend code and integrating security controls into engineering workflows
•Clear communication with engineers and non-technical partners; ability to explain risk in business terms and gain support when priorities compete
Nice to have
•Google Cloud, Kubernetes and Terraform or similar infrastructure tooling
•Experience in a marketplace, e-commerce or other software product business, including account and API security
•Experience securing AI-enabled applications, agents or data pipelines, or using AI to improve security engineering workflows
Benefits
•€100 Catavoucher upon joining and €50 Catavoucher on your birthday
•One extra day off each year to "Pursue Your Passion"; additional leave for key work anniversaries and important life events
•Benefits may vary by location
