What is the role about?

As a senior security engineer you play a vital role in configuring and maintaining security gates within the development process, supporting development teams with implementing security layers within their services that maintains the information security at the desired level. This is all done with a shift left approach where automation is key to get relevant security information fast. Your expertise in secure coding best practices and vulnerability assessment will be critical in safeguarding our applications against potential threats. 

How will you make an impact?

• Defect / vulnerability management: Conduct regular security assessments and code reviews to identify vulnerabilities in web and mobile applications and automate this defect management process, to assess defects based on risk based insights and act accordingly
• Web application security: Support and implement preventive security measures that mitigate known security risks (OWASP, MITRE) and test these by means of  penetration testing
• Continuous improvement: Identify opportunities for process improvement, automation, and optimization of security-related tasks. Encourage innovation and creative problem-solving to enhance the overall security posture of the company
• Threat modelling: Perform threat modelling sessions with the development teams to catch potential security risks early in the process and provide appropriate countermeasures.

How will you be successful?

• Have at least 8 years of relevant experience, with a few of them preferably spend in the financial/tech/trading space
• Excellent experience in pipeline automation (GitHub Actions, (Kubernetes) Cron jobs)
• Strong experience with defect management and how to implement this within the organisation
• Experience with identity and access management (AWS IAM, Auth0, Open Policy Agent)
• Strong experience with implementing security measures for common security risks (OWASP top 10)
• Typescript, Kotlin and Python are languages that you are proficient in 
• Strong analytical and problem-solving skills, with the ability to think like an attacker to anticipate and prevent security issues
• Trustworthy, reliable and committed to ethical behaviour and integrity across all aspects of your role
• Strong Communication: Excellent communication and interpersonal skills, capable of presenting complex technical concepts to both technical and non-technical stakeholders
• Experience with web applications firewalls (Cloudflare, AWS WAF) are a plus
• Any security certifications are a plus (CISSP, CPTS, OSCP, AWS Security+)

At Bitvavo, we believe that diverse perspectives drive innovation, foster creativity, and lead to better outcomes. We are committed to building a team that reflects the diversity of the communities we serve and creating an inclusive environment where everyone can thrive.We welcome applicants of all backgrounds, identities, and experiences. Regardless of race, ethnicity, gender, sexual orientation, age, religion, ability, or any other characteristic. Join us and be part of a team that values and celebrates your unique contributions.

Bitvavo does not accept resumes from staffing, search, or recruitment firms without a signed agreement. If you send us a resume without such an agreement, we may contact the candidate directly without any obligation whatsoever and no fee of any kind will be paid should we hire the candidate.