Senior Security Engineer

Quick Facts

• Start: ASAP or in 1 months
• Duration: ongoing contract
• Notice period: 30 days mutual
• Setup: Hybrid from Stockholm (2/3 days per week in the office)

Description

Secure the platform by owning the security posture of cloud infrastructure and the Kubernetes platform, covering identity and access, network segmentation, secrets management, encryption, workload hardening and logging, and alerting/detection. Build guardrails so secure is the default path for engineers; embed security in product development through threat modelling, secure design reviews, and a pragmatic secure SDLC; and run/tune code, dependency and container scanning with triage and coordination of penetration tests and bug reports through remediation. Turn compliance into engineering by implementing and evidencing technical controls for ISO/IEC 27001, NIS2 and NIST CSF, automating evidence collection where possible, supporting audits, translating requirements into backlog items, and raising the bar on corporate IT security for identity provider, endpoint management, SaaS integrations, and office networks; own incident response, run security risk assessments, and share knowledge via workshops to build a culture where security is everyone’s concern.

Responsibilities

• Own the security posture of cloud infrastructure and Kubernetes
• Identity and access management, network segmentation, secrets management, encryption
• Workload hardening, logging, alerting, and detection
• Build security guardrails for engineers
• Threat modeling and secure design reviews
• Secure SDLC integration
• Run and tune code, dependency, and container scanning; triage findings
• Coordinate penetration tests and bug reports to remediation
• Implement and evidence controls for ISO/IEC 27001, NIS2, and NIST CSF
• Automate evidence collection; support audits and backlog translation
• Strengthen corporate IT security: identity provider, endpoint management, SaaS integrations, office networks
• Maintain and run incident response runbooks
• Lead technical investigation and containment; drive post-incident learnings
• Conduct security risk assessments for systems, integrations, vendors
• Provide balanced recommendations (risk vs speed)
• Run workshops and champion a security culture

Requirements

• Several years of hands-on security engineering experience in a modern, cloud-native software company
• Deep comfort in at least one major cloud (preferably AWS) and with Kubernetes
• Experience with infrastructure as code and CI/CD pipelines
• Ability to read and write code; preference for automating controls
• Practical toolset understanding: identity federation and SSO, secrets and key management, logging and monitoring, vulnerability management, backups and disaster recovery
• Translate ISO 27001, NIS2 or SOC 2 into concrete technical controls and audit evidence; explain control operation to auditors and importance to engineers
• Experience running threat modeling sessions or security assessments with product teams
• Clear communication with legal, engineering, and leadership; comfortable hosting workshops and debugging IAM policies
• High autonomy; drive initiatives end to end and proactively improve security
• Curiosity to keep up with threat landscape and industry trends; enjoy helping others level up

Benefits

• Ongoing contract role with hybrid work from Stockholm
• Opportunity to secure production and corporate environments end to end: guardrails, compliance engineering, audit support, incident response, and risk assessments
• Autonomy to drive initiatives and improve security practices through workshops and knowledge sharing