Security-Engineer, Platform-Security-Engineer, Cloud-Security-Engineer Jobs

Job Summary

Orbis is seeking a Staff Security Engineer to drive the security and trust architecture across Catalyst, our secure multi-cluster service mesh platform. You will set the patterns other engineers follow for authentication, authorization, and tenant isolation. We are looking for someone who has built platform-wide security architecture and wants to set technical direction for a team building critical infrastructure.

TRAVEL: International travel to Middle East and geopolitical hot zones, up to 25% per calendar year is required. Please apply only if you can meet this requirement.

Key Responsibilities

• Define the architecture for Catalyst's authentication and authorization layer (e.g., OIDC, OAuth2, and SAML, RBAC, ABAC models) and help set the patterns other engineers build against
• Drive reliability and security strategy for the trust layer: define SLOs and SLAs for authn/authz latency and availability, lead incident response for credential and access-control incidents, and design for safe revocation under partial failure
• Participate in on-call and incident response for our data platform including leading post-incident reviews, triage, prevention, and mitigation
• Define and implement secure-by-default developer patterns and infrastructure primitives to reduce security friction and eliminate common vulnerability classes (e.g., standardized authentication middleware, automated credential lifecycle management, and hardened service-to-service communication patterns using mTLS and SPIFFE/SPIRE)
• Define the QA philosophy and test strategy for the security layer, including threat modeling, adversarial test coverage, and session and revocation edge cases, and own the security quality gates in the deployment pipeline (e.g., integrating SCA, SAST, and container image scanning)
• Implement and review pull requests across session, token, and authentication systems ensuring that security, testing, and operational readiness
• Architect and implement encryptions at rest and in transit, key hierarchies, and HSM/KMS integration (e.g., using HashiCorp Vault or cloud-native KMS providers)
• Lead team rituals such as design discussions to improve culture, surface new ideas, risks, and strategies across the team
• Partner with security and IT teams to align on networking, observability, and identity patterns (e.g., including VPCs, network policies, IAM, and service mesh configurations) and ensure compliance with relevant industry standards (e.g., OWASP, ISO 27001, NIST, SOC 2)
• Lead offensive security and vulnerability discovery efforts (e.g., directing third-party penetration tests, conducting internal red-team exercises, regular security assessments and penetration testing) against core platform components to identify and remediate vulnerabilities
• Being a force multiplier by championing security programs, patterns, standards, and documentation
• Grow team capability through deliberate coaching; mentor senior engineers on secure API and protocol design
• Travel up to 25% for customer engagement, architecture reviews, or team collaboration (Middle East)

Required Qualifications

• Active security clearance Top Secret Clearance required.
• 7+ years of experience, with a track record of shaping whole platform or infrastructure security areas rather than individual features
• Deep hands-on experience designing and operating mTLS and TLS-based trust in distributed, multi-service systems, including certificate issuance, x509 validation, CA bundle management, and key rotation
• Proven experience building authorization engines and policy models from scratch, including designing the interfaces that other engineers implement against
• Strong background in identity and credential lifecycle: JWT and token issuance and verification, credential grants, session semantics, and revocation across federated or multi-tenant environments
• Fluency in Go and protobuf/gRPC service design, with experience securing gRPC contracts and service-to-service communication in a service mesh or comparable architecture
• A working threat modeling practice: you can reason about attacker paths across host and plugin boundaries, enrollment flows, and tenant isolation gaps, and translate that into concrete architecture
• Exceptional communication skills across technical and non-technical audiences; you routinely interface with customers, product leaders, and engineering teams to gather requirements, articulate security trade-offs, and drive alignment from initial design to delivery
• Has set technical direction others followed, and can point to a subsystem and explain what they built and what they'd do differently
• Travel up to 25% for customer engagement, architecture reviews, or team collaboration (Middle East)

Desired Qualifications

• Experience designing secure APIs for multi-tenant platforms, including tenant isolation guarantees and secure-by-default plugin or extension boundaries
• Familiarity with policy engines such as Cedar or OPA, with experience deciding when to build a custom authorization model versus adopt one
• Experience securing enrollment or bootstrap flows for fleets of untrusted or semi-trusted nodes joining a distributed system
• Background in national security, intelligence, or defense environments with direct understanding of mission-critical operational requirements.

Physical Requirements

• Prolonged periods of sitting at a desk and working on a computer
• Participation in virtual and in-person meetings
• Ability to attend planned meetings and/or work in classified spaces for extended periods within the specified work regions
• TRAVEL: International travel to Middle East and geopolitical hot zones, up to 25% per calendar year is required. Please apply only if you can meet this requirement

Originally posted on Himalayas

🧡 Coverflex

Work changed. Pay didn’t.

Coverflex exists to make compensation work for everyone.
Pay is still rigid, fragmented, and hard to feel.
We turn compensation into choice — one platform, one card, one app — for benefits, meal allowance, insurance and more.

Our platform is simple for HR and meaningful for employees.
We provide choice, smarter compensation tools and empowerment.

⚙️ TL;DR (The Essentials)

Role: Platform Security Engineer
Seniority Level: Senior
Type: Individual Contributor
Languages: English (main) / Portuguese / Spanish / Italian
Main Tools:AWS, Kubernetes, Terraform, GitHub Actions,Ubicloud, Datadog, CI/CD security scanning, identity and secrets management
Main Stack:Elixir/Phoenix, PostgreSQL, React Native (Expo)
Location: Remote (Europe only)
Compensation:

• Base Salary:50.000€ to 67.000€ gross yearly

• Bonus / Commissions: No

• Equity: Yes – Stock Options under our Equity Incentive Plan

• Benefits: All Coverflex benefits apply

• Contract Type: Permanent

💥 Your Impact

Your role will play a major role in our success because…
→ We look after people's benefits and personal data in several countries, so trust is at the heart of what we do. As we grow, you'll make sure our security grows with us. You'll bring deep security expertise to DevX, the team that builds the platform and paved road for our engineers, and you'll make the secure path the easiest path for everyone.

You’ll know you’re successful when, after 90 days, you’ve…
->Shipped your first secure-by-default workflow for production operations, with access that's controlled, auditable and easy to use
->Shaped how we run security in our delivery pipeline: priorities, response targets and automation
->Led a resilience exercise that sharpened our recovery playbooks

How we’ll measure success:

• Main KPI 1: More production operations running through secure, self-service and observable tooling

• Main KPI 2: Security findings caught early in the delivery pipeline and resolved quickly, with automation doing the heavy lifting

• Main KPI 3: Business continuity we can count on, with clear recovery targets that we test regularly

• Secondary KPI 1: Edge protection that adapts to our applications and keeps the user experience smooth

• Secondary KPI 2: Engineers adopt the security guardrails and are happy with them

⚡ Reality Check - What Makes This Role Hard

Let’s be real - here’s what makes this role challenging:

• You're a platform engineer first.Security is your main focus, but you're a full member of DevX. You'll share the team's wider work: infrastructure, CI/CD, developer tooling and experience, observability and incident troubleshooting. Expect a real share of your time on work that isn't about security.

• The challenge is to improve our security posture while improving developer experience, raising security awareness across engineering teams, and making the secure path the easiest path.

• A big part of the work is delivering meaningful, production-grade improvements without slowing developer throughput or impacting platform users. This requires clear prioritisation, safe rollout patterns, and tight feedback loops so we can move quickly while minimising operational risk and unnecessary friction.

👤 You

Must-haves (evidence, not years)

• Owned application or platform security in a production cloud environment, with clear examples of impact

• Strong cloud security fundamentals: IAM and identity plumbing (SSO/OIDC), secrets management, and least privilege in practice

• Strong platform engineering across infrastructure as code, CI/CD with security built in, and observability

• Strong experience running Kubernetes in production, including workload security and access controls

• Cloud networking and edge: VPC boundaries, DNS, TLS, load balancing, CDN and WAF tuning

• Reliability in practice: SLOs, on-call, threat modelling, incident command, and postmortems

• Backup, restore and disaster recovery designed and actually exercised

• Treats the platform as a product: measures adoption and developer experience

• Uses AI tooling to accelerate engineering work, and builds it into the platform (agents, MCP, assisted operations)

• Reads and writes code well enough to fix problems, not just report them

• Fluent English required

Nice-to-have

• ISO 27001, SOC 2 or DORA experience

• Fintech, payroll, or other regulated-data background

• Detection engineering or SIEM experience

• PostgreSQL operations and safe schema migrations

• Elixir, or comfort picking up a functional language

• Cloud cost awareness and FinOps practices

• Certifications welcome, but practical evidence weighs more

🧬 Your DNA

• Enabler, not a blocker:you make security the default through automation, paved-road patterns and self-service guardrails

• Builder at heart:you'd rather ship the fix than file the report, and you work alongside engineers to raise the bar together

• Pragmatic about risk:you weigh costs and benefits, explain trade-offs clearly, and prefer small, safe changes that add up

• Written-first communicator:you write decisions down and share context early so others can move fast

• Deeply curious:you dig into hard problems and incidents, then turn what you learn into tooling and better defaults

You’ll probably find this frustrating if…

• You see security as a gate to guard rather than a path to pave

• You prefer auditing and reporting to building and fixing things hands-on

• You measure progress in policies written rather than in real improvements

• You do your best work with a ready-made roadmap rather than shaping one yourself

👥 Manager & Team

Meet Your Manager

Hiring Manager: Rui Alves - Tech Lead, Platform Engineering
Location: Portugal
LinkedIn Profile:

Profile Snapshot:

• Energy:Steady and low-ego. I try to keep things calm, especially when priorities shift or incidents happen.

• Communication:Structured, transparent, and written-first when it helps. I document decisions, trade-offs, and next steps so alignment survives the meeting.

• Feedback Style:Direct and kind. I give feedback early and specifically, and I expect the same in return.

How to work with me - in the Manager's own words:

Expect a collaborative environment with clear priorities and a bias for small, safe changes that compound. I’ll help remove blockers, protect focus, and make sure we’re shipping work that improves both security posture and developer experience. I value calm, ownership, and good written communication.

Your Team

You’ll work day-to-day with:

• Tina,Platform Engineer,

• Hugo,Platform Engineer,

Key Stakeholders:

• Tiago Fernandes (CTO)

• Bruno Oliveira (VP Engineering)

• Luís Coelho (Quality Team Lead)

Team Rituals:

• Daily standup

• Weekly planning

• Bi-weekly retrospective

💜 Access & Belonging (Equal Opportunity)

We hire for impact and potential, not pedigree.
We welcome applications from people with non-linear careers, career breaks, caregiving gaps, and those changing fields.

No discrimination on the basis of age, disability, gender identity/expression, marital or family status, pregnancy, neurodivergence, race/ethnicity, religion/belief, sexual orientation, or any other protected ground.

Assessment fairness:
We anchor on evidence of outcomes (what you shipped, moved, or influenced).
We actively de-bias by using structured rubrics, multiple assessors, and blind screening most of the time (we won’t know your name, gender, or personal info until the interview stage).

📬 Application Clarity

No cover letter required.

Apply with your LinkedIn or upload your CV.
You will be asked a few short, relevant questions.

Total candidate time investment: ~5–6 hours end-to-end.

🧩 Hiring Stages (What to Expect, Why & How Long)

1. CV / LinkedIn Screen — Signal check vs must-haves

• Done by People + Hiring Manager.

• You’ll hear from us within 7 business days.

2. Quick Interview (Intro Call) — Mutual fit & context • 20-30 min
With DevX. Covers role scope, salary, location, and timeline.

3. Deep Dive: Engineering Mindset — How you think about engineering• 45–60 min
With DevX and an Engineering Manager.Built around outcomes, decisions, trade-offs and collaboration, using examples from your own experience.

4. Deep Dive: Technical — How you design and build • 45-60 min
With a Staff or Architecture engineer.A technical conversation about platform, cloud and security design, and the reasoning behind your choices.

5. Technical Pairing challenge — How you work hands-on • ≤90 min
With two DevX engineers. A practical infrastructure-as-code / CI/CD exercise. We look at how you approach the problem, how you work with others, and how you balance security with developer experience.

6. Culture Interview — Walkthrough + Q&A • 20–30 min
You’ll get actionable feedback either way.

7. Final Conversation (CEO / C-Level) — Values, strategy, and your growth • 30–45 min

🤖 AI & Hiring Tools Transparency

We use a few tools to reduce bias and improve documentation, not to make hiring decisions.

• Teamtailor anonymisation: profiles are reviewed without relying on names/personal identifiers.

• Meeting recording tools (e.g., ): may be used to capture interviews so we can focus on the conversation.

• LLM: may be used to turn interview notes/transcripts into clear, structured summaries.

⏱️ Speed & Communication

• Decision: within 4 weeks of your application.

• Updates: weekly if the process runs longer.

• Scheduling:interviews between 10:00–16:00 CET (flexible across Europe).

• Feedback:from the Deep Dive: Engineering Mindset stage onwards, you’ll always receive written or verbal feedback - what went well, and what to strengthen next time.

Originally posted on Himalayas