Staff / Senior Staff Security Engineer, Vinted Pay

Responsibilities

We are representing a confidential fintech organization seeking a Staff / Senior Staff Security Engineer to own the security roadmap for their regulated payments business. This is a hands-on engineering role with strategic scope, working at the intersection of payments architecture, multi-jurisdiction regulatory compliance, and high-scale infrastructure security.

In this position, you will:

• Own the end-to-end security roadmap for the payments business: assess the estate, prioritize by real attack paths, and drive risks to closure through multi-quarter planning that shapes defensive architecture rather than reacting to audit findings.
• Translate regulatory requirements (PCI DSS, DORA, FCA, Bank of Lithuania) into practical, automated security controls and engineering guardrails—compliance as a by-product of how systems are built, not a parallel workstream.
• Conduct deep technical reviews of AWS infrastructure, payment pipelines, SIEM and logging, and vulnerability management tooling, fixing what you find based on exposure rather than finding count.
• Own PCI DSS and data protection architecture: payment page isolation, script monitoring, data encryption, and least-privilege access across multi-region environments, turning controls into evidence that withstands assessor and regulator scrutiny.
• Lead cross-functional security initiatives across platform and engineering teams, driving them to delivery whether execution sits with partner teams or requires direct code contribution.
• Act as the technical arm of the payments security function: maintain the risk register, prepare mitigation-or-acceptance decisions, and represent the business in group security governance.
• Embed secure development practices into engineering workflows so security lands at design time, raising the security fluency of engineers to enable risk-based decisions without bottlenecks.

What We're Looking For

• Strong hands-on security engineering experience built on a solid engineering foundation—you have built or run large production systems, can threat-model a payment flow, identify attack paths, and drive or build the fix.
• Experience in regulated payments or fintech, working under PCI DSS and a financial regulator (FCA, Bank of Lithuania, CSSF, or equivalent), with knowledge of how requirements translate into operational controls.
• A staff- or principal-level track record: you have defined, led, and delivered major technical initiatives and set security direction through software design on high-scale, distributed systems.
• The range to move across staff engineering archetypes (tech lead, architect, solver, right hand), selecting the approach the domain needs rather than personal preference.
• A working style that engineers respect: evidence over assertions, attack paths over checklists, guardrails over gates.
• Demonstrated ability to influence without authority and translate technical risk into business consequence for senior audiences.
• Comfort with the technology stack: Ruby on Rails, Go, MySQL, Temporal, AWS, SIEM and CSPM tooling—or eagerness to learn with genuine interest in security and privacy as a field.
• Excellent written and spoken English.

Advantages:

• Experience building and running systems at massive scale (2+ million requests per minute).
• Deep knowledge of observability tooling (Kibana, Grafana, Prometheus).
• AWS security depth (IAM, KMS, multi-account and multi-region architecture), or hands-on CSPM and SIEM engineering.
• Privacy engineering experience or offensive security background/certifications (e.g. OSCP).

If this role excites you but you don't tick every box, we'd still like to hear from you.

How We Work With You

Candidates apply through Get A Job.ai. Our talent team will conduct an initial screening to understand your background and match you with the right opportunity. If there's a strong fit, we'll submit your profile to our client for consideration. Please do not contact the client directly—all communication and coordination will be managed through our recruiting team to ensure a smooth and confidential process.

Pay

This role is based in London with a hybrid work model (2 recommended office days per week). No pay information has been provided for positions placed through Get A Job.ai for this listing. Compensation details will be discussed during the screening process.

Equal Opportunity: Get A Job.ai is committed to inclusive hiring practices. We welcome applications from candidates of all backgrounds and experiences.