Cloud Security Engineer

GoDutchAmsterdamHybridFull-time2 weeks ago

GoDutch is seeking a Cloud Security Engineer (GCP) to be the first dedicated security engineer in its Engineering team, based in Amsterdam. The role involves owning the cloud security posture end to end, embedding security into CI/CD, and ensuring compliance with DORA, ISO 27001, and CIS Controls. Requires 5+ years in security or platform engineering, expert cloud security knowledge, and fluency in English with eligibility to work in the Netherlands.

What you'll do

Own the security posture of GoDutch's Google Cloud organisation: IAM, org policies, VPC Service Controls, KMS and secrets, logging and cloud posture management.
Harden the Kubernetes environment that hosts the banking platform, including workload isolation and least-privilege access between services.
Secure the event and orchestration layer (Kafka, Temporal, Apache Camel) and the data platform (BigQuery), including encryption, access and data residency.
Review and advise on the security of system designs, partner integrations and APIs (core banking, card processing, payments, KYC/KYB).
Build and maintain security dashboards that give management and the board a clear view of cloud assets and posture.
Work with engineering and the platform partner to embed security gates into CI/CD and GitOps (Argo CD): SAST, dependency and container scanning, IaC policy checks, secrets detection.
Establish secure development guidelines for Java/Quarkus and TypeScript services, and support teams in adopting them.
Run threat modelling for new features and integrations that move money or handle customer data.
Configure and tune threat detection, alerting and response playbooks across cloud workloads, observability and endpoints.
Participate in incident response, including security investigation and input for DORA major-incident classification and reporting.
Contribute security scenarios to business continuity and disaster recovery testing.
Coordinate penetration tests and, where in scope, threat-led testing; track findings to closure.
Turn GoDutch's information security policies and standards into implemented, evidenced controls, against CIS Controls, ISO 27001 and DORA.
Maintain the ICT asset register and vulnerability management process, and feed the GRC platform with control evidence.
Assess the ICT security of third-party providers and support the Register of Information and contract requirements under DORA.
Prepare evidence and answers for regulators, auditors and partner due diligence
Coordinate with GoDutch's managed service providers and external security partner, holding them to agreed scope and quality.
Run security training and awareness for engineering and the wider company.
Track security metrics and report on posture improvements to the CPTO and management.
Stay current with emerging threats and recommend tools and practices that fit a lean team.

What you need

Must-have

Google Cloud Platform (GCP)IAMKubernetesKafkaTemporalApache CamelBigQueryCI/CD

Nice-to-have

CISSPCCSPGoogle Professional Cloud Security EngineerGIACPCI DSSSEPAPSD2SASTDAST

Soft skills

Strong communication skillsAbility to explain security risk

Cloud SecurityGCPKubernetesFintechFinancial ServicesDevSecOpsDORAISO 27001CIS ControlsSecurity Engineer

/What you'll do

/What you need

Must-have

Nice-to-have

Soft skills

What you'll do

What you need