Principal Security Engineer

ParkBeeAmsterdamOn-siteFull-time1 week ago

ParkBee is seeking a Principal Security Engineer to define, build and lead security across its entire platform, including applications, AWS cloud infrastructure, on-site hardware and AI usage. The role requires 7–10 years of engineering experience with at least 3 years focused on security, deep hands-on application and infrastructure security expertise, and the ability to influence without authority.

What you'll do

Own security across ParkBee and set its direction: define the strategy, standards and roadmap, decide how security is done here, and be accountable for it across engineering, Platform and Ops.
Run vulnerability management end to end - triage, prioritise and close findings from HackerOne and our scanning, own the bug-bounty and penetration-testing programmes, and lead incident response with root-cause fixes.
Mature how we build securely: extend the code scanning we already run, add dependency, secret and container scanning where it's missing, introduce threat modelling at design review, and set gates that catch issues before release.
Set up proactive security monitoring and threat detection - choose the tooling, define alerting, drive adoption, and cover phishing and brand/domain abuse.
Partner with the Platform team to keep infrastructure security at a high bar - review the AWS/EKS setup and flag where IAM, network security, IaC or Kubernetes hardening needs strengthening.
Partner with Ops to secure our on-site technology: ANPR and access-control hardware, network segmentation at locations, and secure installation standards.
Raise the security bar across the company: run a security-champions and awareness programme, apply frameworks pragmatically (OWASP, ISO 27001, SOC 2, GDPR), and own audits and third-party/vendor risk.
Govern how we build with and use AI - set the guardrails for AI-assisted development and company-wide AI use, including review of AI-generated code and how AI handles our data.

What you need

Must-have

Secure SDLCThreat modellingSecure code reviewCI/CD security controlsSASTSCASecret scanningContainer scanning

Nice-to-have

TypeScriptC#/.NETNode.jsReact NativeHardware/IoT securityPhysical-site securityANPRAccess-control hardware

Soft skills

Influence without authorityRisk-based judgementCross-functional leadershipOwnershipAccountability

Security EngineeringCloud SecurityAWSKubernetesVulnerability ManagementIncident ResponseAI SecurityParkingUrban MobilityTechnology

/What you'll do

/What you need

Must-have

Nice-to-have

Soft skills

What you'll do

What you need