Staff / Senior Staff Security Engineer, IT

VintedAmsterdamHybridFull-time18 Sept 2026

Vinted is seeking a Staff / Senior Staff Security Engineer to be the first dedicated security engineer in its IT organisation, owning the security of the corporate IT estate including endpoints, workforce identity, SaaS applications, and physical site networks. This hands-on engineering role requires deep experience securing corporate IT at scale, strong automation and scripting skills, and the ability to build a security practice from scratch.

What you'll do

Own the IT security roadmap end to end: threat-model the workplace estate, prioritise by real attack paths and drive risks to closure
Be a pragmatic evangelist for all things security: raise the security fluency of IT engineers and the wider workforce
Make every device Vinted issues or operates trustworthy by default: hardened, managed baselines across the Mac-first fleet and its Windows and Linux edges, least privilege on endpoints, endpoint detection and response, and device trust as a condition of access
Secure workforce identity as the perimeter: phishing-resistant authentication, joiner-mover-leaver automation, role-based and privileged access, four-eyes controls on high-risk actions, and time-bound access for contractors and community support agents
Own the security of the SaaS and business-application estate: configuration baselines, OAuth and API integrations, data flows between systems, shadow IT and shadow AI
Secure the network and hardware in Vinted's physical sites: office networks, secure remote access, and the standard IT builds for warehouses and electronics verification centres
Engineer security into how IT builds: automation and security solutions that enable resilience and align with business objectives
Build compliance as a code: maintain the risk register, prepare mitigation-or-acceptance decisions against centrally set thresholds, represent IT in Vinted security governance

What you need

Must-have

Endpoint managementDevice managementWorkforce identity and access managementSaaS securityBusiness application securityPythonGoInfrastructure as Code

Nice-to-have

OktaJamfGoogle WorkspaceAtlassianWorkatoFirmware securitySecure bootDevice attestation

Soft skills

Influence without authorityCommunicationPragmatic evangelismEngineering mindsetAbility to build from scratchTranslate technical risk to business consequence

Security EngineerIT SecurityCorporate ITEndpoint SecurityIdentity SecuritySaaS SecurityNetwork SecurityAutomationStaff LevelAmsterdam

/What you'll do

/What you need

Must-have

Nice-to-have

Soft skills

What you'll do

What you need