Security Engineer

Company Description

Cărturești is Romania's leading bookstore and cultural retail chain: over 60 bookstores, carturesti.ro, a

warehouse operation and a mobile app. We take card payments in stores and online, look after

customer and loyalty data, and file directly into ANAF's fiscal systems.

We are building our security operations capability, and this role sits at its centre. You report directly to

the CTO, and your job is to make security true in production implemented, monitored and evidenced,

not just written down.

Responsibilities

This role is responsible for designing, implementing, and maintaining security controls that protect Cărtureşti’s applications, networks, and information systems. Day-to-day activities include monitoring security events, analyzing vulnerabilities, coordinating remediation efforts with IT and development teams, and ensuring secure configurations across infrastructure and cloud services.

The Security Engineer will develop and enforce security policies and standards, perform risk assessments, support incident response and forensic analysis, and contribute to security awareness initiatives for employees.

Collaboration with internal stakeholders is essential to integrate security best practices into ongoing projects and to continuously improve the organization’s cybersecurity posture.

What you'll do

• Own identity and access: least privilege, access reviews and privileged accounts across Active Directory, Google Workspace, the ERP and our databases
• Harden servers, networks, databases, store infrastructure and POS terminals against CIS-style baselines, written as Ansible code rather than documents
• Run vulnerability management end to end: scanning, triage by real risk, and remediation driven through teams that don't report to you
• Introduce secrets management, and build SAST, DAST and dependency scanning into our Gitea Actions pipelines
• Grow our Prometheus, Grafana and Loki stack into security detection, and be first responder when something goes wrong
• Produce GDPR and PCI DSS evidence from live systems, and grow into owning security architecture over your first year

The environment

Mixed Windows and Linux, mostly on-premise: a PHP eCommerce Platform, .NET / MS-SQL ERP and POS,

a warehouse system, a Flutter app and around 60 store networks, managed with Ansible. Legacy and

modernisation side by side — we'll walk you through it honestly in the interview.

What you bring

• Hands-on experience securing production systems in a mixed Windows and Linux environment
• Solid Active Directory security: privileged access, Group Policy, common attack paths
• Network security: segmentation, firewall rule design, secure remote access
• Vulnerability management, and real incident response under time pressure
• Enough PHP and .NET reading to judge risk in code and configuration
• Working knowledge of GDPR controls and of PCI DSS for a merchant
• Romanian and English at professional level

Nice to have : scripting (PowerShell, Python, Bash), Ansible, SIEM build-out, CI/CD security tooling

(GitHub Actions experience transfers directly), retail and POS environments, container security.

Certifications such as CISSP, Security+, OSCP, GCIH or CISM are welcome as evidence, never required.

We assess capability, however you acquired it. No specific degree, and no previous "security" job title needed. If you meet most of the requirements, apply.

What we offer:

• Real ownership and a direct line to the CTO;

• Hybrid work schedule in Bucharest, on-site at the datacenter and in stores when needed;

• A company built around books and culture;

• Competitive salary, based on experience;

• Meal, gift, and cultural vouchers (in accordance with current legislation);

• Transportation allowance;

• Private medical insurance;

• Flexible benefits budget via the Benefit platform;

• Day off on your birthday and additional paid leave based on company tenure;

• Employee discount on all Cărturești purchases.