Security Engineering Lead

• Upvest is at the inflection point where security needs to scale and remain a foundational discipline of the company
• We’re hiring a Security Engineering Lead to step into our lean and efficient Security team, set its multi-quarter direction, work cross-functionally and scale Security Engineering into a team that continues to own Upvest’s entire application security and cloud security posture in a highly regulated environment as it scales
• This role sits alongside our Security Operations and GRC teams, which owns detection, response, and compliance operations
• Where SecOps keeps watch over what’s happening now, Security Engineering shapes what we build and how we build it, embedding security into the SDLC, hardening our cloud environment, and building the platforms that make security teams more effective
• You will own the secure paved roads every Upvest engineer relies on: automated SAST/DAST/SCA in our GitHub Actions pipelines, SSDLC adherence, IAM and network controls, and the technical implementation of DORA’s (and other regulations’) ICT risk framework for our platform
• Our mission for the team is simple: make the secure way the easy way for everyone at Upvest
• Set the multi-quarter strategy for application and cloud security across Upvest’s Investment API platform — aligned with our product roadmap, our tenant commitments, and our regulatory obligations under DORA, MiFID II, and BaFin’s MaRisk / BAIT requirements
• Lead, mentor, and grow our Security Engineering and Upvest’s security culture. You’ll inherit a small, talented team and own hiring, onboarding, growth, and retention as we scale. And you’ll create initiatives to build security into the development and product life cycle
• Build paved roads. Own how Upvest performs encryption, authN/authZ, CI/CD, data, and network surfaces. We want fewer security review queues and more security baked into the templates
• Own application security end-to-end. Threat modeling, secure code review, SAST/DAST/SCA tooling integration in our GitHub Actions CI/CD, and vulnerability management
• Drive better cloud security posture across our GCP environment — IAM, VPC Service Controls, Cloud KMS, CSPM (Wiz), Binary Authorization for GKE, Terraform-driven infrastructure security baselines, and our Linkerd service mesh posture
• Mature Upvest’s DORA technical implementation. Partner with our risk and compliance functions to translate DORA’s ICT risk framework (Art. 5–9), secure development testing requirements (Art. 16), and threat-led penetration testing (Art. 24–27) into engineering work programmes — and into evidence we can show auditors and regulators
• Embed security in every product design. Partner deeply with product and engineering teams. Architecture reviews, design partnerships, security champions across product squads, collaboration beats gatekeeping
• Stay current on emerging threats. AI / LLM security, agentic identities, and the secure use of AI tooling in our own engineering workflow are an active concern
• Represent Upvest’s security posture clearly to everyone

Benefits

• Flexibility - We work in a hybrid set-up, with the team spread around Germany and other parts of Europe. We give you the choice and budget to work where you’re most comfortable and productive, either at home or in the office. You choose.
• Development - In keeping with one of our values, ‘Learn and grow’, every Upvenger has access to a development budget. And in line with one of our other values, ‘Own the outcome’, how you make the most of it is up to you.
• Wellbeing - Everyone here has access to our in-house coach. You can have regular sessions to support you personally and professionally. We also believe it’s important to have time out to rest and recover, which is why we offer 30 days’ holiday.
• Greenfield projects - We’re building something quite complex. A first in Europe. This means you get to work with cutting-edge technologies, with no legacy code.- 6–10 years in security engineering, with 4+ years focused on product security or cloud security, and you work well in a regulated environment. You don’t need to check every box, but we’re asking for evidence that you’ve taken security from “owned by one team in a queue” to “embedded in how an engineering org ships.”
• Product/Application security foundations. OWASP Top 10 / ASVS, secure code review, SAST/DAST/SCA tooling integration, supply-chain security (SLSA, signing)
• Hands-on, technically credible. You earn the trust of engineers by going deep, so you’re comfortable reading code, threat modeling designs, debating architectures, and writing tooling when it’s valuable
• Cloud-native security depth. GCP preferred; AWS or Azure transferable. You know IAM, network segmentation, KMS, IaC security (Terraform), and Kubernetes hardening (RBAC, network policies, Pod Security Standards) as a craft
• Lead through influence, not gatekeeping. You drive security outcomes through partnership with engineering teams. You can navigate ambiguity, set direction, and make sound risk-based decisions that scale with the organisation. People want to work with you, because you don’t just say “no”, you say “yeah, and this is how”
• Hire and grow people. You’ve built or grown a small team. You set a high bar in interviews, invest in onboarding, give real-time feedback, and address performance issues quickly and fairly
• Communicate cleanly across audiences e.g. a security incident write-up to engineering, a control narrative to an auditor, and a risk briefing to executives are three different documents, and you can write all three
• Experience securing multi-tenant B2B platforms or financial-API products: tenant isolation, API-as-product safety boundaries, and the specific operational shape of selling to regulated customers
• Bug bounty / VDP programme management
• In a past life, you have shipped backend code in production, and you’re comfortable in Go (preferred), Python, or another modern backend language
• Background in engineering and offensive security
• German skills are useful for some potential client interactions, but not required. Our working language is English
• Hands-on experience with AI/LLM security, agentic identity, or securing AI tooling in an engineering workflow
• Familiarity with the operational side of security is a bonus, hands-on experience with EDR and SIEM platforms, or a background in incident response. This matters in practice, you’ll be part of the security on-call rotation, so being comfortable picking up an active incident is real, not theoretical
• Experience with trading, custody, or securities settlement platforms, or curiosity about that domain
• Regulatory fluency. Working knowledge of DORA, MaRisk, BAIT, ISO 27001. You can change audit-speak or regulation into actionable technical requirements other people understand. You can hold your own with auditors and regulators without losing engineering pragmatism