Security Engineering Lead (m/f/d)

Upvest is at the inflection point where security needs to scale and remain a foundational discipline of the company. We're hiring a Security Engineering Lead to step into our lean and efficient Security team, set its multi-quarter direction, work cross-functionally and scale Security Engineering into a team that continues to own Upvest's entire application security and cloud security posture in a highly regulated environment as it scales. Our mission for the team is simple: make the secure way the easy way for everyone at Upvest.

Responsibilities

Set multi-quarter strategy for application and cloud security across Upvest's Investment API platform; lead, mentor, and grow Security Engineering and security culture; build paved roads for encryption, authN/authZ, CI/CD, data, and network surfaces; own application security end-to-end (threat modeling, secure code review, SAST/DAST/SCA tooling integration, vulnerability management); drive cloud security posture across GCP environment; mature DORA technical implementation; embed security in every product design; stay current on emerging threats; represent Upvest's security posture clearly to everyone

Requirements

6-10 years in security engineering, with 4+ years focused on product security or cloud security; work well in a regulated environment; hands-on, technically credible; cloud-native security depth, GCP preferred, AWS or Azure transferable; IAM, network segmentation, KMS, IaC security (Terraform), Kubernetes hardening; product/application security foundations (OWASP Top 10 / ASVS, secure code review, SAST/DAST/SCA tooling integration, supply-chain security); lead through influence, not gatekeeping; hire and grow people; communicate cleanly across audiences

Nice to have

Experience securing multi-tenant B2B platforms or financial-API products; experience with trading, custody, or securities settlement platforms; bug bounty / VDP programme management; shipped backend code in production, comfortable in Go (preferred), Python, or another modern backend language; regulatory fluency (DORA, MaRisk, BAIT, ISO 27001); background in engineering and offensive security; German skills useful but not required; hands-on experience with AI/LLM security, agentic identity, or securing AI tooling; familiarity with operational side of security, EDR and SIEM platforms, or incident response; comfortable picking up an active incident

Benefits

Best-in-class AI tools: €20,000 per year; impact-driven work; wellbeing: 30 days annual leave, sports benefits, professional coaching, remote abroad up to 183 days/year, UpRest one-month fully paid sabbatical after every 4 years; development: personal development budget; flexible work environment: hubs hybrid or remotely across Europe, choice and budget to work where comfortable and productive; compensation and equity: competitive above-market salary and employee equity program; team celebrations: UpFest, dinners, offsites, holiday party; inclusion: Employee Resource Groups like Upfem and UpVergent