Staff / Senior Staff Security Engineer, IT

As a Staff / Senior Staff Security Engineer you will be the first dedicated security engineer inside Vinted's IT organisation - and the person who makes the security of how Vinted works match the security of what Vinted builds. Most real-world breaches start where people meet technology: a phished identity, a compromised laptop, an over-privileged SaaS integration, a device nobody knew was on the network. Every employee, contractor and community support agent at Vinted works through what IT provides - including the thousands of agents at partner sites who act on members' accounts every day - so the attack surface you will own is the whole extended workforce. Working at staff /senior staff level as an individual contributor embedded in IT, you will own the security of both halves of IT's estate. The hardware: the managed device fleet, peripherals, office infrastructure, and the network hardware and verification equipment IT deploys in warehouses and electronics verification centres. The software: workforce identity, the SaaS and business-application portfolio, and the integrations, automations and AI tooling that connect them. Vinted Security runs a federated model: the central team sets thresholds and provides core services (pentesting, threat intelligence, vulnerability management framework and so on), while each unit owns local execution. IT's local execution is what you will build - this is an engineering role with a mandate, not a policy or audit function. You will work day to day with IT's engineering teams and the Director of IT, and functionally with the Vinted Security team and your security peers embedded in Platform, Marketplace, Vinted Go and Vinted Pay. This is a build role with room to grow: you start hands-on, closing the highest-impact gaps yourself, and as the practice matures you will shape and functionally lead IT's security engineering capability.

Make every device Vinted issues or operates trustworthy by default: hardened, managed baselines across the Mac-first fleet and its Windows and Linux edges, least privilege on endpoints, endpoint detection and response, and device trust as a condition of access - covering the full lifecycle from procurement to return.

Secure workforce identity as the perimeter: phishing-resistant authentication, joiner-mover-leaver automation, role-based and privileged access, four-eyes controls on high-risk actions, and time-bound access for contractors and the community support agents working from partner sites - built on the group's identity standards and engineered into how IT provisions, not bolted on afterwards.

Secure the network and hardware in Vinted's physical sites: office networks, secure remote access, and the standard IT builds for warehouses and electronics verification centres - where phones, consoles and laptops under test, verification devices and site infrastructure meet - owning the boundary with Vinted Go's security team.