Security Tech Lead Manager

Job description

At Catawiki, every day brings the extraordinary! Whether it’s [Daniel Ricciardo’s Formula 1 Car](https://www.catawiki.com/en/c/583-sports-memorabilia), a [Woolly Mammoth’s Skeleton](https://www.catawiki.com/en/c/579-fossils), [Lady Gaga's Jumpsuit](https://www.catawiki.com/en/l/10035805) or [Usain Bolt’s running shoe](https://www.catawiki.com/en/c/583-sports-memorabilia), we encounter exceptional objects every day. We’re a one-of-a-kind marketplace for buying and selling special objects. Each week, more than 100,000 unique items are auctioned, all carefully curated by our passionate in-house experts. Having sold over 25 million unique objects, our mission is to become the world’s most popular destination for special objects. As a growing, diverse and sustainable scale-up, we proudly live by three core values. If these values resonate with you, we’d love to explore how you can join us. - Taking ownership and driving impact - Being open to change and feedback - Being passionate about our mission and our customers. ### **About the role and team** As our Security Tech Lead Manager, you’ll manage a team of 2–3 security engineers within Platform Engineering and remain hands-on. You’ll own the security engineering roadmap and take responsibility for the team’s delivery, performance and development. Working with Product and Platform Engineering, you’ll help protect our marketplace, our customers and their data. Our platform runs on Google Cloud and Kubernetes. You’ll focus on application and cloud security, secure software delivery and risks in internal and AI-enabled systems. You’ll turn security priorities into engineering work, make clear trade-offs and help teams adopt controls that fit their everyday workflows. ### **What you will do** - Manage and develop the security team through regular one-to-ones, timely feedback, performance reviews and career development. Address underperformance and support hiring and onboarding. - Own the security engineering roadmap. Prioritise work based on risk, business needs and team capacity, delegate effectively and remove blockers to delivery. - Stay hands-on by building security controls and automation, reviewing code and guiding technical decisions across applications, cloud infrastructure and software delivery. - Partner with Product and Platform Engineering early in design. Lead threat modelling and security reviews, and help teams choose secure approaches that are practical to implement. - Improve vulnerability management. Assess findings in the context of exposure and business impact, agree remediation priorities with system owners and track issues through resolution. - Improve security checks in CI/CD and infrastructure as code, including dependency and secret scanning. Reduce false positives and help engineers act on findings. - Coordinate the security team’s technical contribution to incident response and investigations. Turn lessons from incidents into improvements to detection, response and preventive controls. - Work with Legal, IT and Trust & Safety on security controls, policies and audit evidence where responsibilities overlap. - Measure and communicate progress through remediation times, control coverage and adoption. Explain remaining risks, delivery progress and trade-offs to technical and business stakeholders. ### **Who you are** - You have substantial hands-on security engineering experience in a software or cloud environment and have implemented and operated security capabilities in production. - You have previously managed engineers as direct reports, including performance reviews, career development and difficult feedback. You can balance people management with technical contribution. - You have owned a security roadmap or programme, translated priorities into deliverable work and coordinated implementation across engineering teams. - You have strong knowledge of application and cloud security, including identity and access management, secrets management and secure software development. - You are experienced in threat modelling, secure code and design reviews, vulnerability prioritisation and practical incident response. - You can develop or automate in Ruby, Python, Go or a similar language, are comfortable reviewing backend code and have integrated security controls into engineering workflows. - You communicate clearly with engineers and non-technical partners, explain risk in business terms and gain support for decisions when priorities compete. ### **Helpful experience** - Experience with Google Cloud, Kubernetes and Terraform or similar infrastructure tooling. - Experience in a marketplace, e-commerce or another software product business, including account and API security. - Experience securing AI-enabled applications, agents or data pipelines, or using AI to improve security engineering workflows. ### **Why You'll Love Working with Us** - **Create a visible impact** by working at scale in a global organisation serving millions of customers across 80+ categories. In our flat structure, every role has a broad scope and directly impacts both our customers and the business. - **Learn and grow** through our Learning & Development initiatives, including clear development plans and mentorship programmes to support your career progression. - **A culture of connection defines us**. We’re a passionate, diverse team of 800+ Catawikians representing 60+ nationalities. We foster an inclusive and queer-friendly environment where everyone is encouraged to bring their full self to work. - **Celebrate life’s moments with us.** You’ll receive a €100 Catavoucher when you join, a €50 Catavoucher on your birthday, and an extra day off each year to “Pursue Your Passion**”**. We also offer additional leave for key work anniversaries and important life events. Benefits may vary by location. ### **Our Offices and Way of Working** Our vibrant offices in Amsterdam and Lisbon are designed to inspire collaboration. Most Catawikians operate in a hybrid setup, combining office-based and remote work, with a minimum of two days per week in the office, unless a role is explicitly stated as fully remote or fully office-based. ### **Interested?** Apply with an English CV and Cover Letter. By applying, you agree to [Catawiki’s Applicant Privacy Policy.](https://www.catawiki.com/conditions/applicant-privacy-policy.pdf) If you’re excited about this role but don’t meet every requirement, we still encourage you to apply anyway. You may be just the right candidate for this or other roles. We may use artificial intelligence (AI) tools to support the review of your application. AI may help us assess how your experience matches the requirements of the role, but hiring decisions are always made by our recruitment team