Senior Security Engineer, GRC Automation Job at 1Password

Senior Security Engineer- Zalando Payments

The Information Security team at Zalando Payments acts as the second line of def...

Location

Germany , Berlin

Salary:

Not provided

Zalando

Expiration Date

Until further notice

Requirements

5+ years of working experience in Information Security, Risk, or GRC, ideally in regulated environments such as fintech or payments
You understand frameworks and regulations such as DORA, PCI DSS, ISO 27001, or GDPR
You have experience designing or assessing security controls, including defining evidence and evaluating effectiveness
You bring a GRC engineering mindset, with an interest in automation, scalable evidence collection, and continuous monitoring
You are able to challenge constructively as a second line of defense, while collaborating effectively with engineering and security teams
You communicate clearly with both technical and non technical stakeholders, including senior management

Job Responsibility

Own and evolve the Information Security Management System at Zalando Payments, ensuring alignment with DORA, PCI DSS, ISO 27001, and internal policies
Drive the ZPS Security Controls Framework, including control definition, evidence requirements, and maturity targets
Independently verify security controls, assessing design and effectiveness, and ensuring traceability between risks, controls, and evidence
Apply a GRC engineering mindset by enabling automated evidence collection and continuous control monitoring
Collaborate with first line Engineering and Operational Security teams to ensure scalable and effective control implementation
Support internal and external audits and ensure regulatory readiness through structured, evidence driven practices

What we offer

27 days of holiday a year to start for full-time employees (+1 day for every calendar year up to 30 days)
2 paid volunteering days a year
Hybrid working model with up to 60% remote per week, actual practice is up to each team to best support their collaboration
Work from abroad for up to 30 working days a year
Employee shares program
40% off fashion and beauty products sold and shipped by Zalando, 30% off Lounge by Zalando, discounts from external partners
Relocation assistance available (subject to prior agreement)
Family services, including counseling and support
Health and wellbeing options (including Wellhub, formerly Gympass)
Mental health support and coaching available

Fulltime

Senior Security Engineer, Privacy

As a Senior Security Engineer, Privacy, you will serve as a trusted advisor at t...

Location

Canada; England; France; Germany; Italy; Portugal; Spain; United States

Salary:

88000.00 - 110000.00 EUR / Year

Docker

Expiration Date

Until further notice

Requirements

6–8 years of experience in information technology, security engineering, governance, risk and compliance, privacy engineering, or closely related roles
Proven experience designing and implementing GRC programs with a strong emphasis on automation, engineering, and scalable processes
Hands-on experience implementing or operating privacy programs aligned with GDPR and ISO/IEC 27701, including privacy-by-design and privacy-by-default principles
Strong understanding of privacy engineering concepts such as data minimization, purpose limitation, data lifecycle management, and technical data protection controls
Proficiency in one or more programming or scripting languages such as Python or Golang, with experience building automation for compliance and privacy workflows
Experience working with APIs, webhooks, and integrating GRC, privacy, and security tooling
Hands-on experience with public cloud environments (AWS, Azure, or GCP), including applying privacy and data protection controls across backup systems, data lakes, and distributed cloud storage services
Experience integrating security and compliance requirements into SDLC and CI/CD pipelines using DevSecOps practices
Solid understanding of security frameworks and regulatory standards such as ISO 27xxx, SOC 2, GDPR, and NIST, and how they apply to SaaS environments
Knowledge of information security risk management and common security technologies (e.g., SIEM, vulnerability management, data loss prevention, endpoint protection)

Job Responsibility

Embed privacy-by-design principles into Docker products, services, and internal platforms, aligned with ISO/IEC 27001, ISO/IEC 27701, SOC 2, and global privacy regulations
Partner closely with Docker engineering and product teams to integrate privacy requirements into architecture decisions, SDLC processes, and CI/CD pipelines
Design, develop, and maintain automated GRC and privacy workflows to support compliance monitoring, control testing, DPIAs, risk assessments, reporting, and audit readiness
Implement and customize GRC and privacy tooling using APIs, scripting, and automation to streamline evidence collection, control validation, and compliance operations
Lead and automate data discovery, classification, and data mapping across Docker systems to maintain accurate Records of Processing Activities (RoPA) and support data lifecycle governance
Conduct and operationalize security risk assessments and Data Protection Impact Assessments (DPIAs), integrating findings into Docker’s risk register and remediation tracking
Define, implement, and validate data protection and data lifecycle controls, including data minimization, retention, deletion, and access controls
Build and maintain dashboards and security/privacy metrics to provide real-time visibility into risk, compliance posture, and program effectiveness
Support internal and external audits by providing high-quality, automated evidence and serving as a subject matter expert for security and privacy controls
Draft, maintain, and map security and privacy policies, standards, and procedures to relevant regulatory and industry frameworks

What we offer

Freedom & flexibility
fit your work around your life
Designated quarterly Whaleness Days plus end of year Whaleness break
Home office setup
we want you comfortable while you work
16 weeks of paid Parental leave
Technology stipend equivalent to $100 net/month
PTO plan that encourages you to take time to do the things you enjoy
Training stipend for conferences, courses and classes
Equity

Fulltime

Senior Manager, Security Engineering

The Security Engineering team at Fullstory ensures that engineering teams across...

Location

United States

Salary:

Not provided

Fullstory

Expiration Date

Until further notice

Requirements

Has full-time people leadership experience in a similar type of team
Has experience owning, planning, and executing business-level security initiatives
Experience building sustainable security programs with an emphasis on customer service, partnership, and enablement of software engineering and business stakeholders
Experience participating in security architecture, risk management, vendor diligence, threat analysis, and other dimensions of technical expertise to support team initiatives
Experience directly managing security vendor relationships, project scoping, deployment, etc.
Ability to leverage AI tools to enhance work quality and accelerate timelines by implementing AI solutions that optimize efficiency

Job Responsibility

Lead a team of application and cloud security engineers, including strategy and mentorship
Enable our partners, such as Security GRC and Legal, in supporting business outcomes
Create paved roads, with a focus on automation, to speed up secure-engineering practices
Own and maximize investments in third-party security services, consultants, and technologies
Run incident response investigations in collaboration with Legal and external security firms
Advise peer leaders on cross-business initiatives and product strategy on security and risk

What we offer

Flexible PTO policy
Annual company-wide closure
Federal holidays
Sponsored benefit packages for US-based Fullstorians
Supplemental coverage options for international Fullstorians
Professional development opportunities through training programs
Annual learning subsidy for US and EMEA-based employees
Monthly productivity stipend for US and EMEA-based Fullstorians
Team off-sites
Annual full-company meet-up

Fulltime