Platform Security Engineer

This is a fully remote position, open to applicants in Portugal.

📋 Description

• Take charge of platform and application security for Coverflex's production cloud environment.

• Provide security expertise to DevX, the team responsible for developing the platform and streamlined processes for engineers.

• Create secure-by-default workflows for production operations that include controlled and auditable access.

• Define security priorities, response objectives, and automation within the delivery pipeline.

• Lead resilience drills and enhance recovery playbooks.

• Communicate broader DevX initiatives across infrastructure, CI/CD, developer tools and experiences, observability, and incident troubleshooting.

• Enhance security posture and developer experience without hindering developer output or affecting platform users.

• Implement production-grade enhancements using safe rollout strategies and rapid feedback loops.

• Boost production operations through secure, self-service, and observable tools.

• Ensure early detection and rapid resolution of security issues through automation.

• Maintain business continuity with regularly tested clear recovery objectives.

• Strengthen edge protection while ensuring a seamless user experience.

• Promote the adoption of security guardrails across engineering teams.

• Collaborate with the Platform Engineering team and key stakeholders.

• Engage in daily standups, weekly planning sessions, and bi-weekly retrospectives.

⛳️ Requirements

• Have experience overseeing application or platform security in a production cloud environment, with tangible examples of impact.

• Possess strong cloud security fundamentals, encompassing IAM and identity management (SSO/OIDC), secrets management, and least privilege principles.

• Exhibit strong platform engineering skills in infrastructure as code, CI/CD with security integrated, and observability.

• Demonstrate significant experience managing Kubernetes in production, focusing on workload security and access controls.

• Have knowledge of cloud networking and edge technologies: VPC boundaries, DNS, TLS, load balancing, CDN, and WAF tuning.

• Possess reliability experience with SLOs, on-call duties, threat modeling, incident command, and postmortems.

• Have designed and practiced backup, restore, and disaster recovery plans.

• Treat the platform as a product; measure adoption and developer experience.

• Utilize AI tools to expedite engineering tasks and integrate them into the platform (agents, MCP, assisted operations).

• Capable of reading and writing code well enough to resolve issues rather than merely reporting them.

• Fluent proficiency in English is mandatory.

• Nice-to-have: Experience with ISO 27001, SOC 2, or DORA.

• Nice-to-have: Background in fintech, payroll, or other regulated data sectors.

• Nice-to-have: Experience in detection engineering or SIEM.

• Nice-to-have: Experience with PostgreSQL operations and secure schema migrations.

• Nice-to-have: Familiarity with Elixir or willingness to learn a functional programming language.

• Nice-to-have: Awareness of cloud costs and FinOps practices.

• Certifications are welcomed, but practical experience is valued more highly.

🏝️ Benefits

• Equity: Stock Options as part of our Equity Incentive Plan.

• All Coverflex benefits are applicable.

• Fully remote work setup with annual on-site gatherings at least once a year.

• Coverflex card provided.

• MacBook for your work needs.

• €500 onboarding budget for workstation setup.

• €1,000 annual FlexBudget for professional development and enabling remote work.

• Health Insurance plans available, with options to add family members and update conditions (depending on the country).

• 25 paid vacation days each year.

• 3 caring days annually for pursuing side projects that support positive impact initiatives.

• 2 additional paid weeks beyond the legal maximum for Parental Leave.

• Days off for employee and children's birthdays.