Vulnerability Management Security Engineer, Adevinta

• You combine a passionate, open, and hacker mindset with strong analytical, technical, and problem-solving with the ability to synthesise complex data into actionable insights
• You recognize the need for automation to handle problems at scale, and you have proven experience implementing security automation. (e.g., Python, Go, etc.)
• You are proficient in securing cloud environments (preferably AWS) and containerized workloads (Docker, Kubernetes); experienced in integrating security into CI/CD pipelines (e.g., GitHub Actions, Jenkins) and Infrastructure as Code (e.g., Terraform)
• You possess a deep and broad understanding of core cybersecurity principles, common attack vectors (e.g., OWASP Top 10), mitigation techniques, cryptography, standard frameworks, and security across network, protocol, system, and application layers.
• You have in implementing DevSecOps practices, including integrating security tools (SAST, DAST, SCA) into pipelines and guiding development teams on secure coding and vulnerability remediation
• You are an effective communicator and collaborator who takes ownership of problems, builds relationships, influences others, and thrives in a multicultural environment
• You are fluent in English (spoken and written)

Desirable

• As a Vulnerability Management Engineer, you will be a vital part of Adevinta's Information Security team
• You'll manage proactive security programs, conduct in-depth technical assessments, and lead strategic security planning sessions
• Your responsibilities will include driving automation initiatives for security processes, integrating advanced security tools, and leveraging threat intelligence to enhance our defensive capabilities
• You will be key in ensuring that Adevinta's security strategy covers industry-relevant security standards, leaving no gaps open to be exploited
• The Vulnerability Management team is part of the Information Security department, where you'll collaborate closely with other services such as Secure Product Lifecycle, Incident Response and Governance
• You may also be called on to interact with product development teams to help them secure their products
• You will own the vulnerability management lifecycle, including identifying vulnerabilities (via scanning, penetration testing, bug bounties, configuration reviews, etc.), analyzing risks, prioritizing remediation, and coordinating fixes
• You will drive DevSecOps practices by integrating and managing automated security tools (SAST, DAST, SCA, etc.) within CI/CD pipelines, interpreting results, and collaborating with Development and Operations teams to embed security throughout the development lifecycle
• You will define and automate security controls and best practices for containerized environments (Docker, Kubernetes) and cloud infrastructure (IaC security scanning, configuration management)
• You will ensure our assets are properly reporting events to the SIEM, and support the definition of rules for generating alerts
• You will support the other Infosec teams as a subject-matter expert
• You will work in a hybrid environment (remote/on-site at Adevinta hubs in Barcelona or Amsterdam)