Senior Security Engineer

What you'll do ✅

• Secure the platform. Own the security posture of our cloud infrastructure and Kubernetes platform - identity and access, network segmentation, secrets management, encryption, workload hardening, logging, alerting and detection. Build guardrails so secure is the default path for our engineers.
  

• Embed security in how we build products. Partner with product teams on threat modelling and secure design reviews. Run and tune code, dependency and container scanning through to remediation, and coordinate external penetration tests.
  

• Turn compliance into engineering. Implement the technical controls behind our ISO/IEC 27001, NIS2 and NIST CSF work, automate evidence collection, and translate requirements into backlog items engineers can act on.
  

• Raise the bar on corporate IT security. Strengthen the security configuration of our identity provider, endpoint management, SaaS integrations and office networks.
  

• Own incident response for the technical estate. Maintain and exercise runbooks, lead technical investigation and containment, and drive learnings back into the platform.
  

• Make the whole company better at security. Share knowledge, run workshops and champion a culture where security is everyone's concern and never a blocker for its own sake.

What we're looking for⚡

You are driven by impact and know how to turn strategy into execution. You're used to fast-paced environments and thrive when given clear goals and high accountability. We believe you'll thrive here if you:

• Have hands-on security engineering experience in a modern, cloud-native software company - and have seen what scale and growth do to a security posture.
  

• Are deeply comfortable in at least one major cloud (preferably AWS) and with Kubernetes, infrastructure as code and CI/CD pipelines. You can read and write code and would rather automate a control than document a manual one.
  

• Know the practical security toolset - identity federation, secrets management, logging, vulnerability management and backup and recovery - and understand the trade-offs between options.
  

• Have translated frameworks like ISO 27001, NIS2 or SOC 2 into concrete technical controls and audit evidence, including running threat modelling with product teams.
  

• Are excited about how Tibber becomes more AI-enabled and embrace new tools and ways of working. You don't need to be an expert, but we believe you are motivated by that and excited to grow with it too.