Senior Platform Security / DevSecOps Engineer (m/f/d)

Work model

EU-Remote

Location

Germany, Austria, Netherlands, Italy, Spain.

Experience level

About the Company

European by design, headquartered in Amsterdam, Qivalis is working to develop a MiCA-compliant euro-denominated stablecoin backed by a consortium of leading European banks. Currently, Qivalis is progressing towards authorisation by the Dutch Central Bank. Operating across Europe, Qivalis is creating trusted on-chain payment infrastructure for Europe’s digital economy.

Qivalis’ mission is to provide a secure, transparent, and institutionally trusted EMT that serves as a foundational settlement asset for Europe’s digital economy. By bridging traditional financial infrastructure and blockchain technology, Qivalis seeks to enable compliant, scalable, and future-proof payment and settlement use cases for banks, financial institutions, and capital markets.

About the Role

As Senior Platform Security / DevSecOps Engineer at Qivalis, you will build and harden the internal platform our product engineering teams rely on. You join at an early stage of the company's build-up, when our security controls directly support our path to authorisation and launch as a regulated issuer.

You will be part of a small platform team in a distributed, async-first setup, owning platform security from design through day-to-day operations. You will work closely with platform engineers, product teams and leadership to put secure-by-default guardrails in place that scale with the business and hold up under regulatory scrutiny.

Your Responsibilities

• Embed security across the CI/CD lifecycle, including image scanning, static and dynamic analysis, artifact signing and policy gates.

• Define and enforce software supply chain controls such as SBOM generation, image provenance, dependency tracking and admission policies.

• Own the secrets lifecycle across all environments, from provisioning and rotation to revocation and audit, so that no cleartext secrets reach code or CI artifacts.

• Write and maintain policy-as-code that enforces security baselines in Kubernetes, and harden IAM, network segmentation and runtime configuration across AWS and EKS.

• Build security observability: audit log pipelines, alerts on anomalies and failed authentication, and drift detection that also supports regulatory evidence collection.

• Give development teams secure-by-default CI templates, deployment scaffolding and clear documentation so they can ship securely without friction.

• Investigate and respond to security incidents and vulnerabilities across infrastructure, delivery and runtime, and keep raising the platform's security baseline, including sensible guardrails for AI-assisted development workflows.

What You Bring

• Senior, hands-on experience securing CI/CD pipelines, Kubernetes and AWS (including IAM, networking and EKS) in production environments.
• Practical depth in software supply chain security: SBOM generation, image scanning and vulnerability triage, ideally also image signing and policy-based promotion.

• Strong working knowledge of secrets management beyond plain Kubernetes Secrets, container and OS hardening, and Kubernetes security controls such as Pod Security Admission, RBAC, seccomp and network policies.

• Experience with GitOps-based delivery, infrastructure as code, and scripting (Python, Bash or similar) to automate security and compliance tasks.

• A strong plus if you have experience with policy-as-code, service mesh security, SIEM integration or compliance-driven audit logging, an awareness of the security risks in AI-assisted development and tooling, or exposure to financial services regulation such as DORA or MiCA.

• An independent way of working: you get up to speed quickly in an existing setup, document what you build, and communicate clearly with engineers and non-technical stakeholders.

• Excellent written and spoken English.

Core Competencies

Security as a habit, not a gate: You build guardrails into everyday workflows so teams ship with more confidence and no extra friction.

Engineering judgment: You weigh trade-offs pragmatically and choose solutions that fit the company's stage without over-engineering.

Operational ownership: You take responsibility for what you build and run, from design and documentation through to incident response.

Compliance awareness: You translate the requirements of regulated financial infrastructure into concrete, auditable platform controls.

Application Process

Screening call: A short call with our Talent Acquisition team to learn more about Qivalis and the team, and for us to get to know your background and motivation.

Hiring Manager interview: A deep dive into the role with the Platform Lead, covering its responsibilities, priorities, and how your experience fits.

Technical interview: A hands-on in-call session where you’ll work through a practical problem such as a system design questions or code review based on real challenges we face.

Leadership Interview: An interview with the CTO & COO about the ways of working, how you make technical decisions and collaborate across teams and how you see yourself contributing to Qivalis’ technology and engineering culture .

Cultural-Add call: A final conversation with our Head of HR about what you’d bring to the team: your perspective, values, and approach.

Mailbox

talent@qivalis.eu