Principal Security Engineer

THE ROLE & THE TEAM

We are seeking an experienced, high-impact Principal Security Engineer to join our Operational Security (OpSec) function as an individual contributor to lead our technical security strategy and regulatory compliance posture across our e-commerce and financial technology systems.

In this role, you will bridge deep software engineering and technical system design with regulatory compliance and governance (e.g., DORA, PCI-DSS, ISO 27001), operational resilience and cross-departmental alignment. You will serve as the primary technical authority on complex security architectures, change management guardrails, overall security posture and risk assessments for critical financial and cloud infrastructure.

WHAT WE’D LOVE YOU TO DO (AND LOVE DOING)

Security Architecture & Technical Change Governance

• System Design & Reviews: Function as the technical security reviewer and gatekeeper for high-criticality architecture changes. Strong understanding of network and application security, cryptographic primitives and identity and access management.
• Secure Engineering Standards: Maintain and enforce baseline configuration standards across cloud, server, and endpoint assets and secure Software Development Life Cycle (SDLC) practices.

Financial & Regulatory Compliance

• Regulatory Compliance: Direct technical alignment with regulatory standards including DORA, PCI-DSS, ISO 27001, and local regulatory frameworks. Improve the effectiveness of the ISMS and manage ICT risks from the Operational Security domain.
• Third-Party & Data Transfer Security: Evaluate security posture, CIA requirements, and Service Level Agreements (SLAs) for critical ICT outsourcing services and payment partner integrations.
• Risk Management: Familiarity with vulnerability management concepts and risk management methodologies.

Technical Leadership & Cross-Departmental Strategy

• Multi-Team Scope: Drive system designs and technical strategies spanning cross-functional multiple teams (engineering teams, product managers, and principal engineers), business units, and corporate entities (e.g., aligning Zalando Payments infrastructure with central Zalando Group tech).
• Stakeholder Management: Foster a Security first culture across departments, and bridge the gap between core engineering teams and information security operations.

WE’D LOVE TO MEET YOU IF

• Experience: 8+ years of technical security engineering experience, with demonstrated impact at a Principal / Lead level across multi-team or department-wide scopes.
• Regulatory & Compliance Mastery: Deep technical understanding of DORA, PCI DSS, ISO 27001, and ICT risk management frameworks. Experience in financial services, payment processing, or highly regulated e-commerce environments.
• System Design & Cloud Security: Proven track record in securing cloud-native microservices, web application firewalls (WAF), and supply-chain/CI-CD pipeline security.
• Cryptography & Data Protection: Strong foundation in transport and storage encryption standards, tokenization, PGP/GPG key management, and data classification guidelines.
• Communication & Stakeholder Management: Exceptional capability to articulate complex technical securit