{"id":2634900,"url":"https://alion.io/job/coverflex-platform-security-engineer","title":"Platform Security Engineer","company":{"id":54021,"name":"Coverflex","domain":"coverflex.com","url":"https://alion.io/company/coverflex","size_band":"201-500","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Teamtailor","truth_index":{"grade":"B","score":75,"open_postings":5,"ghost_share":0,"stale_share":1,"repost_share":0,"time_to_fill_p50_days":null,"computed_at":"2026-10-16T05:45:00Z"}},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"explicit","locations":[],"countries":[],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":50000,"max":67000,"currency":"EUR","period":"year","gross":true,"usd_annual":75099},"salary_estimate":null,"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":true,"technologies":[{"name":"AWS","optional":false},{"name":"CI/CD","optional":false},{"name":"Datadog","optional":false},{"name":"DNS","optional":false},{"name":"Elixir","optional":false},{"name":"Expo","optional":false},{"name":"GitHub Actions","optional":false},{"name":"IAM","optional":false},{"name":"Kubernetes","optional":false},{"name":"Least Privilege","optional":false},{"name":"LLM Guardrails","optional":false},{"name":"Model Context Protocol","optional":false},{"name":"Platform Engineering","optional":false},{"name":"PostgreSQL","optional":false},{"name":"React Native","optional":false},{"name":"Terraform","optional":false},{"name":"FinOps","optional":true},{"name":"ISO 27001","optional":true},{"name":"JavaScript","optional":true},{"name":"LLM","optional":true},{"name":"React.js","optional":true},{"name":"SIEM","optional":true},{"name":"SOC 2","optional":true}],"status":"live","first_seen_at":"2026-09-30T10:48:43Z","employer_posted_date":"2026-09-30","last_verified_at":"2026-10-16T22:53:43Z","board_verified":true,"closed_at":null,"days_open":16,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":16},"description":"Coverflex\nWork changed. Pay didn’t.\nCoverflex exists to make compensation work for everyone.\nPay is still rigid, fragmented, and hard to feel.\nWe turn compensation into choice - one platform, one card, one app - for benefits, meal allowance, insurance and more.\nOur platform is simple for HR and meaningful for employees.\nWe provide choice, smarter compensation tools and empowerment.\nTL;DR (The Essentials)\nRole: Platform Security Engineer\nSeniority Level: Senior\nType: Individual Contributor\nLanguages: English (main) / Portuguese / Spanish / Italian\nMain Tools: AWS, Kubernetes, Terraform, GitHub Actions, Ubicloud, Datadog, CI/CD security scanning, identity and secrets management\nMain Stack: Elixir/Phoenix, PostgreSQL, React Native (Expo)\nLocation: Remote (Europe only)\nCompensation:\nBase Salary: 50.000€ to 67.000€ gross yearly\n\nBonus / Commissions: No\n\nEquity: Yes - Stock Options under our Equity Incentive Plan\n\nBenefits: All Coverflex benefits apply\n\nContract Type: Permanent\n\nYour Impact\nYour role will play a major role in our success because…\n→ We look after people's benefits and personal data in several countries, so trust is at the heart of what we do. As we grow, you'll make sure our security grows with us. You'll bring deep security expertise to DevX, the team that builds the platform and paved road for our engineers, and you'll make the secure path the easiest path for everyone.\nYou’ll know you’re successful when, after 90 days, you’ve…\n-> Shipped your first secure-by-default workflow for production operations, with access that's controlled, auditable and easy to use\n-> Shaped how we run security in our delivery pipeline: priorities, response targets and automation\n-> Led a resilience exercise that sharpened our recovery playbooks\nHow we’ll measure success:\nMain KPI 1: More production operations running through secure, self-service and observable tooling\n\nMain KPI 2: Security findings caught early in the delivery pipeline and resolved quickly, with automation doing the heavy lifting\n\nMain KPI 3: Business continuity we can count on, with clear recovery targets that we test regularly\n\nSecondary KPI 1: Edge protection that adapts to our applications and keeps the user experience smooth\n\nSecondary KPI 2: Engineers adopt the security guardrails and are happy with them\n\nReality Check - What Makes This Role Hard\nLet’s be real - here’s what makes this role challenging:\nYou're a platform engineer first. Security is your main focus, but you're a full member of DevX. You'll share the team's wider work: infrastructure, CI/CD, developer tooling and experience, observability and incident troubleshooting. Expect a real share of your time on work that isn't about security.\n\nThe challenge is to improve our security posture while improving developer experience, raising security awareness across engineering teams, and making the secure path the easiest path.\n\nA big part of the work is delivering meaningful, production-grade improvements without slowing developer throughput or impacting platform users. This requires clear prioritisation, safe rollout patterns, and tight feedback loops so we can move quickly while minimising operational risk and unnecessary friction.\n\nYou\nMust-haves (evidence, not years)\nOwned application or platform security in a production cloud environment, with clear examples of impact\n\nStrong cloud security fundamentals: IAM and identity plumbing (SSO/OIDC), secrets management, and least privilege in practice\n\nStrong platform engineering across infrastructure as code, CI/CD with security built in, and observability\n\nStrong experience running Kubernetes in production, including workload security and access controls\n\nCloud networking and edge: VPC boundaries, DNS, TLS, load balancing, CDN and WAF tuning\n\nReliability in practice: SLOs, on-call, threat modelling, incident command, and postmortems\n\nBackup, restore and disaster recovery designed and actually exercised\n\nTreats the platform as a product: measures adoption and developer experience\n\nUses AI tooling to accelerate engineering work, and builds it into the platform (agents, MCP, assisted operations)\n\nReads and writes code well enough to fix problems, not just report them\n\nFluent English required\n\nNice-to-have\nISO 27001, SOC 2 or DORA experience\n\nFintech, payroll, or other regulated-data background\n\nDetection engineering or SIEM experience\n\nPostgreSQL operations and safe schema migrations\n\nElixir, or comfort picking up a functional language\n\nCloud cost awareness and FinOps practices\n\nCertifications welcome, but practical evidence weighs more\n\nYour DNA\nEnabler, not a blocker: you make security the default through automation, paved-road patterns and self-service guardrails\n\nBuilder at heart: you'd rather ship the fix than file the report, and you work alongside engineers to raise the bar together\n\nPragmatic about risk: you weigh costs and benefits, explain trade-offs clearly, and prefer small, safe changes that add up\n\nWritten-first communicator: you write decisions down and share context early so others can move fast\n\nDeeply curious: you dig into hard problems and incidents, then turn what you learn into tooling and better defaults\n\nYou’ll probably find this frustrating if…\nYou see security as a gate to guard rather than a path to pave\n\nYou prefer auditing and reporting to building and fixing things hands-on\n\nYou measure progress in policies written rather than in real improvements\n\nYou do your best work with a ready-made roadmap rather than shaping one yourself\n\nManager & Team\nMeet Your Manager\nHiring Manager: Rui Alves - Tech Lead, Platform Engineering\nLocation: Portugal\nLinkedIn Profile: https://www.linkedin.com/in/rui-alves-ab05959\nProfile Snapshot:\nEnergy: Steady and low-ego. I try to keep things calm, especially when priorities shift or incidents happen.\n\nCommunication: Structured, transparent, and written-first when it helps. I document decisions, trade-offs, and next steps so alignment survives the meeting.\n\nFeedback Style: Direct and kind. I give feedback early and specifically, and I expect the same in return.\n\nHow to work with me - in the Manager's own words:\nExpect a collaborative environment with clear priorities and a bias for small, safe changes that compound. I’ll help remove blockers, protect focus, and make sure we’re shipping work that improves both security posture and developer experience. I value calm, ownership, and good written communication.\nYour Team\nYou’ll work day-to-day with:\nTina, Platform Engineer, https://www.linkedin.com/in/tinazhouhui\n\nHugo, Platform Engineer, https://www.linkedin.com/in/hugo-sousa99\n\nKey Stakeholders:\nTiago Fernandes (CTO)\n\nBruno Oliveira (VP Engineering)\n\nLuís Coelho (Quality Team Lead)\n\nTeam Rituals:\nDaily standup\n\nWeekly planning\n\nBi-weekly retrospective\n\nAccess & Belonging (Equal Opportunity)\nWe hire for impact and potential, not pedigree.\nWe welcome applications from people with non-linear careers, career breaks, caregiving gaps, and those changing fields.\nNo discrimination on the basis of age, disability, gender identity/expression, marital or family status, pregnancy, neurodivergence, race/ethnicity, religion/belief, sexual orientation, or any other protected ground.\nAssessment fairness:\nWe anchor on evidence of outcomes (what you shipped, moved, or influenced).\nWe actively de-bias by using structured rubrics, multiple assessors, and blind screening most of the time (we won’t know your name, gender, or personal info until the interview stage).\nApplication Clarity\nNo cover letter required.\nApply with your LinkedIn or upload your CV.\nYou will be asked a few short, relevant questions.\nTotal candidate time investment: ~5-6 hours end-to-end.\nHiring Stages (What to Expect, Why & How Long)\n1. CV / LinkedIn Screen - Signal check vs must-haves\nDone by People + Hiring Manager.\nYou’ll hear from us within 7 business days.\n2. Quick Interview (Intro Call) - Mutual fit & context\n20-30 min\nWith DevX. Covers role scope, salary, location, and timeline.\n3. Deep Dive: Engineering Mindset - How you think about engineering\n45-60 min\nWith DevX and an Engineering Manager. Built around outcomes, decisions, trade-offs and collaboration, using examples from your own experience.\n4. Deep Dive: Technical - How you design and build\n45-60 min\nWith a Staff or Architecture engineer. A technical conversation about platform, cloud and security design, and the reasoning behind your choices.\n5. Technical Pairing challenge - How you work hands-on\n≤90 min\nWith two DevX engineers. A practical infrastructure-as-code / CI/CD exercise. We look at how you approach the problem, how you work with others, and how you balance security with developer experience.\n6. Culture Interview - Walkthrough + Q&A\n20-30 min\nYou’ll get actionable feedback either way.\n7. Final Conversation (CEO / C-Level) - Values, strategy, and your growth\n30-45 min\nAI & Hiring Tools Transparency\nWe use a few tools to reduce bias and improve documentation, not to make hiring decisions.\nTeamtailor anonymisation: profiles are reviewed without relying on names/personal identifiers.\n\nMeeting recording tools (e.g., Talka.ai): may be used to capture interviews so we can focus on the conversation.\n\nLLM: may be used to turn interview notes/transcripts into clear, structured summaries.\n\nImportant: every application is reviewed by a human, and no decision or rejection is made by AI. If recording is used, we’ll be transparent and (where required) ask for consent.\nSpeed & Communication\nDecision: within 4 weeks of your application.\n\nUpdates: weekly if the process runs longer.\n\nScheduling: interviews between 10:00-16:00 CET (flexible across Europe).\n\nFeedback: from the Deep Dive: Engineering Mindset stage onwards, you’ll always receive written or verbal feedback - what went well, and what to strengthen next time.","description_format":"text","description_chars":9821,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[{"language":"Portuguese","level":"All levels","optional":false},{"language":"Italian","level":"All levels","optional":false},{"language":"Spanish","level":"All levels","optional":false},{"language":"English","level":"Advanced (C1)","optional":false}]},"benefits":["Equity","Stock options"],"hiring_locations":[{"name":"Portugal","iso":"PT","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Cards & Card Issuing","HR & Payroll Software"],"lifecycle":[{"event":"open","at":"2026-10-15T17:12:41Z"}],"visa":[],"liveness":{"score":74,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.82,"p_room":0.9,"age_days":15,"expected_fill_days":37,"reasons":["conf:3","win:mid"],"computed_at":"2026-10-16T05:45:00Z"},"pay":{"stated_usd_annual":75099,"is_top_pay":false},"html_url":"https://alion.io/job/coverflex-platform-security-engineer","json_url":"https://alion.io/job/coverflex-platform-security-engineer.json","meta":{"generated_at":"2026-10-17T02:44:16Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":3791,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-18T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":54021},"rest":"https://alion.io/mcp/rest/get_company?id=54021"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fcoverflex-platform-security-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fcoverflex-platform-security-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fcoverflex-platform-security-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/coverflex-platform-security-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fcoverflex-platform-security-engineer"}]}