{"id":2408135,"url":"https://alion.io/job/vinted-payments-information-security-officer-2","title":"Payments Information Security Officer","company":{"id":56356,"name":"Vinted","domain":"vinted.com","url":"https://alion.io/company/vinted-com","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Greenhouse","truth_index":{"grade":"B","score":80,"open_postings":27,"ghost_share":0,"stale_share":1,"repost_share":0,"time_to_fill_p50_days":18,"computed_at":"2026-10-19T05:45:15Z"}},"role":"Security","role_family":"Security","seniority":"middle","employment_type":null,"work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Vilnius, Lithuania"],"countries":["LT"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":3967,"max":5367,"currency":"EUR","period":"month","gross":true,"usd_annual":71988},"salary_estimate":null,"experience_years_min":3,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AWS","optional":false},{"name":"GCP","optional":false},{"name":"PCI DSS","optional":false},{"name":"Red Teaming","optional":false},{"name":"SIEM","optional":false},{"name":"Threat Modeling","optional":false},{"name":"Wiz","optional":false}],"status":"live","first_seen_at":"2026-10-01T14:42:48Z","employer_posted_date":"2026-10-01","last_verified_at":"2026-10-19T21:22:29Z","board_verified":true,"closed_at":null,"days_open":18,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":18},"description":"Brief info about Vinted \nOur mission is to make second-hand the first choice, and we're looking for people who want to help us get there. Every day, we work together to help our members buy and sell pre-loved clothing and lifestyle items, giving each piece a second life - or even a third.\nThe Vinted Group is made up of three business units that support this mission:\nVinted Marketplace is Europe’s leading platform for second-hand fashion and a go-to destination for all kinds of pre-loved items, with a growing range of categories. Our platform connects millions of members across 20+ markets, helping great items find a new life.\nVinted Go enhances the shipping experience with a vast network of over 500,000 pick-up and drop-off points, partnering with more than 60 carriers across Europe, with added services like item verification for peace of mind on high-value pieces.\nVinted Pay is the newest part of the Vinted Group, dedicated to bringing secure, reliable payments to buyers and sellers across Europe. Seamlessly integrated into the Vinted app, it helps keep every transaction safe, efficient, and easy for our members.\nFounded in 2008 in Lithuania, Vinted began as a way for friends to find new homes for clothes they no longer needed. In 2019, we became Lithuania's first unicorn! Today, our headquarters remain in Vilnius, and we've grown with offices across Europe, supported by a team of over 2,000 people. \nInformation about the position \nWe are looking for a Payments Information Security Officer (ISO) to join our growing Payments Security team in Vilnius as our fourth member. Acting as the 2nd line of defense, our team safeguards Vinted Pay’s systems, payments data, and partners in full alignment with Bank of Lithuania regulations, the Digital Operational Resilience Act (DORA), and PCI-DSS standards.\nIn this role, you will take ownership of Vulnerability Management and Security Tooling, lead our Resilience Testing, and partner with product and engineering teams to embed security into the design of our next-generation payment systems.\nIn this position, you’ll \nDrive Vulnerability Management:\nOwn and continuously mature the end-to-end vulnerability management lifecycle across our payment ecosystem, covering code (SAST, SCA), runtime/applications (DAST), and cloud infrastructure.\nDefine and enforce clear vulnerability classification criteria and strict remediation SLAs/SLOs with engineering leads and platform teams.\nAnalyze exposure, prioritize remediation based on real-world exploitability in payment environments, and manage formal risk-acceptance workflows.\nReview Product Security & Threat Modeling:\nAct as the trusted security partner for Payments Product and Engineering teams, conducting proactive architectural reviews and threat modeling on new payment flows, digital wallet features, and checkout services.\nChampion security-by-design across microservices, ensuring robust API security, strong customer authentication (SCA), tokenization, and strict cryptographic key management practices.\nManage Security Testing & Assurance:\nScope, coordinate, and govern third-party penetration testing engagements across payment applications and cloud environments; track remediation actions to verified closure.\nSpearhead preparations and operational execution for advanced security testing under DORA, including Threat-Led Penetration Testing (TLPT / TIBER-EU/LT) and red teaming exercises.\nOversee and triage payments-related bug bounty reports, collaborating with ethical hackers and engineering to resolve valid disclosures swiftly.\nBoost Security Tools Efficiency & Define Logging Requirements:\nMaximize the coverage and operational efficiency of our security tooling stack (e.g., Wiz for cloud security posture and vulnerability management, SIEM, and monitoring tools).\nDefine, standardize, and govern security logging, audit trail, and telemetry requirements across payment services, databases (AWS/GCP), and infrastructure to meet BoL and DORA standards.\nOptimize detection rules and alerting pipelines to cut down noise, accelerate threat detection, and provide high-fidelity security insights to the team.\nOversee Physical Security:\nDefine, maintain, and audit physical and environmental security policies, standards, and access control procedures for Vinted Pay premises, server rooms, and dedicated secure operational areas.\nConduct periodic physical security risk assessments and badge access reviews to ensure ongoing alignment with Bank of Lithuania regulations and DORA resilience expectations.\nAbout you \nExperience: 3+ years of practical experience in information security, IT risk management, or security compliance - ideally within a FinTech, Electronic Money Institution (EMI), payment service provider (PSP), or regulated financial institution.\nRegulatory & Standards Knowledge: Solid understanding of DORA (specifically ICT third-party risk requirements), Bank of Lithuania (BoL) guidelines, PCI-DSS (v4.0), and ISO/IEC 27001.\nVulnerability & Product Security: Hands-on experience with AppSec/DevSecOps practices (SAST/DAST/SCA), threat modeling methodologies, and enforcing vulnerability remediation SLAs across engineering teams.\nTechnical Grasp: Strong familiarity with cloud environments (AWS / GCP), threat-led testing frameworks (TLPT / TIBER), data encryption standards, and secure SDLC principles.\nTooling & Cloud Proficiency: Familiarity with modern cloud security platforms (especially Wiz), SIEM solutions, and AWS/GCP cloud environments\nPragmatic Mindset: Ability to balance rigorous security controls with practical business velocity, communicating clearly with developers, and leadership in English.\nCertifications (Bonus): Relevant industry certifications such as CISA, CISSP, CRISC, CISM, or PCIP / ISA are considered a strong plus.\nWork perks \nThe opportunity to benefit from our share options programme\n25 working days of holiday\nAccess to all the tools & tech needed for work\nHome office support: we provide IT workstation equipment and a personal budget of up to €540 for home workplace furniture\nPrivate health insurance\nConfidential Employee Assistance Program (EAP) for you and your family\nFrequent team-building events\nA personal monthly budget for shopping on Vinted\nA dog-friendly office\nIn Vilnius office: Gym & in-house meals at friendly prices\nIn Kaunas office: a monthly lunch allowance, and a once-a-week provided in-house lunch and breakfast\nWorking at Vinted \nIndividual Learning Budget\nWe invest in your professional growth! As part of our commitment to continuous learning, we offer an annual learning budget to support your personal and career development through courses, certifications, workshops and more.\nHybrid Work\nWe’ve adopted a hybrid workplace model where 2 days in the office are recommended but not enforced. It’s up to you and your team to decide on the exact days you’ll spend working together in person.\nEqual Opportunity\nThe Vinted Group is committed to building an inclusive workplace where people from all walks of life feel a sense of belonging. We welcome applications from people of all backgrounds, identities and life experiences. At Vinted, all applicants are treated fairly without regard to their race, age, religion or belief, sex, national origin, citizenship, gender identity, sexual orientation, disability, or any other protected characteristic.\nThe salary range for this position is €3,967 - €5,367 gross per month.\nThe gross monthly salary range for this position is:\n€3.967—€5.367 EUR","description_format":"text","description_chars":7512,"description_truncated":false,"requirements":{"experience_years_min":3,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[{"language":"English","level":"All levels","optional":false}]},"benefits":["Continuous learning","Health insurance","Home office","Hybrid work","Stock options"],"hiring_locations":[{"name":"Lithuania","iso":"LT","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Marketplaces","Apparel & Fashion Brands"],"lifecycle":[{"event":"open","at":"2026-10-13T01:24:02Z"}],"visa":[],"liveness":{"score":37,"band":"fade","label":"Fading","p_open":1,"p_active":0.499,"p_room":0.75,"age_days":17,"expected_fill_days":18,"reasons":["conf:0","stale_co","velocity","win:late","comp:brand"],"computed_at":"2026-10-19T05:45:15Z"},"pay":{"stated_usd_annual":71988,"is_top_pay":false},"html_url":"https://alion.io/job/vinted-payments-information-security-officer-2","json_url":"https://alion.io/job/vinted-payments-information-security-officer-2.json","meta":{"generated_at":"2026-10-20T01:10:50Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":1511,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-21T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":56356},"rest":"https://alion.io/mcp/rest/get_company?id=56356"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fvinted-payments-information-security-officer-2"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fvinted-payments-information-security-officer-2"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fvinted-payments-information-security-officer-2"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/vinted-payments-information-security-officer-2\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fvinted-payments-information-security-officer-2"}]}