[Hiring] Senior InfoSec Engineer @Qivalis

Role Description

As Senior InfoSec Engineer, Identity & Assurance (m/f/d) at Qivalis, you ensure that access to our critical systems is reviewed, justified and removed when no longer needed, and you own the proof that our controls work. You run access reviews and privileged access in our identity governance platform, grounded in our access model and the risks specific to digital assets and payments. When a vulnerability or test finding lands, you drive it to closure within SLA. You keep us audit-ready by ensuring accurate registers, current evidence and metrics that stand up to auditors and regulators.

You'll join a small, remote first-line security team that works async-first, working closely with IT-Ops, Platform and DevSecOps, and our Security Architect. This role requires a paid on-call rotation of one week per month, covering critical and high incidents and emergency change approvals.

Responsibilities

• Run access review campaigns in our identity governance platform, covering privileged, administrative and third-party accounts, and review access to sensitive platforms such as our custody platform.
• Check joiner, mover and lever controls, find orphaned or excessive access, operate privileged access management controls and maintain the mapping of identity provider groups to roles with IT-Ops.
• Track remediation of vulnerabilities and test findings against SLA, escalate breaches, and run periodic cloud security posture reviews with findings tracked to closure.
• Link vulnerabilities, incidents and risks to assets, report unknown or unmanaged assets, and prepare vulnerability and posture metrics for management reporting.
• Operate our GRC platform day to day (integrations, evidence, failing checks), monitor CI/CD security gate results and collect pipeline evidence, and track test and audit findings to closure, including retests.
• Build continuous control monitoring so evidence is produced by systems, not by hand, and review vendor security evidence such as SOC 2 reports, ISO 27001 certificates and penetration test summaries for third-party risk assessments.
• Take your turn on the security on-call rotation one week per month: support high and critical incidents, approve emergency changes and back up your detection and response colleague.

Qualifications

• 5+ years in information security with a focus on identity and access management, vulnerability management or security assurance, ideally in a regulated environment such as financial services or payments.
• Hands-on experience running access reviews and identity governance processes, including privileged access.
• Experience with vulnerability management workflows and cloud security posture management, and working knowledge of AWS identity and access concepts.
• Practical incident response experience, enough to cover on-call and back up a colleague.
• Comfort working with structured data: registers, inventories and evidence that must be accurate and auditable.
• Ability to work independently in a remote, async-first team and to communicate clearly with engineers, IT-Ops and management.
• Excellent written and spoken English.

Nice to have

• Experience with identity governance platforms and privileged access management tools.
• Experience with GRC and compliance automation platforms.
• Familiarity with DORA, ISO 27001 or comparable frameworks.
• Scripting in Python, Bash or comparable to automate evidence collection and reviews.
• Experience with third-party risk management.
• Exposure to digital assets or custody platforms.
• Certifications such as CISA or CISSP.

Core Competencies

• Thoroughness and accuracy: You keep access reviews, registers and evidence accurate and auditable, because our regulator and auditors rely on them.
• Reliability and follow-through: If you own a process, it runs consistently, and every finding is tracked until it is closed.
• Pragmatism: You prioritise by real risk and automate where it saves effort, instead of producing paperwork for its own sake.
• Clear communication: You explain access and remediation needs concisely and solution-driven to engineers, IT-Ops and management, and escalate early when an SLA is at risk.
• Collaboration: You work closely with Platform, DevSecOps, IT-Ops and your fellow InfoSec Engineer, and you cover for each other when needed.

Application Process

• Screening call: A short call with our Talent Acquisition team to learn more about Qivalis and the team, and for us to get to know your background and motivation.
• Hiring Manager interview: A deep dive into the role with our Head of Security Compliance & Operations, covering its responsibilities, priorities, and how your experience fits.
• Technical interview: A hands-on case study, where you’ll work through realistic access, vulnerability and incident scenarios based on challenges we face.
• Team interview: A conversation with members of our Platform Engineering team about how you would work together on access, remediation and evidence.
• Cultural-Add call: A final conversation with our Head of HR about what you’d bring to the team: your perspective, values, and approach.