Work Across
Get started
All jobs
Save

Lead Security Engineer

Dotworld
Contract type
Ongoing
Work mode
Remote · Europe
Experience
Lead / principal · Not stated

Level inferred from job title

Job description

DotWorld is hiring its first Lead Security Engineer to build the security function for its B2C SaaS products, covering defense, offensive testing and security culture.

At a glance

Employment
Full-time · Employee or contractor
Work mode
Remote · Europe
Languages
French – fluent, English – B2

What you'll do

  • Build centralized identity and access management with SSO, SCIM provisioning and strong MFA
  • Apply least privilege with temporary, audited privilege elevations
  • Secure onboarding, team changes and offboarding, including for contractors
  • Administer the password manager and service accounts
  • Secure cloud environments including multi-account AWS, deployment platforms and CDN/WAF
  • Eliminate static secrets in favor of ephemeral identities and automate their rotation
  • Harden configurations and perform security reviews of new architecture components
  • Manage security of the device fleet (MDM, encryption, updates)
  • Deploy a zero trust approach for access to critical tools
  • Centralize security logs and build genuinely useful alerts
  • Lead security incidents end to end: detection, containment, remediation, post-mortem
  • Counter B2C-specific attacks such as credential stuffing, account takeover, card testing, mass account creation, scraping and DDoS
  • Perform internal pentests and security code reviews, leveraging AI tools
  • Drive external pentests and, if relevant, a bug bounty program
  • Raise team awareness through internal training, best-practice guides and phishing exercises
  • Support squads on secure coding
  • Later, run security audits with each department
  • Eventually contribute to compliance efforts (ISO 27001 / SOC 2, PCI DSS) and relations with auditors and payment partners

What we're looking for

  • Prior experience owning security for a company or large scope autonomously, often via a Dev/DevOps path into security
  • Has led real security incidents end to end
  • Able to prioritize by real risk rather than by checklist
  • Strong AWS cloud security and its native security tooling (IAM, Organizations, SCP, CloudTrail, GuardDuty)
  • Web and API pentesting (OWASP Top 10, exploit development) and pentester tooling, ideally AI-augmented
  • Strong automation culture: Python, scripting, Go
  • Great autonomy and ownership: moves forward without waiting for direction
  • Pedagogical and good communicator, able to make security accessible to non-technical teams
  • Pragmatic: balances security with delivery pace
  • Calm and methodical under pressure
  • Curious and comfortable with intensive use of AI
  • Fluent French, the main working language
  • English at minimum B2 level, assessed during the recruitment process

Nice to have

  • Ideally has worked in a company or team that implemented a compliance program, even if not leading it
  • Having led or supported an ISO 27001, SOC 2 or PCI DSS audit is a bonus
  • Experience with fraud and abuse on B2C products that take payments is a real plus
  • Identity and access: SAML, OIDC, SCIM, MFA, least privilege
  • Security of modern web components: CDN/WAF, DNS, deployment platforms, secrets management
  • Certifications (OSCP, OSWE, AWS Security Specialty, CISSP or equivalent), bug bounty/CTF, Mac fleet management (MDM), open source contributions, articles or talks

Your team

Plateforme

Reports directly to the CTO, works in tandem with the DevOps, serving about 25 developers organized in product squads; full remote, impact-oriented with a strong culture of autonomy.

Benefits

  • Newly created role: you lay the security foundations for high-traffic flagship products
  • Direct access to the CTO and real decision-making power on security choices
  • Small team, big impact: paired with the DevOps, no heavy hierarchy
  • Dedicated tooling budget and a say in choosing future tools
  • Pro-AI environment with access to major cloud models and security-oriented open source models
  • Work remotely from any European country
  • Coworking budget of 200 euros per month
  • Tailored vacation: take the leave you need
  • Flexible hours
  • One month per year working remotely from a different time zone
  • Equipment budget for laptop, desk, chair, screen, headset
  • Two seminars per year

How to get hired

  1. 1Discovery interview with Talent Acquisition Manager Noémie, 30 min
  2. 2Take-home security case study (about 1 week), then technical interview with CTO Grégoire and DevOps Aleksander
  3. 3Culture interview with Head of HR & Finance Matteo, 1h
  4. 4Reference checks

Apply

Save

Direct apply at Dotworld

Opens the job posting at Dotworld

About Dotworld

Venture Builder and SaaS Studio

A fully distributed team running a portfolio of self-funded B2C SaaS products, organized around product universes from HR tools to content management and design creation solutions.

Mission

To design, launch and scale several SaaS products in parallel that make daily life easier for millions of people worldwide.

Key facts

  • SaaS / Venture Builder
  • More than 50 million visitors per year
  • No fundraising: 100% self-funded growth
  • Profitable from the first year
  • From 1 to 50+ employees in 4 years
  • 90% of the team works remotely

What they value

  • Test, Learn, Scale
  • Trust, flexibility and respect for individual rhythms
  • High standards: quality, rigor and efficiency in service of impact
  • Continuous improvement, innovation and creativity