Security Engineer F/H

At Lemonway, we're revolutionizing the way marketplaces handle complex and regulated payments. Our dedicated payment solution empowers investment platforms and B2C/B2B marketplaces across Europe, ensuring secure and compliant transactions through our SaaS API. With €35 million raised in Series B funding in 2019, we're not just profitable today with a +104% growth in 2023 - we're on a mission to shape the future of payments in the digital economy.

The company has more than 140 LemonHeroes from 21 different nationalities.

More than 400 platforms trust Lemonway every day to collect funds and payments in a secure way. We have clients such as Decathlon, Acer, SNCF, Eiffage, FFF (French Football Federation) and many others.

We're at a thrilling juncture in our growth journey, where speed and quality go hand in hand. To maintain this balance, we're constantly innovating and improving our processes, methods, and tools.

Join a dynamic and growing Tech company!

Our Tech Culture:
Collaborative Learning

1. Our Squads and Tribes enable experts to refine and share best practices across teams.
2. We encourage pair programming and collaborative problem-solving.
3. Regular sharing sessions allow everyone to present and discuss technical topics.

Certified Excellence

We are PCI-DSS certified, ensuring the highest standards of payment card industry data security.

Your Mission

As part of our Infra and Security Team, you'll work alongside 7 talented members, including Infra, SRE, and Security. Reporting directly to the Head of Infra & Security, you'll bring your expertise in services and product security, an interest in payments, and a desire to enhance your skills in managing the trust zone perimeter (signature engines, identity management services, PKI, HSM, time servers, etc.).

Key Responsibilities of the Team

1. Maintain the trust zone perimeter and support development and infrastructure teams, ensuring compliance with main regulations (depending on the countries) and ETSI standards.
2. Integrate security into the product lifecycle by collaborating with product and development teams.
3. Support various teams (People, Data, SRE, BusinessOps, Compliance & Risk, Payments, etc.) in integrating security into their processes.
4. Manage external providers for internal, technical, and certification audits.
5. Security Management:
   Design, implement, and maintain security measures for our products and solutions, including network security, identity and access management, and data protection.
6. Risk Assessment:
   Conduct regular security assessments and vulnerability scans of the products and solutions to identify and mitigate potential risks.
7. Compliance:
   In collaboration with the Risk and Compliance team, ensure compliance with industry standards and regulatory requirements (e.g. PCI-DSS, GDPR) and support internal and external audits.
8. Access Control:
   Manage and enforce Identity and Access Management (IAM) policies, roles, and permissions to ensure least privilege access.
9. Security Best Practices:
   Develop and promote security best practices and guidelines among development and operations teams.
10. Incident Response:
    Develop and maintain incident response plans for security incidents, including root cause analysis and corrective actions.
11. Collaboration:
    Work closely with DevOps, IT, and other development teams to integrate security into the deployment pipeline.
12. Documentation:
    Maintain detailed documentation of security configurations, policies, and procedures for the various environment.
13. Innovation:
    Stay up-to-date with the latest security trends, threats, and technologies to continuously enhance our cloud security posture.

(This list is not exhaustive; the job holder may be required to carry out other duties as required to fulfill the role.)

You're the perfect candidate if you have:

1. 5 years' experience in IT security (strict minimum), dealing with challenging and regulated environments.
2. Experience with network segmentation, access control technologies, and Security Service Edge tools.
3. Knowledge of Windows, Linux and MacOs operating systems hardening.
4. Proficiency in shell scripting and automation tools.
5. Experience with incident response and forensic analysis.
6. Strong experience in Security by design, reverse engineering and knowledge of OWASP top 10.
7. You have an extended knowledge of 'hashing.'
8. Very good communication skills.
9. Strong troubleshooting skills and ability to learn quickly (using any tools at your disposal) where knowledge gaps exist to find solutions to technical problems.
10. You care about security, quality, simplicity and performance.
11. Fluent in French and English (yes we really use English as we have international teams and clients).

Nice to have:

1. You have an experience in payment / regulated industry especially regulations or certifications related to PCI DSS, GDPR or Swift.
2. PCI DSS experience would be great (but still not mandatory).
3. ISO 27001 certificate, NIST, SOC 2.

Recruitment process, with at least 1 interview in our Offices in Paris:

1. Meeting with TAM, (External Consultant acting as Talent Manager).
2. Technical Assessment.
3. Meeting with CTO.

Lemonway is committed to promoting diversity, in particular by encouraging the gender mix and the employment of people with disabilities.