# Cloud Security Engineer [Godutch](https://gurify.com/jobs?q=Godutch) · Amsterdam · Posted 3 weeks ago [Security](https://gurify.com/jobs/security) [Apply on the original posting → (opens in a new tab)](https://godutch.teamtailor.com/jobs/8580404-cloud-security-engineer) ## Job description GoDutch is looking for a Cloud Security Engineer (GCP) to become the first dedicated security engineer in its Engineering team, based in Amsterdam. GoDutch is a Dutch fintech platform used by more than 27,500 SMEs and growing fast. Business accounts, cards, invoicing, bookkeeping and payments sit in one app. The engineering team is rapidly growing, senior and close to the product. You will work directly with the CPTO, the Head of Engineering and the Chief Compliance & Risk Officer. Your work is visible from day one: you set the security baseline that the new platform and every future engineer will build on. ### What you will do, in short In a financial institution, security is not only about protecting systems. It is about earning customer trust, meeting DORA and supervisory expectations, and keeping money movements correct. You will own GoDutch's cloud security posture end to end, turn written policy into working controls, and steer the specialist partners who operate parts of the stack today. ### What you will do As the security subject matter expert for GoDutch's engineering teams, this could mean: ### Cloud and platform security - Own the security posture of GoDutch's Google Cloud organisation: IAM, org policies, VPC Service Controls, KMS and secrets, logging and cloud posture management. - Harden the Kubernetes environment that hosts the banking platform, including workload isolation and least-privilege access between services. - Secure the event and orchestration layer (Kafka, Temporal, Apache Camel) and the data platform (BigQuery), including encryption, access and data residency. - Review and advise on the security of system designs, partner integrations and APIs (core banking, card processing, payments, KYC/KYB). - Build and maintain security dashboards that give management and the board a clear view of cloud assets and posture. ### Secure delivery (DevSecOps) - Work with engineering and the platform partner to embed security gates into CI/CD and GitOps (Argo CD): SAST, dependency and container scanning, IaC policy checks, secrets detection. - Establish secure development guidelines for Java/Quarkus and TypeScript services, and support teams in adopting them. - Run threat modelling for new features and integrations that move money or handle customer data. ### Detection, response and resilience - Configure and tune threat detection, alerting and response playbooks across cloud workloads, observability and endpoints. - Participate in incident response, including security investigation and input for DORA major-incident classification and reporting. - Contribute security scenarios to business continuity and disaster recovery testing. - Coordinate penetration tests and, where in scope, threat-led testing; track findings to closure. ### Governance, risk and compliance - Turn GoDutch's information security policies and standards into implemented, evidenced controls, against CIS Controls, ISO 27001 and DORA. - Maintain the ICT asset register and vulnerability management process, and feed the GRC platform with control evidence. - Assess the ICT security of third-party providers and support the Register of Information and contract requirements under DORA. - Prepare evidence and answers for regulators, auditors and partner due diligence - Coordinate with GoDutch's managed service providers and external security partner, holding them to agreed scope and quality. ### Awareness and continuous improvement - Run security training and awareness for engineering and the wider company. - Track security metrics and report on posture improvements to the CPTO and management. - Stay current with emerging threats and recommend tools and practices that fit a lean team. ### Our tech stack Java/Quarkus, TypeScript, Python/Django, Google Cloud Platform (GCP), Kubernetes, Kafka, Temporal, Apache Camel, Argo CD. Security tooling covers cloud posture management, enterprise EDR, centralised logging and observability, zero-trust network access and a central identity provider, run together with specialist partners. Details are shared during the interview process. ### What you need to succeed GoDutch is looking for someone who is passionate about security, combines hands-on technical depth with clear communication, and is comfortable being the first security engineer in a growing team. Furthermore, GoDutch requires: - Proven experience in cloud security (typically 5+ years in security or platform engineering). - Expert knowledge of cloud security: IAM, org policies, network perimeter controls, KMS, centralised logging. - Hands-on experience with cloud security posture management (CSPM/CNAPP) tooling. - Experience securing Kubernetes workloads and Infrastructure as Code. - Knowledge of threat detection, vulnerability management and incident response, with SIEM/EDR tooling. - Experience embedding security into CI/CD pipelines. - Working knowledge of regulatory and control frameworks relevant to financial services: DORA, ISO 27001, CIS Controls, GDPR. - Experience working with, and holding to account, managed service providers or external security partners. - Strong communication skills, and the ability to explain security risk to engineers, management and supervisors alike. - Fluent English; eligible to work in the Netherlands. ### Nice to have - Security certifications (e.g. CISSP, CCSP, Google Professional Cloud Security Engineer, GIAC). - Experience at a licensed payment institution, EMI or bank, ideally under DNB or ECB supervision. - Experience with DORA ICT risk management, third-party risk or threat-led penetration testing (TIBER/TLPT). - Familiarity with card (PCI DSS) and payments security, including SEPA and PSD2 strong customer authentication. - Experience with event-driven architectures (Kafka, Temporal) and securing service-to-service communication. - Experience with zero-trust access and identity platforms. - Experience with a GRC platform and automated control evidence. - Knowledge of secure coding and application security testing (SAST/DAST) for Java and TypeScript ### Why join GoDutch as a Cloud Security Engineer? - You will be the first dedicated security engineer, setting the security architecture of a challenger finance platform rather than inheriting one. - You will protect the money and administration of thousand of users. - You will work with a modern cloud-native stack and have real influence over which security tools and practices are adopted. - You will work directly with the CPTO, engineering leadership and compliance, with short decision lines. - You will help GoDutch scale securely in a competitive market, and can grow the security function with it as the team expands. - Our office on the Nieuwezijds Voorburgwal, right in the center of Amsterdam and a 3-minute walk from Amsterdam Central Station, with a hybrid way of working Although we normally want to reply to every application ourselves, due to the high number of applications for this role, we're temporarily only reaching out to candidates we'd like to invite for a first conversation. Haven't heard from us within two weeks? Then we've decided not to move forward this time. Sorry for the inconvenience, and thank you for your interest in GoDutch. **Live in Godutch’s hiring system.** Read from the company's own applicant tracking system, not reposted from a job board — so it's a real, open requisition rather than an ad that outlived the role. We remove it as soon as it disappears at source. ## More jobs like this - GO [Cloud Security Engineer](https://gurify.com/job/cloud-security-engineer-at-godutch-607759bb97cb) Godutch · Amsterdam · 3 weeks ago - FL [Senior Security Engineer, Corporate Security](https://gurify.com/job/senior-security-engineer-corporate-security-at-flexport-90232267f77b) Flexport · Amsterdam, Netherlands · 4 weeks ago - CA [Lead Security Engineer](https://gurify.com/job/lead-security-engineer-at-catawiki-ded0f7644020) Catawiki · Amsterdam, Netherlands · 5 weeks ago - FL [Senior Security Engineer, Detection & Response](https://gurify.com/job/senior-security-engineer-detection-response-at-flexport-606ae08d1e0a) Flexport · Amsterdam, Netherlands · 4 weeks ago - BJ [Cloud Infrastructure Security Engineer](https://gurify.com/job/cloud-infrastructure-security-engineer-at-bjak-2207deca3ccc) Bjak · United Kingdom · last week - ST [Principal Product Security Engineer](https://gurify.com/job/principal-product-security-engineer-at-storiogroup-820b227654c9) Storiogroup · Amsterdam, Netherlands · 2 months ago ```json {"@context":"https://schema.org/","@type":"JobPosting","title":"Cloud Security Engineer","description":"\u003Cp\u003EGoDutch is looking for a Cloud Security Engineer (GCP) to become the first dedicated security engineer in its Engineering team, based in Amsterdam.\u003C/p\u003E\u003Cp\u003EGoDutch is a Dutch fintech platform used by more than 27,500 SMEs and growing fast. Business accounts, cards, invoicing, bookkeeping and payments sit in one app.\u003C/p\u003E\u003Cp\u003EThe engineering team is rapidly growing, senior and close to the product. You will work directly with the CPTO, the Head of Engineering and the Chief Compliance \u0026amp; Risk Officer. Your work is visible from day one: you set the security baseline that the new platform and every future engineer will build on.\u003C/p\u003E\u003Ch3\u003EWhat you will do, in short\u003C/h3\u003E\u003Cp\u003EIn a financial institution, security is not only about protecting systems. It is about earning customer trust, meeting DORA and supervisory expectations, and keeping money movements correct. You will own GoDutch\u0026#39;s cloud security posture end to end, turn written policy into working controls, and steer the specialist partners who operate parts of the stack today.\u003C/p\u003E\u003Ch3\u003EWhat you will do\u003C/h3\u003E\u003Cp\u003EAs the security subject matter expert for GoDutch\u0026#39;s engineering teams, this could mean:\u003C/p\u003E\u003Ch3\u003ECloud and platform security\u003C/h3\u003E\u003Cul\u003E\u003Cli\u003EOwn the security posture of GoDutch\u0026#39;s Google Cloud organisation: IAM, org policies, VPC Service Controls, KMS and secrets, logging and cloud posture management.\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003EHarden the Kubernetes environment that hosts the banking platform, including workload isolation and least-privilege access between services.\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003ESecure the event and orchestration layer (Kafka, Temporal, Apache Camel) and the data platform (BigQuery), including encryption, access and data residency.\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003EReview and advise on the security of system designs, partner integrations and APIs (core banking, card processing, payments, KYC/KYB).\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003EBuild and maintain security dashboards that give management and the board a clear view of cloud assets and posture.\u003C/li\u003E\u003C/ul\u003E\u003Ch3\u003ESecure delivery (DevSecOps)\u003C/h3\u003E\u003Cul\u003E\u003Cli\u003EWork with engineering and the platform partner to embed security gates into CI/CD and GitOps (Argo CD): SAST, dependency and container scanning, IaC policy checks, secrets detection.\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003EEstablish secure development guidelines for Java/Quarkus and TypeScript services, and support teams in adopting them.\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003ERun threat modelling for new features and integrations that move money or handle customer data.\u003C/li\u003E\u003C/ul\u003E\u003Ch3\u003EDetection, response and resilience\u003C/h3\u003E\u003Cul\u003E\u003Cli\u003EConfigure and tune threat detection, alerting and response playbooks across cloud workloads, observability and endpoints.\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003EParticipate in incident response, including security investigation and input for DORA major-incident classification and reporting.\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003EContribute security scenarios to business continuity and disaster recovery testing.\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003ECoordinate penetration tests and, where in scope, threat-led testing; track findings to closure.\u003C/li\u003E\u003C/ul\u003E\u003Ch3\u003EGovernance, risk and compliance\u003C/h3\u003E\u003Cul\u003E\u003Cli\u003ETurn GoDutch\u0026#39;s information security policies and standards into implemented, evidenced controls, against CIS Controls, ISO 27001 and DORA.\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003EMaintain the ICT asset register and vulnerability management process, and feed the GRC platform with control evidence.\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003EAssess the ICT security of third-party providers and support the Register of Information and contract requirements under DORA.\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003EPrepare evidence and answers for regulators, auditors and partner due diligence\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003ECoordinate with GoDutch\u0026#39;s managed service providers and external security partner, holding them to agreed scope and quality.\u003C/li\u003E\u003C/ul\u003E\u003Ch3\u003EAwareness and continuous improvement\u003C/h3\u003E\u003Cul\u003E\u003Cli\u003ERun security training and awareness for engineering and the wider company.\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003ETrack security metrics and report on posture improvements to the CPTO and management.\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003EStay current with emerging threats and recommend tools and practices that fit a lean team.\u003C/li\u003E\u003C/ul\u003E\u003Ch3\u003EOur tech stack\u003C/h3\u003E\u003Cp\u003EJava/Quarkus, TypeScript, Python/Django, Google Cloud Platform (GCP), Kubernetes, Kafka, Temporal, Apache Camel, Argo CD.\u003C/p\u003E\u003Cp\u003ESecurity tooling covers cloud posture management, enterprise EDR, centralised logging and observability, zero-trust network access and a central identity provider, run together with specialist partners. Details are shared during the interview process.\u003C/p\u003E\u003Ch3\u003EWhat you need to succeed\u003C/h3\u003E\u003Cp\u003EGoDutch is looking for someone who is passionate about security, combines hands-on technical depth with clear communication, and is comfortable being the first security engineer in a growing team. Furthermore, GoDutch requires:\u003C/p\u003E\u003Cul\u003E\u003Cli\u003EProven experience in cloud security (typically 5\u002B years in security or platform engineering).\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003EExpert knowledge of cloud security: IAM, org policies, network perimeter controls, KMS, centralised logging.\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003EHands-on experience with cloud security posture management (CSPM/CNAPP) tooling.\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003EExperience securing Kubernetes workloads and Infrastructure as Code.\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003EKnowledge of threat detection, vulnerability management and incident response, with SIEM/EDR tooling.\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003EExperience embedding security into CI/CD pipelines.\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003EWorking knowledge of regulatory and control frameworks relevant to financial services: DORA, ISO 27001, CIS Controls, GDPR.\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003EExperience working with, and holding to account, managed service providers or external security partners.\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003EStrong communication skills, and the ability to explain security risk to engineers, management and supervisors alike.\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003EFluent English; eligible to work in the Netherlands.\u003C/li\u003E\u003C/ul\u003E\u003Ch3\u003ENice to have\u003C/h3\u003E\u003Cul\u003E\u003Cli\u003ESecurity certifications (e.g. CISSP, CCSP, Google Professional Cloud Security Engineer, GIAC).\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003EExperience at a licensed payment institution, EMI or bank, ideally under DNB or ECB supervision.\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003EExperience with DORA ICT risk management, third-party risk or threat-led penetration testing (TIBER/TLPT).\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003EFamiliarity with card (PCI DSS) and payments security, including SEPA and PSD2 strong customer authentication.\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003EExperience with event-driven architectures (Kafka, Temporal) and securing service-to-service communication.\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003EExperience with zero-trust access and identity platforms.\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003EExperience with a GRC platform and automated control evidence.\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003EKnowledge of secure coding and application security testing (SAST/DAST) for Java and TypeScript\u003C/li\u003E\u003C/ul\u003E\u003Ch3\u003EWhy join GoDutch as a Cloud Security Engineer?\u003C/h3\u003E\u003Cul\u003E\u003Cli\u003EYou will be the first dedicated security engineer, setting the security architecture of a challenger finance platform rather than inheriting one.\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003EYou will protect the money and administration of thousand of users.\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003EYou will work with a modern cloud-native stack and have real influence over which security tools and practices are adopted.\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003EYou will work directly with the CPTO, engineering leadership and compliance, with short decision lines.\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003EYou will help GoDutch scale securely in a competitive market, and can grow the security function with it as the team expands.\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003EOur office on the Nieuwezijds Voorburgwal, right in the center of Amsterdam and a 3-minute walk from Amsterdam Central Station, with a hybrid way of working\u003C/li\u003E\u003C/ul\u003E\u003Cp\u003EAlthough we normally want to reply to every application ourselves, due to the high number of applications for this role, we\u0026#39;re temporarily only reaching out to candidates we\u0026#39;d like to invite for a first conversation. Haven\u0026#39;t heard from us within two weeks? Then we\u0026#39;ve decided not to move forward this time. Sorry for the inconvenience, and thank you for your interest in GoDutch.\u003C/p\u003E","identifier":{"@type":"PropertyValue","name":"Gurify","value":"cloud-security-engineer-at-godutch-7b7f73c4ffa2"},"url":"https://gurify.com/job/cloud-security-engineer-at-godutch-7b7f73c4ffa2","datePosted":"2026-10-20","validThrough":"2026-12-26T23:59:59Z","hiringOrganization":{"@type":"Organization","name":"Godutch","sameAs":"https://godutch.teamtailor.com"},"directApply":false,"jobLocation":{"@type":"Place","address":{"@type":"PostalAddress","addressCountry":"NL","addressLocality":"Amsterdam"}}} ``` ```json {"@context":"https://schema.org/","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Jobs","item":"https://gurify.com/jobs"},{"@type":"ListItem","position":2,"name":"Netherlands","item":"https://gurify.com/jobs/netherlands"},{"@type":"ListItem","position":3,"name":"Cloud Security Engineer","item":"https://gurify.com/job/cloud-security-engineer-at-godutch-7b7f73c4ffa2"}]} ```