Deel ITLocation: Germany, Spain, Italy, Hungary, Czech Republic, Cyprus, Greece, Turkey, Bosnia & Herzegovina, Malta, Estonia, Kosovo, Serbia, Latvia, Portugal, Moldova, Lithuania, Austria, Slovenia, Slovakia, United Arab Emirates, United KingdomSalary: $70,000
- $120,000 USDEmployment type: Built for the way the world works today, Deel combines HRIS, payroll, compliance, benefits, performance, and equipment management into one seamless platform. With AI-powered tools and a fully owned payroll infrastructure, Deel supports every worker type in 150+ countries—helping businesses scale smarter, faster, and more compliantly. Among the largest globally distributed companies in the world, our team of 7,000 spans more than 100 countries, speaks 74 languages, and brings a connected and dynamic culture that drives continuous learning and innovation for our customers. As the fastest-growing Software as a Service (SaaS) company in history, Deel is transforming how global talent connects with world-class companies – breaking down borders that have traditionally limited both hiring and career opportunities. We're not just building software; In 2024 alone, we paid $11.2 billion to workers in nearly 100 currencies and provided healthcare and benefits to workers in 109 countries—ensuring people get paid and protected, no matter where they are. With our momentum—backed by a $17.3 billion valuation and $1 B in Annual Recurring Revenue (ARR) in just over five years—you'll drive meaningful impact while building expertise that makes you a sought-after leader in the transformation of integral work. ResponsibilitiesOwn the platform security architecture strategy across Deel's applications, services, and cloud environments, with a primary focus on AWS. Define secure design patterns, reference architectures, guardrails,



and baseline configurations that teams build against by default. Run Deel's security tooling as one program. Own least-privilege cloud IAM (cross-account roles, permission boundaries, SCPs, just-in-time access) and application authentication and authorization (session and token handling, multi-tenant isolation, object-level access control).
Embed security into the SDLC and CI/CD pipelines. Set the standards for image hardening and signing, admission control, pod security, network policies, secrets management, and runtime protection. Own software supply chain security. Cover dependency and transitive risk, malicious package detection, SBOMs, build integrity, and artifact provenance, from the first npm install to the running workload. Lead threat modeling for new and existing systems, and make it part of how engineering designs software rather than a security-team ritual. Run vulnerability management for findings from scanners, pentests, and bug bounty: triage, exploitability assessment, SLAs, remediation partnership with engineering, and reporting on risk reduction over time. Lead platform security incident response across application and cloud layers: triage, containment, forensics, root cause analysis, and post-incident hardening. Scale security through people. Build a Security Champions program and secure coding enablement so security knowledge spreads across engineering instead of pooling in the security team.



Act as the technical authority on platform security, reviewing high-risk designs, evaluating vendors, and influencing engineering and cloud strategy at the leadership level. Use Artificial Intelligence as an enabler to find new insights, learn from past mistakes, and continuously improve Deel's security posture, including securing the AI features Deel ships. Qualifications3+ years of hands-on experience in cybersecurity, with real depth in both cloud security and application security engineering or architecture. Deep AWS security expertise: IAM design, network controls, logging and monitoring (CloudTrail, Security Hub, GuardDuty), and data protection. Deep application security expertise: OWASP Top 10 and API Security Top 10, authentication and authorization design, injection and deserialization, SSRF, business logic flaws, and secure session handling. Proven hands-on experience operating security platforms such as Wiz (or Orca, Prisma Cloud) and Aikido (or Snyk, Semgrep, GitHub Advanced Security), including rollout, tuning, false-positive reduction, and integration with engineering workflows. Strong experience building security gates into CI/CD pipelines for both application code and Infrastructure as Code. Strong experience securing containers and Kubernetes: image hardening, runtime security, pod security standards, and Kubernetes RBAC.
Hands-on threat modeling experience (STRIDE, attack trees, or equivalent) applied to real systems, with findings turned into concrete engineering work. Ability to read, reason about, and write production code in at least one modern language (TypeScript/Node.js, Python, Go, or Java).
Experience with secrets management (HashiCorp Vault, AWS Secrets Manager) and encryption pattern

📌 Security Architect (Ceuta)
🏢 Deel
📍 Ceuta