Platform Engineer

📋 Job Overview

Application
Validio is the agentic data management platform that automates data quality, lineage, and cataloging, so enterprises can finally trust the data behind their analytics, AI, and reporting. As a Platform Engineer focused on Security & Compliance, you own how we prove that trust, and you do it like an engineer, not an administrator.

🏢 About Validio

Founded in Sweden in 2019, we’re trusted by data-driven enterprises like Nordea, Canva, Truecaller, Traveloka, and Deutsche Glasfaser. We raised a $30M Series A this year and grew ARR 800% in twelve months as enterprises got serious about making their data AI-ready. We’re 35 people today and growing fast across Sweden, London, New York, and Amsterdam. This role is hybrid, and we expect you to work from our Stockholm office at least a couple of days per week. You’ll own initiatives end to end and make the call when you’re closest to the problem. We’re strict about testing and documentation, and fast about decisions.

🎯 The Role

As we move up-market into banking and regulated industries, a SOC 2 report, an ISO 27001 certificate, and a credible answer to “how do you protect our data” increasingly decide whether a deal closes. This is a hands-on DevSecOps role inside our Platform Engineering team. You’ll own our compliance program end to end, but you’ll run it from a terminal. You’ll turn control requirements into Terraform, CI checks, and custom tests, so controls stay green without anyone chasing screenshots. It’s not a pure cybersecurity or policy role. You’ll write code and work on the platform alongside the rest of the team.

✅ Key Responsibilities

• Own our compliance frameworks (SOC 2, ISO 27001, GDPR, HIPAA, and DORA) and run audit cycles from evidence-gathering to the audit room
• Run our Vanta instance and automate it: build custom tests in Go or Python, automate evidence collection, and wire controls into Terraform and GitHub Actions so drift is caught in a PR, not an audit
• Implement the technical measures behind our security policies across GCP, AWS, and Azure, including access management and reviews, logging, secrets, and hardening
• Own security questionnaires and our trust center, and rebuild the answer library so a bank’s 300-question questionnaire takes days, not weeks
• Run vendor security reviews and the data-protection assessments that come with them (DPIAs, LIAs, TRIAs), and keep our risk register honest
• Pitch in on platform and reliability work with the rest of the team

📌 Required Qualifications

• A background in platform, DevOps, cloud, or security engineering. You’ve built and run infrastructure, not just audited it
• Experience owning or heavily supporting a SOC 2 and/or ISO 27001 program, and the ability to turn a control requirement into concrete technical tasks
• Hands-on experience with cloud infrastructure, ideally GCP (strong AWS or Azure experience also works)
• Production experience with Kubernetes, Terraform, and CI/CD, and enough Go or Python to build the automation this role needs
• Experience with a GRC automation platform such as Vanta, Drata, or Secureframe (Vanta a strong plus), and a firm preference for automating evidence over collecting it by hand
• Clear, persuasive writing: questionnaire answers an enterprise security team trusts, and documentation an auditor accepts the first time
• The drive to get things to closure, including chasing control owners across engineering, IT, HR, and legal

⭐ Desirable Experience

• ISO 27001 Lead Implementer / Lead Auditor, CISA, Security+, CISM, or CISSP
• Supporting compliance for financial-services or other regulated customers
• Vendor-risk (TPRM) experience

🎁 Benefits

We use some essential cookies to make this site work. We would like to set performance cookies to help us make sure the website functions as expected.

🛂 Visa & Eligibility