Senior InfoSec Engineer - Identity & Assurance (m/f/d)
About This Role
As Senior InfoSec Engineer, Identity & Assurance (m/f/d), you'll ensure access to critical systems is reviewed, justified and removed when no longer needed, and own the proof that controls work. You'll run access reviews and privileged access processes in the identity governance platform, grounded in the access model and the risks specific to digital assets and payments. When a vulnerability or test finding arises, you'll drive it to closure within SLA, and you'll keep the organization audit-ready through accurate registers, current evidence and metrics that hold up to auditors and regulators.
What You'll Be Doing
Run access review campaigns in the identity governance platform covering privileged, administrative and third-party accounts, including access to sensitive platforms such as the custody platform.
Check joiner, mover and leaver controls, identify orphaned or excessive access, operate privileged access management controls, and maintain the mapping of identity provider groups to roles with IT-Ops.
Track remediation of vulnerabilities and test findings against SLA, escalate breaches, and run periodic cloud security posture reviews with findings tracked to closure.
Link vulnerabilities, incidents and risks to assets, report unknown or unmanaged assets, and prepare vulnerability and posture metrics for management reporting.
Operate the GRC platform day to day, including integrations, evidence and failing checks; monitor CI/CD security gate results and collect pipeline evidence; and track test and audit findings to closure, including retests.
Build continuous control monitoring so evidence is produced by systems rather than manually, and review vendor security evidence such as SOC 2 reports, ISO 27001 certificates and penetration test summaries for third-party risk assessments.
Take part in the security on-call rotation one week per month: support high and critical incidents, approve emergency changes and back up the detection and response colleague.
What We're Looking For
5+ years in information security with a focus on identity and access management, vulnerability management or security assurance, ideally in a regulated environment such as financial services or payments.
Hands-on experience running access reviews and identity governance processes, including privileged access.
Experience with vulnerability management workflows and cloud security posture management, plus working knowledge of AWS identity and access concepts.
Practical incident response experience, sufficient to cover on-call and back up a colleague.
Comfort working with structured data: registers, inventories and evidence that must be accurate and auditable.
Ability to work independently in a remote, async-first team and communicate clearly with engineers, IT-Ops and management.
Excellent written and spoken English.
Bonus Points
Experience with identity governance platforms and privileged access management tools.
Experience with GRC and compliance automation platforms.
Familiarity with DORA, ISO 27001 or comparable frameworks.
Scripting in Python, Bash or similar to automate evidence collection and reviews.
Experience with third-party risk management.
Exposure to digital assets or custody platforms.
Certifications such as CISA or CISSP.
Ready to Apply?
To submit your application for this position, please visit Qivalis's official website and follow their application process.