Senior Platform Security Engineer / DevOps

• Level: Senior individual contributor

• Location: Remote within Poland, with regular overlap with the European team. Our Polish HQ is in Poznań; being able to meet there from time to time is a plus for us, not a requirement.

• Pay: 25,000–34,000 PLN net per month on B2B (invoice amount excluding VAT).

• On-call: part of the role. You would join the rotation, paged through PagerDuty.

• Stack: GCP, GKE, Terraform, GitLab CI/CD, Flux, SOPS, Linux, PostgreSQL

• Process: two conversations and one paid exercise with about three hours of recommended effort and no hard cap. The recommended total commitment is about four and a half hours. We aim to finish within ten working days.

The job

Our production platform has one dedicated owner today, with support from other engineers. That support stays. We want a second owner to work in partnership with the first, and we want that person to bring security.

You would co‑own the GCP/GKE platform with the engineer who runs it now, and you would be the security partner for the engineers who build on it. Fourthwall is a small company with no security department. When something needs fixing, there is nobody to hand it to: you write the Terraform, the pipeline check or the policy yourself, or you get the owning team to, and you check that it landed.

We want teams to keep the freedom to build fast. Security should come from configuration, policies, alerting and automated scans, so that nobody waits for an approval.

You would also run our vulnerability disclosure programme (VDP).

We want infrastructure to lead the company in using AI, beyond read‑only assistants.

What you would own

• The platform, jointly. GCP and GKE, networking, IAM, secrets, GitOps, CI/CD, observability and PostgreSQL. Both of you should be able to change, debug and recover any of it.

• The platform‑security backlog. Less standing privilege and fewer long‑lived credentials; better workload identity and secret handling; infrastructure vulnerabilities triaged, tracked and verified.

• Guardrails. Platform configuration and policies that prevent leaks and misconfiguration, alerting for what gets through, and automated scanning in the pipeline (secrets, dependencies, images, Terraform, code), including AI‑based security review. You decide what blocks a merge and keep the noise low enough that nobody routes around it.

• The VDP. Intake, validation, severity, routing to the right team, communication with the reporter, tracking the fix, disclosure. A report that looks like live exploitation goes to incident response, not into the queue.