Vestiaire Collective - Director of Cloud infrastructure and security

Berlin2w ago

In Office Director EMEA Senior Care Cloud Computing Engineering Manager Director of Security AWS Team Leadership Coaching Kubernetes GCP

Requirements

• 8+ years with a Significant experience in Infrastructure, Platform Engineering, DevOps, SRE or Cloud Security, including experience leading engineers. • You may currently be an Engineering Manager, Senior Engineering Manager or Head of who is ready to broaden your scope and step into a first Director role. • Strong practical experience with public cloud, ideally AWS, Kubernetes and Infrastructure-as-Code, with the willingness to remain close to architecture, incidents and technical delivery. • Track record establishing reliability practice at scale — SLOs, incident management, on-call, capacity planning, disaster recovery. • Demonstrable cloud cost optimisation / FinOps results at meaningful scale. • Strong grounding in cloud and application security fundamentals — IAM, network security, secrets management, CSPM, OWASP Top 10 — and the judgement to know when to hire the depth you don't have. • Working knowledge of compliance frameworks (GDPR, DORA, PCI DSS, NIS2) and how to turn requirements into practical controls. • Experience leading through incidents and security events under pressure. • Excellent communication skills: able to make a technical trade-off legible to a CFO and a risk decision legible to an engineer. • Comfortable operating with a lean team — ruthless prioritisation, automation over headcount, pragmatism over perfection. • AWS cloud (primary), GCP, Kubernetes, Vault, Cloudflare, Datadog, ArgoCD, Okta. Applications are built on top of PHP 8, Golang and Node.js, using MariaDB, MongoDB and Kafka.

Responsibilities

• Leadership across two teams • Directly lead, develop and retain a small team of six (6) experienced engineers across Cloud Infrastructure and Security. This is a player-coach role without multiple management layers, so you will remain close to the team’s technical work and day-to-day priorities. • Define a joint roadmap for both teams, aligned to business priorities and risk appetite, and make explicit calls on what we will not do. • Establish clear KPIs, SLOs and risk metrics, and report regularly to leadership on reliability, cost and security posture. • Set the operating model: what product teams self-serve behind guardrails versus what your teams own centrally. • Foster a culture where reliability and security are shared accountabilities, not tickets thrown over a wall, including establishing a Security Champions model across engineering. • Cloud infrastructure, reliability and platform • Own our AWS and GCP footprint end to end: EKS, networking, secrets (Vault), data stores (RDS/Aurora, MSK, ElastiCache, MongoDB Atlas, OpenSearch) and the edge (Cloudflare). • Establish real reliability engineering practice: SLOs and error budgets, capacity planning, and a business continuity plan. • Drive infrastructure-as-code maturity: Automating Terraform change application, advancing our move to GitOps (ArgoCD), and enforcing guardrails at creation time with policy-as-code (Kyverno/OPA) so provisioning is safe, self-serve and reviewable. • Consolidate observability into a single source of truth for metrics, logs and traces. • Improve developer experience and delivery throughput: CI/CD (Jenkins, GitHub Actions), paved roads, test environments on demand, and delivery metrics that hold up. • Own FinOps: infrastructure cost per unit of business value, cost accountability pushed back to each team, and continued run-rate reduction. Cost discipline is a first-class objective. • Support the modernisation of our core platform: Tech migrations, runtime and framework upgrades, and continuous database and Kubernetes upgrades. • Attack toil systematically: automate the recurring requests, and hand safe self-service back to product teams rather than absorbing the work. • Grow the foundations for AI-augmented engineering and operations • Own security strategy and posture across cloud, application, identity, detection and response, building and improving the governance: risk register, published roadmap, remediation SLAs, and a recurring reporting cadence for leadership. • Strengthen cloud security posture management (CNAPP) and secure-by-default configurations across all environments. • Improve Embedding security into the SDLC and CI/CD: establish full static-analysis and dependency-scanning coverage with clear criteria for when critical findings block a release. • Mature vulnerability management, penetration testing and our bug bounty program into one prioritised program with SLAs and aging reports that measurably reduce risk. • Advance identity and access management toward least privilege and zero trust: automated provisioning from groups, and periodic access reviews. • Mature logging, detection and incident response, closing SIEM coverage gaps • Set guardrails for safe AI adoption (shadow AI outside approved paths, data and prompt leakage, prompt injection, model abuse) and defend against AI-enabled fraud and phishing. • Ensure compliance with GDPR, PCI DSS v4, NIS2, and CIS v8, including a maintained, reusable evidence library rather than evidence gathered on request. • Collaboration with legal and finance teams on compliance and forensic investigation topics • Manage third-party and supply-chain risk with vendor tiering and a recurring review cadence. • Own the security-built services your team already runs (back-office authentication and ACL, banning/fraud tooling, phone verification) and decide what to keep, hand over or retire. • Own endpoint security and partner closely with Corporate IT on device and identity coverage. • Keep security awareness and training relevant to a threat landscape that now includes AI-enabled social engineering.