Platform Engineer - Security & Compliance
Summary
Validio seeks a Platform Engineer for Security & Compliance in Stockholm. This role involves owning compliance frameworks (SOC 2, ISO 27001, GDPR, HIPAA, DORA) and automating controls using Terraform, CI checks, and custom code (Go/Python) on GCP, AWS, and Azure.
Validio is the agentic data management platform that automates data quality, lineage, and cataloging, so enterprises can finally trust the data behind their analytics, AI, and reporting. As a Platform Engineer focused on Security & Compliance, you own how we prove that trust, and you do it like an engineer, not an administrator.
As we move up-market into banking and regulated industries, a SOC 2 report, an ISO 27001 certificate, and a credible answer to “how do you protect our data” increasingly decide whether a deal closes. This is a hands-on DevSecOps role inside our Platform Engineering team. You’ll own our compliance program end to end, but you’ll run it from a terminal. You’ll turn control requirements into Terraform, CI checks, and custom tests, so controls stay green without anyone chasing screenshots. It’s not a pure cybersecurity or policy role. You’ll write code and work on the platform alongside the rest of the team.
What you’ll do
Own our compliance frameworks (SOC 2, ISO 27001, GDPR, HIPAA, and DORA) and run audit cycles from evidence-gathering to the audit room
Run our Vanta instance and automate it: build custom tests in Go or Python, automate evidence collection, and wire controls into Terraform and GitHub Actions so drift is caught in a PR, not an audit
Implement the technical measures behind our security policies across GCP, AWS, and Azure, including access management and reviews, logging, secrets, and hardening
Own security questionnaires and our trust center, and rebuild the answer library so a bank’s 300-question questionnaire takes days, not weeks
Run vendor security reviews and the data-protection assessments that come with them (DPIAs, LIAs, TRIAs), and keep our risk register honest
Pitch in on platform and reliability work with the rest of the team
What you’ll bring
A background in platform, DevOps, cloud, or security engineering. You’ve built and run infrastructure, not just audited it
Experience owning or heavily supporting a SOC 2 and/or ISO 27001 program, and the ability to turn a control requirement into concrete technical tasks
Hands-on experience with cloud infrastructure, ideally GCP (strong AWS or Azure experience also works)
Production experience with Kubernetes, Terraform, and CI/CD, and enough Go or Python to build the automation this role needs
Experience with a GRC automation platform such as Vanta, Drata, or Secureframe (Vanta a strong plus), and a firm preference for automating evidence over collecting it by hand
Clear, persuasive writing: questionnaire answers an enterprise security team trusts, and documentation an auditor accepts the first time
The drive to get things to closure, including chasing control owners across engineering, IT, HR, and legal
Bonus points for
ISO 27001 Lead Implementer / Lead Auditor, CISA, Security+, CISM, or CISSP
Supporting compliance for financial-services or other regulated customers
Vendor-risk (TPRM) experience
Our stack, and why
We use Vanta for compliance automation, because evidence should come from systems, not screenshots. Our infrastructure spans Google Cloud, AWS, and Azure because our customers run on all three, and our workloads run on Kubernetes across GKE, EKS, and AKS. Everything is defined in Terraform and shipped through GitHub Actions, so controls, evidence, and enforcement live in code you can read, query, and test. We write internal tooling and custom tests in Go and Python. Where the automation isn’t there yet, you build it.
Why Validio
Founded in Sweden in 2019, we’re trusted by data-driven enterprises like Nordea, Canva, Truecaller, Traveloka, and Deutsche Glasfaser. We raised a $30M Series A this year and grew ARR 800% in twelve months as enterprises got serious about making their data AI-ready. We’re 35 people today and growing fast across Sweden, London, New York, and Amsterdam. This role is hybrid, and we expect you to work from our Stockholm office at least a couple of days per week. You’ll own initiatives end to end and make the call when you’re closest to the problem. We’re strict about testing and documentation, and fast about decisions.
Come as you are. We hire for what you’ll build with us, and we welcome applicants of every background.