<div class="content-intro"><p><span data-contrast="none">We’re always looking for the ones </span><span style="color: rgb(112, 64, 164);"><strong><span data-contrast="none">truly passionate</span></strong></span><span data-contrast="none"> about their work. If you are amongst them, you can rest assured there is a place for you in eMAG. We’ve grown very fast and are determined to keep doing so. What brought us here is our desire for continuous evolution and practical results. </span><span data-ccp-props="{"134233117":false,"134233118":false,"335551550":6,"335551620":6,"335559738":0,"335559739":0}"> </span></p> <p><span data-contrast="none">More than 6000 colleagues are part of </span><span style="color: rgb(112, 64, 164);"><strong><span data-contrast="none">eMAG Teams</span></strong></span><span data-contrast="none">. We strongly believe in people's development and therefore every year we invest more and more energy and resources to remain an organization that is constantly learning. We want to ensure that you’ll have the most talented colleagues and the proper environment to grow and achieve great results, to become what you desire on a personal and professional level. </span><span style="color: rgb(112, 64, 164);"><strong><span data-contrast="none">Join us, grow faster</span></strong></span><span data-contrast="none"><span style="color: rgb(112, 64, 164);">!</span> </span><span data-ccp-props="{"134233117":false,"134233118":false,"335551550":6,"335551620":6,"335559738":0,"335559739":0}"> </span></p></div><p> </p> <h2 style="text-align: center;"><span style="color: rgb(112, 64, 164);">Security Engineer (Flip Team) </span></h2> <p> </p> <p> </p> <p><strong>Flip</strong> is Romania's largest platform for refurbished electronics, operating in Romania, Bulgaria, Hungary and Greece. We build and run our own e-commerce platform on Google Cloud, with Java services and React front-ends shipped continuously by our development teams.</p> <p>We are now creating our first dedicated security role. You will report directly to the CTO and have a real mandate to shape how security is built into the way we develop, deploy and operate our platform. There is no existing security team to slot into: you will set the priorities, build the first controls and processes, and work side by side with our development and infrastructure engineers to make them stick.</p> <p>This is a builder's role. We are not looking for someone who is already an expert in every corner of security. We are looking for someone with real depth in application security, hands-on security testing, or both; who is curious about the areas they know less well (cloud, detection and incident response, governance).</p> <p><span style="color: rgb(0, 130, 230);"><strong>What you’ll have to do:</strong></span></p> <p><strong>Application security and secure development (Java, React, APIs)</strong></p> <ul> <li>Embed security into our development workflow: threat modeling for new features, secure code review, and clear guidance for developers on the OWASP Top 10, authentication/authorization and API security.</li> <li>Integrate and own security tooling in our CI/CD pipelines: SAST, DAST, dependency scanning and secret detection, tuned so that developers act on the results rather than ignore them.</li> <li>Be the go-to security partner for our development teams, helping them design and ship secure features without slowing releases.</li> </ul> <p><strong>Security testing and vulnerability management</strong></p> <ul> <li>Run hands-on penetration tests and vulnerability assessments against our web applications, APIs and infrastructure, and coordinate external testing and vulnerability reports.</li> <li>Own the vulnerability management process end to end: identify, document with clear impact and remediation guidance, prioritize by real risk, follow up with owners, and validate fixes.</li> </ul> <p><strong>Detection, monitoring and incident response</strong></p> <ul> <li>Improve security logging and monitoring across applications and cloud infrastructure, and define alerts for the events that matter (abuse of OTP/SMS flows, credential attacks, unusual access, misconfiguration changes).</li> <li>Take part in incident response and post-incident reviews, and maintain our incident response procedure and playbooks.</li> </ul> <p><strong>Cloud and infrastructure security (Google Cloud, nice to have)</strong></p> <ul> <li>Review and harden our GCP environment: IAM and least-privilege access, VPC design and network segmentation, Cloud Armor / WAF rules, storage and service exposure.</li> <li>Secure our container and compute workloads: GKE and Cloud Run configuration, image scanning, Linux hardening, secrets management and KMS usage.</li> <li>Bring security into Infrastructure as Code and introduce continuous posture monitoring (CSPM-style) so misconfigurations are caught early rather than found in audits.</li> </ul> <p><strong>Security governance (secondary focus, support the CTO and Legal in already implemented activities)</strong></p> <ul> <li>Be the backup technical point of contact for our NIS2 (OUG 155/2024) obligations: help keeping the incident response procedure current, make sure logging and evidence are in place, and help us stay ready to not