🧡 Coverflex
Work changed. Pay didn’t.
Coverflex exists to make compensation work for everyone.
Pay is still rigid, fragmented, and hard to feel.
We turn compensation into choice — one platform, one card, one app — for benefits, meal allowance, insurance and more.
Our platform is simple for HR and meaningful for employees.
We provide choice, smarter compensation tools and empowerment.
⚙️ TL;DR (The Essentials)
Role: Platform Security Engineer
Seniority Level: Senior
Type: Individual Contributor
Languages: English (main) / Portuguese / Spanish / Italian
Main Tools: AWS, Kubernetes, Terraform, GitHub Actions, Datadog, CI/CD security scanning, identity and secrets management
Main Stack: Elixir/Phoenix, PostgreSQL, React Native (Expo)
Location: Remote (Europe only)
Compensation:
Base Salary: 50.000€ to 67.000€ gross yearly
Bonus / Commissions: No
Equity: Yes – Stock Options under our Equity Incentive Plan
Benefits: All Coverflex benefits apply
Contract Type: Permanent
💥 Your Impact
Your role will play a major role in our success because…
→ We look after people's benefits and personal data in several countries, so trust is at the heart of what we do. As we grow, you'll make sure our security grows with us. You'll bring deep security expertise to DevX, the team that builds the platform and paved road for our engineers, and you'll make the secure path the easiest path for everyone.
You’ll know you’re successful when, after 90 days, you’ve…
-> Shipped your first secure-by-default workflow for production operations, with access that's controlled, auditable and easy to use
-> Shaped how we run security in our delivery pipeline: priorities, response targets and automation
-> Led a resilience exercise that sharpened our recovery playbooks
How we’ll measure success:
Main KPI 1: More production operations running through secure, self-service and observable tooling
Main KPI 2: Security findings caught early in the delivery pipeline and resolved quickly, with automation doing the heavy lifting
Main KPI 3: Business continuity we can count on, with clear recovery targets that we test regularly
Secondary KPI 1: Edge protection that adapts to our applications and keeps the user experience smooth
Secondary KPI 2: Engineers adopt the security guardrails and are happy with them
⚡ Reality Check - What Makes This Role Hard
Let’s be real - here’s what makes this role challenging:
You're a platform engineer first. Security is your main focus, but you're a full member of DevX. You'll share the team's wider work: infrastructure, CI/CD, developer tooling and experience, observability and incident troubleshooting. Expect a real share of your time on work that isn't about security.
The challenge is to improve our security posture while improving developer experience, raising security awareness across engineering teams, and making the secure path the easiest path.
A big part of the work is delivering meaningful, production-grade improvements without slowing developer throughput or impacting platform users. This requires clear prioritisation, safe rollout patterns, and tight feedback loops so we can move quickly while minimising operational risk and unnecessary friction.
👤 You
Must-haves (evidence, not years)
Owned application or platform security in a production cloud environment, with clear examples of impact
Strong cloud security fundamentals: IAM and identity plumbing (SSO/OIDC), secrets management, and least privilege in practice
Strong platform engineering across infrastructure as code, CI/CD with security built in, and observability
Strong experience running Kubernetes in production, including workload security and access controls
Cloud networking and edge: VPC boundaries, DNS, TLS, load balancing, CDN and WAF tuning
Reliability in practice: SLOs, on-call, threat modelling, incident command, and postmortems
Backup, restore and disaster recovery designed and actually exercised
Treats the platform as a product: measures adoption and developer…