Principal Security Engineer

Second Foundation is a global energy trading company with around 500+ employees across locations in Prague HQ (CZ), Zug (CH), Berlin (DE), Charlotte (USA), and Tokyo (JP). We specialize in power market trading and in the integration and optimization of renewable energy and battery storage systems. In parallel, we are actively expanding our own asset base, with a primary focus on battery storage.

We are looking for a senior, hands-on Principal Security Engineer to serve as the technical design authority for security across our full technology stack. This is a builder’s role rather than a governance role: you design secure architecture at the design phase, map needs to risk end-to-end, and stay close enough to the technology to implement and prove what you propose. You work alongside the best mathematicians and engineers in the world.

You may recognize yourself under titles such as Staff/Senior Security Engineer, DevSecOps Engineer, Cloud Security Engineer, Platform Security Engineer, or Security Architect — what matters to us is that you have built and shipped security in a modern engineering environment, not only reviewed and documented it.

What you would work on

• Own security architecture across cloud, on-premise, and hybrid environments, and embed security into new initiatives already at the design phase (new offices, new-country operations, new business lines such as battery storage).
• Perform end-to-end, risk-driven mapping of security needs across systems and data flows, and translate it into concrete, implementable architecture.
• Mature our DevSecOps posture and secure the full tech stack — application security, IAM, secrets management, and vulnerability management — partnering directly with engineering.
• Provide hands-on technical depth across development, data, IaaS (Kubernetes, Terraform), DevOps tooling, and the analytics stack, including Azure resource and permission design.
• Design solutions for concrete cross-entity and partner problems, such as secure data exchange with our Japanese partner and the data separation between Second Foundation and Bochemie.
• Work with the Cybersecurity Admin and our SOC partner to close monitoring connector gaps and turn detections into architectural improvements.
• Co-own architecture decisions within the Security Committee, and consume regulatory requirements from the Compliance Cybersecurity Counsel as design inputs.

Where you go deep, and where you go broad

This is a broad role, but it is not a "one person knows everything at expert level" role. We expect architect-level judgement across all layers — cloud, IAM, network, application, and data — and proven, hands-on delivery depth in the areas that matter most to us:

• Azure resource, identity and permission design (IAM / secrets).
• DevSecOps and cloud-native security — Kubernetes, Terraform / infrastructure-as-code, CI/CD, policy- and compliance-as-code.
• Secure cross-entity and partner data exchange and separation.

Across the remaining areas we value strong architectural reasoning plus a demonstrated ability to get hands-on and learn new technologies quickly — more than pre-existing expert-level command of every domain.

What makes you a great candidate

• Proven, hands-on experience implementing — not only specifying — security across a modern engineering stack; you have built and shipped, not only reviewed and documented.
• Strong architecture skills: able to design at the design phase and reason about trade-offs across cloud, IAM, network, application, and data layers.
• Real hands-on depth in at least two of our core areas above (Azure/IAM, DevSecOps/Kubernetes/Terraform, secure data exchange), and the ability to ramp quickly on the rest.
• Breadth across development, data, IaaS / Kubernetes / Terraform, DevOps, and analytics, and a demonstrated ability to learn new technologies quickly.
• Ability to understand security strategically and to map risk to controls end-to-end.
• Credible with senior engineers; pragmatic; biased toward enabling the business securely rather than blocking it.
• English language – C1 level; comfortable in an international, multi-entity environment.
• Relevant certifications (e.g. AWS/Azure security, CKS, CISSP, OSCP) are valued but not required — we weight demonstrated hands-on delivery over certificates.

What this role is not

To keep the role focused and genuinely deliverable by one person, the following are owned elsewhere and are not required of this role:

• Obscure or jurisdiction-specific regulatory detail (e.g. CRA, CER, NIS2 in Romania) — provided by the Compliance Cybersecurity Counsel.
• Abstract compliance frameworks as an ownership area (MITRE ATT&CK, GDPR, AI Act) — owned by Compliance / Legal.
• Non-IT physical security (camera masking in the office, fence height for battery-storage sites) — owned by asset owners with Compliance.
• Deep single-domain specialist work (e.g. the controller inside a battery-storage control unit, full Unix hardening of a Raspberry Pi) — this is not a one-person-knows-everything role.
• SOC operations and monitoring delivery — covered by our SOC partner and the Cybersecurity Admin.

What we offer

• Senior-level, competitive salary package benchmarked to attract hands-on builders, with a performance-based bonus.
• Autonomy in how you manage your work.
• Diverse, international projects, with opportunities for on-site involvement.
• Flat hierarchies and short decision-making paths — a builder, not a blocker.
• Brand new office in the Prague city center – Masaryčka.
• Exceptional benefits, including a training budget, on-site lunches, gym and more.
• 25 days of paid holiday.