Hello, let’s meet!

Who We Are

While Xebia is a global tech company, our journey in CEE started with two Polish companies – PGS Software, known for world-class cloud and software solutions, and GetInData, a pioneer in Big Data. Today, we’re a team of 1,000+ experts delivering top-notch work across cloud, data, and software. And we’re just getting started.

What We Do

We work on projects that matter – and that make a difference. From fintech and e-commerce to aviation, logistics, media, and fashion, we help our clients build scalable platforms, data and AI solutions, and cutting-edge applications to shape the future of tech. Our clients include McLaren, Aviva, Deloitte, Spotify, Disney, ING, UPS, Tesco, Truecaller, AllSaints, Volotea, Schmitz Cargobull, Allegro, InPost, and many, many more.

We value smart tech, real ownership, and continuous growth. We use modern, open-source stacks, and we’re proud to be trusted partners of Databricks, dbt, Snowflake, Azure, GCP, and AWS. Fun fact: we were the first AWS Premier Partner in Poland!

Beyond Projects

What makes Xebia special? Our community. We support tech communities, organize meetups (Software Talks, Data Tech Talks), and have a culture that actively support your growth via Guilds, Labs, and personal development budgets — for both tech and soft skills. It’s not just a job. It’s a place to grow.

What sets us apart? 

Our mindset. Our vibe. Our people. And while that’s hard to capture in text – come visit us and see for yourself.

About the role
We are looking for a DevSecOps Lead who will act as a key bridge between platform engineering teams and the CSO organization. You will be shaping how security requirements are translated into engineering practices while ensuring alignment between architecture, risk, and business priorities.

You will be:

• developing a deep understanding of platform architecture including infrastructure, services, data flows, and integrations,
• evaluating platform designs against security requirements and identifying risks and gaps,
• producing clear and evidence-based security assessments with prioritized remediation recommendations,
• acting as the primary liaison between platform engineering teams and the CSO organisation,
• translating security policies into actionable engineering guidance,
• representing platform constraints and technical realities to inform security decisions,
• facilitating regular alignment between teams on security priorities, roadmaps, and incident response,
• partnering with engineering teams during design reviews and feature development to embed security from the start,
• tracking remediation efforts and ensuring timely resolution of identified security issues,
• supporting audits, compliance activities, and risk assessments.

Your profile:

• 3 - 6 years of experience in security engineering, platform security, or a closely related discipline,
• strong understanding of platform and cloud architecture (e.g., AWS, GCP, or Azure), including networking, IAM, and containerized environments,
• practical experience using AI-powered assistants (e.g. Claude Code, GitHub Copilot, Cursor) to improve productivity, quality, or decision-making in software delivery,
• demonstrated ability to assess systems against security frameworks (e.g., NIST, CIS, SOC 2, ISO 27001) and identify control gaps,
• excellent communication skills with the ability to translate technical findings for both engineering and executive audiences,
• experience working cross-functionally across engineering, security, and leadership teams,
• relevant certifications such as CISSP, CISM, AWS Security Speciality, or equivalent,
• experience in a liaison or embedded security role within a product or platform engineering organization,
• familiarity with DevSecOps practices, CI/CD security integration, and infrastructure-as-code security review,
• prior exposure to working with or within a CSO or CISO function,
• at least a B2 level of English proficiency.
  
  Work from the European Union region and a work permit are required.

Nice to have:

• experience applying GenAI in a more structured way within the SDLC, including defined workflows, prompt patterns, or tool integrations embedded into daily work,
• interest in and familiarity with emerging AI-driven practices (e.g. agent-based workflows, automation patterns, AI-augmented development), with a willingness to explore and experiment beyond standard approaches.

Recruitment Process:

CV review – HR call – Interview – Team / Client Interview – Decision