Staff Security Engineer

About the Role

We’re looking for a Staff Security Engineer to define and drive the authentication and authorization architecture for Veeam Data Cloud (VDC), our cloud-native SaaS platform. This role is centered on evaluating, defining, and evolving our authorization model - including RBAC and API access control across VDC services and teams. You’ll partner closely with product and platform engineering to ensure access is consistently designed, implemented, and enforced across the product.  We provide secure data protection services on AWS, Azure, and GCP, integrating with platforms like Microsoft 365 and Salesforce for customers in regulated industries

What You’ll Do

Define end-to-end security architecture for identity and authorization across VDC (control plane and data plane)

Evaluate and define authorization standards for multi-tenant SaaS, including RBAC/ABAC patterns, API authorization, and consistent permission modeling across services

Define role/permission models for customer users, customer admins, internal support/admin access, and service-to-service authorization

Design and standardize identity and authorization for agents and connectors running in customer environments (token/scopes, least privilege, rotation)

Define shared security capabilities like tenant isolation, policy enforcement, and rate limiting

Set standards for secure logging and telemetry for authentication and authorization

Turn repeat security issues into reusable guardrails and shared services

Support compliance work (e.g., SOC 2, FedRAMP-style, IRAP) through lasting design improvements

Be hands-on in implementation: write code, perform code reviews, and submit PRs to VDC repositories; at times, embed with product teams to deliver authorization changes end-to-end

Join design reviews and help teams adopt standard security patterns

What You’ll Bring

Proven background as a Security Architect / Senior Security Engineer / Software Engineering for cloudnative, multitenant SaaS

Strong, hands-on expertise integrating and operating Okta, Auth0, and/or Keycloak from a software engineering perspective (SDKs/APIs, OIDC/OAuth flows, token handling, automation)

Strong software engineering background: proficiency in one or more of C#/.NET, Go, Java, Python, or TypeScript

Deep knowledge of authorization concepts and implementation: RBAC, permission modeling, policy enforcement, OAuth2/OIDC, JWT, mTLS, workload identities, tenant isolation, and secure API design

Strong Azure security architecture knowledge (Entra ID, AKS, networking, monitoring, hardening)

Experience turning vulnerability patterns for AAA into scalable platform solutions

Strong communication skills in English; comfortable in distributed teams

Bonus Skills

Building shared authn/authz libraries, policy engines, or security control plane services

Secure logging/telemetry design and data sanitization

Multicloud/hybrid identity experience

What You’ll Get

26 paid days off annually, plus 4 extra global VeeaMe Days for self-care and 24 paid volunteer hours annually through Veeam Cares

Paid parental, maternity, and paternity leave

Fully covered family medical plan, dental, rehab, and vaccinations

Life, critical illness, and disability insurance

Employer pension contribution via PPK

Monthly Edenred allowance of 450 PLN for meals

MultiSport card fully covered by Veeam, giving access to sports facilities nationwide

Up to 12 free therapy sessions annually, plus legal and financial advice

Opportunities to learn and grow through on-demand libraries (LinkedIn Learning, O’Reilly), mentoring, workshops and learning events like our annual Global Day of Learning

#LI-TK1