Security Software Engineer II, Corporate Security

About the Role We are looking for a Security & Compliance Engineer to help ensure security across our internal digital landscape. Reporting to Tacton’s Security & Compliance Manager, you will play a key role in ensuring that our systems, integrations, data flows, and vendor ecosystem are secure by design and in operation. This role focuses on internal systems and corporate security architecture, including infrastructure, integrations, and third-party services. You will combine architectural thinking with hands-on expertise and act as a trusted partner to IT, Engineering, and business stakeholders. You will have a direct impact on how we design, connect, and secure our systems as we continue to grow globally. This is a high-impact role for someone who understands modern digital environments and how to secure them end-to-end. What You Will Do Internal Security & Risk Lead security assessments of systems, integrations, and data flows Conduct technical risk analyses for system implementations and vendor onboarding Perform threat modelling and security reviews Define and implement security requirements for infrastructure and cloud environments Help establish and maintain security guardrails across identity, access, encryption, and integrations Proficiency in risk management Knowledge of emerging cybersecurity threats and trends Vendor & Third-Party Security Define and enforce security requirements in procurement processes Conduct supplier security assessments and due diligence Evaluate third-party risks from a cybersecurity perspective Governance & Compliance Maintain alignment with ISO 27001 and SOC 2 Type II Contribute to policies, standards, and security guidelines Support incident investigations Act as a subject matter expert in audits and internal forums What Will Help You Thrive 5+ years of experience in cybersecurity, information security, or a related field Strong technical foundation in cloud, networking, identity & access management, and system integrations Strong communication and stakeholder management skills Experience conducting technical risk assessments and security reviews Familiarity with ISO 27001 and SOC 2 Type II Ability to understand complex system landscapes and data flows Comfortable working cross-functionally with IT, Engineering, and Legal Certifications such as CISSP, CISM, or CISA are a plus Degree in Computer Science, Engineering, or a related field Who We’re Looking For We’re looking for someone with a strong hands-on, doer mentality who is focused on getting things done and creating real impact. You are pragmatic, prestigeless, and motivated by outcomes. You thrive in dynamic environments where responsibilities are broad, and you feel comfortable navigating uncertainty and solving problems independently. You are curious by nature, proactive in your approach, and continuously looking to learn and improve both yourself and the way things are done. Why Tacton? At Tacton, we’ve been building CPQ software for over 20 years. We’re a stable company with global customers and a product that’s central to how manufacturers sell We offer competitive benefits, flexibility in how we work, and a culture that values learning and collaboration A solid and stable company with over 20 years of industry experience. Flexible hybrid setup - 3x a week at the office 33 days of paid time off – 30 vacation days plus 3 extra to make sure you get the rest you deserve. Premium occupational pension – Our pension plan goes beyond ITP1, with higher employer contributions depending on your age and salary level. Generous wellness allowance – 5,000 SEK annually to support your health and wellbeing. Private healthcare insurance – Skip the waiting lines and get quick access to private medical care, including specialist consultations and treatments. Parental leave top-up – We top up your parental leave so you receive up to 90% of your base salary for up to 6 months, helping you focus on your family without financial stress Weekly treats – Fika one week, breakfast the next, because good food brings people together. This role is based in Stockholm, where we have invested in creating our unique home right next to Hötorget station. Tacton is a leading Software as a Service company trusted by global manufacturers. We got started in the late 1990s when six computer scientists figured out a revolutionary way to help Manufacturers overcome their most business-critical, product configuration challenges. Since those early days, we have grown to support global manufacturers seeking to thrive in a changing world. We invite you to find out more about us @ www.tacton.com/about

WHO WE ARE The real world is the next frontier, and at Metropolis, we are creating the artificial intelligence to make it responsive. We are pioneering the Recognition Economy — a future where mundane repetition disappears and being known unlocks access, comfort and belonging everywhere you go. From transforming parking into a seamless drive-in, drive-out experience for millions of Members to expanding our intelligence layer across retail and hospitality, we are building a world that feels instinctive and magical. The future isn’t coming; it’s here, and we need builders, innovators and problem solvers to help us create it. WHO YOU ARE Metropolis is seeking a Governance, Risk, and Compliance (GRC) Analyst to join our expanding Security team. Reporting to the Senior Manager, GRC, you will mature information security policies, drive employee security awareness, and pioneer our AI governance framework. You will partner across Technology, Legal, Internal Audit, Procurement, and People Operations to safeguard customer trust and support operational excellence.  WHAT YOU'LL DO * Author, update, and enforce corporate security policies to guarantee cross-departmental compliance * Deploy and manage required information security training campaigns as the platform owner * Transform static policies into interactive modules with comprehension quizzes for mandatory sign-offs * Establish and enforce an internal AI governance framework with Data, Legal, and Tech teams * Conduct structured risk assessments on emerging tools and internal AI models to maintain behavioral guardrails * Report training metrics, policy exceptions, and risk postures directly to senior management * Review vendor security profiles and software pipelines to mitigate security risk WHAT WE'RE LOOKING FOR * 3+ years of experience in information security GRC, cybersecurity training, or technology compliance * Proven track record of managing required security awareness programs and driving cross-functional accountability * Experience with modern training orchestration platforms and understanding of AI and machine learning data security * Working knowledge of standard industry frameworks, specifically SOC 2 and PCI-DSS * Communication skills with the ability to explain complex regulatory needs to non-technical employees * Bachelor’s degree in Cybersecurity, Information Systems, or an equivalent technical discipline  WHILE NOT REQUIRED, THESE ARE A PLUS: * GRC certifications such as CISA or CRISC ---------------------------------------------------------------------------------------------------------------------------------- 4 Days in Office: Metropolis values in-person collaboration to drive innovation, strengthen culture, and enhance the Member experience. Our corporate team members hold to our office-first model, which requires employees to be on-site at least four days a week, fostering organic interactions that spark creativity and connection When you join Metropolis, you'll join a team of world-class product leaders and engineers, building an ecosystem of technologies at the intersection of parking, mobility, and real estate. Our goal is to build an inclusive culture where everyone has a voice and the best idea wins. You will play a key role in building and maintaining this culture as our organization grows. The anticipated base salary for this position is $100,000.00 USD to $135,000.00 USD annually. The actual base salary offered is determined by a number of variables, including, as appropriate, the applicant's qualifications for the position, years of relevant experience, distinctive skills, level of education attained, certifications or other professional licenses held, and the location of residence and/or place of employment. Base salary is one component of Metropolis’s total compensation package, which may also include access to or eligibility for healthcare benefits, a 401(k) plan, short-term and long-term disability coverage, basic life insurance, a lucrative stock option plan, bonus plans and more. #LI-CM1 #LI-Onsite Metropolis may utilize an automated employment decision tool (AEDT) to assess or evaluate your candidacy for employment or promotion. AEDTs are used to assist in assessing a candidate’s application relative to the required job qualifications and responsibilities listed in the job posting. As part of this process, Metropolis retains data relevant to your candidacy, including personal information, for a period that is reasonably necessary for the use of the tool. If you are hired for the position, your data may become part of your employee records. Metropolis Technologies is an equal opportunity employer. We make all hiring decisions based on merit, qualifications, and business needs, without regard to race, color, religion, sex (including gender identity, sexual orientation, or pregnancy), national origin, disability, veteran status, or any other protected characteristic under federal, state, or local law.