SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Klarna is a regulated financial institution operating across 26 markets under frameworks including DORA, SFSA, FCA, NYDFS, and SOX. The Engineering Assurance function provides independent, evidence-based assessment of whether Klarna's ICT and security risks are actually under control. This function has been rebuilding its methodology, governance framework, and assurance programme from the ground up under new CSRO leadership since June 2026.
As a Risk Control Engineer in Engineering Assurance, you will plan and deliver risk-based assurance reviews across engineering and technology domains: software delivery, cloud infrastructure, cybersecurity, identity and access management, change management, incident management, resilience, and third-party technology risk. You will work directly with engineering teams to test whether controls actually hold up in practice, and you will answer to senior stakeholders and regulators for your findings.
You will assess the design and operating effectiveness of engineering controls. You will translate regulatory obligations under frameworks like DORA, SFSA, FCA, NYDFS, and SOX into clear, testable technical control expectations. You will evaluate evidence, identify control weaknesses or systemic engineering risks, and produce defensible findings and recommendations for senior stakeholders. You will work constructively with engineering teams while maintaining professional independence. You will help build automated testing, continuous control monitoring, and reusable assurance methods as the function moves from point-in-time reviews toward continuous assurance.
Klarna values co-located teams; most teams currently meet in the office 2–3 days per week, with variation by team and potential for change over time.
REQUIREMENTS:
Klarna is open to two backgrounds: (1) a technology assurance professional with Big Four experience in DORA, ICT risk, IT audit, technology risk, or regulatory compliance; or (2) a technically strong GRC engineer from a regulated technology or fintech organisation such as Adyen, PayPal, Revolut, or Klarna itself.
You must have worked in technology assurance, IT audit, ICT risk, security assurance, or GRC engineering, with specific reviews or assessments you can point to. You must be able to assess both whether a control is designed correctly and whether it actually operates as intended in practice. You must have technical depth in cloud, software delivery, cybersecurity, infrastructure, or operational resilience sufficient to challenge engineering teams credibly. You must be able to evaluate evidence, recognize when it is incomplete or misleading, and reach a defensible conclusion using professional judgement. You must be able to turn a regulatory requirement into a specific, testable technical control. You must have worked in a regulated or high-control environment, so you understand what evidence, documentation, and independence mean in practice.
Bonus qualifications: experience within fintech, payments, banking, or technology-led regulated business; knowledge of DORA, EBA requirements, NIS2, or comparable ICT regulations; knowledge of ISO 27001, NIST, COBIT, SOC reporting, or ISAE assurance standards; experience automating evidence collection or control testing using APIs, SQL, Python, or GRC tooling.
