Security Engineer – Application Security, GRC, AI

This is a fully remote position, open to applicants in Croatia.

📋 Description

• Perform security-centered code evaluations to detect possible vulnerabilities in applications.

• Analyze, prioritize, and address security weaknesses across various applications and services.

• Collaborate closely with developers to adopt secure coding practices and implement vulnerability resolutions.

• Engage with Git/GitHub development workflows to review code and contribute to security enhancements.

• Oversee external penetration testing activities and security audits.

• Monitor identified vulnerabilities and ensure prompt remediation in collaboration with engineering teams.

• Evaluate application security risks and propose feasible technical solutions.

• Create, sustain, and continuously refine the organization's security risk register.

• Identify and evaluate security exposure across internal systems, applications, and third-party services.

• Prioritize security enhancements based on the severity of risks, operational needs, and business impact.

• Assist in security governance processes, documentation, and audit preparations.

• Manage audit follow-up tasks and monitor remediation progress.

• Enhance internal security controls and risk management practices.

• Track security alerts, emerging threats, and pertinent vulnerabilities.

• Investigate suspicious activities and coordinate suitable responses.

• Organize security awareness programs and phishing simulation exercises.

• Convey security risks, best practices, and new threats to internal teams.

• Provide occasional security monitoring coverage during evenings and weekends as needed.

• Facilitate secure onboarding and offboarding processes for employees.

• Review and manage user access permissions across internal systems.

• Strengthen identity and access management measures.

• Support device security management, including mobile device management (MDM).

• Identify opportunities to enhance internal IT security processes and operational controls.

• Monitor new security risks affecting generative AI applications and platforms.

• Assess threats related to prompt injection, jailbreaks, and content-filter bypassing.

• Track security vulnerabilities and incidents involving third-party AI providers.

• Collaborate with engineering teams to identify and mitigate AI-related security risks.

• Research emerging AI security techniques, tools, and defensive strategies.

⛳️ Requirements

• A minimum of 2-3+ years of practical security engineering experience, with flexibility for exceptional candidates from rapidly growing technology environments.

• Strong hands-on experience in application security, encompassing code reviews, vulnerability identification, and remediation.

• Demonstrated experience in conducting or coordinating security audits and penetration tests.

• Proficient in working directly with application code and development teams using Git/GitHub.

• Practical experience in scripting or automation, ideally using Python, Bash, or similar technologies.

• Previous experience in an AI company or a technology scale-up with a workforce of at least 50 employees.

• Solid understanding of security governance, risk assessment, vulnerability prioritization, and remediation processes.

• Capability to develop or maintain security risk registers and assist with audit-related activities.

• Strong technical problem-solving abilities and an investigative, security-oriented mindset.

• Competence in independently identifying, investigating, and resolving security vulnerabilities.

• Comfortable assuming total ownership of security operations without relying on a large dedicated security team.

• Strong collaborative skills when engaging with developers, engineering leadership, and external security providers.

• Excellent written and spoken English communication skills.

• Ability to operate independently in a fast-paced, fully remote technology environment.

• Willingness to provide occasional evening and weekend security monitoring coverage.

• Open to working under a B2B contractor agreement.

• Experience securing AI-powered applications, generative AI systems, or LLM-based products.

• Previous responsibility as a lead, sole, or independently operating Security Engineer.

• Experience within rapidly growing AI startups or technology scale-ups.

• Practical utilization of AI tools for security research, code review, vulnerability analysis, or workflow automation.

• Engagement in personal security research, ethical hacking projects, or independent vulnerability discovery.

• Experience across application security, governance, access management, and security awareness.

• Familiarity with emerging AI security threats, such as prompt injection and jailbreak techniques.

🏝️ Benefits

• Competitive compensation package based on experience and seniority.

• Fully remote working arrangement available for candidates based in Europe.

• B2B contractor engagement.

• Opportunity to take full ownership of security operations for a fast-growing AI platform with over 50 million users.

• Direct collaboration with engineering leadership and senior technical stakeholders.

• High degree of autonomy and responsibility for security-related decisions and outcomes.

• Opportunity to work across application security, governance, vulnerability management, and emerging AI security challenges.

• Exposure to large-scale consumer technology infrastructure and AI-powered products.

• Hands-on technical environment focused on implementing practical security enhancements.

• International working environment within a rapidly expanding technology organization.

• Opportunities for professional growth and development in application and AI security.