Security Engineer – AppSec, GRC

This is a fully remote position, open to applicants in Portugal.

📋 Description

• Evaluate the security posture of AI-driven products, applications, APIs, and their underlying infrastructure.

• Integrate security requirements and practices within the software development lifecycle, covering design, development, deployment, and maintenance phases.

• Perform or oversee application security evaluations, threat modeling, vulnerability assessments, and penetration testing.

• Recognize, prioritize, and assist in the remediation of security vulnerabilities, including risks associated with AI systems and integrations.

• Analyze AI system designs and data flows to identify risks such as prompt injection, data leakage, insecure model access, and potential misuse of outputs.

• Create and uphold secure coding standards, technical security guidelines, and AppSec policies.

• Provide guidance to engineering teams on secure architecture, authentication, authorization, encryption, secrets management, and API security.

• Facilitate security measures for AI models, datasets, third-party services, and workflows related to model development or deployment.

• Develop and sustain security governance, risk, and compliance protocols for products, services, and internal systems.

• Contribute to risk assessments, control evaluations, audit evidence collection, and remediation strategies.

• Assist in aligning security practices with pertinent frameworks, standards, and regulatory requirements.

• Collaborate with privacy, legal, compliance, and risk teams to address data protection and responsible AI issues.

• Enhance security incident preparedness and aid in the investigation and resolution of application or AI-related security incidents.

• Monitor security metrics, generate reports, and communicate risks, findings, and recommendations to both technical and non-technical stakeholders.

• Stay informed about application security trends, AI threats, security standards, and relevant regulatory changes.

⛳️ Requirements

• Professional background in security engineering, application security, information security, or a related domain.

• Experience in evaluating and securing web applications, APIs, cloud services, or software platforms.

• Knowledge of secure software development practices, threat modeling, vulnerability management, and security testing methodologies.

• Familiarity with common application security vulnerabilities and associated testing strategies.

• Experience with governance, risk, and compliance tasks, including risk assessments, control reviews, or audit support.

• Understanding of security frameworks and standards such as ISO 27001, NIST, or SOC 2.

• Knowledge of cloud security, identity and access management, encryption, and secure configuration best practices.

• Awareness of AI and machine learning security risks, encompassing data, model, and inference-time threats.

• Capability to evaluate technical risks and articulate their implications and remediation strategies effectively.

• Strong analytical and problem-solving abilities, with a keen attention to detail and a pragmatic approach to risk management.

• Ability to collaborate effectively with engineering, product, data, legal, and compliance teams.

• Excellent written and verbal communication skills, including proficiency in creating clear security documentation.

• Ability to manage multiple priorities and contribute meaningfully in a dynamic technology landscape.

• Experience with security testing tools, code scanning, cloud security platforms, or GRC systems is a plus.

• Relevant security certifications or training are advantageous.

• Proficiency in English, both written and spoken.

🏝️ Benefits

• Opportunity to enhance the security of AI-enabled products and services.

• Collaborative environment with engineering, product, data, legal, and compliance teams.

• Significant participation in application security and security governance initiatives.

• Professional growth in a rapidly advancing technology and security landscape.

• International and multidisciplinary work environment.