Senior Security Engineer

This is a fully remote position, open to applicants in Spain.

📋 Description

• Take charge of application, cloud, and AI security at Metricool.

• Strengthen Spring Security, JavaEE filters, CORS, anti-CSRF protections, SameSite/HttpOnly cookie flags, and CSP headers.

• Execute threat modeling and vulnerability assessments for AI/LLM features.

• Safeguard against OWASP Top 10 vulnerabilities relevant to LLMs, including prompt injection, data poisoning, data leakage, insecure output management, and API misuse.

• Define, review, and gather technical evidence for ISO 27001 and SOC 2 controls.

• Lead the audits for ISO 27001 and SOC 2.

• Assess risks associated with third-party vendors.

• Configure AWS load balancers, Nginx, Tomcat, Docker container security, and enforce HTTPS.

• Perform code reviews, secret-detection audits, and evaluations of third-party dependencies.

• Integrate SAST/DAST/ZAP security checks into CI/CD pipelines.

• Collaborate with Senior Developers and Leads to embed security within development processes.

• Document controls, evidence, and runbooks to ensure continuous audit readiness throughout the year.

• Promote a security-first culture and facilitate secure AI adoption.

• In the first month: acquire an understanding of the monolith architecture, AWS stack, and compliance status.

• In the first quarter: finalize AI feature threat modeling, enhance security headers, and create the ISO 27001/SOC 2 evidence collection framework.

• Take ownership of platform security comprehensively and guide the secure integration of new AI technologies.

⛳️ Requirements

• Candidates must be based in Spain.

• Senior-level profile with comprehensive ownership of security across application code, cloud infrastructure, and compliance.

• Professional proficiency in both Spanish (mandatory) and English.

• Language proficiency assessment will be conducted during the hiring process.

• Experience with JavaEE, Spring Security, Vue.js, Node.js, Docker, OWASP ZAP, AWS, Linux, MySQL, Maven, Git/Bitbucket.

• Familiarity with the OWASP Top 10 for LLM Applications, AI data privacy, and secure API/prompt engineering.

• Knowledge of ISO/IEC 27001 ISMS controls.

• Understanding of SOC 2 Type II Trust Services Criteria (security, availability, confidentiality).

• Acquainted with vendor risk assessments.

• Comfortable with writing and reviewing code.

• A pragmatic approach to security, capable of implementing controls without excessive bureaucratic processes.

• An inquisitive mindset regarding emerging GenAI/LLM risks.

• Excellent communication skills and the ability to translate audit requirements into actionable, developer-friendly processes.

🏝️ Benefits

• Truly Remote: Work from wherever you’re most productive.

• 100% Flexible Schedule.

• Health Insurance.

• Language Lessons.

• Annual in-person team gathering (The Epic Weekend).

• Growth opportunities.