Senior Security Engineer

This is a fully remote position, open to applicants in Spain.

📋 Description

• Take ownership of application, cloud, and AI security at Metricool.

• Strengthen Spring Security, JavaEE filters, CORS settings, anti-CSRF measures, cookie flags, and CSP headers.

• Conduct threat modeling and vulnerability assessments for AI/LLM features.

• Safeguard against OWASP Top 10 risks related to LLMs.

• Define, audit, and gather technical evidence for ISO 27001 and SOC 2 controls.

• Lead the audits for ISO 27001 and SOC 2.

• Assess third-party vendor risk.

• Configure AWS load balancers, Nginx, Tomcat security, Docker security, and enforce HTTPS.

• Perform code reviews, secret detection audits, and dependency assessments.

• Integrate SAST/DAST/ZAP security checks into CI/CD pipelines.

• Work collaboratively with Senior Developers and Leads to embed security in development processes.

• Document controls, evidence, and operational runbooks.

• Promote a security-first culture and facilitate secure AI adoption.

• In the first month: gain an understanding of the monolith, AWS infrastructure, and compliance framework.

• In the first quarter: complete AI threat modeling, enhance security headers, and create an evidence collection matrix.

• In the long term: take full responsibility for platform security and spearhead the secure integration of new AI technologies.

⛳️ Requirements

• Candidates must be based in Spain.

• Senior-level profile with comprehensive ownership of security across application code, cloud infrastructure, and compliance.

• Professional fluency in Spanish (mandatory) and English.

• Language proficiency assessment will be part of the hiring process.

• Proficiency in JavaEE, Spring Security, Vue.js, Node.js, Docker, OWASP ZAP, AWS, Linux, MySQL, Maven, and Git/Bitbucket.

• Familiarity with the OWASP Top 10 for LLM Applications, AI data privacy, and secure API/prompt engineering.

• Knowledge of ISO/IEC 27001 ISMS controls, SOC 2 Type II Trust Services Criteria, and vendor risk evaluations.

• Practical experience in writing and reviewing code.

• A pragmatic approach to implementing security controls.

• An inquisitive mindset regarding emerging GenAI/LLM risks.

• Strong communication abilities to translate audit requirements into developer-friendly processes.

🏝️ Benefits

• Truly Remote: Work from any location that boosts your productivity.

• 100% Flexible Schedule.

• Health Insurance.

• Language Lessons.

• The Epic Weekend: an annual in-person company gathering.

• Unlimited growth opportunities.

• Necessary tools provided for remote work.