Security Engineer – AppSec, GRC, AI Security

• Take end-to-end ownership of security operations as the company's sole dedicated Security Engineer
• Review code, identify and remediate vulnerabilities, work with developers in Git/GitHub, and coordinate external penetration tests and audits
• Build and maintain the security risk register, assess exposure across systems, support audit follow-up, and prioritise fixes by risk and business impact
• Monitor alerts and threats, run security awareness programmes and phishing simulations, and provide occasional evening and weekend cover
• Manage secure onboarding and offboarding, device security through MDM, access permissions, and internal controls
• Track generative AI security risks including prompt injection, jailbreaks, filter bypasses, and vulnerabilities in third-party AI providers
• Collaborate directly with engineering leadership

• 2–3+ years of hands-on security engineering experience, with flexibility for exceptional scale-up experience
• Strong application security experience, including code reviews and vulnerability remediation
• Proven experience conducting or coordinating security audits and penetration tests
• Comfortable coding and working directly with Git/GitHub
• Practical scripting or automation skills, ideally Python or Bash
• Previous experience within an AI company or a scale-up with 50+ employees
• Sound understanding of security governance, risk assessment and prioritisation
• Ability to independently identify, investigate and resolve security issues, and to take end-to-end ownership in a fast-paced environment
• Excellent English communication skills
• Based in Europe, with approximately 80% overlap with CET working hours
• Comfortable with occasional evening/weekend security monitoring
• Fully comfortable working with adult/NSFW content as part of daily responsibilities

• Fully remote working from Europe
• Opportunity to own security for a fast-growing AI platform with over 50 million users
• Direct collaboration with engineering leadership
• Hands-on, non-advisory role with real responsibility for security outcomes