Senior Security Engineer

• Own application, cloud and AI security at Metricool
• Harden Spring Security, JavaEE filters, CORS, anti-CSRF protections, SameSite/HttpOnly cookie flags, and CSP headers
• Run threat modeling and vulnerability testing for AI/LLM features
• Protect against OWASP Top 10 for LLMs risks including prompt injection, data poisoning, data leakage, insecure output handling, and API abuse
• Define, audit, and collect technical evidence for ISO 27001 and SOC 2 controls
• Lead ISO 27001 and SOC 2 audits
• Evaluate third-party vendor risk
• Configure AWS load balancers, Nginx, Tomcat, Docker container security, and HTTPS enforcement
• Conduct code reviews, secret-detection audits, and third-party dependency reviews
• Build SAST/DAST/ZAP security checks into CI/CD pipelines
• Work with Senior Developers and Leads to integrate security into development
• Document controls, evidence, and runbooks to maintain year-round audit readiness
• Drive a security-first culture and secure AI adoption
• First month: gain context of the monolith architecture, AWS stack, and compliance posture
• First quarter: complete AI feature threat modeling, harden security headers, and establish the ISO 27001/SOC 2 evidence collection matrix
• Own platform security end to end and lead secure adoption of new AI technologies

• The candidate must be located in Spain
• Senior profile with ownership of security end-to-end across application code, cloud infrastructure and compliance
• Professional fluency in Spanish (mandatory) and English
• Language proficiency check during the hiring process
• JavaEE, Spring Security, Vue.js, Node.js, Docker, OWASP ZAP, AWS, Linux, MySQL, Maven, Git/Bitbucket
• Understanding of the OWASP Top 10 for LLM Applications, AI data privacy, and secure API/prompt engineering
• Knowledge of ISO/IEC 27001 ISMS controls
• Knowledge of SOC 2 Type II Trust Services Criteria (security, availability, confidentiality)
• Knowledge of vendor risk assessments
• Comfortable writing and reviewing code
• Pragmatic approach to security and ability to apply controls without heavy bureaucratic overhead
• Curiosity about emerging GenAI/LLM risks
• Clear communication and ability to turn audit requirements into practical, developer-friendly processes

• Truly Remote: Work from wherever you’re most productive
• 100% Flexible Schedule
• Health Insurance
• Language Lessons
• Annual in-person team gathering (The Epic Weekend)
• Growth opportunities