Senior Security Engineer - Fully Remote (Spain)

Metricool

13h • Remote

About The Position

Metricool is hiring a Senior Security Engineer to own application, cloud, and AI security across its B2B SaaS product and internal compliance frameworks. The role focuses on embedding security into the product and development process, reducing the need for manual security reviews by senior developers and leads. The position is fully remote, but the candidate must be located in Spain.

The engineer will secure Metricool’s core monolith, including JavaEE, Spring Security, and Vue, as well as its AWS infrastructure and AI-powered features. The role also owns technical controls and evidence for ISO 27001 and SOC 2, including audit readiness and third-party vendor risk assessment. The engineer will work closely with developers and leads, documenting controls, evidence, and runbooks while promoting secure AI adoption without unnecessarily slowing development.

In the first month, the engineer is expected to learn the monolith architecture, AWS stack, and current compliance posture. In the first quarter, the engineer will complete AI feature threat modeling, harden security headers, and establish an ISO 27001/SOC 2 evidence collection matrix. Over time, the role will own platform security end to end, maintain continuous compliance, and guide the secure adoption of new AI technologies.

Requirements

• Must be located in Spain.
• Senior-level capability and confidence owning security end to end across application code, cloud infrastructure, and compliance.
• Professional fluency in Spanish and English; language proficiency will be checked during hiring.
• Hands-on experience with JavaEE, Spring Security, Vue.js, Node.js, Docker, OWASP ZAP, AWS, Linux, MySQL, Maven, and Git/Bitbucket.
• Understanding of the OWASP Top 10 for LLM Applications, AI data privacy, and secure API and prompt engineering.
• Knowledge of ISO/IEC 27001 ISMS controls and SOC 2 Type II Trust Services Criteria for security, availability, and confidentiality.
• Knowledge of vendor risk assessments.
• Comfort writing and reviewing code rather than focusing only on paper compliance.
• Pragmatic approach to applying security controls without imposing excessive bureaucratic overhead on development speed.
• Clear communication skills and ability to translate audit requirements into practical, developer-friendly processes.

Nice To Haves

• Genuine curiosity about emerging security risks, especially risks associated with GenAI and LLM adoption in software platforms.

Responsibilities

• Harden application security, including Spring Security, JavaEE filters, CORS, anti-CSRF protections, SameSite and HttpOnly cookie flags, and strict CSP headers.
• Threat-model and test AI/LLM features for risks such as prompt injection, data poisoning, data leakage, insecure output handling, and API abuse.
• Define and audit technical compliance controls and collect evidence for access management, encryption at rest and in transit, and incident logs.
• Lead ISO 27001 and SOC 2 audits and evaluate third-party vendor risk.
• Configure and secure AWS load balancers, Nginx, Tomcat, Docker containers, and HTTPS enforcement.
• Conduct regular code reviews, secret-detection audits, and third-party dependency reviews for Maven and Node.js projects.
• Build automated security checks, including SAST, DAST, and ZAP, into CI/CD pipelines.
• Work with senior developers and leads to integrate security into development from the start.
• Document controls, audit evidence, and runbooks to maintain year-round compliance readiness.
• Promote a security-first culture and enable secure AI adoption without unnecessarily slowing developer velocity.
• Learn the monolith architecture, AWS stack, and current compliance posture during the first month.
• Complete AI feature threat modeling, security-header hardening, and an ISO 27001/SOC 2 evidence collection matrix during the first quarter.

Benefits

• Fully remote work; the role is remote within Spain.
• Flexible schedule, with employees organizing their own time while remaining available for team collaboration when needed.
• Health insurance.
• Language lessons.
• An annual in-person team gathering called The Epic Weekend.
• Competitive salary package estimated at €55,000–€65,000 annually.
• Growth opportunities at a fast-growing company.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: No Education Listed