Senior Security Engineer - Fully Remote (Spain)

About the Position

Job Description: Senior Security Engineer - Fully Remote (Spain)

If you love getting hands-on with web security, cloud infrastructure, and the emerging risks of AI and LLM integrations, you’ll feel right at home with us. At Metricool you will be able to do so with real ownership over how security and compliance get built into the product, not just audited after the fact.

You will have the possibility to work 100% remotely, working in a high-growth international B2B SaaS, in which all members love to create, work in teams, analyze and help Community Managers make their work easier.

Your mission is to become the dedicated owner of application, cloud, and AI security at Metricool, relieving our Senior Developers and Leads from manual security reviews and building specialized security management across our core monolith (JavaEE, Spring Security, Vue), AWS infrastructure, AI-powered features, and internal compliance frameworks (ISO 27001, SOC 2).

Responsibilities

As Senior Security Engineer, you will:

• Application & Platform Security: Harden Spring Security, JavaEE filters, CORS, anti-CSRF protections, SameSite/HttpOnly cookie flags, and strict CSP headers.
• AI Security & Testing: Run threat modeling and vulnerability testing on our AI/LLM features, protecting against the OWASP Top 10 for LLMs: prompt injection, data poisoning, data leakage, insecure output handling, and API abuse.
• Compliance & Auditing (ISO 27001 / SOC 2): Define, audit, and collect technical evidence for compliance controls (access management, encryption at rest and in transit, incident logs), lead ISO 27001 and SOC 2 audits, and evaluate third-party vendor risk.
• Infrastructure & Cloud Security: Configure AWS load balancers, Nginx, Tomcat, container security (Docker), and HTTPS enforcement.
• Code Reviews & Audits: Run regular code reviews, secret-detection audits, and third-party dependency reviews (Maven, Node.js).
• Build automated security checks (SAST/DAST/ZAP) into our CI/CD pipelines.

As a Team Member, you will:

• Cross-functional Alignment: Work closely with Senior Developers and Leads to bring security into the development process from the start, rather than bolting it on afterward.
• Continuous Improvement: Document controls, evidence, and runbooks so compliance stays audit-ready year-round, not just ahead of a renewal.
• Culture of Excellence: Drive a security-first culture that embraces secure AI adoption without slowing down developer velocity.

Requirements

• Location: Spain (Remote)
• Experience: Senior level with more than 5 years of experience.
• Languages: Professional fluency in Spanish (mandatory) and English.
• Hard Skills:
  • JavaEE, Spring Security, Vue.js, Node.js, Docker, OWASP ZAP, AWS, Linux, MySQL, Maven, Git/Bitbucket.
  • AI & Security: Understanding of the OWASP Top 10 for LLM Applications, AI data privacy, and secure API/prompt engineering.
  • Compliance Frameworks: Knowledge of ISO/IEC 27001 ISMS controls, SOC 2 Type II Trust Services Criteria (security, availability, confidentiality), and vendor risk assessments.
• Soft Skills:
  • Hands-on mindset: comfortable writing and reviewing code, not a “paper compliance” auditor.
  • Pragmatic approach to security: applies controls without imposing heavy bureaucratic overhead on development speed.
  • Genuine curiosity about emerging risks, especially around GenAI/LLM adoption in software platforms.
  • Clear communicator, able to turn audit requirements into practical, developer-friendly processes.

We Offer

• Truly Remote: Work from wherever you’re most productive.
• 100% Flexible Schedule: Organize your own time as long as you’re there to collaborate when the team needs you.
• Health Insurance: We’ve got you covered.
• Language Lessons: We’ll help you learn a new language to help break down barriers and connect better with your colleagues.
• The Epic Weekend: Once a year, we all get together in person to hang out, touch grass, and remind ourselves we’re not just avatars on Slack.
• Salary: Competitive package between 55,000€ and 65,000€ (annually).
• Growth: We’re a fast-growing company. If you’re curious and take ownership, there’s no ceiling here.

About the Company

At Metricool, we are passionate about creating tools that help Community Managers make their work easier. We are an international team speaking English, Spanish, French, and German, committed to fostering a culture of excellence and continuous improvement.

Hiring Process

• First interview (30 minutes) with Horten People & Culture: culture fit, compensation alignment, and language check.
• Second interview (60 minutes) with Marcos Cacabelos: a deep dive on SAST/DAST/ZAP tools, AI testing scenarios, and ISO 27001/SOC 2 practical cases.

If you are excited about the things that you just read, don’t hesitate to apply for the job position!