Senior Security Engineer - Fully Remote (Spain)

About the Position

Join Metricool as a Senior Security Engineer in a fully remote role, focusing on web security, cloud infrastructure, and AI risks.

At Metricool, you will have the opportunity to work 100% remotely in a high-growth international B2B SaaS company. You will be responsible for ensuring security and compliance are built into the product from the start, not just audited after the fact.

Responsibilities

• Application & Platform Security: Harden Spring Security, JavaEE filters, CORS, anti-CSRF protections, SameSite/HttpOnly cookie flags, and strict CSP headers.
• AI Security & Testing: Run threat modeling and vulnerability testing on AI/LLM features, protecting against the OWASP Top 10 for LLMs.
• Compliance & Auditing (ISO 27001 / SOC 2): Define, audit, and collect technical evidence for compliance controls, lead ISO 27001 and SOC 2 audits, and evaluate third-party vendor risk.
• Infrastructure & Cloud Security: Configure AWS load balancers, Nginx, Tomcat, container security (Docker), and HTTPS enforcement.
• Code Reviews & Audits: Run regular code reviews, secret-detection audits, and third-party dependency reviews (Maven, Node.js).
• Build automated security checks (SAST/DAST/ZAP) into our CI/CD pipelines.

Requirements

• Senior profile: Confident owning security end-to-end across application code, cloud infrastructure, and compliance.
• Languages: Professional fluency in Spanish (mandatory) and English. A language proficiency check is part of the hiring process.

Hard Skills

• JavaEE, Spring Security, Vue.js, Node.js, Docker, OWASP ZAP, AWS, Linux, MySQL, Maven, Git/Bitbucket.
• AI & Security: Understanding of the OWASP Top 10 for LLM Applications, AI data privacy, and secure API/prompt engineering.
• Compliance Frameworks: Knowledge of ISO/IEC 27001 ISMS controls, SOC 2 Type II Trust Services Criteria (security, availability, confidentiality), and vendor risk assessments.

Soft Skills

• Hands-on mindset: Comfortable writing and reviewing code, not a “paper compliance” auditor.
• Pragmatic approach to security: Applies controls without imposing heavy bureaucratic overhead on development speed.
• Genuine curiosity about emerging risks, especially around GenAI/LLM adoption in software platforms.
• Clear communicator, able to turn audit requirements into practical, developer-friendly processes.

We Offer

• Truly Remote: Work from wherever you’re most productive. We provide the tools; you provide the talent.
• 100% Flexible Schedule: We care about the work getting done, not the hours you’re sitting at the desk. You organize your own time so you can live your life, as long as you’re there to collaborate when the team needs you.
• Health Insurance: We’ve got you covered so you can work with peace of mind.
• Language Lessons: We’re an international team speaking English, Spanish, French, and German. We’ll help you learn a new language to help break down barriers and connect better with your colleagues.
• The Epic Weekend: Once a year, we all get together in person to hang out, touch grass, and remind ourselves we’re not just avatars on Slack.
• Salary: We are actively working to align our budgets with market standards, offering highly competitive salary packages. For this position we estimate between €55,000 and €65,000 (annually).
• Growth: We’re a fast-growing company. If you’re curious and take ownership, there’s no ceiling here.

About the Company

Metricool is an international B2B SaaS company that helps Community Managers make their work easier. We are passionate about creating, working in teams, analyzing, and helping our clients.

Hiring Process

• First interview (30 minutes) with Horten People & Culture: Culture fit, compensation alignment, and language check.
• Second interview (60 minutes) with Marcos Cacabelos: A deep dive on SAST/DAST/ZAP tools, AI testing scenarios, and ISO 27001/SOC 2 practical cases.

Apply for this position

This job is hosted externally. Click below to view the full posting and apply.

Apply on www.jobleads.com