Security Engineer

Airlock BV; Belgique; Hybrid; EUR 148.000 - 203.000; Teilzeit

Zusammenfassung

airlock is seeking a fractional Security Engineer to fortify our security foundations from a hands-on perspective. This first dedicated security role works with founders and our compliance partner, not as a pure advisory function.

The role is 1 day per week, Belgium-based with remote-friendly options, and reports to the Founders. The successful candidate will drive ISO 27001 readiness, review identity and access controls, audit tenant isolation, and scope the first independent pen test.

Qualifikationen

• Hands-on ISO 27001 experience.
• Strong AWS security knowledge, especially IAM and KMS.
• Comfortable with OAuth 2.0 and OpenID Connect.
• Able to read infrastructure-as-code.
• Able to work independently in a small team.

Aufgaben

• Get us ready for ISO 27001 certification.
• Review our identity and authorization surface.
• Check tenant isolation and key security assumptions.
• Scope and coordinate our first independent penetration test.
• Triage security findings and benchmark drift.
• Run recurring ISMS controls and access reviews.
• Support security questionnaires and selected customer security calls.
• Help us improve our security posture as the platform grows.
• AI-agent security, MCP-specific threat modeling (plus topics: network controls, BYOK, SOC 2 readiness, DORA readiness).

Kenntnisse

Security engineering

ISO 27001

AWS IAM

AWS KMS

OAuth 2.0

OpenID Connect

Infrastructure as code

Independent work

AI-agent security

SOC 2 readiness

DORA readiness

Jobbeschreibung

# Security EngineerFractional · 1 day/week · Belgium · Remote-friendly## The roleSecurity is close to the core of what airlock sells. We're looking for someone who can help us strengthen that foundation, hands-on.This is our first dedicated security role, working directly with the founders and our external compliance partner.Not advisory. Not a full-time security function squeezed into one day.## What you'll ownFirst priorities* Get us ready for ISO 27001 certification.* Review our identity and authorization surface.* Check tenant isolation and key security assumptions.* Scope and coordinate our first independent penetration test.Ongoing* Triage security findings and benchmark drift.* Run recurring ISMS controls and access reviews.* Support security questionnaires and selected customer security calls.* Help us improve our security posture as the platform grows.Later topics may include* AI-agent and MCP-specific threat modeling.* Network controls.* BYOK.* SOC 2 readiness.* DORA readiness, for our customers in financial services.## What success looks like* **3 months:** the ISO 27001 gap analysis is done, the risk register is live, and the identity and authorization review is finished with findings ranked.* **6 months:** internal audit done, first independent pen test run, critical findings fixed, and we're ready for the certification audit.* **Ongoing:** security questionnaires answered within 5 working days, from an answer library you keep current.We can answer customers and auditors with confidence, without overselling where we are.## You* Strong security engineering background, not just compliance.* Hands-on ISO 27001 experience.* Strong AWS security knowledge, especially IAM and KMS.* Comfortable with OAuth 2.0 and OpenID Connect.* Able to read infrastructure-as-code.* Comfortable owning work independently in a small team.Experience with AI-agent security, MCP, penetration test scoping, SOC 2 or DORA is a plus.## Why airlockYou're joining early enough to have real influence on how we build security into the company and product.Small team. Real customers. High trust.You help us build security we can actually defend in front of a CISO.## PracticalCommitment: 1 day/weekLocation: Belgium preferred, remote-friendlyReports to: FoundersStructure: Fractional contractor or part-timeCompensation: To be discussedStart: To be discussedApply### Show us.Audit us, from what is public: our site, our docs, and what we say about security. Tell us the first three things you would fix, and why. No active testing of the product, please.Mail it to [e-mail] with a few lines on why airlock. A CV is welcome. It is not what we decide on.Apply →