Hybrid App Security Engineer | Proactive Pentesting

Factorial HR; Barcelona; Hybrid; EUR 40,000 - 55,000; Full time

Benefits offered by this job

Health insurance

Gym access

Cobee benefits

Language classes

Breakfast in the office

Food discounts

Pet friendly

Career growth

Job summary

Factorial is seeking an Application Security Engineer in Barcelona to proactively hunt for vulnerabilities and strengthen defenses. You will test applications, APIs, and AI-powered features, reproduce external reports, and work with product teams to remediate issues.

The role requires 3+ years in application security and fluency in English. The team collaborates across Product and Engineering to ship with security baked in, while offering a flexible office-first, hybrid model.

Qualifications

• 3+ years of professional experience in Application Security, Offensive Security, or Penetration Testing.
• Web Application Penetration Testing experience is mandatory.
• Fluency in English.
• Degree in Engineering or Computer Science; strong knowledge of web apps, databases, networks, and OS.

Responsibilities

• Perform proactive penetration testing across Factorial’s applications, APIs, infrastructure, and AI-powered features.
• Reproduce and validate vulnerability reports from third parties.
• Collaborate with development teams to remediate security findings and enhance secure coding practices.
• Improve validation, triage, and remediation of vulnerabilities from bug bounty reports, internal testing, automated controls, and external research.
• Hunt for recurring or legacy vulnerability patterns based on root cause analysis and security findings.
• Build and improve security automations, agents, skills, and CI/CD controls for early issue detection.
• Help secure Factorial’s use of AI across product and internal workflows, including LLMs, agents, data access, tools, permissions, and abuse scenarios.
• Contribute to development of security tools, automations, and infrastructure.
• Stay up-to-date with latest security research and AI security risks.

Skills

Web pentesting

Python

Bash

English fluency

Education

Engineering or Computer Science degree

Tools

Ruby on Rails

Job description

Factorial is seeking an Application Security Engineer in Barcelona to proactively hunt for vulnerabilities and strengthen defenses. You will test applications, APIs, and AI-powered features, reproduce external reports, and work with product teams to remediate issues.

The role requires 3+ years in application security and fluency in English. The team collaborates across Product and Engineering to ship with security baked in, while offering a flexible office-first, hybrid model.