Job Description: Senior Security Engineer - Fully Remote (Spain)

team.blue; Spain; Remote; EUR 70,000 - 110,000; Full time

Benefits offered by this job

Health insurance

Remote work access

Language lessons

Epic team weekends

Job summary

Metricool is hiring a Senior Security Engineer to own application, cloud and AI security across our platform. You will work remotely (Spain-based) within an international SaaS team, shaping security controls from the start rather than auditing after the fact.

You will lead threat modeling and vulnerability testing for AI features, ensure compliance with ISO 27001 and SOC 2, and integrate security reviews into CI/CD pipelines, empowering developers while maintaining high security standards.

Qualifications

• Spain-based candidate required.
• End-to-end security ownership across application, cloud and compliance.
• Fluent Spanish and English required.
• Hard skills include JavaEE, Spring Security, Vue.js, Node.js, Docker, OWASP ZAP, AWS, Linux, MySQL, Maven, Git/Bitbucket.
• AI & Security knowledge: OWASP Top 10 for LLMs, data privacy, secure API/prompt engineering.
• Compliance knowledge: ISO/IEC 27001 ISMS, SOC 2 Type II, vendor risk.

Responsibilities

• Own security for applications, cloud and AI features across the product.
• Run threat modeling and vulnerability testing on AI/LLM features.
• Lead ISO 27001 and SOC 2 audits and evidence collection.
• Configure AWS load balancing, Nginx, Tomcat, Docker container security, and HTTPS.
• Perform code reviews, secret-detection audits and dependency reviews (Maven, Node.js).
• Build automated security checks (SAST/DAST/ZAP) into CI/CD pipelines.
• Collaborate with developers to embed security from the start.

Skills

JavaEE

Spring Security

Vue.js

Node.js

Docker

OWASP ZAP

AWS

Linux

MySQL

Maven

Git/Bitbucket

Tools

JavaEE

Spring Security

Vue.js

Node.js

Docker

OWASP ZAP

AWS

Linux

MySQL

Maven

Git/Bitbucket

Job description

If you love getting hands-on with web security, cloud infrastructure and the emerging risks of AI and LLM integrations, you'll feel right at home with us. At Metricool you will be able to do so with real ownership over how security and compliance get built into the product, not just audited after the fact. You will have the possibility to work 100% remotely, working in a high-growth international B2B SaaS, in which all members love to create, work in teams, analyze and help Community Managers make their work easier. Your mission is to become the dedicated owner of application, cloud and AI security at Metricool, relieving our Senior Developers and Leads from manual security reviews and building specialized security management across our core monolith (JavaEE, Spring Security, Vue), AWS infrastructure, AI-powered features and internal compliance frameworks (ISO 27001, SOC 2).

In this position, you will be able to make a wonderful contribution and impact in different areas:

• As Senior Security Engineer, Application & Platform Security: Harden Spring Security, JavaEE filters, CORS, anti-CSRF protections, SameSite/HttpOnly cookie flags, and strict CSP headers.
• AI Security & Testing : Run threat modeling and vulnerability testing on our AI/LLM features, protecting against the OWASP Top 10 for LLMs: prompt injection, data poisoning, data leakage, insecure output handling, and API abuse.
• Compliance & Auditing (ISO 27001 / SOC 2): Define, audit and collect technical evidence for compliance controls (access management, encryption at rest and in transit, incident logs), lead ISO 27001 and SOC 2 audits, and evaluate third-party vendor risk.
• Infrastructure & Cloud Security: Configure AWS load balancers, Nginx, Tomcat, container security (Docker), and HTTPS enforcement.
• Code Reviews & Audits: Run regular code reviews, secret-detection audits, and third-party dependency reviews (Maven, Node.js).
• Build automated security checks (SAST/DAST/ZAP) into our CI/CD pipelines.

As a Team Member:

• Cross-functional Alignment: Work closely with Senior Developers and Leads to bring security into the development process from the start, rather than bolting it on afterward.
• Continuous Improvement: Document controls, evidence and runbooks so compliance stays audit-ready year-round, not just ahead of a renewal.
• Culture of Excellence: Drive a security-first culture that embraces secure AI adoption without slowing down developer velocity.

Long story short: How will your first days in Metricool look like? First month: Gain full context of the monolith architecture, the AWS stack and our current compliance posture. First Quarter: Complete AI feature threat modeling, execute security header hardening, and set up the ISO 27001/SOC 2 evidence collection matrix. To the moon: Own platform security end to end, keep compliance continuous and seamless, and lead the secure adoption of new AI technologies.

Job Requirements

• The candidate must be located in Spain.
• A senior profile, confident owning security end-to-end across application code, cloud infrastructure and compliance, not just reviewing it on paper.
• Languages: Professional fluency in Spanish (mandatory) and English. A language proficiency check is part of the hiring process.
• Hard skills: JavaEE, Spring Security, Vue.js, Node.js, Docker, OWASP ZAP, AWS, Linux, MySQL, Maven, Git/Bitbucket.
• AI & Security: Understanding of the OWASP Top 10 for LLM Applications, AI data privacy, and secure API/prompt engineering.
• Compliance Frameworks: Knowledge of ISO/IEC 27001 ISMS controls, SOC 2 Type II Trust Services Criteria (security, availability, confidentiality), and vendor risk assessments.
• Soft skills: Hands-on mindset: comfortable writing and reviewing code, not a "paper compliance" auditor. Pragmatic approach to security: applies controls without imposing heavy bureaucratic overhead on development speed. Genuine curiosity about emerging risks, especially around GenAI/LLM adoption in software platforms. Clear communicator, able to turn audit requirements into practical, developer-friendly processes.

Why will you fall in love with Metricool?

Truly Remote : Work from wherever you're most productive. We provide the tools; you provide the talent.

100% Flexible Schedule: We care about the work getting done, not the hours you're sitting at the desk. You organize your own time so you can live your life, as long as you're there to collaborate when the team needs you.

Health Insurance: We've got you covered so you can work with peace of mind.

Language Lessons: We're an international team speaking English, Spanish, French, and German. We'll help you learn a new language to help break down barriers and connect better with your colleagues.

The Epic Weekend: Once a year, we all get together in person to hang out, touch grass, and remind ourselves we're not just avatars on Slack.

Salary: We are actively working to align our budgets with market