Remote-First Lead App Security Engineer

Remofirst; España; Presencial; USD 140.000 - 190.000; Jornada completa

Ventajas ofrecidas por este puesto de trabajo

Parental leave

Wellbeing stipend

Remote-first, always

Descripción de la vacante

RemoFirst is seeking a Senior Security Engineer to own offensive security, secure SDLC, and cloud security for a 100% remote US-based team. You will lead internal and third-party testing, enforce least-privilege in AWS, and secure customer-facing identity across a multi-tenant platform.

You will collaborate with engineers across Python, Django, FastAPI, Java/Spring Boot services, Kafka, and database layers, ensuring robust API security and model governance for AI initiatives.

Formación

• Deep hands-on application security in a real engineering org: code review, threat modelling, offensive testing.
• Familiarity with Python and Java stack (Django, FastAPI, Spring Boot) and messaging with Kafka/RabbitMQ.
• Strong AWS security focus: IAM, SCPs, EKS, RDS, S3, least privilege.
• Experience securing customer-facing identity: Auth0 or equivalent, SAML/OIDC, API security.
• Ability to explain security decisions in terms of risk and business need.

Responsabilidades

• Conduct internal penetration tests and vulnerability scans on our Python/Django, FastAPI and Java/Spring Boot services.
• Coordinate third-party pentests: scope, findings, remediation accountability.
• Defend multi-tenant architecture to prevent data leakage across accounts.
• Review code and threat models with engineers; maintain internal security libraries.
• Own SAST/DAST tooling and dependency posture; secure infrastructure layers (PostgreSQL, MongoDB, Kafka, RabbitMQ).
• Shape the secure SDLC with guardrails and developer-friendly practices.
• Define guardrails for AI initiatives and secure model pipelines.

Conocimientos

Offensive security

Threat modelling

Code review

AWS security

Auth0/Identity security

Communication

Herramientas

Python/Django

FastAPI

Java/Spring Boot

Kafka

RabbitMQ

PostgreSQL

MongoDB

AWS IAM/SCPs

OIDC/SAML

Descripción del empleo

RemoFirst is seeking a Senior Security Engineer to own offensive security, secure SDLC, and cloud security for a 100% remote US-based team. You will lead internal and third-party testing, enforce least-privilege in AWS, and secure customer-facing identity across a multi-tenant platform.

You will collaborate with engineers across Python, Django, FastAPI, Java/Spring Boot services, Kafka, and database layers, ensuring robust API security and model governance for AI initiatives.