Remote Security Engineer - App Sec & Vulnerability Champion

Ersilia; Barcelona; Remote; EUR 70,000 - 90,000; Full time

Job summary

Ersilia is seeking a Security Engineer to own the protection of our product, users, and collaborators as we scale. You will test aggressively, review code weekly, and drive remediation across the stack.

This fully remote role can be based globally within the CET region. You will coordinate audits, manage risk, run phishing simulations, monitor alerts, and work with GitHub workflows to ship secure software.

Qualifications

• 5 years in security within a startup or scale-up.
• Strong application security and vulnerability management experience.
• Experience coordinating or performing penetration tests and audits.
• Comfort with shipping code using Git/GitHub workflows.
• Scripting or automation skills.

Responsibilities

• Perform weekly code reviews to catch vulnerabilities before they ship.
• Track and drive remediation of security vulnerabilities across the stack.
• Coordinate external security audits and penetration tests.
• Maintain risk register and map company services.
• Support audit follow-up and keep GRC documentation up to date.
• Communicate new threats to the team, document findings, and broadcast security updates company-wide.
• Run phishing simulations.
• Own monitoring of security channels and alerts, including weekend coverage.
• Set up and secure new employee devices (MDM), manage access provisioning / deprovisioning.
• Keep an eye on emerging attack techniques targeting generative AI.
• Track security incidents and vulnerabilities disclosed.

Skills

Security exp 5y

App security

Vuln mgmt

Pen tests

Git workflows

Scripting/Automation

Tools

GitHub

Job description

Ersilia is seeking a Security Engineer to own the protection of our product, users, and collaborators as we scale. You will test aggressively, review code weekly, and drive remediation across the stack.

This fully remote role can be based globally within the CET region. You will coordinate audits, manage risk, run phishing simulations, monitor alerts, and work with GitHub workflows to ship secure software.