Remote Senior Security Engineer: AI, Cloud & Compliance

Metricool; Barcelona; Remote; EUR 55,000 - 65,000; Full time

Benefits offered by this job

Truly remote work

Flexible schedule

Health insurance

Language lessons

Competitive salary 55k–65k EUR

Job summary

Metricool is seeking a Senior Security Engineer to own end-to-end security for our application, cloud, and AI features. You will harden security across JavaEE/Spring, manage AWS and containerized environments, and drive compliant security practices from design through deployment.

You will run threat modeling, perform vulnerability testing on AI/LLM features, and lead ISO 27001/SOC 2 audits with a bias toward practical, developer-friendly security controls.

Qualifications

• Senior profile owning security end-to-end across application code, cloud infrastructure and compliance.
• Fluent in Spanish and English; language check during hiring.
• Based in Spain or eligible to work remotely from Spain.
• Experience with ISO/IEC 27001 and SOC 2 is a plus.

Responsibilities

• Own application, cloud and AI security across Metricool's stack.
• Run threat modeling and vulnerability testing for AI/LLM features.
• Lead ISO 27001 and SOC 2 audits and evidence collection.
• Configure AWS, Nginx, Tomcat, Docker and HTTPS enforcement.
• Perform code reviews, secret-detection audits and dependency reviews.
• Integrate SAST/DAST/ZAP into CI/CD pipelines.

Skills

Security ownership

Threat modeling

CI/CD security

Code reviews

Cross-functional collaboration

Bilingual (Spanish/English)

Tools

JavaEE

Spring Security

Vue.js

Node.js

Docker

OWASP ZAP

AWS

Linux

MySQL

Maven

Git/Bitbucket

Job description

Metricool is seeking a Senior Security Engineer to own end-to-end security for our application, cloud, and AI features. You will harden security across JavaEE/Spring, manage AWS and containerized environments, and drive compliant security practices from design through deployment.

You will run threat modeling, perform vulnerability testing on AI/LLM features, and lead ISO 27001/SOC 2 audits with a bias toward practical, developer-friendly security controls.