Remote Senior Security Engineer - AI, Cloud & Compliance

team.blue Global; Madrid; Remote; EUR 55,000 - 65,000; Full time

Benefits offered by this job

Truly Remote

Flexible schedule

Health Insurance

Language Lessons

Job summary

Metricool is seeking a Senior Security Engineer to own application, cloud and AI security end-to-end. You will Harden security across JavaEE, Spring Security, and Vue and drive compliance with ISO 27001 and SOC 2 while supporting AWS infrastructure and secure AI features.

The role is fully remote with a flexible schedule and a strong emphasis on integrating security into the development process from day one, not retrofitting it after delivery.

Qualifications

• Senior profile owning security end-to-end across application code, cloud infrastructure and compliance.
• Fluent in Spanish and English; language check part of hiring process.
• Candidate must be located in Spain.

Responsibilities

• Harden Spring Security, JavaEE filters, CORS, CSRF protections, cookies, CSP headers.
• Run threat modeling and vulnerability testing on AI/LLM features.
• Lead ISO 27001 and SOC 2 audits and collect evidence for controls.
• Configure AWS load balancers, Nginx, Tomcat, Docker containers and HTTPS enforcement.
• Perform code reviews, secret-detection, and third-party dependency reviews (Maven, Node.js).
• Build automated security checks (SAST/DAST/ZAP) into CI/CD pipelines.
• Collaborate with developers to embed security from the start; drive secure AI adoption.

Skills

JavaEE

Spring Security

Vue.js

Node.js

Docker

OWASP ZAP

AWS

Linux

MySQL

Maven

Git/Bitbucket

Tools

Docker

OWASP ZAP

AWS

Maven

Git/Bitbucket

Job description

Metricool is seeking a Senior Security Engineer to own application, cloud and AI security end-to-end. You will Harden security across JavaEE, Spring Security, and Vue and drive compliance with ISO 27001 and SOC 2 while supporting AWS infrastructure and secure AI features.

The role is fully remote with a flexible schedule and a strong emphasis on integrating security into the development process from day one, not retrofitting it after delivery.