Security Architect / Senior Security Engineer

Wizeline; Lugo; Híbrido; EUR 70.000 - 110.000; Jornada completa

Ventajas ofrecidas por este puesto de trabajo

Global mobility opportunities

Flexible work policy

Remote-friendly approach

WizeAcademy Learning & Certifications

Descripción de la vacante

Wizeline, proveedor global de soluciones tecnológicas centradas en IA, busca un experto en seguridad de aplicaciones para realizar pruebas dinámicas y estáticas, revisiones de código y ejercicios de Red Teaming. Se priorizan habilidades en .NET, Java y React, y la integración de seguridad en CI/CD.

El candidato ideal gestionará herramientas como Wiz, Snyk, Qualys, Burp Suite y OWASP ZAP, y aplicará buenas prácticas OWASP SAMM y SBOM.

Formación

• Experiencia en pruebas de seguridad dinámicas y estáticas de aplicaciones (SAST/DAST/SCA).
• Capacidad de realizar pruebas de penetración y revisiones de código manuales.
• Conocimiento de marcos de seguridad como OWASP TOP 10 y SAMM.

Responsabilidades

• Conducir pruebas de seguridad en aplicaciones y APIs en pilas .NET, Java y React.
• Integrar controles de seguridad en pipelines CI/CD (GitHub Actions) y gestión de herramientas de AppSec.
• Modelar amenazas y revisar la arquitectura para mantener la conformidad de seguridad.

Descripción del empleo

Descripción del trabajo

Wizeline, a global AI-centric technology solutions provider, develops cutting-edge, AI-powered digital products and platforms. We partner with clients to leverage data and AI, accelerating market entry and driving business transformation. As a global community of innovators, we foster a culture of growth, collaboration, and impact.

Application Security & Offensive Testing: Conduct dynamic and static application security testing (SAST/DAST/SCA), red team exercises, penetration testing, and manual code reviews on live applications and APIs to uncover business logic flaws and vulnerabilities beyond automated scanner capabilities. Establish risk-based prioritization criteria (CVSS, exploitability, business context) and directly execute code-level patches and infrastructure configuration fixes across .NET, Java, and React stacks without disrupting operational continuity.

AppSec & Security Tooling Management: Manage, configure, and optimize primary scanning tools, focusing on Wiz, Snyk, Qualys, and dynamic analysis tools (Burp Suite Enterprise/Pro, OWASP ZAP). Embed automated security checks, SAST/SCA scanning, and compliance gates directly into GitHub CI/CD pipelines for continuous verification and shift-left security. Perform threat modeling and architecture security reviews based on OWASP SAMM principles, ensuring existing solutions meet organizational security baselines and compliance requirements.

Hybrid & Cloud Security: Secure and harden hybrid architecture spanning primary AWS cloud environments, containerized workloads, and on-premise infrastructure. Offensive & Defensive AppSec: Proven experience in Penetration Testing, Red Teaming, manual code review, and dynamic application analysis using tools like Burp Suite Professional and OWASP ZAP. AppSec Tooling Mastery (SAST / DAST / SCA): Deep hands-on expertise with Wiz (primary), Snyk, Qualys, SonarQube, and automated DAST tools integrated into active environments. Demonstrated ability to refactor vulnerable code, apply security patches, and remediate OWASP Top 10 vulnerabilities across .NET, Java, and React application stacks. Hands-on experience securing CI/CD pipelines (GitHub Actions) and implementing dynamic secret management (AWS KMS, HashiCorp Vault, IAM Roles).

Security Frameworks: Strong command of OWASP Top 10, OWASP SAMM, threat modeling methodologies, and Software Bill of Materials (SBOM) management. Cloud & Hybrid Infrastructure: Solid experience securing AWS environments, IAM policies, network security controls, and hybrid setups.

Global mobility opportunities Flexible work policy and remote-friendly approach Happy hours, gaming tournaments, sports activities & more Continuous learning & training programs with WizeAcademy Free certifications in cloud technologies and coding languages