Security Architect / Senior Security Engineer - Wizeline

Wizeline; Valencia; Híbrido; EUR 90.000 - 130.000; Jornada completa

Ventajas ofrecidas por este puesto de trabajo

Health benefits

Retirement plans

Global mobility opportunities

Flexible work policy

WizeAcademy learning

Cloud certifications

Descripción de la vacante

Wizeline is seeking a Security Architect / Senior Security Engineer to lead application security across web and API platforms, combining hands-on testing, remediation, threat modelling, and secure design reviews in a hybrid cloud environment to protect critical products and customers.

You will manage Wiz, Snyk, Qualys, and other tooling, embed SAST/DAST checks into GitHub Actions, perform threat modelling per OWASP SAMM, ensure compliance with GDPR/PCI-DSS, and secure AWS and on‑prem

Formación

• Penetration testing, red teaming, and manual code review experience.
• Deep hands-on with SAST/DAST/SCA tooling (Wiz, Snyk, Qualys, SonarQube).
• Experience remediating OWASP Top 10 across .NET, Java, and React stacks.
• CI/CD security integration and secret management (GitHub Actions, AWS KMS, Vault).
• Familiarity with OWASP Top 10, SAMM, SBOM management.
• Cloud and hybrid infra security in AWS environments.

Responsabilidades

• Perform dynamic and static application security testing on live applications and APIs.
• Prioritize remediation with CVSS, exploitability, and business context; patch code and infrastructure.
• Manage scanning tools (Wiz, Snyk, Qualys, SonarQube, Burp Suite, ZAP).
• Embed SAST/DAST checks into GitHub CI/CD pipelines for shift-left security.
• Conduct threat modeling and architecture reviews per OWASP SAMM.
• Secure hybrid and cloud environments across AWS and on‑prem.

Conocimientos

Offensive Security

Defensive AppSec

AppSec Tooling

Code & Infra Remediation

DevSecOps

Threat Modeling

SBOM Management

AWS Security

Cloud/Hybrid Security

Herramientas

Wiz

Snyk

Qualys

SonarQube

Burp Suite Pro

OWASP ZAP

Descripción del empleo

Security Architect / Senior Security Engineer - Wizeline Wizelinecomunidad valenciana, Spain

We are:

Wizeline, a global AI-centric technology solutions provider, develops cutting-edge, AI-powered digital products and platforms. We partner with clients to leverage data and AI, accelerating market entry and driving business transformation. As a global community of innovators, we foster a culture of growth, collaboration, and impact.

With the right people and the right ideas, there’s no limit to what we can achieve

Sounds awesome, right? Now, let’s make sure you’re a good fit for the role:

Responsibilities:

• Application Security & Offensive Testing: Conduct dynamic and static application security testing (SAST/DAST/SCA), red team exercises, penetration testing, and manual code reviews on live applications and APIs to uncover business logic flaws and vulnerabilities beyond automated scanner capabilities.
• Vulnerability Remediation & Triage: Establish risk-based prioritization criteria (CVSS, exploitability, business context) and directly execute code-level patches and infrastructure configuration fixes across .NET, Java, and React stacks without disrupting operational continuity.
• AppSec & Security Tooling Management: Manage, configure, and optimize primary scanning tools, focusing on Wiz, Snyk, Qualys, and dynamic analysis tools (Burp Suite Enterprise/Pro, OWASP ZAP).
• DevSecOps & Pipeline Integration: Embed automated security checks, SAST/SCA scanning, and compliance gates directly into GitHub CI/CD pipelines for continuous verification and shift-left security.
• Governance & Architecture Alignment: Perform threat modeling and architecture security reviews based on OWASP SAMM principles, ensuring existing solutions meet organizational security baselines and compliance requirements (e.g., PCI-DSS, HIPAA, GDPR).
• Hybrid & Cloud Security: Secure and harden hybrid architecture spanning primary AWS cloud environments, containerized workloads, and on-premise infrastructure.

Must-have Skills

To be successful in this role, you must have:

• Offensive & Defensive AppSec: Proven experience in Penetration Testing, Red Teaming, manual code review, and dynamic application analysis using tools like Burp Suite Professional and OWASP ZAP.
• AppSec Tooling Mastery (SAST / DAST / SCA): Deep hands-on expertise with Wiz (primary), Snyk, Qualys, SonarQube, and automated DAST tools integrated into active environments.
• Code & Infrastructure Remediation: Demonstrated ability to refactor vulnerable code, apply security patches, and remediate OWASP Top 10 vulnerabilities across .NET, Java, and React application stacks.
• DevSecOps & Secret Management: Hands-on experience securing CI/CD pipelines (GitHub Actions) and implementing dynamic secret management (AWS KMS, HashiCorp Vault, IAM Roles).
• Security Frameworks: Strong command of OWASP Top 10, OWASP SAMM, threat modeling methodologies, and Software Bill of Materials (SBOM) management.
• Cloud & Hybrid Infrastructure: Solid experience securing AWS environments, IAM policies, network security controls, and hybrid setups.

What we offer:

• Health benefits & wellness programs
• Savings & retirement plans
• Global mobility opportunities
• Flexible work policy and remote-friendly approach
• Happy hours, gaming tournaments, sports activities & more
• Continuous learning & training programs with WizeAcademy
• Free certifications in cloud technologies and coding languages

Find out more about our culture here.