Security Engineer

Ersilia; Barcelona; Remote; EUR 70,000 - 90,000; Full time

Job summary

Ersilia is seeking a Security Engineer to own the protection of our product, users, and collaborators as we scale. You will test aggressively, review code weekly, and drive remediation across the stack.

This fully remote role can be based globally within the CET region. You will coordinate audits, manage risk, run phishing simulations, monitor alerts, and work with GitHub workflows to ship secure software.

Qualifications

• 5 years in security within a startup or scale-up.
• Strong application security and vulnerability management experience.
• Experience coordinating or performing penetration tests and audits.
• Comfort with shipping code using Git/GitHub workflows.
• Scripting or automation skills.

Responsibilities

• Perform weekly code reviews to catch vulnerabilities before they ship.
• Track and drive remediation of security vulnerabilities across the stack.
• Coordinate external security audits and penetration tests.
• Maintain risk register and map company services.
• Support audit follow-up and keep GRC documentation up to date.
• Communicate new threats to the team, document findings, and broadcast security updates company-wide.
• Run phishing simulations.
• Own monitoring of security channels and alerts, including weekend coverage.
• Set up and secure new employee devices (MDM), manage access provisioning / deprovisioning.
• Keep an eye on emerging attack techniques targeting generative AI.
• Track security incidents and vulnerabilities disclosed.

Skills

Security exp 5y

App security

Vuln mgmt

Pen tests

Git workflows

Scripting/Automation

Tools

GitHub

Job description

We are looking for a Security Engineer who can move fast, test aggressively and scale what works. you will take ownership of protecting our product, our users, and our collaborators as we scale a fast.

Your responsibilities:

• Perform weekly code reviews to catch vulnerabilities before they ship

• Track, prioritize, and drive remediation of security vulnerabilities across the stack

• Coordinate external security audits and penetration tests, and follow through on findings

• Maintain and evolve our risk register, mapping all company services and prioritizing what's exposed

• Support audit follow-up and keep GRC documentation up to date

• Communicate new threats to the team, document findings, and broadcast security updates company-wide

• Run phishing simulations

• Own the monitoring of security channels and alerts, including weekend coverage, so nothing goes unanswered

• Set up and secure new employee devices (MDM), manage access provisioning / deprovisioning

• Keep an eye on emerging attack techniques targeting generative AI

• Track security incidents and vulnerabilities disclosed

What we are looking for:

• 5 years in a security environment working in a startup or scale up.

• Solid experience in application security (code review, vulnerability management)

• Experience coordinating or conducting penetration tests / security audits

• Comfortable shipping code and working with Git/GitHub workflows

• Scripting/automation skills

This is a fully remote position which can be based globally given a +-4 hour time difference within the CET region.