Senior Cybersecurity Engineer (Infrastructure)

Fyul; España; On-site; EUR 45,000 - 67,000; Full time

Job summary

FYUL is seeking a senior security engineer to own significant parts of its security platform, including detection engineering, vulnerability discovery, cloud and endpoint security, and data loss prevention. You will drive automation of security operations and contribute to AI-enabled detection pipelines in production.

The role reports to the Information Security Engineering Manager and is an individual-contributor position focused on depth of expertise, ownership, and practical impact across

Qualifications

• 5+ years in security engineering or SecOps roles with hands-on responsibility for detections and incidents in production - not solely policy or advisory work.
• Real detection engineering experience on a modern SIEM/security platform (Elastic Security preferred; Splunk, Sentinel, or comparable count).
• Deep, hands-on mastery of Linux, macOS, and Windows: internals, hardening, and investigation on all three.
• Strong networking expertise: TCP/IP, routing, VPNs, firewalls, and packet-level analysis.
• Strong cloud security foundation in AWS, including Kubernetes; you have personally secured and monitored production cloud workloads.
• Hands-on LLM experience and building or operating AI-powered tooling in security workflows.

Responsibilities

• Detection engineering: design, implement, and tune detections across our security telemetry and ML-based detection.
• Triage alerts, investigate real incidents, and drive them to closure with incident response improvements.
• Harden and monitor AWS and Kubernetes environments and collaborate with engineering to enable security as a feature.
• Own health and hardening of the endpoint agent fleet across macOS, Windows, and Linux.
• Operate and extend DLP coverage across removable media, email, and SaaS channels.
• Automate recurring security operations and detection-to-response workflows with AI-powered tooling.
• Perform vulnerability discovery and drive remediation through scanning and targeted testing.

Skills

Detection engineering

Security engineering

SIEM

Cloud security

LLM experience

Automation

Incident response

Vulnerability management

Tools

AWS

Kubernetes

Terraform

Helm

Atlantis

Postman

Git

GitHub Copilot

Grafana

Kibana

Prometheus

Job description

About the role

The cybersecurity team at FYUL is deliberately small and execution-focused. Its engineering branch runs the company's security operations backbone: a large-scale telemetry and detection platform covering endpoints, network traffic, cloud workloads, and SaaS - a modern SIEM at its core, extended with substantial custom machine learning and AI agents that this team designs and builds itself. This senior engineer role, reporting directly to the Information Security Engineering Manager, owns significant parts of that platform: detection engineering, vulnerability discovery, cloud and endpoint security, data loss prevention, and the automation of security operations. This is an individual-contributor position where professional growth comes from depth of expertise and ownership of outcomes. The security program is mature, with governance and compliance handled by a dedicated GRC function - so this role is about building and running security engineering, full-time.

Your daily tasks will include:

• Detection engineering. Design, implement, and tune detections across our security telemetry - SIEM rules as well as custom ML models for anomaly and risk detection. Triage alerts, investigate real incidents, and drive them to closure - including technical incident response and post-incident improvement.
• Cloud and platform security. Harden and monitor our AWS and Kubernetes (EKS) environments: workload security, IAM, container runtime defense, and configuration standards. Collaborate with engineering teams so security lands as enablement, not friction.
• Endpoint security. Own the health and hardening of the endpoint agent fleet across macOS, Windows, and Linux.
• Data loss prevention. Operate and extend DLP coverage across removable media, email, and SaaS channels: telemetry-driven detection of data exfiltration, tuned to keep false positives low.
• Security automation. Automate recurring operations and detection-to-response workflows - including AI-based agents and pipelines, which are already a working part of this program. Prefer integrating established tooling over bespoke development where it delivers the same outcome.
• Vulnerability discovery and management. Find infrastructure vulnerabilities yourself - through scanning, configuration review, and targeted penetration testing of our environments - then prioritize and drive remediation to closure.
• This is not an application security role: a dedicated sub-team covers appsec.

Your qualifications:

• 5+ years in security engineering or SecOps roles with hands-on responsibility for detections and incidents in production - not solely policy or advisory work.
• Real detection engineering experience on a modern SIEM/security platform (Elastic Security preferred; Splunk, Sentinel, or comparable count), and the appetite to go beyond built-in rules into custom ML-based detection.
• Deep, hands-on mastery of Linux, macOS, and Windows: internals, hardening, and investigation on all three. You have personally hunted or hardened systems on each of them, not just one favorite.
• Strong networking expertise: TCP/IP, routing, VPNs, firewalls, and packet-level analysis - you can reconstruct what happened from a packet capture and reason about how traffic actually flows through our environments.
• Strong cloud security foundation in AWS, including Kubernetes; you have personally secured and monitored production cloud workloads.
• Hands-on LLM experience. You have built or operated LLM-powered tooling - agents, pipelines, or detection/automation workflows - not merely used a chat assistant. Our security program already runs AI agents in production; you will extend that work.
• A certification in practical infrastructure hacking or hardening - e.g., OSCP, OSEP, or a comparable hands-on offensive credential. This matters more to us than knowledge-exam certifications.
• Demonstrated automation capability: scripts, integrations, pipelines, or AI-assisted workflows you can show. Software engineering background is not required; a track record of building practical automation is.
• Self-directed working style with strong ownership - the ability to take ambiguous problems through to completed outcomes with minimal supervision. Excellent written and spoken English.
• Further certifications (e.g., CISSP, GIAC/GCFA/GCIH, AWS Security) are an advantage, but the hands-on hacking/hardening credential above is the one we screen for. Hands-on experience always outweighs certification.

Our tech stack:

• Infra: AWS, Kubernetes, Terraform, Helm, Atlantis
• Engineering Tools: Postman, Git, GitHub Copilot, PhpStorm, Grafana, Kibana, Prometheus
• Remote work Tools: Jira, Miro, Google Workspace, Slack
• Development Practices: Pair Programming, Code Reviews, Continuous Integration/Deployment

What we offer:

• Monthly salary EUR €4,000 - €6,000/monthgross, depending on work experience, education, and skills
• A global, inclusive team that's as supportive as it is ambitious and serious about getting things done
• An opportunity to work