Senior Security Engineer

Hexa Consulting; Lisboa; Hybrid; EUR 60,000 - 80,000; Full time

Benefits offered by this job

Private health insurance from day one

Mental health support via TEAM 24

Childcare vouchers

Certification support

Learning and development opportunities

Collaborative team culture

Job summary

Hexa Consulting is seeking a Senior Security Engineer to join the Client's team in a hybrid work model from Lisbon. You will coordinate cybersecurity initiatives across development, operations and external partners, and drive continuous improvement of security controls for digital platforms.

The role requires 4+ years of experience, strong OWASP knowledge, vulnerability management and CI/CD security practices, with English proficiency for multinational collaboration.

Qualifications

• 4+ years of professional experience as a Security Engineer in digital platforms, e-commerce or software environments.
• Bachelor's or Master's degree in Computer Science, Software Engineering or related field.
• Strong knowledge of information security principles and web application security across Internet, Extranet and Intranet.
• Hands-on experience with vulnerability scanning, penetration testing, security controls and incident response.
• Solid understanding of OWASP Top 10, secure coding principles and common web vulnerabilities.
• Experience supporting security hardening, vulnerability remediation, and secure deployment practices.
• Understanding of security integration into Agile development and CI/CD processes.
• Strong analytical and problem-solving skills with pragmatic security decisions.
• Ability to coordinate security activities across development, operations, cybersecurity and external partners.

Responsibilities

• Act as the security reference for digital product teams, coordinating cybersecurity initiatives with IT, development, operations and external partners.
• Implement, maintain and improve security controls across digital platforms and services.
• Ensure digital solutions comply with security policies, standards and secure design principles.
• Plan and follow up on security testing activities including penetration testing and vulnerability scanning.
• Collaborate with development and operations to remediate vulnerabilities.
• Promote secure coding, design and deployment practices throughout the SDLC.
• Strengthen automated security testing within CI/CD pipelines with DevOps/QA.
• Document and promote security hardening procedures for web infrastructure and middleware.
• Participate in security audits and assessments covering data protection and e-commerce security.
• Maintain and improve security processes, controls and incident management procedures.
• Provide training and coaching on security best practices to internal and external teams.
• Coordinate security activities across stakeholders for continuous improvement.

Skills

Security engineering

Vulnerability scanning

Penetration testing

OWASP Top 10

CI/CD security

DevSecOps

Incident response

Secure coding

Agile / SDLC

English proficiency

Education

Bachelor's or Master's in Computer Science / Software Engineering

Tools

GitLab

SonarQube

Snyk

OIDC

OpenFGA

AWS IAM Policies

Job description

Hexa Consulting is looking for a Senior Security Engineer to join our Client's team in a hybrid work model from Lisbon.

JOB DETAILS

Lisbon, Portugal | Hybrid | Luxury Goods & Digital Commerce Sector

MANDATORY REQUIREMENTS

• At least 4 years of professional experience as a Security Engineer, ideally in digital platforms, e-commerce or software-driven environments.
• Bachelor's or Master's degree in Computer Science, Software Engineering or a related field.
• Strong knowledge of information security principles, IT security and web application security across Internet, Extranet and Intranet environments.
• Hands-on experience with vulnerability scanning, penetration testing, security controls and incident response.
• Solid understanding of OWASP Top 10, secure coding principles and common web application vulnerabilities.
• Experience supporting security hardening, vulnerability remediation and secure deployment practices.
• Understanding of security integration into Agile software development and CI/CD processes.
• Strong analytical and problem-solving skills, with the ability to make pragmatic security decisions.
• Ability to work independently and coordinate security activities across development, operations, cybersecurity and external partner teams.
• Excellent communication skills and experience collaborating with multinational, cross-functional teams.
• Proactive, self-driven mindset and willingness to continuously learn and improve.
• Professional working proficiency in English.

NICE TO HAVE

• Previous experience in digital commerce or e-commerce environments.
• Exposure to security intelligence reviews and related assessment activities.

TECHNOLOGY STACK

• Security Testing: Vulnerability Scanning, Penetration Testing, Security Assessments.
• DevSecOps: GitLab, SonarQube, Snyk, CI/CD Security Testing.
• Identity & Access Management: OIDC, OpenFGA, AWS IAM Policies.
• Security Operations: Incident Response, Security Hardening, Vulnerability Management.
• Methodologies: Agile Delivery, Secure Software Development Practices.

KEY RESPONSIBILITIES

• Act as the security reference for digital product teams, coordinating cybersecurity initiatives with IT, development, operations and external partners.
• Support the implementation, maintenance and continuous improvement of security controls across digital platforms and services.
• Ensure digital solutions comply with applicable security policies, standards and secure design principles.
• Plan, coordinate and follow up on security testing activities, including penetration testing, vulnerability scanning and security intelligence reviews.
• Collaborate with development and operations teams to identify, prioritize and remediate security vulnerabilities.
• Promote secure coding, secure design and secure deployment practices throughout the software development lifecycle.
• Work closely with DevOps and QA teams to strengthen automated security testing within CI/CD pipelines.
• Define, document and promote security hardening procedures for web infrastructure, applications and middleware components.
• Participate in security audits and assessments covering data protection, e-commerce and digital platform security requirements.
• Maintain and improve security processes, technical controls and incident management procedures.
• Provide technical guidance, training and coaching to internal teams and external partners on security best practices.
• Coordinate security-related activities across multiple stakeholders and contribute to continuous cybersecurity improvement.

WHAT WE OFFER

• Work Model: Hybrid.
• A culture where each person is encouraged to act as a Builder, contributing with ownership, responsibility and impact.
• A collaborative environment built on Honesty, Mutual Support and Agility.
• Continuous learning and certification support throughout your journey.
• Private health insurance from day one, with optional family extension.
• Confidential mental health support through TEAM 24, including psychological support, content and live sessions.
• Childcare vouchers and practical family support measures.
• Opportunities to grow through exposure to quality management, information security, AI governance and cybersecurity best practices.

EQUAL OPPORTUNITY

Hexa is committed to equal opportunity, inclusion and fair access to professional growth. We value diverse backgrounds, perspectives and experiences, and we support the principles of the Portuguese Diversity Charter in the way we build teams and opportunities.

HEXA LIFE

Life at Hexa means being part of a community of Builders. We work with transparency, support each other across projects and geographies, and stay focused on learning, adapting and delivering work that creates real impact.