Senior Security Engineer

Epidemic Sound; Sweden; On-site; SEK 600,000 - 800,000; Full time

Job summary

Epidemic Sound is looking for a Security Engineer to enhance security across its products and platforms. Based in Sweden, this role involves owning the vulnerability management programme and working closely with software engineers to improve the Secure Software Development Lifecycle.

The ideal candidate should have around five years of experience in security engineering, strong knowledge of Kubernetes and vulnerability management, and the ability to evaluate security frameworks. Join the dynamic team at Epidemic Sound and ensure a safe experience for users worldwide.

Qualifications

• Around five years in security engineering, with depth in application or infrastructure security.
• Hands-on experience with vulnerability management programmes.
• Working knowledge of SCA/SAST tooling and public cloud security.

Responsibilities

• Own the vulnerability management programme across our products and cloud.
• Consolidate findings into a single risk picture.
• Partner with software engineers to enhance the Secure Software Development Lifecycle.

Skills

Application security

Infrastructure security

Vulnerability management

Kubernetes

Python

Tools

Snyk

Elastic SIEM

GitHub Actions

Terraform

Job description

Join our global force of 400+ innovators, blending the latest in tech with the greatest in soundtracking, from our Stockholm HQ to offices in London, New York, Los Angeles, Berlin, Paris, Oslo, and Seoul. We're an industry leader with a startup mentality. We take what we do seriously, but we don't take ourselves too seriously. Creating and collaborating to transform the sound of streaming, content, and culture. Come join us, and let the world feel your work.

As a Security Engineer at Epidemic Sound, you will help keep the company safe across three connected surfaces: the products our customers use, the platform our engineers build on, and the systems our employees rely on every day. This is a broad, generalist role where your work directly shapes how an industry‑leading company with a startup mentality manages risk and builds securely at scale.

Building security automations and custom AI agents is a normal part of how the team operates, and you will be expected to do the same. You will sit within the Business Tech Division and report to the Head of Security, working closely with engineers, SRE, IT, Legal, and People teams across the organisation.

Your key responsibilities

• Own the vulnerability management programme across our products, cloud, and corporate estate: discovery, prioritisation, remediation tracking, and reporting.
• Consolidate findings across our detection stack into a single risk picture.
• Partner with software engineers to grow the Secure Software Development Lifecycle, including code reviews, threat models, and pre‑ship security input.
• Harden the GCP estate, Kubernetes platform, and CI/CD systems our engineers depend on.
• Run vendor security reviews and respond to enterprise customer security questionnaires.
• Operate and tune the Elastic SIEM and broader detection stack, building new detections as the threat picture evolves.
• Respond to security incidents including on‑call, and run training exercises to keep the team ready.
• Build and run security agents and automations that other engineers and the wider business rely on, treating them as production‑grade software.
• Evaluate AI models and frameworks against security standards.

Requirements

• Around five years in security engineering, with depth in at least one of application security, infrastructure security, enterprise security, or vulnerability management, and solid breadth across the others.
• Hands‑on experience running or contributing to a vulnerability management programme, including prioritisation, SLA setting, remediation tracking, and reporting.
• Working knowledge of SCA/SAST tooling, Internal Developer Portals, and SIEM; we use Snyk, Port, and Elastic.
• Working knowledge of the security features of the major public cloud providers, with GCP preferred.
• Comfort with Kubernetes, Docker, or other container architectures.
• Confident with at least one programming or scripting language such as Python, Go, or Bash.
• Solid experience with Git, GitHub Actions, and Terraform.
• Active, daily use of AI and agentic tools, with concrete examples of agents you have built and outputs you have shipped.
• Experience with vendor security questionnaires.
• Familiarity with common security frameworks such as PCI DSS and NIST.

It would also be music to our ears if you have

• Penetration testing background or OWASP Top 10 fluency.
• Experience with CI/CD security hardening at scale.
• A track record of building security tools other engineers want to use.
• Experience reporting vulnerability management and security posture metrics to leadership.
• Familiarity with social engineering attacks, especially phishing, and the controls that reduce them.

Equal opportunity employer

We believe that bringing people together from different backgrounds, experiences and perspectives makes for a healthy workplace, a more successful business and a better world. We value diversity and encourage everyone to come and soundtrack the world with us.