Security engineer

Metricool; United States; Remote; USD 62,000 - 73,000; Full time

Benefits offered by this job

Удаленная работа

Гибкий график

Страхование здоровья

Уроки языков

Ежегодный оффлайн‑уикенд

Job summary

Metricool ищет специалиста по кибербезопасности для позиционной роли с полным владением безопасностью приложений и инфраструктуры. Вы будете внедрять безопасные практики в продукт и процессы разработки, вести аудиты и тесно сотрудничать с Senior Developers.

Требуется опыт работы с JavaEE, Spring Security, Vue.js и облачными технологиями; удаленная работа 100%, высокоуровневое владение испанским и английским языками обязательно.

Qualifications

• Свободное владение испанским (профессиональный уровень) и английским.
• JavaEE, Spring Security, Vue.js, Node.js; Docker, OWASP ZAP, AWS, Linux, MySQL, Maven, Git/Bitbucket.

Responsibilities

• Упрочнять безопасность Spring Security, фильтры JavaEE, CORS, anti‑CSRF, CSP, SameSite/HttpOnly.
• Проводить threat-моделирование и тестирование на уязвимости для функций AI/LLM; защищать от OWASP Top 10.
• Проводить аудит и сбор доказательств для соответствия (доступ, шифрование, журналы).
• Настраивать балансировщики AWS, Nginx, Tomcat, безопасность контейнеров (Docker).
• Внедрять SAST/DAST/ZAP в CI/CD и работать с командами разработки.

Skills

Spanish

English

Tools

Docker

AWS

Maven

Git/Bitbucket

Nginx

Tomcat

Job description

Описание:

If you love getting hands‑on with web security, cloud infrastructure and the emerging risks of AI and LLM integrations, you’ll feel right at home with us. At Metricool you will be able to do so with real ownership over how security and compliance get built into the product, not just audited after the fact. You will have the possibility to work 100% remotely, working in a high‑growth international B2B SaaS, in which all members love to create, work in teams, analyze and help Community Managers make their work easier.

Задачи:

Harden Spring Security, JavaEE filters, CORS, anti‑CSRF protections, SameSite/HttpOnly cookie flags, and strict CSP headers. Run threat modeling and vulnerability testing on our AI/LLM features, protecting against the OWASP Top 10 for LLMs: prompt injection, data poisoning, data leakage, insecure output handling, and API abuse. Define, audit and collect technical evidence for compliance controls (access management, encryption at rest and in transit, incident logs), lead ISO 27001 and SOC2 audits, and evaluate third‑party vendor risk. Configure AWS load balancers, Nginx, Tomcat, container security (Docker), and HTTPS enforcement. Run regular code reviews, secret‑detection audits, and third‑party dependency reviews (Maven, Node.js). Build automated security checks (SAST/DAST/ZAP) into our CI/CD pipelines. Work closely with Senior Developers and Leads to bring security into the development process from the start, rather than bolting it on afterward. Document controls, evidence and runbooks so compliance stays audit‑ready year‑round, not just ahead of a renewal. Drive a security‑first culture that embraces secure AI adoption without slowing down developer velocity.

Требования:

The candidate must be located in Spain. A senior profile, confident owning security end‑to‑end across application code, cloud infrastructure and compliance, not just reviewing it on paper. Languages: Professional fluency in Spanish (mandatory) and English. JavaEE, Spring Security, Vue.js, Node.js, Docker, OWASP ZAP, AWS, Linux, MySQL, Maven, Git/Bitbucket. Understanding of the OWASP Top 10 for LLM Applications, AI data privacy, and secure API/prompt engineering. Knowledge of ISO/IEC27001 ISMS controls, SOC2 TypeII Trust Services Criteria (security, availability, confidentiality), and vendor risk assessments. Hands‑on mindset: comfortable writing and reviewing code, not a “paper compliance” auditor. Pragmatic approach to security: applies controls without imposing heavy bureaucratic overhead on development speed. Genuine curiosity about emerging risks, especially around GenAI/LLM adoption in software platforms. Clear communicator, able to turn audit requirements into practical, developer‑friendly processes.

Условия:

Truly Remote: Work from wherever you’re most productive. We provide the tools; you provide the talent.

100% Flexible Schedule: We care about the work getting done, not the hours you’re sitting at the desk. You organize your own time so you can live your life, as long as you’re there to collaborate when the team needs you.

Health Insurance: We’ve got you covered so you can work with peace of mind.

Language Lessons: We’re an international team speaking English, Spanish, French, and German. We’ll help you learn a new language to help break down barriers and connect better with your colleagues.

The Epic Weekend: Once a year, we all get together in person to hang out, touch grass, and remind ourselves we’re not just avatars on Slack.

Salary: We are actively working to align our budgets with market standards, offering highly competitive salary packages. For this position we estimate between 55,000€ and 65,000€ (annually).

Growth: We’re a fast‑growing company. If you’re curious and take ownership, there’s no ceiling here.