Security Lead

About the role

We are seeking a Security Lead to shape and drive the security strategy of a fast‑growing, cloud‑native organization that develops cutting‑edge AI applications. Based in Spain and operating in a remote‑first environment, you will combine hands‑on technical expertise with cross‑functional leadership to embed security across all layers of the business.

Key responsibilities

• Lead and continuously improve cloud, application, and corporate security across infrastructure, systems, and business operations.
• Design and maintain secure AWS architectures, identity and access management, network security, and configuration management.
• Drive application security initiatives, including secure development practices, threat modeling, and automated security testing.
• Own the incident response program, develop playbooks, coordinate response efforts, and enhance threat detection.
• Manage vulnerability identification, prioritization, remediation, and risk reduction in collaboration with engineering teams.
• Maintain and optimize security tooling such as monitoring, logging, SIEM, alerting, endpoint protection, and secrets management.
• Collaborate with engineering and platform teams to integrate security into architecture and design decisions while supporting ISO 27001 and SOC 2 compliance.
• Lead customer‑facing security reviews and oversee IT security operations.

Required profile

• Bachelor's degree in Computer Science, Engineering, or equivalent practical experience.
• At least 5 years of experience in security engineering, cloud security, or application security.
• Proven ability to lead security initiatives and work closely with engineering and product teams.

Required skills

• AWS security architecture, IAM, and network security.
• DevOps environments and infrastructure‑as‑code security.
• Secure software development lifecycle (SDLC) practices.
• Authentication, authorization, vulnerability management, incident response, and threat detection.
• Security tooling: monitoring, logging, SIEM, alerting, endpoint protection, secrets management.
• Compliance frameworks: ISO 27001, SOC 2.