Security Engineer, Application Security and GRC

A consumer AI business is hiring a security engineer to own security end to end, from application security through to governance and compliance. It is a broad brief rather than a narrow one, and the person who takes it sets how the work is done.

The work splits three ways. Application security is the daily half: code review, finding and closing vulnerabilities, and running the tooling that tracks them. Governance, risk and compliance is the other half: the risk register, and coordinating external audits and penetration tests. Around both sits security monitoring, device management and access control, with occasional out-of-hours cover, and the newer question of what an AI product has to defend that a conventional one does not.

It suits somebody with two to three years or more of hands-on work in application security, GRC or both, done inside an AI company or a scale-up rather than a large corporate security function. The role leans on Git and GitHub, scripting in Python or Bash, and real use of vulnerability management tooling.

One thing worth saying here rather than saving for a call: the product includes adult content, and whoever takes this role works with it daily.

Remote, anywhere in Europe, permanent or on a B2B contract. Most of the working day needs to overlap CET, and the role carries occasional nights and weekend monitoring or on-call cover. No visa sponsorship is available.