> Markdown version of [/jobs/ext/1479361-senior-security-engineer](https://www.wearedevelopers.com/jobs/ext/1479361-senior-security-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Senior Security Engineer

- **Company:** Spendesk
- **Location:** Barcelona, Spain
- **Contract:** Permanent contract
- **Skills:** Software System Penetration Testing, Bash Shell, Software as a Service, Cloud Engineering, Continuous Integration, Linux, Elasticsearch, Identity and Access Management, Python (Programming Language), Platform as a Service (PAAS), Security Information and Event Management, Scripting, Microservices
- **Published:** July 29, 2026
- **Apply:** https://www.buscojobs.com.es/senior-security-engineer-en-barcelona-ID-365103378

## About the Role

Ability to own a roadmap and execute autonomously with clear communication to non-specialists

 - Deep understanding of modern web architectures (microservices, cloud-native, PaaS/SaaS)
 - Strong scripting/automation skills (Python, Bash, or similar)
 - Experience mentoring engineers or security practitioners
 - Excellent communication skills (ability to explain CVSS ratings to PMs)Requisitos principales
 - Flexible on-site and remote policy

## Description

Experteer Overview As a Senior Security Engineer at Spendesk, you will shape the first dedicated security function, driving technical security from day one and building a security-aware engineering culture.You'll own the security roadmap, partner with Infrastructure and Compliance to translate findings into engineering-focused tools and processes, and mentor the Associate Security Engineer.This is a hands-on IC role that evolves toward architecture, strategy, and escalation leadership as the team grows.You'll partner across squads to protect our platform and respond to threats with real impact.Compensaciones / Beneficios- Own and operate the bug bounty program and drive strategic improvements- Lead vulnerability triage and act as escalation point for high-severity findings- Lead security incident response including forensics, remediation coordination, post-mortems- Own SIEM architecture, rules, and detection coverage (ElasticSearch, Linux)- Develop and maintain security runbooks and operational docs- Own IAM implementation and operations for product and infrastructure systems- Embed security into the development lifecycle with threat modelling and secure CI/CD- Coordinate penetration tests and security audits and drive post-audit actions- Coach engineers on secure development and surface security risks to leadership- Partner with Infrastructure on secure-by-default solutionsResponsabilidades- Experience owning security outcomes end-to-end across multiple areas (code auditing, infrastructure security, pentesting, SIEM, incident response)- Ability to own a roadmap and execute autonomously with clear communication to non-specialists- Deep understanding of modern web architectures (microservices, cloud-native, PaaS/SaaS)- Strong scripting/automation skills (Python, Bash, or similar)- Experience mentoring engineers or security practitioners- Excellent communication skills (ability to explain CVSS ratings to PMs)Requisitos principales- Flexible on-site and remote policy- Latest Apple equipment- Moka.Care for wellbeing- Office snacks- Location-specific benefits (health insurance, wellness, commuter support, meal vouchers, gym)


## Related Videos

- [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers)
- [Old tools, new tricks](https://www.wearedevelopers.com/videos/1916-old-tools-new-tricks)
- [JavaScript? No. Java Scripts! - Scripting with Java](https://www.wearedevelopers.com/videos/2094-javascript-no-java-scripts-scripting-with-java)
- [Docker network without Docker](https://www.wearedevelopers.com/videos/1418-docker-network-without-docker)
- [MCP doesn’t suck — your agent does](https://www.wearedevelopers.com/videos/100202-mcp-doesn-t-suck-your-agent-does)
- [Intermediate Bitcoin Script](https://www.wearedevelopers.com/videos/25-intermediate-bitcoin-script)

## Related Articles

- [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed)
- [Fully Remote Software Engineer Jobs](https://www.wearedevelopers.com/magazine/447-fully-remote-software-engineer-jobs)
- [Why Upskilling And Reskilling is Important For Developers](https://www.wearedevelopers.com/magazine/428-why-upskilling-and-reskilling-is-important-for-developers)
- [The 12 Best Jobs for Software Engineers](https://www.wearedevelopers.com/magazine/401-the-12-best-jobs-for-software-engineers)
- [Where To Find Software Engineering Jobs](https://www.wearedevelopers.com/magazine/396-where-to-find-software-engineering-jobs)
- [Spanish Business Culture and Etiquette](https://www.wearedevelopers.com/magazine/353-spanish-business-culture-and-etiquette)