Application Security Engineer (Vulnerability Management)

We at Hack in Hire, are looking for a Application Security Engineer (Vulnerability Management) to become part of our client's team.

Our client is a Spanish cybersecurity company based in Madrid. They are looking for an Application Security Engineer to join a project focused on managing, coordinating and tracking vulnerabilities found in corporate applications and services. The role is remote from Spain, with occasional on-site attendance, preferably in Madrid or Barcelona.

The role

You will act as the link between security teams, specialist penetration testing providers and development teams, helping to turn technical findings into concrete remediation actions. We are not looking for a pentester who runs intrusion tests full time. We want someone who understands technical vulnerabilities, can interpret pentest results and is able to advise development teams on fixing them.

Responsibilities

• Coordinate and follow up security testing of web applications, APIs and mobile apps.
• Analyze, validate and prioritize vulnerabilities found by pentesting providers and security tools.
• Interpret technical pentest reports and turn findings into remediation specifications development teams can act on.
• Work with technical teams to identify solutions and corrective measures.
• Assess vulnerability risk using CVSS and other criticality and business context criteria.
• Manage the vulnerability lifecycle, from identification to closure.
• Track remediation deadlines, owners and status.
• Coordinate retests and verify evidence of fixes.
• Identify recurring vulnerabilities and propose improvements to secure development controls.
• Produce reports, indicators and metrics on vulnerabilities, remediation and SLA compliance.
• Escalate critical findings, deviations and unremediated risks.

Requirements

• At least 3 years of professional experience, with a minimum of 2 years in vulnerabilities, pentesting or AppSec.
• Experience managing and analyzing vulnerabilities in web applications and APIs.
• Solid knowledge of OWASP Top 10.
• Ability to understand and validate pentest findings.
• Knowledge of CVSS and vulnerability prioritization criteria.
• Experience writing technical reports and remediation recommendations.
• Ability to communicate with developers and technical teams.
• Knowledge of Burp Suite, OWASP ZAP or similar tools.
• Familiarity with vulnerability management and remediation tracking processes.
• English at B2 level or higher.

Nice to have

• Experience managing third-party pentest results.
• Experience with bug bounty or vulnerability disclosure programs.
• Knowledge of web application development, APIs and common frameworks.
• Experience with vulnerability and ticket tracking tools such as Jira.
• Knowledge of SSDLC and secure development practices.
• Experience with reporting, dashboards and remediation metrics.
• Certifications such as eJPT, BSCP, OSCP, CEH, Security+ or AppSec-related ones.

Hiring process

1. Initial filter from Hack In Hire
2. Technical interview, where the Client team will assess your technical knowledge and you will have the opportunity to get to know each other.
3. HR interview, where the clients HR team will tell you more about the company and the position.
4. Technical assessment to demonstrate your skills.

📩 Interested? Apply via LinkedIn or submit your CV via hackinhire.com.