Vulnerability Management Engineer

Do you enjoy investigating whether a reported vulnerability is genuinely exploitable, explaining why it matters and helping engineering teams fix it properly?
We are recruiting an Application Security & Remediation Engineer for a permanent position within a long-term international technology programme.
This is not a role focused solely on running scanning tools. You will examine findings, remove false positives, assess real-world risk and work with development teams until the underlying issue has been resolved and successfully retested.
What you will work on
Manual testing of web applications and APIs using Burp Suite.
Analysis of findings produced by code, dependency and runtime security tools.
Risk-based prioritisation of vulnerabilities.
Remediation guidance and follow-up with engineering teams.
Security integration within CI/CD workflows.
Application risk reviews and secure-design discussions.
Reporting on remediation progress, risk trends and outstanding actions.
Support during urgent or high-impact vulnerability events.
What we are looking for
You should bring solid hands-on experience in application security or vulnerability management, a good understanding of OWASP risks and the ability to communicate clearly with both technical and business stakeholders.
Experience with scripting or development languages such as Python, Java or .NET will be valuable. Knowledge of Azure, Azure DevOps, ServiceNow, security dashboards or recognised security frameworks would be an additional advantage.
There is flexibility regarding years of experience. A professional with around three or four years of directly relevant experience may be considered where the technical capability, autonomy and stakeholder skills are strong.
Practical information
Fully remote Iberia
Permanent employment contract
Fluent professional English required
Spanish is advantageous, but not mandatory
Applicants must be able to work in Spain without employer sponsorship
This opportunity may be particularly attractive to someone who wants to move beyond identifying problems and play an active role in improving the way application-security risk is managed across the software lifecycle.
#ApplicationSecurity #AppSec #CyberSecurityJobs #VulnerabilityManagement #RemoteJobsSpain #RemoteJobsPortugal

Work arrangement
Yes