Security Engineer

In breve

Air Apps is a family‑founded tech company that builds an AI‑powered Personal Entrepreneurial Resource Planner. With headquarters in Lisbon and a second office in San Francisco, the firm has delivered more than 100 million downloads worldwide and remains self‑funded. The opening is for a Security Engineer who will protect the company's applications, infrastructure and data, working on‑site from the Lisbon office and collaborating closely with development, DevOps and IT teams. In this role you will design and run threat‑modeling exercises, carry out vulnerability scans, penetration tests and broader security assessments, and define secure‑coding standards together with developers. You will embed security controls into CI/CD pipelines, automate testing, and monitor for incidents, performing root‑cause analysis and preventive actions. Ensuring compliance with standards such as ISO 27001, GDPR and SOC 2, you will also craft IAM policies, encryption guidelines and authentication mechanisms, and review new product features, APIs and third‑party integrations for security risks. Documentation of incident‑response plans and best practices, plus staying current on emerging threats, round out the day‑to‑day duties. The position requires at least four years of experience in cybersecurity, application security or security engineering. Candidates must be well‑versed in secure‑coding principles, the OWASP Top 10 and threat‑modeling methods, and have hands‑on experience with vulnerability‑scanning tools such as Nessus, Qualys or Burp Suite, as well as penetration‑testing techniques. Proficiency with SIEM, IDS and other security‑monitoring solutions, plus scripting abilities in Python, Bash or PowerShell, is essential. Familiarity with cloud security on AWS, Azure or GCP, including IAM and workload protection, and knowledge of encryption, network and API security are also required. Experience integrating security into DevSecOps pipelines and the ability to analyse logs, spot anomalies and communicate findings to non‑technical audiences complete the must‑have profile. Preferred qualifications include a strong problem‑solving mindset and the capacity to convey security concepts clearly to stakeholders. The role is fully onsite in Lisbon, with relocation support offered. Air Apps provides a range of benefits such as Apple hardware, an annual bonus, comprehensive health and life insurance, transportation budget, meal allowances, childcare support, a pension fund, Urban Sports Club membership and free meals at the hub. The company emphasizes diversity, inclusion and a transparent hiring process that excludes any AI‑generated application material. What the role asks for: - 4+ years cybersecurity or security engineering experience - Strong knowledge of secure coding and OWASP Top 10 - Experience with threat modeling techniques - Proficiency with Nessus, Qualys or Burp Suite - Hands‑on SIEM and intrusion detection system experience - Scripting skills in Python, Bash or PowerShell - Cloud security experience in AWS, Azure or GCP - Experience integrating security into CI/CD pipelines (DevSecOps)