Security Engineer (AppSec / GRC / AI Security)

Location: Paris, France; London, United Kingdom; Lisbon, Portugal; Milan, Italy; Rome, Italy; Berlin, Germany; Athens, Greece; Barcelona, Spain; Bari, Italy; Split, Croatia; Copenhagen, Denmark; Oslo, Norway; Tallinn, Estonia; Limassol, Cyprus; Budapest, Hungary; Florence, Italy; Amsterdam, Netherlands; Stockholm, Sweden; Warsaw, Poland; Kraków, Poland; Lublin, Poland; Aarhus, Denmark; Antwerp, Belgium; Baku, Azerbaijan; Basel, Switzerland; Belfast, United Kingdom; Belgrade, Serbia; Bergen, Norway; Bern, Switzerland; Birkirkara, Malta; Birmingham, United Kingdom; Bologna, Italy; Bordeaux, France; Bratislava, Slovakia; Brno, Czechia; Bruges, Belgium; Brussels, Belgium; Bucharest, Romania; Burgas, Bulgaria; Cardiff, United Kingdom; Celje, Slovenia; Chișinău, Moldova; České Budějovice, Czechia; Cluj-Napoca, Romania; Cologne, Germany; Constanța, Romania; Cork, Ireland; Coventry, United Kingdom; Craiova, Romania; Crete, Greece; Daugavpils, Latvia; Debrecen, Hungary; Derby, United Kingdom; Dnipro, Ukraine; Dresden, Germany; Dublin, Ireland; Düsseldorf, Germany; Edinburgh, United Kingdom; Frankfurt, Germany; Galway, Ireland; Gdańsk, Poland; Geneva, Switzerland; Genoa, Italy; Ghent, Belgium; Glasgow, United Kingdom; Gothenburg, Sweden; Graz, Austria; Hamburg, Germany; Helsinki, Finland; Heraklion, Greece; Iași, Romania; İstanbul, Türkiye; Kaunas, Lithuania; Kazan, Russia; Kharkiv, Ukraine; Kyiv, Ukraine; Košice, Slovakia; Larnaca, Cyprus; Leeds, United Kingdom; Leipzig, Germany; Lille, France; Liverpool, United Kingdom; Ljubljana, Slovenia; Łódź, Poland; Lviv, Ukraine; Lyon, France; Madrid, Spain; Maastricht, Netherlands; Málaga, Spain; Malmö, Sweden; Manchester, United Kingdom; Maribor, Slovenia; Marseille, France; Munich, Germany; Moscow, Russia; Nantes, France; Naples, Italy; Newcastle, United Kingdom; Nice, France; Nicosia, Cyprus; Niš, Serbia; Nizhny Novgorod, Russia; Novi Sad, Serbia; Nuremberg, Germany; Palermo, Italy; Patras, Greece; Pécs, Hungary; Pljevlja, Montenegro; Plovdiv, Bulgaria; Podgorica, Montenegro; Porto, Portugal; Poznań, Poland; Prague, Czechia; Pristina, Kosovo; Riga, Latvia; Rotterdam, Netherlands; Salzburg, Austria; Samara, Russia; San Marino; Sarajevo, Bosnia and Herzegovina; Seville, Spain; Skopje, North Macedonia; Sliema, Malta; Sofia, Bulgaria; The Hague, Netherlands; Thessaloniki, Greece; Timișoara, Romania; Tirana, Albania; Toulouse, France; Turin, Italy; Utrecht, Netherlands; Valencia, Spain; Valletta, Malta; Varna, Bulgaria; Saint Petersburg, Russia; Hanover, Germany; Zürich, Switzerland; Stuttgart, Germany; Venice, Italy; Verona, Italy; Vienna, Austria; Vilnius, Lithuania; Wrocław, Poland; Zagreb, Croatia; Zaragoza, Spain; Zrenjanin, Serbia Workplace: fully David Kennedy Recruitment is working with a rapidly growing technology company with over 50 million users worldwide that is seeking to onboard a Security Engineer to join their R&D team. As the company's sole dedicated Security Engineer, the successful candidate will take end-to-end ownership of security operations, covering application security, vulnerability management, governance and risk, and emerging AI security challenges. The company's products include adult/NSFW content, so candidates must be fully comfortable working with this material. Position: Security Engineer (AppSec / GRC / AI Security) Location: Europe/ASIA, Remote Employment type:  B2B engagement preferred DUTIES AND RESPONSIBILITIES: Application security (core of the role) Review code every week to catch vulnerabilities before they ship Find and prioritise real vulnerabilities across the stack, and drive them through to fixes Audits and pentests Coordinate external security audits and penetration tests Challenge findings where needed and follow them through to fixes Engineering and automation Automate security work and build the tools needed to scale it Use AI tools daily for code review, pentesting and scripting Ownership and communication Own security end to end with little support, deciding what matters most Explain technical risk in plain language to the team and leadership Cover security alerts, including occasional night and weekend on-call Also part of the role (lighter) Maintain a simple risk register and GRC documentation Share security updates with the team and run awareness training Monitor emerging AI threats (prompt injection, jailbreaks, content filter bypass) and incidents at AI providers Advantages AI/LLM security testing (prompt injection, jailbreaking), a strong plus Experience at an AI company or a scale-up GRC awareness Familiarity with MDM and access management REQUIREMENTS: 2+ years of hands-on security experience Hands-on AppSec experience, not compliance only: reviews code regularly and can walk through a real vulnerability found and fixed Experience coordinating an external audit or pentest and following the findings through to fixes Ships code with Git/GitHub, scripts in Python or Bash, and has recent hands-on experience on a modern web stack (e.g. Rails, Node; GCP, Heroku or similar) Has been the sole or lead security person, or owned a security area independently, with weekly code review or system testing over the last 2 years Clear communicator of risk to non-technical colleagues Uses AI tools every day in security work Hacker mindset, with security as a passion as well as a job (bug bounties, CTFs, research, write-ups or personal tools) Perfectly fluent English Comfortable working with products built on uncensored models and NSFW content BENEFITS: Fully remote working from Europe Opportunity to own security for a fast-growing AI platform with over 50 million users Direct collaboration with engineering leadership Hands-on, non-advisory role with real responsibility for security outcomes And many more!!!