Lead Security Engineer, Smallpdf

• Bachelor's degree in Computer Science or equivalent practical experience
• Excellent communication and collaboration skills
• Technical knowledge of security engineering, computer and network security, authentication, and security protocols
• Experience in coordinating and validating penetration tests
• Familiarity with common vulnerabilities (OWASP, etc..)
• Experience working with cloud providers (we’re on AWS)
• Experience working with one of the popular L7 WAF solutions
• Experience coding/scripting in one or more general-purpose languages, including but not limited to Go, Python, JavaScript, Terraform, etc
• Fluent in English
• Zurich, Barcelona, or Belgrade

Desirable

• As Senior Security Engineer at Smallpdf, you will lead the efforts to ensure that our software and systems are designed and implemented to the highest security standards
• You will perform technical security assessments, code reviews, vulnerability testing, and advanced monitoring to highlight risks, helping Smallpdf improve security
• You will also work closely with other engineers to design and build processes and guidelines to enhance our security
• You will participate actively in ISO 27001 certification and PCI DSS 4.0 SAQ certification
• You coordinate cybersecurity risk assessment and routine penetration testing
• Partner with internal product teams to continuously improve the security of our product
• Conduct research to identify new attack vectors against Smallpdf products and services
• Develop technical solutions to help mitigate security vulnerabilities
• Promote and advise security and secure practices throughout Smallpdf
• Contribute to the certification and audit processes (ISO 27001, PCI DSS 4.0 SAQ, SOC-2)
• Foster a culture of security awareness within Smallpdf
• Collaborate with developers to integrate security best practices into the application development process (DevSecOps)
• Design, implement, and maintain security controls for our cloud-based applications using L7 security tools (e.g., Web Application Firewalls)
• Develop and document security policies and procedures