Security Engineer (Product Security)

The product is a vulnerability management platform that scans networks and ranks fixes by real-world risk. Based in Lisbon, TLT Risk Partners also trains client staff and runs simulated phishing campaigns. Founded in 2013, we now have 100 employees.

TLT Risk Partners is hiring a Security Engineer (Product Security) to work remotely from Portugal. The Detection and Response team is small and hands-on. We need someone who writes code and automation, not just policy. Remote within Portugal. The team meets in Lisbon once a quarter, travel covered. Hours are flexible, with one short team call each morning.

In this role you will:

• Triage bug bounty reports from HackerOne or Bugcrowd
• Own secrets management, key rotation and KMS policies
• Design and maintain SSO, MFA and conditional access with Okta or Entra ID
• Write secure coding guidelines and run developer training
• Manage SAST, DAST and dependency scanning with tools such as Semgrep, Snyk, Burp Suite or GitHub Advanced Security
• Coordinate external penetration tests and track remediation
• Harden AWS, Azure or GCP accounts and fix misconfigurations found by Wiz, Prisma Cloud or Security Hub

Who you are:

• 3+ years in security engineering, application security or a related engineering role
• Strong knowledge of the OWASP Top 10 and common web vulnerabilities
• Programming or scripting ability in Python, Go or similar
• Good judgment on risk: knowing what to fix now and what can wait
• Hands-on cloud security experience in AWS, Azure or GCP

Perks and benefits:

• Private health insurance
• Training budget
• Remote work allowance
• Meal vouchers
• Flexible start and finish times
• Stock options

We review applications as they come in.

Candidates must be eligible to work in Portugal.

Start: Immediately.

Demo job created on 11jobs for testing and demonstrations. It is not an actual opening at TLT Risk Partners Lda..