Application security engineer in kids entertainment

We're Lingokids, the #1 entertainment platform for young kids. Most kids content is designed to capture attention. We create experiences little ones genuinely love. Everything we make is created in-house to be seriously fun, with the good stuff built in from the very beginning. We're KidSAFE certified, completely ad-free, and committed to giving families entertainment they can trust, with no compromise. Ever.

• Own application security across our React Native app, Ruby backend services and APIs, and AWS infrastructure.
• Run threat modeling and design reviews with squads on new features and architecture changes.
• Build and maintain security tooling in CI/CD: SAST, dependency scanning, secrets detection, mobile app analysis.
• Strengthen our software supply chain: third-party SDKs, open-source dependencies, build pipeline integrity.
• Find, triage and fix vulnerabilities, hands-on in the code when needed.
• Run or coordinate penetration tests and turn findings into fixes.
• Work with Legal and Privacy so our apps meet kids privacy requirements (COPPA, GDPR) in practice, not just on paper.
• Raise the security baseline of the engineering team through guidelines, reviews and practical training.
• Take part in security incident response.

• 5+ years in security engineering, with a strong focus on application security in a product company.
• Hands-on mobile application security experience, ideally with React Native, and familiarity with OWASP MASVS / ASVS.
• Ability to read, review and write code; Ruby and/or JavaScript / TypeScript preferred.
• Experience integrating security tooling into CI/CD pipelines.
• Solid understanding of web and API security, authentication and authorization.
• Judgment to prioritize real risk over theoretical findings, and the communication skills to get engineers on board.
• English is a must
• We're a multicultural team building in English, so while certifications aren't necessary, fluency is.
• And since we're fully remote, clear communication matters as much in writing as in speaking, especially in the long-form, async formats that keep a distributed team working well together.
• Будет плюсом: Native iOS and/or Android security experience; AWS security experience (IAM, network controls, security services); Experience with privacy regulation affecting kids products (COPPA, GDPR-K, KidSAFE); Software supply chain security (SBOM, dependency pinning, signed builds); Certifications such as OSCP, OSWE or GWAPT

• Your growth drives our success! We invest in your development up to €2,000 per year for books and training; so you can keep learning and growing with us.
• Work from wherever you’re most productive, whether that’s your home anywhere in Spain or our vibrant hub in Madrid .
• Not currently in Spain? We’d love to have you here! We actively encourage relocation for those looking to make Spain their new home base.
• Your contribution matters! You'll receive stock options , giving you the opportunity to own part of the company and share in its success.
• Create your ideal workspace with a €400 allowance for setup and €35/month for remote work expenses, because comfort fuels creativity!
• Get €60/month on your Cobee card to enjoy meals at restaurants or food delivery, good food makes everything better!
• Manage your meal, transport and childcare expenses easily with Cobee , integrating them directly into your payroll.
• Access private health coverage at exclusive rates through Adeslas, seamlessly deducted from your payroll, quality care made simple.
• Enjoy free language classes in Spanish and English, to sharpen your skills and stay connected in a global team.
• If you need a visa to work in the EU , we’ll handle the process and cover the costs to make your transition seamless.
• We’re a fully remote team spread across different countries, but we love getting together from time to time in different corners of Spain, for team gatherings and recharging at our amazing off-sites!