DevSecOps

Join a newly created engineering team as its first DevSecOps engineer and build the delivery platform from the ground up, with security designed in from the start. This is a greenfield role: you set the foundations, you own them, and you decide how they are built. A new software engineering team backed by a well-established international group, as its second engineering hub, AI-first from day one. The team builds and operates internal products that automate business processes, with real users from day one, and plans to grow its product portfolio over the coming years. You would join at the very beginning and help shape how the team works.

• Infrastructure as code, from zero. Hosts, networking, ingress, access and environments — versioned, parameterised and reviewable, with every environment reproducible from a repo from your first week.
• CI/CD and the release path. Commit to production with an automated test gate, per-branch preview URLs and a rehearsed one-click rollback.
• Self-service deployment. A golden path down to one command, so no developer ever holds a platform credential.
• Security in the pipeline. SAST, DAST, dependency and container-image scanning, secret detection and IaC checks as merge gates, with all findings triaged and closed in one place. The goal is findings that actually get fixed, not more dashboards.
• Secrets and machine identity — including for AI agents. A proper secrets manager and a secure credential model for both people and automated processes.
• Backups with a proven restore. Regular, documented recovery testing.
• Observability and cost control. Monitoring, dependency hygiene, per-project budgets and hard cost caps for AI agents.
• Documentation. Everything reproducible and written down as you go — nothing lives only in one person's head.

• you have built infrastructure from nothing before, and it survived other people using it. Maintaining a platform you inherited is not enough — you must have created one.
• Infrastructure as code as your default way of working (e.g. Terraform, OpenTofu, Pulumi, Ansible), including handling drift between reality and the repo.
• Hands-on ownership of backups, and real restores done under pressure.
• Comfort running self-hosted / own servers (bare metal, VMs), not only managed cloud consoles.
• Container orchestration in production (e.g. Kubernetes), and the judgement to know when it is not the right answer (no Kubernetes today, by design).
• Security built into a delivery pipeline as gates, not reports: SAST/DAST, dependencies, images, secrets. Tools such as Trivy, Semgrep, SonarQube, ZAP, DefectDojo, Vault or equivalents.
• Solid fundamentals: secrets management, access control, least privilege, patching.
• Proven self-service platform work that other teams actually adopted (golden paths, internal platform, scaffolding).
• Fluent English.
• Willingness to work on-site in Barcelona.
• Будет плюсом: Real experience building with AI coding agents (prompt-injection risks, supply-chain hygiene, agent credentials). Curiosity is enough — they will train you; Spanish (useful day to day). Catalan is not required

• Healthy work-life balance. No on-call rota. Your job is to engineer systems that recover reliably, and during working hours you share ownership of your products with the developers and product owners.
• Real authority. You are not implementing someone else's design. On infrastructure, you make the calls.
• Pragmatic engineering culture. Simple, maintainable solutions over complexity for its own sake.
• AI-first team. Engineers work daily with AI coding tools, and you will help design the infrastructure and security around them.
• Structured growth. A defined learning path over your first years, with recognition of the expertise you build.
• On-site in Barcelona, with flexibility to work remotely for short periods when needed.
• Private healthcare from day one.
• Holidays in line with Spanish regulations, plus public holidays.
• Salary: competitive, to be discussed in the first conversation.