Application Security Engineer

Contentsquare is the all-in-one experience intelligence platform designed to be easily used by anyone who cares about digital journeys. With our flexible and scalable platform, organizations quickly get a deep understanding of their customers’ whole online journey.

We are a global leader in the experience analytics space, with a growing presence across 15 offices worldwide. We’re here to stay—and we’re looking for team members who are excited to drive impact and help us scale even further.

Our aim is to create an inclusive workplace where everyone learns and succeeds. Contentsquare has built a community of individuals who are daring, understanding, and deliberate. We invite you to join us in making the complex simpler—for our customers, their customers, and each other.

Important note:

Be careful of scammers pretending to be from Contentsquare. We will never ask for money or contact you through random texts. Any communication from our in house Talent Acquisition team will only ever come from our  or  domain. For more information, visit our careers blog.

The Contentsquare Security team is looking for an application security engineer (Appsec) who can work closely with the development team, product managers and diverse third-party groups (including bug bounty hunters).

Contentsquare provides a globally leading SaaS service and commits to the highest security standards for its customers. We are ISO 27001 and ISO 27701 certified and maintain robust security initiatives (SOC 2 Type 2 report, private bug bounty program, SIEM, advanced security awareness, etc.). Working alongside other cybersecurity experts, your mission will be to ensure the security of Contentsquare’s products and for keeping Contentsquare’s users and customers safe.

You will work out of our Barcelona office.

• Conduct continuous, automated security audits of our global SaaS applications to identify misconfigurations and ensure strict adherence to industry-standard security benchmarks and internal best practices.
• Serve as a strategic security consultant to product and engineering teams, facilitating complex threat modeling sessions and App Sec reviews during the design phase to proactively mitigate risks.
• Perform deep-dive, security-focused code reviews and mentor developers on secure coding patterns to minimize the introduction of high-impact vulnerabilities.
• Architect and manage the end-to-end vulnerability lifecycle, developing sophisticated automation for the triage, reporting, and remediation tracking of security flaws across cloud infrastructure and application layers.
• Orchestrate and optimize AI-driven security workflows, leveraging LLMs and autonomous agents to conduct scaleable, proactive vulnerability discovery and validation within our CI/CD pipelines.
• Lead "Shift-Left" initiatives by integrating security checkpoints into the automation stack, developing custom security-as-code tools that empower developers to own security outcomes.
• Oversee the strategic direction of our private and public bug-bounty programs, ensuring high-quality engagement with the researcher community and rapid internal response to critical findings.
• Coordinate specialized external penetration testing engagements and customer-driven security assessments, acting as the primary technical point of contact for complex security inquiries.
• Drive the technical response to application-level security incidents, conducting root‑cause analysis to prevent recurrence and enhance our defensive posture.

• 3+ years of professional experience in Application Security Operations within a high-growth SaaS or cloud-native environment.
• Advanced proficiency in securing modern technical stacks, with specific expertise in NestJS, Vue.js, and Angular…