Sr. Application Security Engineer

We're Lingokids, the #1 entertainment platform for young kids. Most kids content is designed to capture attention. We create experiences little ones genuinely love.

Everything we make is created in-house to be seriously fun, with the good stuff built in from the very beginning. We're KidSAFE certified, completely ad-free, and committed to giving families entertainment they can trust, with no compromise. Ever.

20 million kids come back to us every single month, and we’ve earned more than 50 awards along the way. Now we're going after something bigger: becoming the go-to entertainment destination for kids everywhere, and changing what content looks like for the generation growing up on it.

We're hiring a Senior Application Security Engineer to own the security of the Lingokids apps and the systems behind them. Millions of families trust us with their kids' time, and keeping that trust is part of the product. You'll work inside our engineering teams, making the secure path the easy path, not acting as a gate at the end.

• Own application security across our React Native app, Ruby backend services and APIs, and AWS infrastructure.

• Run threat modeling and design reviews with squads on new features and architecture changes.

• Build and maintain security tooling in CI/CD: SAST, dependency scanning, secrets detection, mobile app analysis.

• Strengthen our software supply chain: third-party SDKs, open-source dependencies, build pipeline integrity.

• Find, triage and fix vulnerabilities, hands-on in the code when needed.

• Run or coordinate penetration tests and turn findings into fixes.

• Work with Legal and Privacy so our apps meet kids privacy requirements (COPPA, GDPR) in practice, not just on paper.

• Raise the security baseline of the engineering team through guidelines, reviews and practical training.

• Take part in security incident response.

• 5+ years in security engineering, with a strong focus on application security in a product company.

• Hands-on mobile application security experience, ideally with React Native, and familiarity with OWASP MASVS / ASVS.

• Ability to read, review and write code;
  Ruby and/or JavaScript / Type Script preferred.

• Experience integrating security tooling into CI/CD pipelines.

• Solid understanding of web and API security, authentication and authorization.

• Judgment to prioritize real risk over theoretical findings, and the communication skills to get engineers on board.

Nice to have

• Native iOS and/or Android security experience.

• AWS security experience (IAM, network controls, security services).

• Experience with privacy regulation affecting kids products (COPPA, GDPR-K, KidSAFE).

• Software supply chain security (SBOM, dependency pinning, signed builds).

• Certifications such as OSCP, OSWE or GWAPT.

English is a must

We're a multicultural team building in English, so while certifications aren't necessary, fluency is. And since we're fully remote, clear communication matters as much in writing as in speaking, especially in the long-form, async formats that keep a distributed team working well together.

Career Growth: Your growth drives our success! We invest in your development up to €2,000 per year for books and training; so you can keep learning and growing with us.

Remote in Spain & Relocation-Friendly Work from wherever you’re most productive, whether that’s your home anywhere in Spain or our vibrant hub in Madrid
. Not currently in Spain? We’d love to have you here! We actively encourage relocation for those looking to make Spain their new home base.

Stock Options: Your contribution matters! You'll receive stock options
, giving you the opportunity to own part…