Senior Security Consultant, Application Security
IOActive Inc. · Valladolid, Spain ·
COMPENSATION
€75k – €175k
Listed on WeAreDevelopers
- Senior Security Consultant
- AppSec & Code Review
- Flexible remote/office
- Global cybersecurity firm
- 5+ years experience
As a Senior Consultant in the Application Security practice, you will lead manual source code reviews across complex production codebases. Your work spans web applications, mobile backends, APIs, and embedded systems, identifying both common and nuanced vulnerabilities.
Beyond code review, you will conduct application penetration testing, threat modeling, and SDLC advisory engagements. You will serve as the senior technical voice for clients, translating findings into actionable remediation guidance and helping engineering teams build long-term security resilience.
What you'll do
- Lead manual source code reviews on complex production codebases
- Identify vulnerability classes from injection to architectural weaknesses
- Author clear findings reports with remediation guidance and PoCs
- Conduct application penetration testing on web, API, and mobile targets
- Perform threat modeling using STRIDE or equivalent frameworks
- Advise clients on integrating security into their SDLC and CI/CD
- Mentor junior consultants in code review methodology and research
- Represent the company at conferences and in industry conversations
What you'll need
- 5+ years in offensive security services
- 2-3 years focused on application security and source code review
- Deep code review expertise in at least two major language stacks
- Strong written communication skills for actionable reporting
- Ability to present complex concepts to technical and general audiences
- Comfort moving between different languages and technology stacks
- Relevant bachelor’s degree or equivalent practical experience
- Industry certifications such as OSCP, OSWE, or CSSLP preferred
Nice to have
- Familiarity with OWASP ASVS, NIST SSDF, BSIMM, or SAMM
- Working competence in additional programming languages
- Experience with hardware hacking or red team operations
- Published research or conference speaking experience
Stack
- JavaScript
- TypeScript
- Python
- Java
- C#
- C/C++
- Rust
- Go
- Node.js
- Django
- Spring
- .NET
How you'll work
- Flexible work arrangement: remote or office based
- Opportunities for travel to client sites or events
- Global team with offices in Seattle, Madrid, and Cheltenham
What you get
- Competitive compensation and performance-based incentives
- Access to world-class technical teams and research labs
- Collaborative high-energy team environment
- Support for professional development and community involvement