Head of Security (AI)

Location: Barcelona; Spain (Remote). Workplace type: Hybrid.

Company

hirify.global develops consumer subscription applications for iOS and Android with a GCP backend and LLM-powered features.

What you will do

• Own hirify.global’s end-to-end security program as the first dedicated security hire, reporting to the CTO and prioritizing work by risk.
• Build application security practices including threat modeling, secure development, code review, and protection against reverse engineering, API abuse, account takeover, and in-app purchase fraud.
• Harden GCP cloud infrastructure and CI/CD through infrastructure as code, least-privilege access, secrets management, logging, monitoring, and alerting.
• Establish company security controls including SSO, MFA, device management, access reviews, and employee and vendor onboarding and offboarding.
• Manage vulnerability discovery, penetration testing, bug bounty or disclosure programs, incident response, post-mortems, and user communications when needed.
• Develop AI security guardrails, data protection, privacy, governance, risk assessments, vendor risk management, and certification readiness for standards such as SOC 2 and ISO 27001.

Requirements

• Experience leading security at a fast-growing technology company as Head of Security, Security Lead, or in a similar role, ideally as the first or an early security hire.
• Deep hands-on application security experience with iOS and Android applications and backend APIs, including strong knowledge of OWASP MASVS and OWASP Top 10.
• Strong GCP security skills covering IAM, networking, secrets management, and infrastructure as code.
• Ability to read and review code and build security tools and automation, for example with Python or Go.
• Experience handling real security incidents from detection through post-mortem.
• Excellent analytical skills, pragmatic risk prioritization, strong judgment, autonomy, and ownership from day one.
• Good spoken and written English, with the ability to explain security risks to technical and non-technical colleagues and collaborate with engineering, product, and IT.
• Daily use of AI tools and understanding of their security risks.

Nice to have

• Mobile reverse engineering and anti-tampering experience with tools such as Frida, Jadx, Ghidra, or app hardening tools.
• Experience fighting fraud in subscription applications, including receipt validation, App Attest, Play Integrity, and bot protection.
• Experience securing LLM-powered features, AI agents, and third-party AI APIs, including OWASP Top 10 for LLMs and red-teaming.
• Experience securing applications that handle sensitive financial or document data.
• Experience leading SOC 2 or ISO 27001 certification, or knowledge of GDPR, HIPAA, NIS2, and the AI Act.
• OSCP, OSWE, GMOB, or CISSP certification.
• Track record in bug bounties, CVEs, open-source security tools, or conference talks.

Culture & Benefits

• Hybrid work arrangement in Barcelona, with remote work available from Spain.
• Close collaboration with engineering, product, IT, founders, and the CTO.
• Opportunity to build the security function and team from an early stage.

Hiring process

• Answer the first-90-days question, including the first areas to assess and the top three expected risks across the mobile applications, GCP backend, and LLM-powered features.
• Explain how AI tools are used in personal work, identify one company-level AI risk, and describe a mitigation that does not ban AI tools.
• List two or three sources used to stay current on mobile, cloud, or AI security and describe one useful recent takeaway from one source.