Cloud & Application Security Engineer

• Sec & DevOps Mindset: A solid understanding of how security is built from the origin of the code, how CI/CD pipelines operate, how IaC is managed, and how to structure effective remediation.
• Practical experience in Public Cloud: Proficient handling of core services in IAM, networking, and logging (we work intensively with GCP; if your experience comes from AWS or Azure, we assume the transfer curve).
• Container and Kubernetes Fundamentals: Ability to understand the anatomy of a pod, node, or ingress, and fluency in inspecting and correcting manifests (we will not ask you to operate or administer the cluster alone).
• Solid foundation in Linux and Networking: Mastery of network protocols (TCP/IP, DNS), firewalls, VPNs, and perimeter segmentation.
• Technical prioritization criteria: CVSS is the floor, not the ceiling. We need you to be able to argue and prioritize with business common sense (why an Internet-exposed medium vulnerability takes precedence over a critical one in an isolated internal service).
• Ownership and influence without hierarchy: A large part of your recommendations will be implemented by other Engineering teams. You need skills to communicate the "why," document technical agreements, and drive closure constructively.

• Handling or reading Terraform modules.
• Experience configuring or fine-tuning tools in CI/CD pipelines.
• Familiarity with financial regulations and security frameworks (ISO 27001, MiCA, DORA).
• Automation and scripting via Python, Go, or Bash.
• Adoption of AI tools applied to the technical workflow (Claude Code, Cursor, Claude) to accelerate finding triage, scripting, and code review.
• Practical technical certifications in Cloud or Cybersecurity.
• Experience coordinating operations with external partners and SOC providers.
• Passion or curiosity for the crypto / blockchain ecosystem (a great plus, never an excluding filter).

Are you motivated to protect a crypto infrastructure operating under the MiCA standard, where every line of defense has a real impact on millions of transactions?

At Bit2Me, cybersecurity is not an audit passed once a year or a report that is filed away: it is the core of our product. As the first MiCA-licensed exchange and the leading crypto fintech in Europe, we operate with the highest technical and regulatory demands.

We are not looking for a PDF generator or a desk auditor. We are looking for a Cloud & Application Security Engineer who wants to get into the technical trenches, work shoulder to shoulder with Engineering and SRE, and solve the industry's most critical challenge: closing the gap between detecting a flaw and remediating it in production.

🌟 Your mission: From finding to remediation in code

Your daily focus will be to execute defensive and operational security hand-in-hand with the development and infrastructure teams: prioritizing by real impact and risk (not by theoretical numbers), executing the hardening of our environments, and transforming cybersecurity policies into automated controls as code (IaC and DevSecOps).

You will be part of the Information Security team (reporting to the Security Management), in constant communication with Cloud Security, AppSec, SRE, Software Engineering, and our specialized SOC and vulnerability management partners.

• Living management of the vulnerability lifecycle: You will perform triage by CVE, evaluating real contextual risk (base severity, active exploitability, Internet exposure, and existing compensatory controls), pushing each ticket until its verified closure in production.
• Governance and prioritization of the security backlog: You will maintain and organize the technical vulnerability board by asset, establishing realistic resolution cycles and systematically expanding our perimeter coverage.
• Hardening and Cloud infrastructure security: You will analyze and fine-tune security rules and alerts, audit project configurations, IAM policies, and cloud network segmentation.
• Security integrated into CI/CD (DevSecOps): You will implement and maintain DAST, SAST, SCA, and secret scanning controls in deployment pipelines, mitigating technical debt and validating the security of relevant architectural changes.
• Security as Code (IaC): You will collaborate with the SRE team on the terraformization of security controls so that infrastructure is deployed hardened by default (Security by Design & Default).

We believe in honest offers that represent real work:

• It is NOT a Pentesting or Red Team position: For intrusion exercises and offensive audits, we rely on specialized external partners and companies.
• We do NOT require previous experience in Blockchain or Web3: It is the industry where you will operate, but what we value from the start is your rigor in cloud and application security.
• You will NOT have direct communication with the regulator: The Compliance and Legal area handles that layer.
• We are NOT looking for a "unicorn" who is an absolute expert in Cloud, AppSec, and IaC all at once: We are looking for a solid technical base in security and infrastructure, combined with autonomy and a real desire to deepen knowledge in the other areas.