Security Champion

• We are looking for people with strong organizational skills and impeccable work methodology; in this team, everyone contributes.
• At Nunsys Group, camaraderie is essential. We support each other to overcome any challenge and achieve our goals as a team.
• Essential: knowledge and experience in Java development
• Experience in risk assessment and classification methodologies (ISO 27005, NIST RMF, OWASP Risk Rating).
• Knowledge of application architectures (microservices, APIs, cloud-native environments) and familiarity with frameworks such as SABSA or TOGAF.
•  Knowledge in writing security requirements, ideally under the OWASP ASVS standard.
• Knowledge of threat modeling methodologies such as STRIDE, PASTA, or DREAD, and tools like Microsoft Threat Modeling Tool, IriusRisk, or OWASP Threat Dragon.
• Ability to interpret results from SAST, DAST, and pentesting, with knowledge of the OWASP Top 10 and CWE/CVE.
• Security by Design mindset and knowledge of applicable regulations (GDPR, PCI-DSS, ISO 27001, depending on the sector).
• Hands-on experience with SAST/SCA tools (SonarQube, Checkmarx, Veracode, Fortify, Snyk, Black Duck, or similar).
• Proficiency in Jira or other ticket management tools, and knowledge of CI/CD pipelines with security gates (DevSecOps).

If you have experience in this role and want to be part of our team, we are on the right track! 

Of course! We positively value specific training in the field of cybersecurity, as well as experience in integrating cloud and hybrid security technologies.

We are looking for people who are passionate about the world of cybersecurity; you should be proactive, technologically curious, and eager to learn.

💼 Permanent contract in a leading company in the sector. 

💰 Competitive remuneration package in line with the knowledge and experience contributed.

🌴 Reduced working hours in July and August and every Friday of the year. 

📚 In our team we believe in people and their talent, which is why we bet on the training of our professionals.

💳 Possibility of joining the flexible compensation program: Childcare Voucher, Restaurant Card, Transport Card, and Health Insurance. 

🤑 Discounts at different establishments, on products (appliances, fashion, technology) and services (travel, car rental, health). 

💗 A diverse and, above all, inclusive environment where people come first. 

🎉 It's not all work, there's also time for fun! We have different events throughout the year, from our "Christmas Jumper Day" to our Halloween costume contest, we are always looking for ways to create a fun environment.  

📍 Additionally, you will enjoy: 

• Sports activities, family-oriented. We love paddle tennis, running, bringing the Three Kings to our employees' children at Christmas, and water parties in the summer. 
• Free coffee in all buildings of the office. 

And many more things we want you to discover! 

Do you want to join us and be part of the change? 

Are you passionate about technology? Do you want to develop yourself in a dynamic and constantly growing company? We are expanding our team! At Nunsys Group, we are looking for a Security Champion to join us in Barcelona.

Our journey began in 2007 and we have one goal: to be the leading Spanish technology company. We are passionate about digital transformation and we have a great portfolio of technology solutions. Thanks to this, we guarantee that we can face any challenge our clients present to us.

We currently have more than 2,600 professionals and a presence in 25 Spanish cities, as well as Portugal, the USA, Colombia, and Ecuador. And this is only the beginning!

Your mission will be to ensure that security is integrated transversally throughout the entire application lifecycle. The selected person will act as a cybersecurity reference point within the team, combining technical security knowledge with a vision close to development and software architecture.

And what does the project involve? The day-to-day work is very varied, but some of the main functions you will participate in are:

• Verify that all applications in the squad have their Risk Profile correctly assigned, according to the internal risk assessment methodology.
• Check that each application follows the architecture pattern defined in the corporate blueprints.
• Generate and maintain the Security Requirements for the squad's applications, reviewing them upon any functional change.
• Develop and update the Threat Modeling for the applications, adapting it to the evolution of functionality.
• Request and analyze the results of Security Tests to define and implement the appropriate mitigations.
• Analyze new functional requirements to apply the relevant security measures from the initial phases (Security by Design).
• Review the results from SAST and SCA tools, and manage the creation and tracking of tickets (Jira) to ensure vulnerabilities are resolved within established deadlines, in collaboration with the security gates defined for production deployment.