IT & Security Specialist

• Experience leading IT and/or security solo, in a startup or mid-size company.
• Network infrastructure management: routers, access points, diagnostics.
• Implementation and administration of MDM tools.
• Access and identity management: SSO, MFA, password managers (such as Bitwarden).
• Solid information security concepts: hardening, vulnerability management.
• Familiarity with certification frameworks like ISO 27001. You don't need to be an auditor, but you do need to know what they require and how to gather it.
• Real autonomy: you know when to decide and when to escalate, without having a technical superior telling you to do so.

Bonus points if you also have experience negotiating with providers and optimizing the cost of licenses and tools, or have been close to an ISO 27001 certification process (or similar), even if you haven't led it solo.

Culture

This position reports directly to our Operations Manager, within the People Ops department. You will work side-by-side with Operations and with the external consultancy handling the ISO 27001 certification.

You will be the company's only IT and Security line. You will not have a technical team below you, so your judgment is TRIBBU's judgment.

At TRIBBU, there is no bureaucracy or heavy hierarchies: decisions are made close to the problem and every person builds with real autonomy.

We eliminate the take-home technical test and replace it with agile conversations where what matters is how you think, not how you memorize.

 Perks

• Salary: 32.000€ - 38.000€ + Phantom Shares (we want you to own what you build).
• Real ownership: total autonomy to propose improvements and participate in the technical strategy.
• Healthy body: personal training sessions in the office gym 3 days a week. No excuses!
• Nutritionist: we look after what you eat so that your energy is always at 100%.
• Flexible compensation: save on your dining and public transport expenses.
• Free trips: move with TRIBBU and experience the product you build from the inside.
• Flexibility: flexible schedule and a culture of trust based on results.

The Challenge

At TRIBBU, we do not have an IT team. Everything is to be built: the challenge is to find the person who decides how we protect data, how the team works every day, and what happens when something breaks.

We need someone who takes that responsibility with the same seriousness they would carry their own company. This is not a vacancy we have invented: it is a position that does not exist here, to create processes, and with an ISO 27001 audit underway that will not wait.
We are looking for someone who can step in, understand the terrain quickly, and continue building from where it was left off. Because at TRIBBU, there is no technical layer between this person and decisions: what they decide regarding access, devices, network, or security is applied directly.

Growing fast without access control, without equipment inventory, and without a well-implemented certification is not growing, it is accumulating risk.

 Role

This person builds, literally, the security standard for the entire company. In a company that has multiplied its users by 30 in months, ensuring that every access, every device, and every security process scales without breaking is what allows TRIBBU to continue growing without accumulating risk.

 Profile

• Manage devices and access: know what equipment each person has, who can enter where, and be able to revoke access or block a device in minutes if someone loses it or leaves the company.
• Periodically audit permissions so that no one has more access than they need.
• Decide which MDM to use: compare providers, negotiate terms, and maintain an optimized stack, without duplicate tools or licenses gathering dust.
• Ensure the office network can handle the actual volume of people and traffic.
• Be the internal point of contact with our external support for ISO 27001: translate what the certification requires into concrete things that must be done, and ensure they are actually done.
• Provide technical support with judgment: resolve issues quickly and know how to distinguish between what is decided alone, what is decided with Operations or Privalex, and what is never decided without escalating, such as any active vulnerability with user data at risk.

• Location: Madrid. We come to the office Monday to Friday, but with flexibility and freedom.