Senior IT Security Engineer

📋 Job Overview

We’re looking for a Senior IT Security Engineer to help build and mature security across our growing organization. This role sits at the intersection of IT, Security, and Engineering, helping design, implement, and continuously improve security controls across identity, endpoints, SaaS platforms, and cloud infrastructure.

🏢 About Codeway

Codeway builds category-leading consumer AI apps on mobile and web, at global scale. 600M+ downloads. 60+ apps. 400+ builders across Barcelona and İstanbul. Completely bootstrapped. No board. Profitable since year two. Small teams move faster than big ones. But they need big resources to win at scale. Nobody starts from zero. The problem decides the solution, not us. We turn category wins into six focused vertical companies: Wishlabs (AI Creativity), Wellture (Wellness), Learna (Education), Sparked (Media), Cosmic Jam (Entertainment), and Catalyst Apps (Utilities & Productivity). Each has full ownership and the depth to go further than anyone else in its space. Codeway HQ powers them all. One platform. One team that finds and grows builders. One set of guardrails. Every idea born here starts with an unfair advantage: the platform, the people, and the profits of every product before it. That's the system. Turns out you can do both. Move like an indie. Hit like a giant.

🎯 The Role

You’ll work closely with IT and Engineering teams to build security capabilities that support company growth while maintaining a practical, collaborative, and business-friendly security posture. This is a hands-on role with meaningful opportunities to shape security foundations, improve processes, and influence how security evolves across the organization. Several security capabilities are still early in their maturity and continuing to evolve. We are looking for someone who enjoys building and improving the programs, processes, controls, and automation that will form the foundation of our security function as the company scales.

✅ Key Responsibilities

• Partner with teams to strengthen security monitoring, detection, and response capabilities.
• Investigate security events, coordinate incident response activities, and continuously improve operational playbooks and response processes.
• Develop security metrics and reporting that provide visibility, support prioritization and risk management, and demonstrate the effectiveness of security controls.
• Strengthen security controls across identity, endpoint, and business-critical SaaS platforms.
• Improve identity and access controls, including governance, privileged access management, MFA, conditional access, and device trust.
• Establish endpoint security standards, monitoring capabilities, and remediation processes.
• Partner with stakeholders to evaluate security considerations for new applications, vendors, and integrations.
• Maintain and enhance security controls across cloud environments while promoting secure-by-default approaches.
• Build and operate a sustainable vulnerability management process across infrastructure, cloud, endpoint, and SaaS environments, including prioritization, remediation tracking, and reporting.
• Review cloud configurations, permissions, and security risks, partnering with teams on practical remediation strategies and secure-by-design approaches.
• Design and implement automation that improves security operations and reduces manual effort.
• Build integrations and workflows across security, identity, endpoint, and cloud platforms.
• Contribute to architecture reviews, security standards, and long-term security roadmaps.
• Support security governance, compliance, and audit readiness initiatives by helping implement, document, and maintain effective security controls and processes.
• Partner with teams across the organization to promote secure working practices and help foster a positive security culture.

📌 Required Qualifications

• Experience building, operating, or improving security controls in cloud-first environments, including identity, SaaS, endpoint, or public cloud platforms.
• Experience collaborating with IT, Engineering, and business stakeholders.
• Experience investigating security incidents and supporting remediation efforts.
• Strong understanding of identity, endpoint, and cloud security fundamentals.
• Experience automating workflows through scripting, APIs, or workflow platforms.
• Ability to balance security requirements with operational efficiency and a positive employee experience.

⭐ Desirable Experience

• Hands-on experience with identity, cloud, endpoint, or SaaS security platforms.
• Experience building or maturing security programs, processes, or operational capabilities.
• Experience with security tooling such as SIEM, CSPM, XDR, vulnerability management, or endpoint management platforms.
• Experience supporting compliance initiatives, modern identity architectures, AI platforms, or emerging technologies.
• Relevant certifications in cloud, endpoint, or security disciplines.

🎁 Benefits

Our environment includes Google Workspace, Okta, Jamf, AWS, and Google Cloud Platform (GCP). Experience with these platforms is beneficial but not required. We value strong security fundamentals, curiosity, and the ability to quickly learn new technologies and environments.

🛂 Visa & Eligibility

No specific visa or eligibility information provided.