About Lingokids
We're Lingokids, the #1 entertainment platform for young kids. Most kids content is designed to capture attention. We create experiences little ones genuinely love. Everything we make is created in-house to be seriously fun, with the good stuff built in from the very beginning. We're KidSAFE certified, completely ad-free, and committed to giving families entertainment they can trust, with no compromise. Ever.
Responsibilities
•Own application security across our React Native app, Ruby backend services and APIs, and AWS infrastructure.
•Run threat modeling and design reviews with squads on new features and architecture changes.
•Build and maintain security tooling in CI/CD: SAST, dependency scanning, secrets detection, mobile app analysis.
•Strengthen our software supply chain: third-party SDKs, open-source dependencies, build pipeline integrity.
•Find, triage and fix vulnerabilities, hands-on in the code when needed.
•Run or coordinate penetration tests and turn findings into fixes.
•Work with Legal and Privacy so our apps meet kids privacy requirements (COPPA, GDPR) in practice, not just on paper.
•Raise the security baseline of the engineering team through guidelines, reviews and practical training.
•Take part in security incident response.
Requirements
•5+ years in security engineering, with a strong focus on application security in a product company.
•Hands-on mobile application security experience, ideally with React Native, and familiarity with OWASP MASVS / ASVS.
•Ability to read, review and write code; Ruby and/or JavaScript / TypeScript preferred.
•Experience integrating security tooling into CI/CD pipelines.
•Solid understanding of web and API security, authentication and authorization.
•Judgment to prioritize real risk over theoretical findings, and the communication skills to get engineers on board.
•English is a must. We're a multicultural team building in English, so while certifications aren't necessary, fluency is. And since we're fully remote, clear communication matters as much in writing as in speaking, especially in the long-form, async formats that keep a distributed team working well together.
Nice to have
•Native iOS and/or Android security experience.
•AWS security experience (IAM, network controls, security services).
•Experience with privacy regulation affecting kids products (COPPA, GDPR-K, KidSAFE).
•Software supply chain security (SBOM, dependency pinning, signed builds).
•Certifications such as OSCP, OSWE or GWAPT.
Conditions
•Your growth drives our success! We invest in your development up to €2,000 per year for books and training, so you can keep learning and growing with us.
•Work from wherever you're most productive, whether that's your home anywhere in Spain or our vibrant hub in Madrid. Not currently in Spain? We'd love to have you here! We actively encourage relocation for those looking to make Spain their new home base.
•Your contribution matters! You'll receive stock options, giving you the opportunity to own part of the company and share in its success.
•Create your ideal workspace with a €400 allowance for setup and €35/month for remote work expenses.
•Get €60/month on your Cobee card to enjoy meals at restaurants or food delivery.
•Manage your meal, transport and childcare expenses easily with Cobee, integrating them directly into your payroll.
•Access private health coverage at exclusive rates through Adeslas, seamlessly deducted from your payroll.
•Enjoy free language classes in Spanish and English.
•If you need a visa to work in the EU, we'll handle the process and cover the costs to make your transition seamless.
•We're a fully remote team spread across different countries, but we love getting together from time to time in different corners of Spain, for team gatherings and off-sites.
