Security Engineer

Have you been dreaming of a job where you can protect one of the best products available on the worldwide aviation market?

As a Security Specialist, you will join a small central security team responsible for end-to-end security and data protection at Smart4Aviation. A small team means impactful work: you will work directly with IT administration, infrastructure (including the AWS cloud, which we consider our native ecosystem), software development product teams and security governance, and you will have direct access to the CIO. It also means that creativity, taking ownership from day one and willingness to understand security in a broader context are valued here. This is primarily an engineering role, not a compliance administration or tool operator role.

Key Requirements ( Skills & Experience)

• 3–5 years of hands‑on experience in an engineering role with a substantial security component (e.g. Security Engineer, SecOps or DevSecOps, an infrastructure engineer who owned security, or a software developer who moved into security).
• University degree in Computer Science, Information Technology, Cybersecurity, Mathematics, or a closely related field.
• Practical experience with AWS, including IAM, CloudTrail, CloudWatch and network security (VPC, Security Groups), as well as a broad understanding of the AWS services that underpin modern enterprise‑grade applications.
• Solid Linux and networking fundamentals, and Bash scripting skills.
• Working understanding of the modern SDLC, including Git, CI/CD, and building custom automations, including with AI tools (e.g. Claude Code) for routine tasks.
• Experience in vulnerability management, including practical understanding of the OWASP Top 10 and sufficient technical knowledge to analyse exploitability (e.g. PoCs) in the context of a specific environment.
• Ability to work with ambiguous problems, across multiple domains and parts of the organisation.
• Independent judgement combined with an understanding of the bigger picture and business context (or openness to building it)
• Ability to raise concerns constructively and stand by well‑reasoned recommendations.
• Readiness to handle recurring operational work, such as periodic reviews and documentation.
• Ability to adapt quickly to unfamiliar areas, including our tech stack.
• Fluent Polish for daily communication and very good command of English, both spoken and written, for correspondence with customers, auditors and vendors.
• Familiarity with security industry best practices, including a broad understanding of security controls, how they relate to each other and which risks they mitigate, within a recognised framework (e.g. ISO 27001, PCI DSS, NIST CSF, NIST 800‑171, OWASP SAMM, BSIMM).
• Familiarity with build and dependency management tools for the JVM/Java ecosystem.
• DevOps skills, including familiarity with Terraform and Ansible.
• Relevant certifications such as OSCP, eJPT, AWS certifications (including AWS Certified Security – Specialty) or CISSP.
• Experience in CSIRT, incident response or cyber forensics, especially in AWS and Linux environments.

Core Responsibilities

• Security controls - designing, implementing, deploying and maintaining all types of security controls, as a part of company's security risk mitigation effort across domains, and making us compliant with industry best practices. Also the technical part of company's ISO 27001 compliance program, with the control reviews, documentation and tracking that go with it.
• Vulnerability management - scanning, triaging findings by real exploitability in our context, driving fixes and temporary mitigations, vulnerability reporting, designing and implementing the processes and automations behind it.
• Threat hunting and detection in AWS - designing, building and running log aggregation, threat detection and alerting across various cloud components, authoring, tuning and maintaining detection rules.
• Identity and access management - reviewing and hardening access to production and infrastructure, managing privileged access, running the daily IAM process.
• Metrics - building and running the measurements to show progress in numbers.
• Incident response - a seat in company's security incident response team, investigating suspected events, contributing to post‑incident reviews.

I hereby give consent for my personal data included in my application to be processed for the purposes of the recruitment process.

If you would like us to contact you in terms of some future career opportunities, please attach also the following clause: "I hereby give consent for my personal data included in my application to be processed for the purposes of the future recruitment processes if relevant vacancies would be available, and kept for the aforementioned purpose