Part 2Senior DevSecOps EngineerBuild a company's entire delivery platform from the first commit, with security in it from that same commit, own it outright, and never carry a pager. Both halves of that sentence are deliberate.
Barcelonaon siteOpen1 seatWhat you own01 Infrastructure-as-code, from zero02 CI/CD and the release path03 Security in the pipeline, and secrets — including for agents04 Observability, backup and a tested restoreOne method, many productsThis is a senior role, and not one we can hire junior into— you are the first, for a while the only, and the platform everyone else builds on is the one you put in place.
Mainloop is anengineering company in Barcelona. We own what we build and we answer to ourselves. You get the interesting part of a new company, with a real customer and real products from day one.
What we build is the software that automates professional‑services work — across roughly fifteen countries, for businesses drowning in process. We build those productsand we run them. That second half is why this role exists, and it is not a formality: a team that owns how its software is built should own how it ships.
You are the person who ends that.
You are our first DevSecOps engineer, and for a while our only one.
What the job actually isYou are not inheriting a platform. You are writing one.
There is no infrastructure-as-code in our estate today — not a line. Your first job is to make that permanently untrue:every environment we run reproducible from a committed repo, from your first week, before the habit sets.
In Your First Few Months You WillBuild the platform from code. Hosts, networking, ingress, access, environments — committed, parameterised, reviewable. It is the cheapest moment this will ever be done, and you get to do it properly instead of retrofitting it.
Make deployment self‑serve. Today,



shipping an existing app is a git push; standing up a new one needs admin rights and two undocumented footguns. That gap is yours to close: a golden path, down to one command, so a developer never holds a platform credential.
Own secrets properly. A real machine secrets manager, and — because we run a lot of AI agents — credentials brokered so an agent process only ever holds a placeholder, never a key. If you have opinions about how you stop a prompt‑injected agent leaking a production credential, you will enjoy this part; almost nobody gets to design it from scratch.
Put security into the pipeline, not after it. Static analysis, dependency and container‑image scanning, secret detection and infrastructure‑as‑code checks as gates on every merge; dynamic scans against the preview environments; and every finding landing in one place where it is triaged, owned and closed — not spread across a dozen dashboards nobody opens. The measure is not how many scanners run. It is how few findings are still open a month later, and how rarely anyone feels the need to route around a gate.
Prove the restore. We have a written standard that says "someone deploys it" is not "someone has proven the restore works." You will run the drill and write the report.
Build the release path. Commit to production, an automated test gate, per‑branch preview URLs a stakeholder can open from their phone,



and a rollback that everyone on the team has rehearsed before they need it.
Then keep it all running — and keep making it duller. Observability, cost caps, dependency hygiene, the unglamorous work that decides whether a small team can own a lot of products.
And you will have the authority to match.
You are not implementing someone else's platform design. How this is built is yours to decide.
We are hiring at senior level precisely so that those decisions can be yours— the platform every product here runs on is the one you put in place, and we would rather bring in the judgement than supervise it.
Nobody is on call. Ever.
No rota, no pager, no phone number, no "just keep an eye on it this weekend".
Alerts post to a team channel and wait there. This is a decision on the record, not an oversight we will rediscover later — and it applies to every product we own, with no exceptions.
We are telling you this up front because it is not a perk we are quietly hoping you will waive.
Plenty of ads say "healthy on‑call culture" and mean a rota. We mean there is no rota.
Here is the honest other half, and it is the presente job:we can only make that promise because we protect ourselves with engineering instead of with people's evenings — andthat engineering is what we are hiring you to build.
Infrastructure as code, so a lost machine is rebuilt rather than resurrected. Backups with a restore we have actually tested. A rollback that is one click and that everyone has already practised. Alerting that queues instead of paging, because nothing on the other end of it is expected to answer at night.
So the trade is explicit:you are never woken up, and in exchange the systems have to be genuinely recoverable. If you have spent a career being paged for things that sh

📌 Senior Devsecops Engineer (Madrid)
🏢 Mainloop AI
📍 Madrid