It drives everything we do – from research to client work to community involvement. And it unifies our global team into an elite force with integrity, fierce passion, and relentless creativity that doesn’t just "push the envelope" or "think outside the box." IOActive, a trusted partner for General 1000 enterprises, provides research-fueled security services across all industries. Our cutting‑edge cybersecurity teams provide highly specialized technical and programmatic services including full‑stack penetration testing, program efficacy assessments, and hardware hacking. IOActive brings a unique attacker’s perspective to every engagement to maximize cybersecurity investments and improve the security posture and operational resiliency of our clients. Founded in 1998, IOActive is headquartered in Seattle with global operations, including state‑of‑the‑art hardware hacking labs in Seattle, WA, Madrid, Spain and Cheltenham, UK.
The Senior Consultant, Application Security is a senior technical practitioner in IOActive’s Application Security practice, with secure code review as the central specialty.[AM1] [AM2] The role centers on deep manual code audit work across web and systems languages, paired with application penetration testing, threat modeling, and Secure Development Lifecycle (SDLC) advisory engagements.
Code review engagements at IOActive span the full landscape: source code reviews on production codebases for enterprise web applications, mobile backends, embedded systems, and cryptographic implementations; application penetration testing against web, API, and mobile targets; and SDLC advisory work helping clients integrate security into their development processes. The Senior Consultant brings particular depth in code review and broad competence across the adjacent work.
Lead manual source code reviews on complex production codebases spanning web applications, mobile backends, APIs, and embedded systems
Author findings reports that developers can act on: clear remediation guidance,



working proof‑of‑concepts where appropriate, and architectural recommendations beyond the immediate fix
Lead client developer workshops to explain findings and patterns, helping teams build security resilience rather than just fixing the listed issues
Engagement Delivery — Adjacent Application Security Work
Application penetration testing across web, API, and mobile targets, particularly where engagements span code review and dynamic testing
SDLC advisory engagements: helping clients integrate code review, threat modeling, and security testing into their development lifecycle (CI/CD, pull‑request workflows, developer training)
Serve as the senior technical voice in engagement status meetings, client workshops, technical deep‑dives, and developer training sessions
Build trusted technical relationships with client engineering leadership, AppSec teams, and security architects
Translate technical findings for two distinct audiences: developers who need to fix the issue, and security leadership who need to understand the business risk and pattern
Mentor junior and mid‑level consultants in code review methodology, vulnerability research, and client engagement — even without direct reporting authority
Collaborate with adjacent practices (Red Team, Hardware/Silicon, Advisory) on composite engagements
Contribute to IOActive’s application security research — vulnerability discovery, novel attack techniques, framework‑oriented findings
Build personal profile in the application security community: conference talks (Black Hat, DEF CON, OWASP Global, BSides,



regional AppSec events), published research, working group participation
Represent IOActive in AppSec industry conversations, OSS security efforts, and customer advisory engagements as opportunities arise
5+ years in offensive security services, with at least 2–3 years focused on application security and source code review
~ Hands‑on engagement delivery across multiple AppSec disciplines — code review, application penetration testing, threat modeling, or SDLC consulting
~ Deep code review expertise in at least two of: JavaScript / TypeScript (Node.js, modern frontends), Python (Django, Flask, FastAPI), Java (Spring, J2EE), C# / .NET (ASP.NET, Core), C / C++, Rust, GoLang. Working knowledge of common framework patterns, ORM behavior, authentication and authorization libraries, cryptographic libraries, and the security pitfalls particular to each
~ Strong technical credibility and the comfort to operate as the senior voice on engagements
to a general audience
Relevant bachelor's degree or equivalent experience
OSCP, OSWE, GWAPT, CSSLP, GWEB, or equivalent application‑security focused credentials
A chance to work with an industry leader in cyber security
Flexibility—work remotely or from the office as needed
Competitive compensation and performance‑based incentives
We're one of "the good guys" doing crazy cool stuff to thwart bad guys in a critically important business, social and political arena. We prohibit discrimination and harassment of any kind based on race, color, sex, religion, sexual orientation, national origin, disability, genetic information, pregnancy, or any other protected characteristic as outlined by federal, state, or local laws.
This policy applies to all employment practices within our organization, including hiring, recruiting, promotion, termination, layoff, recall, leave of absence, compensation, benefits, training, and apprenticeship.

📌 Senior Security Consultant, Application Security (España)
🏢 IOActive
📍 España