Security Lead (Application and Infrastructure Security), Long-Term Partnership Opportunity

Quick note: Before sending in your application, please make sure to read all the instructions in our "How to Apply" section. Any applications with missing items from our instructions will not be entertained.

About MSTR

MSTR is an AI software company based in the Netherlands and an Anthropic partner. We build custom AI software for Dutch businesses, run programs that bring AI into daily use, and ship our own products.

We are 20+ people, with a customer-facing team in the Netherlands and a remote development team in the Philippines. Our clients include municipalities, accountants, law firms and enterprise companies.

Why this role exists

Security work is currently shared by our infra and DevOps teams, alongside their main jobs. We want one person to own it end to end, set the standard, and be able to block a release.

This is a long-term career opportunity

We are looking for someone who wants to build a long-term career with us, not find their next gig. You start as our security lead and build this into a small department over time.

Location and type

• Remote
• Full-time, 40 hours per week, 3:00 p.m - 12:00 a.m Philippine time (overlapping with Netherlands business hours)
• Long-term contractor position

What you will do

• Dependency and supply-chain hygiene across all repos: Dependabot or Renovate, npm/pip/NuGet audits, SBOMs, a fixed patch cadence, and triaging what is actually exploitable
• Pentesting our own products and the custom builds for clients, before release and on a recurring schedule
• Security checks in CI: SAST, secrets scanning, container and IaC scanning, and DAST against staging
• Cloud and platform posture on Azure and Supabase: identity and access, row-level security (RLS), network exposure, key management
• AI-specific risks: prompt injection, MCP and tool permissions, data leaking through LLM calls, and which model providers may see client data
• Own i ---------- response and a vulnerability disclosure process
• Support enterprise security questionnaires and compliance (GDPR, NIS2, ISO 27001 readiness)
• Build security into a small department over time and set the rules the developers follow

How we split the work

DevOps runs the platform. Security sets policy, finds issues, checks the fixes, and has veto on releases.

What we are looking for

Must-have:

• At least 4 years in application security or pentesting, with real findings you can walk us through
• Strong grip on the OWASP Top 10 and the OWASP LLM Top 10
• Hands-on with Burp Suite or similar
• Can read and fix code in our stacks: TypeScript/React/Next, Python, .NET, Postgres
• Azure security experience
• Supabase experience
• You write clear findings that a developer can act on and a client can read
• You take ownership without being chased. This is a lead role, not an assistant role.
• Excellent English communication, written and verbal

Nice-to-have:

• OSCP, OSWE, BSCP or an Azure security certification
• A bug bounty track record
• Has gone through ISO 27001 or SOC 2 with a company
• Has used Claude Code for security review

AI tools are welcome. We are an AI company. If you use Claude, Claude Code or similar tools for code review or security work, tell us how. We would rather hire someone who uses AI well than someone who avoids it.

What we offer

• Long-term partnership: we are investing in your future with us
• Build something from scratch: you set up the security function, with direct access to the leadership team
• Real authority: you have veto on releases
• Interesting problems: application, infrastructure and AI security in one role
• A clear growth path: build and lead a small security department
• Continuous learning: work at an Anthropic partner, with Claude as part of your daily work
• Flexible remote work
• A team that moves fast and takes quality seriously

Our stack

• Cloud and platform: Azure, Supabase
• Languages and frameworks: TypeScript, React, Next.js, Python, .NET
• Database: Postgres

How to apply

IMPORTANT: We assess candidates primarily through video responses. Please do not apply without submitting a video.

Step 1: Create a short video (3 to 7 minutes)

Record yourself answering these 5 questions:

1. Tell us about yourself: Briefly introduce yourself and how you got into application security.
2. A finding you are proud of: Walk us through a real vulnerability you found. How did you find it, what was the impact, and how did you get it fixed? Leave out anything confidential.
3. Stopping a release: Tell us about a time you had to say "this can't go live yet". How did you explain it, and how did you get the team on your side?
4. Securing AI: An AI assistant at a client can read their documents and use tools through MCP. What are the main risks, including which model providers may see client data, and what would you check first?
5. Your next role: What would you like to achieve in your next role? Where do you see yourself in 5 to 10 years?

Video guidelines:

• Length: 3 to 7 minutes in total
• Production: no need for professional quality, we want to see the real you
• Authenticity: it's fine to use AI to prepare, but talk to us in your own words. Please don't read from a script.
• Language: English (this assesses your communication skills)
• Format: any video format is fine (MP4, MOV, etc.)
• Hosting: upload to Google Drive, Dropbox, YouTube (unlisted) or similar

Step 2: Submit your application

Send the following to ---------- and ----------

1. Your video (link or attachment)
2. Your CV / resume
3. Optional: certifications, bug bounty profile, GitHub, LinkedIn, or an anonymized finding report you wrote

Email subject: "Security Lead Application - [Your Name]"

What happens next

1. We review your video and CV within 2 to 3 days
2. If you are a strong match, we schedule an initial interview
3. Successful candidates move to a technical evaluation
4. Final candidates meet with our founder
5. We aim to complete the entire process in 1 to 2 weeks

Who should apply

Apply if you:

• Want a long-term career in a high-performance organization
• Like setting up structure where there is none yet
• Take ownership without being chased
• Are curious about AI and the new security risks it brings

Don't apply if you:

• Only want short-term gigs or are juggling multiple clients
• Aren't willing to create a video response
• Don't have hands-on application security or pentesting experience

Ready to apply? Send your video and CV to ---------- and ---------- are happy to answer any questions.

We look forward to learning more about you.