Cyber Security Staff Engineer (Application Security)

Join our team as a Cyber Security Staff Engineer (Application Security) and play a crucial role in integrating security into the Software Development Lifecycle (SDLC) and DevSecOps pipelines.

Unfortunately, many promising candidates tend to apply only if they meet all the criteria. So if you think you have what it takes, but don't necessarily meet every single item in the job description, please contact us anyway. We'd love to talk with you and find out if you might be a good fit for us

Responsibilities

• You will conduct threat modeling, perform secure code reviews, and build internal libraries to eliminate vulnerabilities.
• Additionally, you will take ownership of the application vulnerability lifecycle, provide guidance to product and engineering teams, and support incident response efforts.
• This position offers a range of benefits, including a learning and development budget, remote working allowance, and additional vacation days.
• Integrar la seguridad de manera fluida en el ciclo de vida del desarrollo de software (SDLC) y las canalizaciones de DevSecOps mediante la automatización de puertas de seguridad.
• Realizar revisiones de seguridad arquitectónica y modelado de amenazas para aplicaciones complejas, API y microservicios antes de su implementación.
• Tomar la responsabilidad de la gestión del ciclo de vida de las vulnerabilidades de la aplicación, incluyendo la priorización y validación de las vulnerabilidades.
• Hands-on experience integrating security testing tools into modern CI/CD pipelines (e.g., GitHub Actions, GitLab CI, Jenkins, Snyk, Semgrep)

Requirements

• Ability to thrive in a fast-paced environment and adapt security strategies to evolving product frameworks

Experience by doing threat modeling

• Proven experience analyzing and securing code written in our core tech stack/modern languages (e.g., Java, Go, Python, TypeScript, or Rust)
• Deep understanding of web application vulnerabilities, API security, and exploitation techniques (OWASP Top 10, CWE)
• Business proficient written and spoken English. German is a plus
• Depending on your level of experience, your responsibilities and scope of role will range. We don’t care much about fancy titles, but rather about real personal and professional development, as laid out in our learning framework. Let’s figure together out how you can contribute to our team
• A degree in Computer Science, Software Engineering, Information Technology, Cybersecurity, or equivalent professional experience
• 6+ years of experience in dedicated Application Security, DevSecOps, or Software Engineering roles with a strong focus on security in high-growth cloud environments (Fintech or highly regulated environment is a plus)
• Experience managing or triaging external penetration testing reports and crowdsourced bug bounty programs
• Curious, constant learner that is willing to share learning with others
• Ability to translate complex cryptographic or technical security vulnerabilities into business risk for non-technical stakeholders and actionable fixes for developers

Understands agile workflows and lean principles

• Strong analytical mindset capable of finding creative ways to secure cutting-edge application architectures
• Empathic collaborator who builds bridges between security goals and engineering targets, avoiding the "department of No" stereotype

Preferred

• Experience with cloud computing infrastructure (AWS, GCP, or Azure), containerization (Docker), and orchestration (Kubernetes)
• Individual Contributor, technical mentorship focus

Pay

EUR 85,000 - 110,000

Benefits

• Proactive peer that helps the growth of the team