Job
In this role, you will conduct hands-on security testing of APIs, web and mobile apps, and cloud infrastructures to identify vulnerabilities and work collaboratively with teams to implement fixes.
This listing has been machine translated. Show original
Job technologies
Your role in the team
- You will conduct hands-on, authenticated security testing across a real attack surface: public booking APIs for partners, payment flows, web and mobile apps used by millions of travellers, and the cloud infrastructure behind them.
- You'll plan and run your own testing, work directly with our engineering squads to get findings fixed, and see your impact in production within weeks.
- Test our partner-facing booking APIs against the OWASP API Security Top 10, with a focus on object- and function-level authorization, tenant isolation, mass assignment, data exposure and rate limiting.
- Assess API authentication and integrity end to end, including OAuth 2.0/OIDC, API keys, JWTs, webhooks and request signing.
- Hunt for business-logic abuse in booking, checkout, payment and refund flows, including race conditions and pricing manipulation.
- Run authenticated tests of traveller-, partner- and operator-facing web and mobile apps following OWASP WSTG and ASVS, including how passenger personal data is stored, shown and exported.
- Review cloud, Kubernetes, and CI/CD configurations and secrets handling for attack paths that could be chained from an application bug.
- Map and regularly test our internet-facing attack surface.
- Red-team our AI features (assistants, agents, support bots) against the OWASP Top 10 for LLM Applications.
- Write clear, reproducible, risk-rated findings with practical remediation guidance, walk engineers through fixes, and verify them with retests.
Our expectations of you
Qualifications
- You have deep, practical knowledge of the OWASP API Security Top 10, WSTG and ASVS, including authentication and authorization models (OAuth2/OIDC, JWT), IDOR/BOLA, mass assignment, SSRF, injection and XSS.
- You have found business logic and race condition vulnerabilities in transactional systems such as booking, e-commerce, payments, or fintech.
- You are proficient in Burp Suite Pro (or similar tools) and write your own scripts and tooling in Python, Go, or similar languages.
- You are comfortable assessing cloud and container environments (GCP preferred, Kubernetes) and CI/CD pipelines.
- You work independently: you scope, prioritise, test and report with minimal guidance, and you explain complex risks plainly to engineers and leadership.
- You are available to start at short notice.
Experience
- You bring 5+ years of hands-on penetration testing experience, primarily with web applications and APIs, and can point to recent engagements you’ve led end to end.
- Bonus points: OSCP, OSWE, BSCP, or similar certifications; experience red-teaming LLM applications or AI agents; testing in PCI-DSS environments.
What we offer
- You will join a fast-paced travel tech company with a flat organizational structure.
- You will have exciting opportunities, ownership, and responsibility and contribute directly to the success of the company.
- You will join an international team of talented and driven people with a clear mission.
- Expect your colleagues to inspire, support and challenge you every day!
- We have a flexible work policy with the option of working remotely and international opportunities arising as we continue to expand our global footprint.
- Our heart is in Berlin, but you'll find us across the globe.
- You will get a competitive salary.
Topics you will work on
Job locations
About your employer
Wir haben die erste globale B2B-Buchungs-API und das branchenweit größte Netzwerk von Carriern und Einzelhändlern entwickelt. Über unsere Plattform verbinden sich globale Reisemarken mit Hunderten von Bus-, Flughafentransfer-, Zug- und Fähranbietern. Reisehändler verwenden unsere API, um auf die größten Inhalte zuzugreifen, während Fluggesellschaften von einer umfassenden End-to-End-Buchungslösung profitieren. Wir bauen den weltweiten Standard für den Bodentransport.
- 2014
- Digital Agency
- Onsite, Hybrid, Full Remote
- Logistics, Transportation
More jobs
These jobs might also interest you
Area of responsibility “DRV Bund IT” is the service provider for Deutsche Rentenversicherung Bund, developing and operating a complex IT system landscape in close coordination with its customers. Our “IT4IT” domain provides IT departments across DRV...
Operation, monitoring, and further development of the network infrastructure. Administration and configuration of firewalls, routers, and switches. Ensuring network availability, performance, and security. Participation in IT security concepts and...
Lead our Stuttgart IT team, both professionally and as line manager, set priorities, and support each team member's development. Ensure the secure, reliable, and efficient operation of our heterogeneous IT infrastructure, including networks, servers,...