Job
In this role, you assess the security of third-party software, derive security measures, and improve the vulnerability management process while considering modern technologies and security standards.
Job summary
This listing has been machine translated. Show original
Job technologies
Your role in the team
- This is a hands-on engineering role in Security Governance with no people management responsibilities. You assess the security of third-party software, open-source components, and packages used in software development and infrastructure, and derive practical security measures and clear technical recommendations from your findings. The focus is on the security of software and components—not supplier questionnaires, commercial supplier assessments, or responsibility for Third-Party Risk Management (TPRM).
- You assess third-party software, commercial products, open-source libraries, packages, and container images before their introduction and throughout their entire lifecycle. You review technical documentation, dependencies, security findings, and deployment requirements, and conduct targeted hands-on validations.
- You are responsible for and improve the technical vulnerability management process for third-party components in software development and infrastructure engineering—from identification and validation through prioritization and remediation to verifying effectiveness.
- You assess the provenance of components, software composition, and dependency chains, including Software Bills of Materials (SBOMs), where available. You investigate vulnerabilities as well as suspicious or unsupported components, and recommend more secure versions or alternatives.
- You define practical criteria for security assessments, technical minimum requirements, and software release reviews. You document evidence-based recommendations to approve, restrict, or reject software as a basis for decisions by the responsible stakeholders, and track exceptions and compensating measures.
- You configure and improve security tools such as Tenable, Aikido Security, Microsoft Defender, and Nexus Repository Firewall, and integrate component checks and security controls into development pipelines and package repositories.
- You validate findings and prioritize remediation based on exploitability, exposure, the criticality of the affected IT assets, and the deployment context, supported by CVSS, EPSS, and CISA KEV. Together with developers and infrastructure engineers, you update, replace, harden, or isolate affected components.
- You assess the secure deployment and hardening of third-party software on Windows and Linux, as well as across networks, VMware, Kubernetes, AWS, and Microsoft Azure—including permissions, configuration, and integration boundaries.
- You assess AI-related third-party software, packages, and integrations, particularly how they handle data, permissions, and external services. For AI-assisted analyses, you apply your technical judgment and independently validate the results.
- You automate recurring assessments, evidence collection, and the tracking of vulnerability remediation actions. You maintain traceable technical documentation and prepare meaningful reports on findings, exceptions, and remediation progress for Security Governance and audit stakeholders.
- You work with software development, infrastructure, architecture, and application owners to embed security requirements throughout the software development lifecycle. When needed, you provide colleagues in TPRM and Compliance with technical findings, without taking responsibility for their supplier risk management processes.
Our expectations of you
Education
- Demonstrable hands-on experience in security engineering, software development, or infrastructure engineering, with concrete examples of assessing and improving software security. A specific degree or formal qualification is not required; what matters is your practical expertise.
Qualifications
- In-depth understanding of software development practices, SDLC, OWASP Top 10, dependency management, package repositories, and CI/CD pipelines. Hands-on experience with Windows/Linux, networking, Active Directory, VMware, Kubernetes, AWS, and Azure/M365, as well as the ability to evaluate AI-powered software and integrations.
- You can write and maintain scripts, work with APIs, and integrate security checks into engineering workflows—with clear, reproducible results.
- You work analytically, in a structured manner, and independently. You constructively challenge technical decisions and collaborate with developers, infrastructure teams, and software vendors. You can clearly explain findings and trade-offs to both technical and non-technical audiences.
- Excellent written and spoken English skills; German language skills are a plus.
Experience
- You can investigate findings, understand their technical impact, and drive practical measures to remediate vulnerabilities in third-party software and dependencies. We assess the depth of your experience and your technical judgment rather than requiring a minimum number of years of professional experience.
- Practical experience with vulnerability scanners, Software Composition Analysis, and repository controls. Relevant tools include Tenable, Microsoft Defender, Aikido Security, and Nexus Repository Firewall; experience with comparable tools is also welcome. Experience with ServiceNow is a plus.
- You can translate security requirements into verifiable technical controls, document assessment evidence, and explain residual risks and exceptions. Familiarity with regulatory requirements or IT compliance standards is an advantage; certifications are welcome but do not replace practical experience.
- Practical knowledge of system hardening concepts and benchmarks, such as CIS, as well as the ability to review software permissions and deployment configurations. Experience coordinating penetration tests or red team exercises is a plus, but not required.
What we offer
- With us, you’ll find a sustainable corporate culture, a diverse range of challenging projects, and plenty of scope to shape your work, along with flexibility.
- Attractive salary & great benefits
- Flexible working hours and at least two days of working from home
- 30 days of vacation + 5 flex days
- Family support services for personal assistance
Benefits
Food & drink
Work-Life-Integration
Topics you will work on
Job locations
About your employer
At pbb Deutsche Pfandbriefbank, we are one of the leading European specialist banks for real estate financing and public investment financing. Our customers are convinced by our strong commitment, our innovative power and our industry-specific expertise.
- Established Company
- Onsite, Hybrid
- Banking, Finance, Insurance
More jobs
These jobs might also interest you
Anyone who joins here not only designs software – they bring machines to life that are recognizable on real construction sites. Software Developer (m/f/d) Basic Engineering Our client is an internationally leading manufacturer of technically...
Operation, monitoring, and further development of the network infrastructure. Administration and configuration of firewalls, routers, and switches. Ensuring network availability, performance, and security. Participation in IT security concepts and...
Participation in security analyses and assessment of applications and IT systems. Support in the design and implementation of technical security measures (e.g., WAF, Load Balancing, Firewall, etc.). Conducting and supporting penetration tests,...
