Job
- Level
- Senior
- Job Field
- IT, Security
- Employment Type
- Full Time
- Contract Type
- Permanent employment
- Location
- Berlin
- Working Model
- Full Remote, Onsite
Job Summary
In this role, you lead threat modeling, implement security gates in CI/CD, and work closely with the DevOps team on cloud security policies while developing security standards and practices.
Job Technologies
Your role in the team
- Lead threat modeling and secure design reviews for high-risk changes, partner integrations, and payment flows.
- Implement, tune, and enforce security gates in GitLab CI/CD (SAST, SCA, secrets scanning, and DAST) while minimizing developer friction.
- Act as the primary technical owner for triaging, reproducing, and prioritizing findings from bug bounties, partner pentests, and automated scanners.
- Work hands-on with the DevOps team to implement GCP organizational policies, IAM least-privilege architectures, and Cloud Armor (WAF/rate limiting).
- Establish a security-champions network across engineering squads and leverage automation/AI-assisted tooling to scale code reviews effectively.
This text has been machine translated. Show original
Our expectations of you
Qualifications
- You read and write production code (Python, Go, TypeScript, Ruby, etc.) and deeply understand web frameworks, CI/CD, and Kubernetes.
- You have deep knowledge of web and API security, specifically authentication/authorization models (OAuth2, JWT), rate limiting, tenant isolation, IDOR, and XSS.
- You have strong cloud security fundamentals (GCP preferred), specifically regarding public exposure, secrets hygiene, and WAF rules.
- You prioritize by real-world risk, propose trade-offs rather than demanding perfection, and communicate complex risks plainly to engineers and leadership.
Experience
- You bring 5+ years in AppSec (or 3+ years plus a strong software engineering/web-pentesting background), with a track record of true ownership.
- Bonus Points: You have experience securing high-volume, multi-tenant B2B APIs and utilizing AI tooling to accelerate triage and review.
This text has been machine translated. Show original
What we offer
- You will join a fast-paced travel tech company with a flat organizational structure.
- You will have exciting opportunities, ownership, and responsibility and contribute directly to the success of the company.
- You will join an international team of talented and driven people with a clear mission. Expect your colleagues to inspire, support and challenge you every day!
- We have a flexible work policy with the option of working remotely and international opportunities arising as we continue to expand our global footprint - Our heart is in Berlin, but you'll find us across the globe.
- You will get a competitive salary.
This text has been machine translated. Show original
Topics You Will Work On
Job Locations
About Your Employer
Distribusion Technologies Gmbh
Wir haben die erste globale B2B-Buchungs-API und das branchenweit größte Netzwerk von Carriern und Einzelhändlern entwickelt. Über unsere Plattform verbinden sich globale Reisemarken mit Hunderten von Bus-, Flughafentransfer-, Zug- und Fähranbietern. Reisehändler verwenden unsere API, um auf die größten Inhalte zuzugreifen, während Fluggesellschaften von einer umfassenden End-to-End-Buchungslösung profitieren. Wir bauen den weltweiten Standard für den Bodentransport.
Description
- Founding Year
- 2014
- Company Type
- Digital Agency
- Working Model
- Full Remote, Hybrid, Onsite
- Industry
- Logistics, Transportation
Senior Application Security Engineer
- Location
- Berlin
- Working Model
- Full Remote, Onsite
- Diversity
- Open for all genders
- English Only
- English only required
