Job
In this role, you lead threat modeling, implement security gates in CI/CD, and work closely with the DevOps team on cloud security policies while developing security standards and practices.
This listing has been machine translated. Show original
Job technologies
Your role in the team
- Lead threat modeling and secure design reviews for high-risk changes, partner integrations, and payment flows.
- Implement, tune, and enforce security gates in GitLab CI/CD (SAST, SCA, secrets scanning, and DAST) while minimizing developer friction.
- Act as the primary technical owner for triaging, reproducing, and prioritizing findings from bug bounties, partner pentests, and automated scanners.
- Work hands-on with the DevOps team to implement GCP organizational policies, IAM least-privilege architectures, and Cloud Armor (WAF/rate limiting).
- Establish a security-champions network across engineering squads and leverage automation/AI-assisted tooling to scale code reviews effectively.
Our expectations of you
Qualifications
- You read and write production code (Python, Go, TypeScript, Ruby, etc.) and deeply understand web frameworks, CI/CD, and Kubernetes.
- You have deep knowledge of web and API security, specifically authentication/authorization models (OAuth2, JWT), rate limiting, tenant isolation, IDOR, and XSS.
- You have strong cloud security fundamentals (GCP preferred), specifically regarding public exposure, secrets hygiene, and WAF rules.
- You prioritize by real-world risk, propose trade-offs rather than demanding perfection, and communicate complex risks plainly to engineers and leadership.
Experience
- You bring 5+ years in AppSec (or 3+ years plus a strong software engineering/web-pentesting background), with a track record of true ownership.
- Bonus Points: You have experience securing high-volume, multi-tenant B2B APIs and utilizing AI tooling to accelerate triage and review.
What we offer
- You will join a fast-paced travel tech company with a flat organizational structure.
- You will have exciting opportunities, ownership, and responsibility and contribute directly to the success of the company.
- You will join an international team of talented and driven people with a clear mission. Expect your colleagues to inspire, support and challenge you every day!
- We have a flexible work policy with the option of working remotely and international opportunities arising as we continue to expand our global footprint - Our heart is in Berlin, but you'll find us across the globe.
- You will get a competitive salary.
Topics you will work on
Job locations
About your employer
Wir haben die erste globale B2B-Buchungs-API und das branchenweit größte Netzwerk von Carriern und Einzelhändlern entwickelt. Über unsere Plattform verbinden sich globale Reisemarken mit Hunderten von Bus-, Flughafentransfer-, Zug- und Fähranbietern. Reisehändler verwenden unsere API, um auf die größten Inhalte zuzugreifen, während Fluggesellschaften von einer umfassenden End-to-End-Buchungslösung profitieren. Wir bauen den weltweiten Standard für den Bodentransport.
- 2014
- Digital Agency
- Onsite, Hybrid, Full Remote
- Logistics, Transportation
More jobs
These jobs might also interest you
Operation, monitoring, and further development of the network infrastructure. Administration and configuration of firewalls, routers, and switches. Ensuring network availability, performance, and security. Participation in IT security concepts and...
Area of responsibility “DRV Bund IT” is the service provider for Deutsche Rentenversicherung Bund, developing and operating a complex IT system landscape in close coordination with its customers. Our “IT4IT” domain provides IT departments across DRV...
Anyone who joins here not only designs software – they bring machines to life that are recognizable on real construction sites. Software Developer (m/f/d) Basic Engineering Our client is an internationally leading manufacturer of technically...
