Job
- Level
- Senior
- Ort
- Berlin
- Arbeitsmodell
- Full Remote, Onsite
- Job Feld
- IT, Security
- Anstellung
- Vollzeit
- Vertragsart
- Unbefristetes Dienstverhältnis
Job Zusammenfassung
In dieser Rolle führst du Bedrohungsmodellierungen durch, implementierst Sicherheitsprüfungen in CI/CD, und arbeitest eng mit dem DevOps-Team an Cloud-Sicherheitsrichtlinien sowie der Entwicklung von Sicherheitsstandards.
Job Technologien
Deine Rolle im Team
- Lead threat modeling and secure design reviews for high-risk changes, partner integrations, and payment flows.
- Implement, tune, and enforce security gates in GitLab CI/CD (SAST, SCA, secrets scanning, and DAST) while minimizing developer friction.
- Act as the primary technical owner for triaging, reproducing, and prioritizing findings from bug bounties, partner pentests, and automated scanners.
- Work hands-on with the DevOps team to implement GCP organizational policies, IAM least-privilege architectures, and Cloud Armor (WAF/rate limiting).
- Establish a security-champions network across engineering squads and leverage automation/AI-assisted tooling to scale code reviews effectively.
Unsere Erwartungen an dich
Qualifikationen
- You read and write production code (Python, Go, TypeScript, Ruby, etc.) and deeply understand web frameworks, CI/CD, and Kubernetes.
- You have deep knowledge of web and API security, specifically authentication/authorization models (OAuth2, JWT), rate limiting, tenant isolation, IDOR, and XSS.
- You have strong cloud security fundamentals (GCP preferred), specifically regarding public exposure, secrets hygiene, and WAF rules.
- You prioritize by real-world risk, propose trade-offs rather than demanding perfection, and communicate complex risks plainly to engineers and leadership.
Erfahrung
- You bring 5+ years in AppSec (or 3+ years plus a strong software engineering/web-pentesting background), with a track record of true ownership.
- Bonus Points: You have experience securing high-volume, multi-tenant B2B APIs and utilizing AI tooling to accelerate triage and review.
Unser Angebot
- You will join a fast-paced travel tech company with a flat organizational structure.
- You will have exciting opportunities, ownership, and responsibility and contribute directly to the success of the company.
- You will join an international team of talented and driven people with a clear mission. Expect your colleagues to inspire, support and challenge you every day!
- We have a flexible work policy with the option of working remotely and international opportunities arising as we continue to expand our global footprint - Our heart is in Berlin, but you'll find us across the globe.
- You will get a competitive salary.
Themen mit denen du dich im Job beschäftigst
Job Standorte
Das ist dein Arbeitgeber
Distribusion Technologies Gmbh
Wir haben die erste globale B2B-Buchungs-API und das branchenweit größte Netzwerk von Carriern und Einzelhändlern entwickelt. Über unsere Plattform verbinden sich globale Reisemarken mit Hunderten von Bus-, Flughafentransfer-, Zug- und Fähranbietern. Reisehändler verwenden unsere API, um auf die größten Inhalte zuzugreifen, während Fluggesellschaften von einer umfassenden End-to-End-Buchungslösung profitieren. Wir bauen den weltweiten Standard für den Bodentransport.
Description
- Gründungsjahr
- 2014
- Unternehmenstyp
- Digitale Agentur
- Arbeitsmodell
- Full Remote, Hybrid, Onsite
- Branche
- Logistik, Transport
Senior Application Security Engineer
- Ort
- Berlin
- Arbeitsmodell
- Full Remote, Onsite
- Diversität
- Für alle Personen geeignet (m/w/d)
- Nur Englisch
- Nur Englisch erforderlich
