Application Security Engineer

Quick Facts

• Role: Application Security Engineer

• Focus: Web application security, security assessments, and DevSecOps/SDLC tooling

Description

You will support and continuously improve a Security Champion program and run community activities (e.g., Capture the Flag) while strengthening security culture through training and coaching. The role includes creating SDLC guidelines aligned with ISO 27001 requirements and developing DevSecOps security and compliance tools that enable security shift-left in the software lifecycle. You’ll work with self-organized agile teams and integrate security tooling into GCP-based microservices platforms.

Responsibilities

• Build and continuously improve the Security Champion Program and organize community events (e.g., Capture the Flag)

• Improve security culture by training and coaching software engineers, leaders, and Product Owners on offensive security, Security by Design, and secure coding

• Create practical SDLC guidelines and tooling instructions that make ISO 27001 ISMS requirements actionable for developers

• Develop and improve DevSecOps security and compliance tools to integrate security into the SDLC (shift left)

• Support platform teams integrating tools into their platforms

• Perform independent, agile work in and with self-organized teams

Requirements

• Expertise in web application security testing and cloud/network security assessments

• Knowledge of web application security and OWASP Top 10 vulnerabilities and solutions

• Experience creating guidelines and architecture requirements that fulfill ISO 27001 ISMS requirements

• Experience as a Security Champion or Security Engineer in an agile product team

• Initial practical experience building security communities and Security Champion programs

• Knowledge of Prometheus, Grafana, Terraform, Kubernetes, and Google Cloud Platform (GCP)

• DevOps mindset and interest in outcome-oriented, experimental, data-driven product development and automation across CI/CD, DevOps, SDLC, DevSecOps, and microservice architectures

• Completed degree in computer science with an IT security focus or equivalent training; alternatively, long-term experience

Benefits

• Flexible working hours and mobile work

• 30 vacation days plus regional public tradition days

• Time-off models and up to two additional weeks of leave per year

• Annual training budget with a dedicated learning platform, workshops, and tech events

• Networks for personal development

• Discounted Deutschlandticket and employee benefits such as a company bike, parking, health services, and support for retirement savings

• Vacation and Christmas bonuses and discounts at REWE, PENNY, toom Baumarkt, and DERTOUR Group