Web Application Security Engineer (Remote)

Quick Facts

• Role: Web Application Security Engineer (Remote)
• Focus: Web-app security enablement, vulnerability assessment, threat modeling, and secure development support

Description

You will help protect a large web application and its users by assessing security weaknesses, creating actionable recommendations, and supporting teams throughout planning, development, and operations. The work includes analyzing vulnerabilities, developing and maintaining cross-team security mechanisms, and enabling secure configuration, build, and release practices (IaC, CI/CD, SDLC). This is a modern, agile environment with DevOps practices and the ability to work flexibly from office or home.

Responsibilities

• Support feature teams with security questions during conception, implementation, and operation of the application
• Analyze vulnerabilities and develop and maintain cross-team security controls
• Deep-dive into technical topics and help engineers consider security from planning through runtime
• Evaluate vulnerabilities in the application context and create clear, precise recommendations

Requirements

• Strong and extensive experience in web application and cloud security, preferably with AWS
• Understanding of how to securely configure, build, and release modern web applications (IaC, CI/CD, SDLC)
• Ability to assess vulnerabilities and produce recommendations
• Knowledge of Java web applications and JavaScript web clients (TypeScript)
• Knowledge of dependency management tooling configuration (NPM, Gradle)
• Development experience and ability to automate security-related tasks with scripts (Bash, Python or similar)
• Threat modeling knowledge and ability to identify threats by thinking like an attacker
• Ability to communicate vulnerabilities and security recommendations clearly and precisely
• German C2 and very good English
• Incident response experience is a plus

Benefits

• Work in a modern, agile DevOps setup (Scrum and Kanban)
• Flexible office/home working and team-led interview process
• Security-focused culture with Hacking Days and occasional After-Work sessions