Senior Security Engineer – AppSec

This is a fully remote position, open to applicants in Germany.

📋 Description

• Develop, expand, and design an advanced application security program from inception.

• Foster a culture of security, establish processes, and implement tools throughout the global engineering team.

• Oversee the entire application security lifecycle, encompassing offensive red teaming, threat modeling, risk-focused vulnerability management, and shift-left security practices.

• Impact shift-left architecture across both application and platform layers.

• Secure a substantial TypeScript monolith alongside Go-based supporting services.

• Strengthen GitHub CI/CD pipelines.

• Safeguard the vivenu ticketing application and its underlying API framework.

• Tackle security obstacles in a multi-tenant, multi-region, multi-cloud landscape that includes Kubernetes, GCP, and various database services.

• Protect Kubernetes satellite architecture by utilizing hardened private compute nodes, VPC peering, and Argo CD for GitOps.

• Collaborate with engineering teams as a trusted advisor for security-by-design.

• Organize and conduct threat modeling and advanced security assessments across products and infrastructure.

• Lead risk-based vulnerability triage and remediation utilizing EPSS and AI technologies.

• Design and automate SAST, DAST, and secret-scanning controls within CI/CD pipelines.

• Conduct code and configuration reviews while promoting secure coding practices.

⛳️ Requirements

• Over 5 years of specialized Security Engineering experience, preferably in a rapidly growing SaaS, E-commerce, or Fintech setting.

• Capability to assess the business logic of intricate SaaS applications to identify and validate attack vectors.

• Profound knowledge of web/API attack vectors and scalable security best practices.

• Proficiency in securely managing workloads in a cloud environment, including Kubernetes, AWS, GCP, or Azure.

• Demonstrated ability to independently drive security initiatives from initial concept to final execution.

• Skilled in at least one programming language for scripting and developing security tools.

• Bachelor’s or Master’s degree in Computer Science, Cybersecurity, IT, or a related technical discipline, or equivalent practical experience.

• Experience with PCI DSS script security is preferred.

• Preferred background in Red/Purple Team operations and advanced penetration testing.

• Strong empathy and collaboration abilities to assist development teams in addressing software vulnerabilities are preferred.

• Hands-on experience with Terraform is preferred.

• Familiarity with GCP, Golang, and TypeScript is preferred.

🏝️ Benefits

• Sustainable, profitable, venture capital-backed company with ongoing investment in its people, products, and long-term vision.

• Collaboration with an international team of over 160 professionals across six locations.

• A diverse and inclusive work environment.

• Opportunities for daily learning, shared successes, and collective advancement.

• A chance to work alongside seasoned technology leaders and award-winning founders.

• An opportunity to influence the future of live entertainment technology and the ticketing industry.