application security engineer

Distribusion Technologies; Berlin; Remote; EUR 90,000 - 140,000; Full time

Benefits offered by this job

Remote work option

International opportunities

Job summary

Distribusion Technologies ищет специалиста по AppSec для поддержки безопасной B2B-платформы, связывающей перевозчиков и онлайн-ретейлеров по всему миру.

Вы будете руководить threat modelling, внедрять gate-процессы в GitLab CI/CD (SAST, SCA, DAST, Secrets), координировать внешние тесты и обеспечение соответствия PCI-DSS/ISO 27001.

Требуется 5+ лет опыта в AppSec (или 3+ года с сильной инженерной/пентест-декой), знание Python/Go/TypeScript/Ruby, Kubernetes и GCP.

Qualifications

• 5+ лет опыта в AppSec или 3+ лет с сильной инженерной/пентест-бэкграундом
• Умение читать и писать код на Python, Go, TypeScript или Ruby
• Глубокие знания веб/API безопасности (OAuth2, JWT, rate limiting, XSS, IDOR)
• Опыт SAST, SCA и secrets scanning в CI/CD

Responsibilities

• Вести threat modelling и безопасный дизайн для высокорискованных изменений и интеграций
• Внедрять, настраивать и поддерживать gate-процессы в GitLab CI/CD (SAST/SCA/DAST/секреты)
• Тригировать, воспроизводить и приоритизировать результаты баг-баунти и тестирований
• Работать с DevOps для настройки GCP IAM, политик least-privilege, Cloud Armor WAF
• Укреплять сеть security-champions и масштабировать обзоры с помощью авт-инструментов/ИИ
• Вести управление уязвимостями с backlog и SLA
• Планировать годовые внешние пентесты и документацию по PCI-DSS/ISO27001

Skills

Python

Go

TypeScript

Ruby

Tools

Aikido

Semgrep

Snyk

Job description

Описание:

Distribusion operates a ground transportation marketplace that gives travellers online access to search for and purchase tickets. Its B2B technology platform connects bus, rail, and ferry operators in over 70 countries with online retailers.

Задачи:

• Lead threat modeling and secure design reviews for high-risk changes, partner integrations, and payment flows
• Implement, tune, and enforce security gates in GitLab CI/CD, including SAST, SCA, secrets scanning, and DAST, while minimizing developer friction
• Triage, reproduce, and prioritize findings from bug bounties, partner penetration tests, and automated scanners as the primary technical owner
• Work with the DevOps team to implement GCP organizational policies, least-privilege IAM architectures, and Cloud Armor WAF and rate limiting
• Establish a security-champions network across engineering squads and use automation and AI-assisted tooling to scale code reviews
• Own end-to-end vulnerability management, including a risk-ranked backlog, remediation SLAs, an escalation path, and closing findings with teams
• Scope and coordinate the annual external penetration test and produce secure-development evidence for PCI-DSS and ISO 27001

Требования:

• 5+ Years of AppSec experience, or 3+ years plus a strong software engineering or web penetration testing background
• Track record of taking ownership
• Ability to read and write production code in languages such as Python, Go, TypeScript, or Ruby
• Deep understanding of web frameworks, CI/CD, and Kubernetes
• Deep knowledge of web and API security, including OAuth2, JWT, rate limiting, tenant isolation, IDOR, and XSS
• Strong cloud security fundamentals, preferably GCP, including public exposure, secrets hygiene, and WAF rules
• Experience running threat modeling and secure design reviews on real systems, using STRIDE or similar
• Hands-on experience with SAST, SCA, and secrets scanning in CI, using Aikido, Semgrep, Snyk, or similar
• Ability to prioritize real-world risk, propose trade-offs, and communicate complex risks clearly to engineers and leadership
• Будет плюсом: experience securing high-volume, multi-tenant B2B APIs, using AI tooling to accelerate triage and review

Условия:

Competitive salary Flexible work policy with the option to work remotely and international opportunities as the company expands globally