AppSec Engineer

Enfint; Deutschland; Vor Ort; EUR 80.000 - 120.000; Vollzeit

Benefits dieser Stelle

Flexible monthly budget for expenses

Budget for courses & certifications

Language learning support

Medical insurance or reimbursement

Mental health support

Merch shop with rewards system

Team offsites and company events

Office role with relocation support

Zusammenfassung

CoinsPaid is seeking an experienced security professional to lead vulnerability management and application security efforts. You will triage, assess risk, prioritize remediation, and drive fixes with engineering teams while monitoring SLAs and reporting security posture.

You will model threats for new systems and help embed secure design in development workflows. The role requires hands-on experience with SAST/DAST/SCA, container and cloud security tools, plus strong communication with

Qualifikationen

• 4+ years in application or product security, vulnerability management, or related security discipline.
• Hands-on managing vulnerabilities across apps, infra, containers and cloud.
• Strong knowledge of OWASP Top 10, CWE, CVSS, MITRE ATT&CK and risk-based approaches.
• Experience with SAST/DAST/SCA and container/cloud security tools.
• Threat modeling experience and security risk assessments.
• Understanding of CI/CD practices; familiar with Kubernetes and cloud platforms.
• Excellent stakeholder management and communication; fintech/blockchain experience is a plus.

Aufgaben

• Support and continuously improve the Vulnerability Management process.
• Triage risks, prioritize, and track remediation progress.
• Collaborate with engineering to ensure timely remediation of findings.
• Analyze findings from security tools and reduce noise via prioritization.
• Monitor remediation SLAs and report on security posture with metrics.
• Participate in threat modeling for new systems and significant changes.
• Conduct security risk assessments and provide actionable recommendations.
• Define and maintain application security requirements with engineering.
• Support Secure SDLC and integrate security into development workflows.
• Guide developers and DevOps on vulnerability remediation and secure design.

Kenntnisse

Vulnerability management

Application security

Threat modeling

CI/CD security

Stakeholder communication

Tools

SAST

DAST

SCA

Container security

Cloud security tools

Kubernetes

Cloud platforms (AWS/GCP/Azure)

Jobbeschreibung

Описание:

CoinsPaid is a fintech company that builds blockchain payment infrastructure for the global economy. It designs, implements, and scales payment systems that connect digital assets with real‑world financial operations to help businesses and financial institutions operate efficiently.

Задачи:

• Support and continuously improve the company's Vulnerability Management process;
• Perform vulnerability triage, risk assessment, prioritization, and remediation tracking;
• Work with engineering teams to ensure timely remediation of identified vulnerabilities;
• Analyze findings from multiple security tools and sources and reduce noise through effective prioritization;
• Monitor vulnerability remediation SLAs and provide visibility into security posture through reporting and metrics;
• Participate in threat modeling activities for new systems, services, and significant architectural changes;
• Conduct security risk assessments and provide actionable recommendations;
• Define and maintain application security requirements in collaboration with engineering teams;
• Support Secure SDLC initiatives and help integrate security practices into development workflows;
• Provide guidance to developers and DevOps engineers on vulnerability remediation and secure design practices.

Требования:

• 4+ Years of experience in Application Security, Product Security, Vulnerability Management, or a related security discipline;
• Hands‑on experience managing and prioritizing vulnerabilities across applications, infrastructure, containers, and cloud environments;
• Strong understanding of OWASP Top 10, CWE, CVSS, EPSS, MITRE ATT&CK, and risk‑based vulnerability management approaches;
• Experience with security testing technologies such as SAST, DAST, SCA, Container Security, and Cloud Security tools;
• Experience conducting threat modeling and security risk assessments;
• Understanding of modern software development practices and CI/CD pipelines;
• Familiarity with Kubernetes and cloud platforms (AWS, GCP, or Azure);
• Ability to analyze security findings and make risk‑based remediation recommendations;
• Strong stakeholder management and communication skills;
• Nice to have: Relevant professional certifications, experience in fintech or blockchain domains.

Условия:

• Flexible monthly budget of up to €230 for sports, mental health, coworking, home office, or medical expenses;
• Budget for courses, certifications, and professional development;
• Language learning support;
• Medical insurance or reimbursement depending on location;
• Access to mental health support;
• Financial support for important life events;
• Merch shop with rewards system;
• Team offsites and company events;
• Office role with relocation support.