IT Security Engineer (m/f/d) – Application Security, SBOM & CRA

VamiSec GmbH; Bonn; Hybrid; EUR 70,000 - 100,000; Full time

Benefits offered by this job

Flexible work from anywhere in Germany

Bonuses

Benefits

Competitive salaries

Job summary

VamiSec GmbH in Germany is seeking an IT Security Engineer (m/f/d) focused on application security, SBOM and CRA compliance. You will integrate SAST/DAST tools into client CI/CD pipelines and drive secure development practices.

Ideal candidates have hands-on security expertise, knowledge of OWASP ASVS and MASVS, and strong German (C1) plus good English. Remote-friendly with occasional Bonn office presence.

Qualifications

• Several years of experience in application security, DevSecOps or security-focused software development.
• In-depth knowledge of the OWASP Top 10 and ASVS, secure development processes.
• Hands-on experience with CI/CD and container/cloud environments.
• Excellent German (C1) and good English.
• Nice-to-have: CRA, IEC 62443-4-1 or ISO/SAE 21434; OSWE, GWEB or CSSLP.

Responsibilities

• Integrate SAST, SCA, secrets, IaC and DAST scans into CI/CD pipelines.
• Triage and assess findings; advise development teams on remediation.
• Generate SBOMs and monitor vulnerabilities for CRA compliance.
• Conduct security reviews along OWASP ASVS, MASVS and SAMM; threat modeling.
• Collaborate with product team to evolve VamiAppSec.

Skills

Application security

DevSecOps

CI/CD

German language

English

Tools

Semgrep

Trivy

Grype

Gitleaks

Checkov

VamiDAST

GitHub Actions

GitLab CI

Azure DevOps

Job description

IT Security Engineer (m/f/d) - Application Security, SBOM & CRA

Hybrid: mostly remote within Germany, occasionally at our Bonn office.

You bring security into everyday development: from the first commit to a CRA-ready release - with VamiAppSec and VamiDAST.

• Integrate SAST, SCA, secrets, IaC and DAST scans (including Semgrep, Trivy, Grype, Gitleaks, Checkov and VamiDAST) into our clients' CI/CD pipelines
• Triage and assess findings, run reachability analyses and advise development teams on remediation
• Generate SBOMs (CycloneDX/SPDX), monitor vulnerabilities and prepare reporting obligations under CRA Art. 14
• Security reviews and assessments along OWASP ASVS, MASVS and SAMM, complemented by threat modeling
• Evolve VamiAppSec together with the product team

Your profile

• Several years of experience in application security, DevSecOps or security-focused software development
• In-depth knowledge of the OWASP Top 10 and ASVS, secure development processes and at least one programming language (e.g. Python, Java, TypeScript or Go)
• Hands-on experience with CI/CD (GitHub Actions, GitLab CI or Azure DevOps) and container and cloud environments
• Excellent German (at least C1) and good English
• A plus: knowledge of the CRA, IEC 62443-4-1 or ISO/SAE 21434 and certifications such as OSWE, GWEB or CSSLP

Your responsibilities

• Integrate SAST, SCA, secrets, IaC and DAST scans (including Semgrep, Trivy, Grype, Gitleaks, Checkov and VamiDAST) into our clients' CI/CD pipelines
• Triage and assess findings, run reachability analyses and advise development teams on remediation
• Generate SBOMs (CycloneDX/SPDX), monitor vulnerabilities and prepare reporting obligations under CRA Art. 14
• Security reviews and assessments along OWASP ASVS, MASVS and SAMM, complemented by threat modeling
• Evolve VamiAppSec together with the product team

Your profile

• Several years of experience in application security, DevSecOps or security-focused software development
• In-depth knowledge of the OWASP Top 10 and ASVS, secure development processes and at least one programming language (e.g. Python, Java, TypeScript or Go)
• Hands-on experience with CI/CD (GitHub Actions, GitLab CI or Azure DevOps) and container and cloud environmentsExcellent German (at least C1) and good English
• A plus: knowledge of the CRA, IEC 62443-4-1 or ISO/SAE 21434 and certifications such as OSWE, GWEB or CSSLP

Your contact Valeri Milke Founder & CEO, VamiSec

[e-mail] LinkedIn

Flexible work from anywhere in Germany - we trust in results.

Professional Development

Certifications, training, and conferences - we invest in your growth.

Responsibility

Autonomous work on exciting projects for renowned clients.

Team

Small, highly motivated team with flat hierarchies and direct communication.

Competitive salaries, bonuses, and benefits - transparent and performance-based.

Impact

Your work makes organizations and critical infrastructure more secure.