Lead Security Engineer

Jobgether; Deutschland; Remote; EUR 153,000 - 200,000; Full time

Benefits offered by this job

Fully remote work

Timezone flexibility

Equity opportunities

Annual team gatherings

Inclusive workplace

Job summary

Jobgether is seeking a hands-on Lead Security Engineer in a fully remote setup to define and drive security strategy for a global SaaS platform. You will own application security, infrastructure protection, compliance, and incident management while embedding security across the development lifecycle with AI-powered tools and integrations.

You will collaborate with engineering teams to model threats, build automation, and strengthen operational resilience in a lean, high-trust environment.

Qualifications

• Extensive senior security experience in a SaaS or multi-tenant setup.
• Hands-on security in application and API contexts with modern tooling.
• Strong threat modeling, vulnerability remediation, and security automation.
• Experience with SOC 2 or similar compliance programs and evidence collection.

Responsibilities

• Define and lead the security strategy, roadmap, standards, and execution.
• Identify gaps and build tools, automation, and processes with engineers.
• Integrate security into SDLC via reviews, threat modeling, and dependency checks.
• Lead security incidents end-to-end and coordinate communications and postmortems.
• Own on-call rotation, incident exercises, and remediation of gaps.
• Secure AI-powered systems and manage risk across MCP servers and connectors.
• Drive vulnerability disclosure coordination and external security reports.
• Support customer trust with security questionnaires and Trust Center resources.
• Collaborate with product teams on designs, reviews, and security champions.

Skills

Security leadership

Application security

API security

Threat modeling

Security automation

AWS

Kubernetes

Cloudflare

SOC 2 compliance

TypeScript

Python

Communication

Tools

AWS

Kubernetes

Cloudflare

Job description

This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for a Lead Security Engineer based in Germany.

We are looking for a hands-on Lead Security Engineer to define and drive security strategy within a fully remote, globally distributed technology organization. In this role, you will take ownership of application security, infrastructure protection, compliance, and incident management while helping shape the security standards of an evolving SaaS platform. You will work closely with engineering teams to embed security throughout the development lifecycle, particularly as AI-powered tools, agents, and integrations expand the product ecosystem. Combining strategic leadership with practical engineering, you will identify vulnerabilities, build security automation, and strengthen operational resilience. This is an opportunity to make a significant impact in a lean, high-trust environment where collaboration, autonomy, and innovation are essential.

Accountabilities

• Define and lead the overall security strategy and roadmap, establish priorities, set standards, and drive execution across the organization.


• Identify security gaps and develop practical solutions, including building tools, automation, and processes alongside other security engineers.


• Integrate security into the software development lifecycle through pull request reviews, threat modeling, dependency management, secrets detection, and software supply chain security.


• Strengthen operational security while maintaining a flexible, high-trust working environment and aligning practices with industry standards.


• Manage day-to-day security operations, including security requests, internal support, maintenance, and continuous improvements, while automating manual processes wherever possible.


• Lead security incidents from detection through resolution, including incident communications, customer updates, and postmortems.


• Participate in the engineering-wide on-call rotation, organize incident response exercises, and ensure identified security gaps are addressed.


• Assess and secure AI-powered systems, including internal agents, MCP servers, connectors, and in-product AI features, by conducting threat modeling and establishing appropriate safeguards.


• Manage vulnerability disclosure activities, assess external security reports, prioritize legitimate findings, and coordinate remediation.


• Oversee security compliance initiatives, particularly SOC 2 and Meta platform compliance, ensuring that controls improve actual security rather than simply satisfying audit requirements.


• Support customer trust initiatives by responding to security questionnaires, collaborating with customer-facing teams, and developing resources such as a Trust Center.


• Partner with product engineering teams on technical specifications, security reviews, and the development of security champions across the organization.

Requirements

• Significant experience as a senior security engineer or security lead, ideally as the most senior security specialist in an organization without a CISO above you.


• Strong hands‑on expertise in application and API security within multi‑tenant SaaS environments, preferably involving public APIs.


• Deep understanding of authorization models, OAuth, OIDC, authentication and session management, IDOR, SSRF, and threat modeling.


• Proven ability to identify, investigate, and remediate security vulnerabilities rather than simply report them.


• Strong programming skills, particularly in TypeScript, with the ability to navigate, modify, and contribute to existing codebases. Familiarity with PHP and Python is also valuable.


• Experience leading security incidents end‑to‑end, including technical response, stakeholder communications, customer updates, and actionable postmortems.


• Working knowledge of AWS, Kubernetes, and Cloudflare, or comparable technologies, with the ability to assess infrastructure risks and collaborate effectively with infrastructure teams.


• Experience managing or contributing to SOC 2 or similar compliance programs, ideally with an emphasis on automating evidence collection.


• Previous experience operating or triaging vulnerability disclosure or bug bounty programs, with the ability to distinguish genuine security issues from low‑quality reports.


• Strong communication and stakeholder management skills, including the confidence to challenge technical decisions constructively and collaborate toward effective solutions.


• Familiarity with modern AI tools and their practical applications, alongside a strong understanding of the security risks associated with AI‑powered systems and agents.


• Ability to thrive in remote, asynchronous environments, with excellent written communication, clear documentation, accountability, and consistent follow‑through.

Technical environment:

• Product: Node.js, TypeScript, MongoDB, REST APIs, PHP legacy services, iOS and Android applications, GraphQL API, MCP server, CLI, and connectors.


• Infrastructure: AWS (EKS, IAM, SQS, S3, CloudFront), Terraform, ArgoCD, GitHub Actions, and Cloudflare (WAF, Zero Trust, Workers, DNS).


• Security and compliance: Vanta, Dependabot, gitleaks, AWS GuardDuty, Cloudflare WAF and Zero Trust, Action1, 1Password, and Google Workspace.


• Observability and incident management: Datadog, Sentry, incident.io, and PagerDuty.


• AI ecosystem: Claude Team, internally developed AI agents and MCP servers, and in‑product AI features.

Experience using social media management platforms or familiarity with the product ecosystem is an additional advantage.

Benefits

• Competitive compensation: Annual base salary ranging from $171,100 to $222,880.


• Equity: Additional equity opportunities as part of the overall compensation package.


• Fully remote work: Join a globally distributed team and work remotely.


• Timezone flexibility: Open to candidates based between UTC-3 and UTC+3 to support collaboration and shared incident coverage.


• Transparent compensation philosophy: A commitment to fair, simple, generous, and transparent salary and equity practices.


• International collaboration: Opportunities to connect and work alongside colleagues from different countries and backgrounds.


• Annual team gatherings: One or two in‑person team meetups per year to strengthen relationships and collaboration.


• Inclusive workplace: A strong commitment to diversity, equal opportunities, and creating an environment where underrepresented groups can thrive.