Product Security Engineer (m/f/x)

Scalable Capital; München; Hybrid; EUR 65.000 - 85.000; Vollzeit

Benefits dieser Stelle

Flexible vacation policy

Education budget

50% contribution for 'Deutschland Jobticket'

Complementary subscription for PRIME+ Broker

Discounted sports activities with Urban Sports Club

Zusammenfassung

A leading fintech startup in Munich is seeking a Product Security Engineer to champion the security of their platform. In this role, you will perform security assessments, manage vulnerability disclosures, and advocate for secure coding practices while collaborating closely with engineering teams. Ideal candidates have a background in application or product security, familiarity with OWASP standards, and a collaborative mindset. The position offers flexible work arrangements, educational support, and competitive compensation.

Qualifikationen

• Foundation in application security with eagerness to learn and grow.
• Experience in application security testing and code review.
• Empathy for developers; clear communication of technical findings.

Aufgaben

• Perform security assessments and code reviews on web and mobile apps.
• Triage incoming security reports and manage vulnerability disclosures.
• Integrate security tooling into our CI/CD pipelines.

Kenntnisse

Application Security

Product Security

Kotlin

Python

Collaboration

Ausbildung

Bachelor’s degree in Computer Science or Information Security

Tools

Burp Suite

AWS

GitHub Actions

Jobbeschreibung

Scalable Capital is a leading digital investment and banking platform with a full banking licence, empowering people across Europe to shape their own finances. Scalable Broker makes it easy and affordable for clients to invest professionally in stocks, ETFs, cryptocurrencies, and derivatives, as well as set up savings plans. Scalable Wealth, the digital wealth management service, offers clients professional investment in ETF portfolios, and is also adopted as a white‑label solution by banks and other B2B partners. The company’s offerings are rounded off by attractive interest rates, loans, and private equity. With the European Investor Exchange, Scalable Capital offers an exchange specifically for retail investors. Over one million clients have already entrusted more than €30 billion to the platform.

Job Description

We’re looking for a Product Security Engineer to join our team and help champion the security of our platform. We don’t expect you to be a “unicorn” who knows everything on day one; instead, we are looking for someone with a strong foundation in application security who is eager to learn and grow.

In this role, you will act as a bridge between security and engineering. You will start by focusing on hands‑on security testing and code review, and with the support of senior team members, you will gradually expand your scope to include architecture reviews, automated tooling, and strategic security initiatives.

What You’ll Do (and learn to do)

• Application Security Testing: Perform security assessments and code reviews on our web apps, mobile apps, and APIs. You will combine manual testing with automated tooling to validate security controls against industry standards.
• Vulnerability Disclosure & Management: Triage incoming reports from bug bounties, vulnerability disclosures, and external penetration tests. You will help manage the intake process and work towards establishing a formal Bug Bounty program in the future.
• Secure Software Development Lifecycle (SSDLC): Assist in integrating security tooling (SAST, DAST, SCA) into our CI/CD pipelines (AWS/GitHub). You will help tune these tools to ensure high‑fidelity alerts for our developers.
• Threat Modeling Support: Partner with senior security engineers and product teams to participate in threat modeling sessions. You will learn to identify architectural flaws and logic vulnerabilities in the design phase.
• Developer Enablement: Collaborate with engineering teams to advocate for secure coding practices. You will help build “paved roads”—secure defaults and libraries—that make it easier for developers to write secure code in Kotlin and Python.
• Cloud Security Basics: Gain exposure to securing infrastructure‑as‑code and AWS environments, helping ensure our microservices architecture remains resilient.

Qualifications

• Bachelor’s degree in Computer Science, Information Security, or a related field (or equivalent practical experience).
• Profound experience in Application Security, Product Security, or Software Engineering with a security focus. We are looking for potential and foundational skills over a perfect checklist.
• Strong understanding of the OWASP Top 10 and familiarity with verification standards like OWASP ASVS/MASVS. You know what “good” looks like and how to verify it.
• You can read and review code. Familiarity with Kotlin, Java, Python, or TypeScript is highly desired. You should be comfortable discussing code logic with developers.
• Experience with Burp Suite or similar testing tools. Familiarity with CI/CD concepts (GitHub Actions) is a plus.
• Certifications are nice to have but not required. Examples include OSCP, GWAPT, GCPN, CSSLP, or AWS Security Specialty.
• You have high empathy for developers. You can explain technical findings clearly and enjoy working in a collaborative environment.
• You believe security is a team sport. You prefer collaboration over confrontation and have a strong teamwork orientation.

Additional Information

• Be part of one of the fastest‑growing and most visible Fintech startups in Europe, creating innovative services that have a substantial impact on the lives of our customers.
• Work with an international, diverse, inclusive, and ever‑growing team that loves creating the best products for our clients.
• Work from our centrally located offices in the heart of Munich or Berlin, nestled in lively neighborhoods filled with vibrant restaurants, cozy cafés, and a wide range of convenient amenities.
• Be productive with the latest hardware and tools.
• Learn and grow by joining our in‑house knowledge sharing or career development sessions and spending your individual Education Budget.
• Learn and experience German culture first hand by joining our free German language classes.
• International relocation support is provided if required.
• Flexible vacation policy and the opportunity to work from abroad.
• Benefit from an attractive compensation package and from the company pension scheme.
• Monthly contribution of 50% for the ‘Deutschland Jobticket’.
• Say goodbye to order commissions and say hello to your complimentary subscription of Scalable Capital’s PRIME+ Broker.
• Enjoy flexible and discounted sports activities with Urban Sports Club.