Security Engineer, Product Security team

Deliveryhero; Berlin; Hybrid; EUR 90,000 - 120,000; Full time

Benefits offered by this job

Hybrid working model

27 days holiday

Educational Budget

Language Courses

Parental Support

Udemy Business access

Health & Gym

Employee Share Purchase Plan

Sabbatical Bank

Transport Discount

Pension Plan

Meal Vouchers

Job summary

Delivery Hero in Berlin is seeking a Security Engineer II to join the Product Security team and work with senior engineers to ensure our web, mobile, and backend applications are built securely from the ground up.

You will champion a Secure by Design approach, help shift security left in the development lifecycle, and participate in threat modeling, vulnerability remediation, and automation across CI/CD pipelines.

Qualifications

• Solid foundational knowledge of web and mobile application security principles, common vulnerability types (OWASP Top 10), and basic web/API security architectures.

Responsibilities

• Application Security Testing & Remediation: Conduct security assessments, review code, and assist product teams in remediating application-layer vulnerabilities across web and mobile apps.
• Bug Bounty & Vulnerability Triage: Help manage Bug Bounty and Vulnerability Disclosure Programs, triaging and reproducing reported flaws.
• DevSecOps Integration: Implement and maintain automated security testing tools in CI/CD pipelines to catch vulnerabilities automatically.
• Threat Modeling: Facilitate threat modeling sessions and architectural reviews for new features and microservices using STRIDE.
• Support AI & Security Automation: Leverage AI-driven tools to optimize vulnerability triage, code analysis, and security workflows.
• Track Vulnerability SLAs: Monitor remediation progress with MTTR and SLA adherence in collaboration with developers.
• Developer Enablement: Guide engineers on secure coding standards and practices.

Skills

Application Security Fundamentals

Hands-On Coding Ability

Vulnerability Triage & Validation

DevSecOps & CI/CD Awareness

Cloud & Container Baselines

AI & Automation Curiosity

Pragmatic Communication

Tools

Burp Suite

OWASP ZAP

GitHub Actions

GitLab CI

SAST

DAST

SCA

Job description

Security Engineer, Product Security team

Full-time

As the world’s pioneering local delivery platform, our mission is to deliver an amazing experience, fast, easy, and to your door. We operate in around 65 countries worldwide, powered by tech, designed by people. As one of Europe’s largest tech platforms, headquartered in Berlin, Germany, Delivery Hero has been listed on the Frankfurt Stock Exchange since 2017 and is part of the MDAX stock market index. We push hard, learn quickly and stay human along the way. It’s this wonderful mix of high performance and real community that makes Delivery Hero a place where ambition and belonging grow side by side. If you’re curious, collaborative and ready to dive deep into meaningful work, you’ll fit right in.

We are on the lookout for aSecurity Engineer llto join our Product Security team.

In this role, you will work directly alongside senior engineers and product development teams to ensure our web, mobile, and backend applications are built securely from the ground up.

You will champion a "Secure by Design" approach, helping us shift security left into the early stages of the development lifecycle. From assisting with application threat models and triaging vulnerability reports to configuring CI/CD security tooling and helping developers write secure code, you will play a key operational role in keeping our global delivery platform safe

Application Security Testing & Remediation: Conduct security assessments, review code, and assist product teams in remediating application-layer vulnerabilities (such as the OWASP Top 10) across our web and mobile apps.

Bug Bounty & Vulnerability Triage: Help manage our Bug Bounty and Vulnerability Disclosure Programs, systematically triaging, validating, and reproducing reported flaws before routing them to the right engineering teams.

DevSecOps Integration: Assist in implementing and maintaining automated security testing tools (SAST, DAST, SCA) directly within our CI/CD pipelines to catch vulnerabilities automatically.

Participate in Threat Modeling: Partner with senior security engineers to facilitate threat modeling sessions and architectural reviews for new features and microservices using frameworks like STRIDE.

Support AI & Security Automation: Support team initiatives in leveraging modern security automation and AI-driven tools to optimize vulnerability triage, code analysis, and daily security workflows.

Track Vulnerability SLAs: Help track remediation progress against key metrics like Mean Time to Remediate (MTTR) and SLA Adherence %, working directly with developers to ensure timely fixes.

Developer Enablement: Serve as a helpful partner for software engineers, providing guidance on secure coding standards, best practices, and secure library usage.

What you need to be successful:

• Application Security Fundamentals: Solid foundational knowledge of web and mobile application security principles, common vulnerability types (OWASP Top 10), and basic web/API security architectures.
• Hands-On Coding Ability: Ability to read and understand code in at least one modern programming language (e.g., Java, Python, Go, or TypeScript) to help identify and fix security flaws.
• Vulnerability Triage & Validation: Experience reproducing application vulnerabilities (e.g., XSS, SQLi, IDOR, authentication bypasses) and using tools like Burp Suite or OWASP ZAP.
• DevSecOps & CI/CD Awareness: Basic understanding of modern CI/CD systems (e.g., GitHub Actions, GitLab CI) and how automated security scanners (SAST/SCA) integrate into developer workflows.
• Cloud & Container Baselines: Exposure to basic cloud computing principles (AWS, GCP, or Azure) and container concepts (Docker, Kubernetes).
• AI & Automation Curiosity: Eagerness to learn and utilize AI-driven tools (such as LLM coding assistants) to automate security scripts, triage tasks, and security analysis.
• Pragmatic Communication: Strong collaborative skills and an empathetic approach to partnering with software engineers to solve security issues without slowing them down.

Nice to have:

• Experience participating in Bug Bounty programs (as a reporter or triager) or CTF (Capture The Flag) competitions.
• Familiarity with authentication/authorization standards like OAuth 2.0, OIDC, or SAML.
• Industry certifications focusing on foundational security skills (e.g., Security+, eJPT, or GWAPT).

Who We Are

As the world’s pioneering local delivery platform, our mission is to deliver an amazing experience, fast, easy, and to your door. We operate in around 65 countries worldwide, powered by tech, designed by people. As one of Europe’s largest tech platforms, headquartered in Berlin, Germany, Delivery Hero has been listed on the Frankfurt Stock Exchange since 2017 and is part of the MDAX stock market index. We push hard, learn quickly and stay human along the way. It’s this wonderful mix of high performance and real community that makes Delivery Hero a place where ambition and belonging grow side by side.

If you’re curious, collaborative and ready to dive deep into meaningful work, you’ll fit right in.

What’s in it for you

• Ensuring you and all our Heroes are looked after, happy, and healthy is always on the menu. Because if you’re in good shape, then we’re in good shape.
• Make the most of our hybrid working model and join the team for face-to-face connection and collaboration in our beautiful Berlin campus 2 days a week
• We offer 27 days holiday with an extra day on 2nd and 3rd year of service
• We will support you in developing yourself and your career growth opportunities: 1.000 € Educational Budget, Language Courses, Parental Support and access to the Udemy Business platform to explore a variety of online courses.
• Get moving and release those wonderful, mind-boosting endorphins: Health Checkups, Meditation & Gym.
• Cash. Dough. Cheddar. Whatever you call it, we’ll help you with it: Employee Share Purchase Plan, Sabbatical Bank, Public Transportation Ticket Discount, Life & Accident Insurance, Corporate Pension Plan
• The power of getting together over some food is unrivaled. Here are a few ways to help you do that. All the yum: Digital Meal Vouchers and Food Vouchers.

delivery platform, we’d love to hear from you.

We believe diversity and inclusion are key to creating not only an exciting product, but also an amazing customer and employee experience. Fostering this starts with hiring - therefore we do not discriminate on the basis of racial identities, religious beliefs, color, national origin, gender identities or expressions, sexual orientations, age, marital or disability statuses, or any other aspect that makes you, you. We encourage you to let us know if you need any accommodations or specific accessibility support to ensure a smooth interview experience—just let us know with an email to our Inclusion Officer at [e-mail]. Severely disabled applicants with equal qualifications will be given preferential consideration. You’re welcome to share your pronouns (he/she/they) right from the start so we can address you respectfully from our first contact.

By clicking the link above or any third-party link within this posting, you are leaving this site and going to a third-party website where the third-party website's terms and privacy policy apply