Senior Product Security Engineer (d/f/m)

Personio; Berlin; Hybrid; EUR 90,000 - 120,000; Full time

Benefits offered by this job

Competitive salary

Paid vacation and holidays

Impact Day

Family support and mental health

Catered lunches

Job summary

Personio is seeking an experienced Product Security Engineer to partner with engineering teams and embed security into the core of what we build. You’ll conduct reviews, shape best practices, and develop automated tooling to scale protection across our products.

You’ll own vulnerability management, from discovery to remediation, and collaborate with external researchers and vendors. This role requires strong security background, threat modeling, and fluent English.

Qualifications

• 5+ years in product security, offensive security, systems security, or equivalent.
• Practical vulnerability management experience with consolidating issues from multiple sources.
• Define and report vulnerability management metrics showing programme health.
• Technical expertise in secure-by-default design, least privilege, and secure logging.
• Strong understanding of threat modeling and exploitability assessment.
• Guide engineers on remediation methods across languages and frameworks.
• Fluent English (written and verbal).
• Proactive, with bias for action and ability to handle ambiguity.

Responsibilities

• Own end-to-end vulnerability lifecycle from discovery to remediation.
• Maintain and evolve product security tooling and automation.
• Participate in security operations and respond to incidents.
• Manage external vendors and bug bounty coordination.
• Provide design and code security reviews to engineering teams.
• Maintain security policies, guidance, and stakeholder metrics.
• Drive security awareness across engineering through sessions and enablement.

Skills

Hands-on security

Vulnerability management

Security automation

Security reviews

Threat modeling

English communication

Initiative / bias for action

Remediation guidance

Tools

Security tooling

Penetration testing tools

Job description

Personio's intelligent HR platform helps small and medium-sized organizations unlock the power of people by making complicated, time-consuming tasks simple and efficient. Our team of 1,500 Personios is building user-friendly products that delight our 15,000+ customers and their 1.5 million employees. Ready to make an impact from day one?

The Role

Join us to shape the future of software in the underserved and high-impact HR technology industry. Your work will have a direct and tangible impact on customers, offering ownership and the chance to make a meaningful difference. As we prepare for significant growth, you'll face exciting challenges and have the opportunity to influence our path toward becoming one of the world's leading tech companies.

Security is a priority at Personio.

We're looking for an experienced Product Security Engineer to join our Product & Engineering organization and help us embed security into the core of everything we build. You'll partner directly with engineering teams to ensure our platforms are designed and built securely from the ground up, whether that means conducting in-depth security reviews, introducing security best practices, advising engineers on vulnerability mitigation or building automated tooling that scales protection across our products.

What You´ll do

• Vulnerability Management Oversight: You own the end-to-end vulnerability lifecycle from discovering vulnerabilities, through its triage to tracking remediation, managing risk acceptances, and reporting on security posture across the organisation.

• Security Tooling & Automation: You maintain and evolve the product security toolchain (traditional and AI workflows), ensuring teams have reliable, well-integrated tools to identify and address security issues within their development environment.

• Participate in Security Operations. You respond to security incidents, provide security expertise for internal customers and use your technical prowess to find and reproduce vulnerabilities or sometimes perform small internal pentests.

• Manage External Partners: You manage collaboration with security vendors and external researchers (Bug Bounty) and coordinate penetration tests, to ensure focus on the right research areas and help set correct scopes for their exercises.

• Security Reviews: You act as a trusted security advisor to engineering teams, providing design reviews, code reviews, and ad-hoc guidance to proactively embed security into product development before issues reach production.

• Security Documentation: You maintain security policies and best-practice guidance ensuring development teams have clear security standards to follow. As well as documentation and metrics for your stakeholders and business leaders.

• Security Education: You drive security awareness across the engineering organisation through the knowledge sharing sessions, and ongoing enablement initiatives that scale security knowledge across engineering.

What You´ll need

• 5 + years of hands-on experience in product security, offensive security, systems security or equivalent professional education.

• You have a practical experience with vulnerability management programmes or equivalent experience consolidating security issues from different sources and prioritising findings based on real-world risk (e.g., exploitability, exposure, business impact, CVSS/EPSS/KEV).

• You are comfortable defining and reporting vulnerability management programme metrics showing programme health and driving accountability.

• You possess technical expertise of best practices in security engineering, like secure-by-default design, least privilege, robust authentication and authorization patterns, secure secrets handling, safe dependency management, and high-quality security logging and monitoring.

• You have a strong understanding of security vulnerabilities and threat modeling. You are able to assess real-world exploitability and attack paths by reviewing code and technical documentation for security flaws.

• You can guide engineers on remediation methods and strategies across different programming languages and frameworks, earning trust and understanding the balance between security and development experience.

• You have fluent English communication skills (written and verbal) and can effectively translate complex security concepts for executive, technical, and non-technical audiences.

• You take initiative to identify gaps, improve processes, and drive security outcomes rather than waiting for issues to surface, embodying a bias for action approach.

• You can handle ambiguous situations, accurately deciding on relevant information. You can deal with competing priorities, focusing your efforts for maximum security impact.

Why Personio

Personio is an equal opportunities employer, committed to building an integrative culture where everyone feels welcomed and supported. We embrace uniqueness and understand that our diverse, values-driven culture makes us stronger. We are proud to have an inclusive workplace environment that will foster your development no matter your gender, civil status, family status, sexual orientation, religion, age, disability, education level, or race.

At Personio, we value in-person collaboration while also offering flexibility. This role requires 2 days per month in the office and can be based:

Munich/Berlin/Dublin/London/Madrid/Amsterdam.Aside from our people, culture, and mission, check out some of the other benefits that make Personio a great place to work:

• Receive a competitive reward package – reevaluated each year – that includes salary, benefits, and pre-IPO equity

• Enjoy 28 days of paid vacation, plus an additional day after 2 and 4 years

• Make an impact on the environment and society with 1 (fully paid) Impact Day

• Receive generous family leave, child support, mental health support (including 24 sessions per year with Oli for yourself and 10 sessions for a significant other), and sabbatical opportunities

• We enjoy gathering for meals, cultural initiatives, and events like local Summer Sessions and year-end celebrations. There's also healthy snacks, drinks, and a weekly catered lunch.