Senior Security Engineer

Darwin Recruitment; Berlin; Hybrid; EUR 124,000 - 193,000; Part time

Job summary

Darwin Recruitment seeks a freelance Senior Security Engineer for a Berlin-based online marketplace. You will own edge and web application defense, tune WAF policies, and coordinate with engineering teams to roll out changes safely.

The role emphasizes incident response, dashboards, automation via APIs or IaC, and documentation of runbooks. English is required; German is a plus; 4 days on-site with one day remote.

Qualifications

• Hands-on experience with Akamai, Cloudflare, or similar edge/WAF platforms.
• Proven WAF rule tuning and false-positive reduction in high-traffic environments.
• Strong web security knowledge, OWASP Top 10 and HTTP attack patterns.
• Experience investigating bot, scraping, credential stuffing and DDoS activity with SIEM/Kibana.
• Scripting in Python or Shell to automate security operations.
• Hands-on AWS experience.
• Understanding of prompt injection and AI-related attack vectors.
• Incident response experience.
• Fluent English; German a plus.
• E-commerce/ marketplace background is a plus.

Responsibilities

• Tune WAF policies, rules and rate controls to reduce attacks and false positives.
• Investigate bot, scraping, credential stuffing and DDoS activity.
• Support security incidents and roll out changes with rollback tracking.
• Build attack reports and dashboards; feed findings to alerting.
• Automate recurring tasks via APIs, IaC or scripting; onboard services with Eng teams.
• Document runbooks and rule decisions.

Skills

WAF rule tuning

Web security (OWASP)

Bot/DDoS investigation

Scripting (Python/Shell)

AWS experience

Incident response

English proficiency

German language

E-commerce experience

Edge security architecture

Tools

Akamai

Cloudflare

ELK / Kibana

Terraform / IaC

AWS

SIEM

Edge security platforms

Job description

Freelance Senior Security Engineer (DRWN)

Job title – Senior Security Engineer

Client Location – Berlin, Germany

Remote work offering – 20% (4 days per week on site)

Client Industry – E-commerce

Contract Length – 6 months (extension possible)

Contract type – Freelance

Project focus

Join the security team of a large online marketplace and take ownership of its edge and web application defense platform. You will tune WAF policies, rules and rate controls to cut attacks and false positives, investigate bot, scraping, credential stuffing and DDoS activity, support security incidents, and roll out configuration changes safely with tracking and rollback. The role also covers building attack reporting and dashboards, feeding findings into alerting, automating recurring tasks via APIs, infrastructure as code or scripting, onboarding new services with engineering teams, and documenting runbooks and rule decisions.

Key skills and Experience required

• Hands-on experience operating Akamai, Cloudflare or a comparable edge/WAF security platform
• Proven WAF rule tuning and false-positive handling in high-traffic environments
• Strong web security knowledge, including OWASP Top 10 and common HTTP attack patterns
• Investigating bot, scraping, credential stuffing and DDoS activity using SIEM, Kibana/ELK or similar
• Scripting in Python, shell or similar to automate security operations
• Hands-on AWS experience
• Understanding of prompt injection and AI-related attack vectors
• Incident response experience
• Fluent written and spoken English; German is a plus
• E-commerce or marketplace background is a plus