Senior Security Engineer - Application Security

Creandum; Berlin; Vor Ort; EUR 90.000 - 130.000; Vollzeit

Zusammenfassung

Trade Republic in Berlin is seeking a Senior Security Engineer to safeguard applications and the development lifecycle. You will partner with engineering to embed security from design through deployment and lead testing and automation efforts across the stack.

You will perform threat modeling, code reviews, and security testing, while advancing secure coding standards and security tooling in CI/CD pipelines.

Qualifikationen

• 5+ years as a Security Engineer with 4+ years focused on application security
• Deep understanding of web application security (OWASP Top 10, API security, authentication/authorization)
• Hands-on experience with security testing tools (Burp Suite, OWASP ZAP, Semgrep)
• Strong programming skills in modern languages (Python, Java, Kotlin, Go, or JavaScript)
• Experience integrating security tooling into CI/CD pipelines (GitHub Actions, GitLab CI, Jenkins)
• Expertise in secure architecture patterns for microservices, APIs, and distributed systems
• Solid understanding of cryptography, secure session management, and identity/access management
• Hands-on experience with security testing of cryptocurrency/blockchain infrastructure and applications is a major bonus
• Experience with mobile application security (iOS/Android)
• Knowledge of compliance frameworks (PCI-DSS, GDPR, MaRisk) is advantageous
• Excellent communication skills to translate security concepts for engineering audience

Aufgaben

• Embed security into the software development lifecycle from design to deployment
• Conduct security code reviews, threat modeling, and architecture reviews
• Design and implement SAST, DAST, and SCA solutions
• Build and maintain application security testing automation in CI/CD
• Develop secure coding standards and reusable security components
• Perform penetration testing and vulnerability assessments
• Triage, prioritize, and remediate vulnerabilities with development teams
• Create security champions program and provide training to engineers
• Research emerging threats and integrate defenses into architecture
• Coordinate with external researchers for bug bounty programs

Kenntnisse

Security engineering

Web app security

Security testing tools

Programming languages

CI/CD security tooling

Secure architecture

Cryptography and IAM

Mobile app security

Compliance (PCI-DSS GDPR MaRisk)

Communication skills

Tools

Burp Suite

OWASP ZAP

Semgrep

Jobbeschreibung

Please note that this position is based in Berlin or London.

THE BEST WORK OF YOUR CAREER

Trade Republic is the largest savings platform in Europe - we operate in 17 countries, serving +8 million customers who trusted us with over 100B in assets. But we’re striving for more.

We have a bold mission to empower everyone to build wealth with easy, safe, and free access to financial systems. You will have the opportunity to grow your career by collaborating with a team of outstanding talents and state of the art technology to build a lasting, positive future for millions.

WHAT YOU'LL BE DOING

As a Senior Security Engineer in our Application Security team, you'll safeguard Trade Republic's applications and development lifecycle through proactive security integration and engineering excellence. Your responsibilities include:

• Partner with engineering teams to embed security into the software development lifecycle from design to deployment;
• Conduct security code reviews, threat modeling sessions, and architecture reviews for critical applications and services;
• Design and implement SAST, DAST, and SCA solutions to identify vulnerabilities early in the development process;
• Build and maintain application security testing automation within CI/CD pipelines;
• Develop secure coding standards, security libraries, and reusable security components for engineering teams;
• Perform penetration testing and vulnerability assessments of web applications, APIs, and mobile applications;
• Triage, prioritise, and remediate application vulnerabilities working closely with development teams;
• Create security champions program and provide security training to engineering teams;
• Research emerging application security threats and integrate defensive measures into the security architecture;
• Contribute to bug bounty program management and coordinate with external security researchers

WHAT WE'RE LOOKING FOR

Core Experience:

• 5+ years as a Security Engineer with 4+ years focused on application security
• Deep understanding of web application security (OWASP Top 10, API security, authentication/authorization)
• Hands-on experience with security testing tools (Burp Suite, OWASP ZAP, Semgrep, etc.)
• Strong programming skills in modern languages (Python, Java, Kotlin, Go, or JavaScript)
• Experience integrating security tooling into CI/CD pipelines (GitHub Actions, GitLab CI, Jenkins)
• Expertise in secure architecture patterns for microservices, APIs, and distributed systems
• Solid understanding of cryptography, secure session management, and identity/access management
• Hands-on experience with security testing of cryptocurrency/blockchain infrastructure and applications is a major bonus
• Experience with mobile application security (iOS/Android)
• Knowledge of compliance frameworks (PCI-DSS, GDPR, MaRisk) is advantageous
• Excellent communication skills to translate security concepts for engineering audience

WHY YOU SHOULD APPLY NOW

Our culture rewards ownership, excellence, and high energy. We care deeply about outcomes and hold each other accountable - we’re here to win and fix one of the largest challenges Europeans face - closing the pension gap and democratising wealth. If this gets you fired up, reach out!

We believe it’s our team’s varied identities and backgrounds that make us sharper and stronger. We’re committed to creating an environment where everyone feels respected and has equal opportunity to thrive in their careers. For any questions on DEI during the interview process, reach out to your recruitment partner.