Security Software Engineer (Junior)

Exact Software Germany GmbH; Delft; On-site; EUR 65,000 - 90,000; Full time

Job summary

Exact Software Germany GmbH in Delft seeks a software engineer focused on security operations to build secure tooling and IAM functionality, translating findings into fixes and contributing to defensive capabilities.

You will participate in structured security campaigns, validate vulnerabilities, and help the team shift security left. The role involves collaborating with engineers across languages and frameworks, communicating findings clearly and growing toward autonomy over time.

Qualifications

• Software engineer with real coding experience.
• Interest in application security and basics of pen testing (OWASP Top 10).
• Desire to understand how vulnerabilities are exploited and how attackers would use them.
• Basic threat modeling awareness and attack-surface thinking interest.
• Ability to read code across languages/frameworks.
• Clear, structured communication to engineers and non-technical stakeholders.
• Collaborative mindset with mentoring and growth toward autonomy.

Responsibilities

• Build secure tooling and playbooks to make secure software the default.
• Translate findings into concrete low-level fixes.
• Contribute to IAM functionality development.
• Participate in security campaigns: inventory, rank, investigate, report.
• Tackle low-level security issues and build tools to prevent insecure patterns.
• Improve shift-left security tooling and playbooks.
• Contribute to recurring scanning and testing, following up with engineering teams.

Skills

Software engineering background

Interest in application security

Threat modeling awareness

Communicating findings

Code reading across languages

Tools

Burp Suite

OWASP ZAP

Dependency tooling

Job description

This = the job

Security Operations is Exact's security engineering team, owning two areas: security across Exact's full product portfolio, and the development of Identity and Access Management (IAM) functionality used across Exact's products. The team builds secure tooling that integrates into engineering teams' existing workflows, bringing a security-first mindset into the development lifecycle (SSDLC). Automation covers what it can; manual, pentest-style testing covers what it can't.

This = the job that you aspire to

Within the team, you write code across several fronts: building secure tooling and playbooks that make secure software the default, translating findings into concrete low-level fixes, and contributing to the development of Identity and Access Management (IAM) functionality.

• When deeper investigation is needed, you take part in structured security campaigns: building an inventory of what needs to be checked, ranking findings by risk, investigating the highest-risk areas in depth, and reporting clearly on what was tested, what was found, and what remains open.
• You help tackle low-level security issues and build tools that prevent insecure software patterns.
• You help build and improve the team's shift-left security tooling and playbooks.
• You contribute to the team's recurring scanning and testing program, following up with engineering teams on findings.

This = your team

Security Operations is part of Technology, made up of security-minded software engineers who both build and break things: building secure tooling and IAM functionality, and testing systems the way an attacker would to see if they hold up. The team continuously refines its tooling, playbooks, and methods based on what it finds.

This = our tech stack

• Exact's core products are primarily built in C#/.NET.
• Across the wider Exact portfolio you will also encounter other languages, such as C, Python, and PHP — comfort reading unfamiliar code is useful, though you don't need to master every language.The team relies on a combination of automated scanning and dependency tooling, AI-assisted analysis, and manual, pentest-style testing with tools such as Burp Suite or OWASP ZAP.

This = what you bring

• A software engineering background (junior to medior level), you've written and shipped real code, ideally in C#/.NET or a comparable ecosystem.
• Genuine interest in application security and classical penetration-testing techniques: you know your way around the OWASP Top 10 (injection, broken authentication, IDOR, SSRF, and similar) and want to go deeper.
• A \"trace it to the source\" mindset: you want to understand not just that something is vulnerable, but why, and how an attacker would actually use it.
• Basic awareness of threat modeling concepts (e.g., STRIDE) and interest in growing into attack-surface thinking.
• Comfort reading code across different languages and frameworks.
• Clear, structured communication: you can explain a technical finding to both an engineer and a non-technical stakeholder.
• A collaborative, learning attitude: you are supported by senior colleagues and are expected to grow toward more autonomous work over time.

Nice to have (not required):

• Familiarity with the OWASP Top 10 and OWASP ASVS.
• CompTIA Security+ or an equivalent foundational security certification.
• eJPT (eLearnSecurity Junior Penetration Tester) or a similar hands-on/practical entry-level pentest credential.