Information Security Engineer - Application Security

Camunda; United States; Remote; USD 120,000 - 193,000; Full time

Benefits offered by this job

Remote & Flexible

In Person Connection

Health & Wellbeing

Job summary

Camunda, an AI-first enterprise platform, is hiring an Information Security Engineer focused on Application Security. Join a security‑minded team working with R&D to review designs, model threats, examine code, and build scalable internal tooling.

You’ll contribute to CVE registries, AI-assisted workflows, and secure-by-default guidance across engineering. You’ll spend time with engineers, participate in on‑call rotation, and support customer security inquiries and audits, while growing in a

Qualifications

• 3+ years in security or software engineering, with at least 2 in AppSec or product security.
• Experience at a SaaS or software product company.
• Hands-on vulnerability triage with tools like Snyk, Trivy, Semgrep, CodeQL.
• Threat modeling and design review experience (e.g., STRIDE) on real systems.
• Ability to read/write code and follow data flows in Java; scripts/tools contribution.
• Experience using AI coding agents and ensuring second-look reviews for security.

Responsibilities

• Triage findings from SCA, container and code scanning and external reports.
• Run threat modeling sessions and design reviews with R&D teams.
• Use LLM-assisted tooling to review code, validate findings and reproduce issues.
• Build internal security tooling and CVE registry automation.
• Help engineers adopt secure defaults; review PRs and run workshops.
• Participate in on-call rotation and incident response.
• Draft security advisories for customers and support audits.

Skills

Security

SaaS

Vulnerability triage

Threat modeling

Code reading/writing

AI tooling

Clear communication

Tools

Snyk

Trivy

Semgrep

CodeQL

Job description

Camunda is the enterprise platform for agentic orchestration, enabling organizations to coordinate AI agents, people, and systems across complex, end-to-end business processes. With built-in governance, auditability, and human oversight, Camunda gives enterprises the control they need to move AI from pilots to production — safely and at scale. Trusted by over 700 organizations worldwide, including 9 of top 10 US banks, Camunda helps enterprises boost operational efficiency, accelerate time-to-value, and deliver better customer experiences.
Fully remote and global, we are in the middle of something bigger: transforming into an AI-first organisation, built on our own platform. We use Agentic AI to automate, orchestrate intelligent processes, and elevate human contribution across every team.
Named GP Bullhound’s Top 100 Next Unicorn list, 2025 Great Place to Work certified. Visionaryin 2025 Gartner® Magic Quadrant™for Business Orchestration and Automation Technologies. ranked 3rd in Flexa's 2026 Most Flexible Companies, We’re growing fast and looking for top talent to join our team. If you want meaningful work, visible impact and put something genuinely rare on your CV, keep reading.

About the Role:

Hi there! We're hiring an Information Security Engineer with a focus on Application Security to join our Information Security team at Camunda.

We are a team that takes security seriously without making it feel like a locked door. We work in a transparent, straightforward way, and we care about doing the work right rather than just checking a compliance box.

You will work side by side with our R&D engineers: reviewing designs, threat modeling new features, digging into code and helping teams make good, risk-based decisions about the vulnerabilities that come in. You'll also help build the internal tools that make this work scale, including our CVE registry and the LLM-assisted workflows we use to analyse code and triage findings.

Camunda is an AI-first company, and InfoSec is no exception: AI agents are part of how we review code, assess vulnerabilities, and build our tools. You will help shape how that works.

This is a hands‑on role for someone who already has solid AppSec foundations and wants to grow. We are a generalist team, so you will also take part in our on‑call rotation and incident response, and get exposure to other areas of security. But most of your time will be spent with engineers and building and maintaining internal tools and processes.

What You Will Do

• Vulnerability management: triage findings from SCA, container and code scanning, external reports and internal security testing; assess whether Camunda is actually affected; agree fix / mitigate / accept with engineering and follow through to release.

• Threat modeling and security reviews: run threat modeling sessions and design reviews with R&D teams for new features and architecture changes, and turn the results into concrete, prioritised actions.

• Code analysis with LLMs: use and improve LLM-assisted tooling (agents, prompts, reusable skills) to review code, validate findings and reproduce issues, while applying your own judgement to know when the model is wrong.

• Build internal security tooling: contribute to the CVE registry and related automation that connects scanners, engineering teams, and customer communication. Much of it is built on Camunda itself.

• Help engineers do the secure thing by default: answer questions, review pull requests, improve guidelines and occasionally run a session or workshop.

• On‑call and incident response: share the InfoSec on‑call rotation with the other engineers and help investigate and resolve security incidents.

• Support the wider team: help write security advisories for our customers, answer customer security questions and support audits.

What You Will Bring to the Role

• Around 3+ years in security or software engineering, with at least 2 of them working on application or product security (AppSec, product security, pentesting, or a security‑focused developer role all count).

• Experience at a SaaS or software product company, working closely with engineering teams that ship often through modern CI/CD and cloud environments.

• Hands‑on vulnerability triage: you've worked with tools like Snyk, Trivy, Semgrep, CodeQL or similar, can tell a real issue from a false positive, and can explain how exploitable something actually is in context (CVSS, exploitability, configuration).

• Threat modeling and design review experience (e.g. STRIDE) on real systems, ideally web apps, APIs, or distributed services.

• You read and write code. You're comfortable reading Java (Camunda is built on it) well enough to follow a data flow and spot a security bug. You can write scripts and small tools and contribute to an existing codebase with review.

• You build with AI, not just chat with it. You use AI coding agents (Claude Code, Cursor, Copilot or similar) in your daily work to write tools, analyse code or automate tasks. And you know their output still needs a second look, especially when it comes to security.

• Clear, friendly communication with engineers. You see yourself as an enabler, not a gatekeeper, and you can explain risk to people who aren't security specialists.

Nice to haves

• Some Python and/or JavaScript experience, or experience building internal tools.

• Willingness to learn and use Camunda, since we build a lot of our own security automation on it. Prior BPMN / workflow experience is a plus.

• Experience responding to security incidents or being part of an on‑call rotation.

• Exposure to security advisories, CVE disclosure or bug bounty programmes.

• Knowledge of AI/LLM security risks (OWASP Top 10 for LLMs / agentic apps, prompt injection, tool abuse).

• Experience securing Kubernetes or container‑based workloads, or open‑source / B2B software.

This role is an existing vacancy

#LI-SG1 #LI-Remote #C1 #USEAST

What We Have to Offer:

Compensation

We offer competitive, fair, and transparent compensation. Salary ranges are location‑based, with Standard and Major markets (global tech hubs) reflecting local competition.

The Annual Total Target Cash (base salary + 100% variable target, where applicable) shown below spans from the minimum in a Standard market to the maximum in a Major market. Final offers depend on skills, experience, and location, and we typically hire in the first half of the range to allow room for growth:

• United States: $119,900.00 to $193,200.00

• United Kingdom: £75,300.00 to £123,800.00

• Singapore: S$148,900.00 to S$223,300.00

If you’re based elsewhere, you’ll be hired via Remote.com (our global employer partner), and your Talent Acquisition Partner will provide a personalized Total Rewards Calculator after your first interview.

Equity: We also offer equity (where applicable) through our Virtual Stock Option Plan (VSOP).

Benefits & Perks

We invest in your wellbeing, growth, and ability to connect, along with perks that support you no matter where you’re based. Our benefits are globally designed and locally delivered where applicable.

• Remote & Flexible: Work from anywhere with the setup that suits you, home office budget, co‑working space support, and flexible time off to recharge when you need it.

• In Person Connection: We invest in meaningful face time through our Annual Kickoff (Vienna in 2025, Madrid in 2026!), team offsites, and Camundi Connection Budgets, including contributing to meetups while travelling,, and local gatherings with fellow Camundi.

• Health & Wellbeing: Access locally tailored healthcare, Modern Health for global mental wellbeing, and our Live Well Lifestyle Spending Account (LSA), a flexible, global benefit that puts you in control of your whole life, not just work, from: staying active, to caring for family, exploring personal passions, meaningful experiences, and investing in your financial wellbeing. The Live Well program launches in 2026 and scales to €1,000 annually from 2027.

• Financial Security: Retirement and pension plans (often with company contributions), plus life and disability insurance where relevant.

• Professional Growth: Up to $/€/£1,000 per year for self‑driven learning: courses, certifications, books, you decide!

AI in our hiring process

Camunda may use AI tools to aid the screening of applications and during the interview process. You can learn more here.

“Everyone is welcome at Camunda” — it’s a celebrated component of our culture. We strive to create an inclusive environment that empowers our people. At Camunda, we honour diverse cultures and backgrounds and are proud to be an equal opportunity employer. All qualified applicants will receive consideration without regard to gender, race, ethnicity, religion, belief, sexual orientation, age, disability or any other protected characteristics under applicable law. We are looking forward to your application!

Come join us and be part of Camunda’s incredible journey: Make an impact at a pivotal moment in our story!

Note for recruiting and placement agencies: Camunda does not accept unsolicited agency resumes. Please do not forward resumes to our careers site, employees, or any other Camunda contact unless we have specifically engaged your firm for that search. Camunda will not pay fees related to unsolicited resumes.
For information about how your personal data is processed, please refer to Camunda’s Applicant Privacy Policy. We note that phone numbers and SMS opt‑in data are not shared, sold, or rented to third parties or affiliates for marketing or promotional purposes.

By opting in to SMS use, please be aware that:

• Text message frequency may vary;

• Standard text message and data rates may apply; and

• By opting in, you will be enrolled directly in ongoing recruiting text messages from Camunda.

To opt‑out, simply select 'No' when prompted during your application. You can also change your preferences at any time by contacting [e-mail].