Information Security Engineer - Application Security

RemoteWork; United States; Remote; USD 120,000 - 180,000; Full time

Job summary

Camunda is seeking a security-focused engineer to own hands-on information security work with emphasis on application security. You will collaborate with R&D engineers to review designs, perform threat modeling, and build secure tooling.

Responsibilities include triaging vulnerabilities, conducting threat modeling, and supporting audits. Remote, international collaboration with a focus on SaaS security practices and CI/CD environments.

Qualifications

• 3+ years in security or software engineering with 2+ years in AppSec.
• Experience at a SaaS or software product company with CI/CD and cloud environments.
• Hands-on vulnerability triage using industry tools.

Responsibilities

• Triage vulnerabilities from SCA, container and code scanning, external reports, and internal testing.
• Conduct threat modeling and design reviews for new features and architecture changes.
• Perform code analysis with LLMs and validate findings to reproduce issues.
• Build and maintain internal security tooling and CVE registry integrations.
• Answer security questions, write advisories, and support customer audits.
• Participate in on-call rotation and incident response activities.

Skills

AppSec experience

Vulnerability triage

Threat modeling

Code reading/writing

AI coding agents usage

Tools

Snyk

Trivy

Semgrep

CodeQL

Job description

About the role

Camunda provides an enterprise platform for agentic orchestration, enabling coordination of AI agents, people, and systems across complex processes. This role owns the hands-on information security work focused on application security, collaborating with R D engineers to review designs, perform threat modeling, and build secure tooling.

What you'll do

• Triage vulnerabilities from SCA, container and code scanning, external reports, and internal testing
• Conduct threat modeling and design reviews for new features and architecture changes
• Perform code analysis with LLMs and validate findings to reproduce issues
• Build and maintain internal security tooling and CVE registry integrations
• Answer security questions, write advisories, and support customer audits
• Participate in on-call rotation and incident response activities

What they're looking for

• Around 3+ years in security or software engineering with at least 2 focused on AppSec
• Experience at a SaaS or software product company working with CI/CD and cloud environments
• Hands-on vulnerability triage with tools like Snyk, Trivy, Semgrep, or CodeQL
• Threat modeling and design review experience, ideally STRIDE on web apps, APIs or distributed services
• Ability to read and write code, comfortable with Java, and able to write scripts/tools
• Experience using AI coding agents in daily work and recognizing their limits

For applicants in Nigeria

• The listing states eligibility worldwide and remote work; no country-specific restriction is stated beyond worldwide eligibility
• Timezone expectations are not specified; confirm during interview
• Pay currency or range is not stated in the listing; confirm during interview
• The listing does not specify visa or work-authorization requirements; confirm during interview