Senior Application Security Engineer (all genders)

About This Opportunity

We are representing a confidential travel technology organization seeking their first dedicated Senior Application Security Engineer. This is a true greenfield role with immediate impact—you'll build the AppSec practice from scratch for a platform handling public APIs, payment flows, and active bug bounty programs. You'll define security standards, implement security gates, and enable approximately 150 engineers across global teams.

Location: Berlin (remote-first with optional office presence)

Responsibilities

• Lead threat modeling and secure design reviews for high-risk changes, partner integrations, and payment processing workflows
• Implement, tune, and enforce security gates in CI/CD pipelines (SAST, SCA, secrets scanning, DAST) while maintaining developer velocity
• Serve as primary technical owner for triaging, reproducing, and prioritizing findings from bug bounties, partner penetration tests, and automated scanners
• Collaborate hands-on with DevOps teams to implement cloud organizational policies, IAM least-privilege architectures, and WAF/rate limiting controls
• Establish and mentor a security-champions network across engineering squads
• Leverage automation and AI-assisted tooling to scale code review effectiveness

What We're Looking For

• 5+ years in Application Security, or 3+ years with strong software engineering or web penetration testing background
• Ability to read and write production code in languages such as Python, Go, TypeScript, or Ruby
• Deep understanding of web frameworks, CI/CD pipelines, and Kubernetes environments
• Expertise in web and API security, including authentication/authorization models (OAuth2, JWT), rate limiting, tenant isolation, IDOR, and XSS
• Strong cloud security fundamentals (GCP preferred), covering public exposure risks, secrets hygiene, and WAF configuration
• Risk-based prioritization approach with ability to propose pragmatic trade-offs and communicate complex security issues clearly to both engineers and leadership
• Bonus: Experience securing high-volume, multi-tenant B2B APIs and utilizing AI tooling to accelerate triage and review processes

How We Work With You

Candidates apply directly through Get A Job.ai. Our talent team will conduct an initial screening to understand your background and ensure alignment with the role requirements. Qualified candidates are then submitted to our client for consideration. Please do not attempt to contact the client organization directly, as all communication is managed through our recruitment process to ensure a streamlined experience for everyone involved.

Pay

Compensation details will be discussed with qualified candidates during the screening process based on experience level and location.

Equal Opportunity

Get A Job.ai is committed to providing equal employment opportunities to all applicants regardless of race, color, religion, sex, national origin, age, disability, or any other protected characteristic. We celebrate diversity and are dedicated to creating an inclusive environment for all candidates.