Description review
Senior Application Security Engineer (all genders)
Distribusion Technologies GmbH · Remote · back to the listing
HR standards
65/100
needs work
Title ↔ description
92/100
strong
Reads as
Security Engineer
100% confident
What this role officially is
ICT security administrator — ESCO, the EU occupation classification
ICT security administrators plan and carry out security measures to protect information and data from unauthorised access, deliberate attack, theft and corruption.
Also known as: network security administrator, system security administrator, ICT security administrators, IT security administrator
How others title the same work
Large employers
- Security Risk Management Specialist Canonical Ltd.
- Security Software Engineer Canonical Ltd.
- Senior Security Operations Engineer Canonical Ltd.
- Staff Security Operations Engineer Canonical Ltd.
- Ubuntu Security Engineer Canonical Ltd.
Startups
- Security Engineer (Bangalore, India) AiPrise
- Security & Trust Engineer Alex
- Elucid | Senior Security Engineer | Boston, MA | ONSITE (hybrid) | $130k–$170k Elucid
- Factory | Security Engineer | ONSITE, San Francisco, CA | Full-Time Factory
- Factory | Security Engineer | Onsite in San Francisco | Full-time Factory
What the listing never says
- 16 bullet points. Long requirement lists deter qualified candidates, who read them as hard gates. Scope clarity
- No pay range published. Candidates cannot tell whether applying is worth their time. Pay transparency
The listing, marked up
Nothing in the wording of this listing tripped a check. The scores above still judge how complete and coherent it is.
Distribusion is the world’s leading ground transportation marketplace and gives travellers seamless access to ground transportation online, from search to ticket purchase. We have built a cutting-edge B2B technology platform that connects bus, rail and ferry operators in 70+ countries with the biggest online retailers including Google Maps and Booking.com.
We are shaping the future of travel and building the largest global network of transport providers and retailers. We are one of the fastest growing startups in travel, backed by leading venture capital investors including TQ Ventures, Lightrock, Creandum, and Northzone, and are headquartered in Berlin, Germany. Following our recent $80m Series C funding, we are ready to push beyond.
We are looking for our first dedicated Application Security Engineer to build our AppSec practice from the ground up. This is a greenfield opportunity with a real attack surface: public partner-facing APIs, payment flows, and active bug bounties. You will own secure development, define what gets reviewed, implement security gates, build the "paved road" for ~150 engineers, and see the impact of your work in production within weeks.
What you will do:
• Lead threat modeling and secure design reviews for high-risk changes, partner integrations, and payment flows.
• Implement, tune, and enforce security gates in GitLab CI/CD (SAST, SCA, secrets scanning, and DAST) while minimizing developer friction.
• Act as the primary technical owner for triaging, reproducing, and prioritizing findings from bug bounties, partner pentests, and automated scanners.
• Work hands-on with the DevOps team to implement GCP organizational policies, IAM least-privilege architectures, and Cloud Armor (WAF/rate limiting).
• Establish a security-champions network across engineering squads and leverage automation/AI-assisted tooling to scale code reviews effectively.
Workplace:
We are a remote-first company with teams located around the Globe.
Also, the HQ office is in Berlin, where the team often meets.
Requirements
Who you are:
• You bring 5+ years in AppSec (or 3+ years plus a strong software engineering/web-pentesting background), with a track record of true ownership.
• You read and write production code (Python, Go, TypeScript, Ruby, etc.) and deeply understand web frameworks, CI/CD, and Kubernetes.
• You have deep knowledge of web and API security, specifically authentication/authorization models (OAuth2, JWT), rate limiting, tenant isolation, IDOR, and XSS.
• You have strong cloud security fundamentals (GCP preferred), specifically regarding public exposure, secrets hygiene, and WAF rules.
• You prioritize by real-world risk, propose trade-offs rather than demanding perfection, and communicate complex risks plainly to engineers and leadership.
• Bonus Points: You have experience securing high-volume, multi-tenant B2B APIs and utilizing AI tooling to accelerate triage and review.
What you can expect:
• You will join a fast-paced travel tech company with a flat organizational structure.
• You will have exciting opportunities, ownership, and responsibility and contribute directly to the success of the company.
• You will join an international team of talented and driven people with a clear mission. Expect your colleagues to inspire, support and challenge you every day!
• We have a flexible work policy with the option of working remotely and international opportunities arising as we continue to expand our global footprint – Our heart is in Berlin, but you’ll find us across the globe.
• You will get a competitive salary.
Our hiring team for this role:
Your Talent Partner (TP) and point of contact is Lorena Rebenciuc, and the Hiring Manager (HM) is Ilya Isakov.
For any queries, contact your Talent Partner at .
Do you want to work on a product that is used by millions of people daily with a high load, availability and scalability, and most advanced technology? Come join us!
Originally posted on Himalayas
We are shaping the future of travel and building the largest global network of transport providers and retailers. We are one of the fastest growing startups in travel, backed by leading venture capital investors including TQ Ventures, Lightrock, Creandum, and Northzone, and are headquartered in Berlin, Germany. Following our recent $80m Series C funding, we are ready to push beyond.
We are looking for our first dedicated Application Security Engineer to build our AppSec practice from the ground up. This is a greenfield opportunity with a real attack surface: public partner-facing APIs, payment flows, and active bug bounties. You will own secure development, define what gets reviewed, implement security gates, build the "paved road" for ~150 engineers, and see the impact of your work in production within weeks.
What you will do:
• Lead threat modeling and secure design reviews for high-risk changes, partner integrations, and payment flows.
• Implement, tune, and enforce security gates in GitLab CI/CD (SAST, SCA, secrets scanning, and DAST) while minimizing developer friction.
• Act as the primary technical owner for triaging, reproducing, and prioritizing findings from bug bounties, partner pentests, and automated scanners.
• Work hands-on with the DevOps team to implement GCP organizational policies, IAM least-privilege architectures, and Cloud Armor (WAF/rate limiting).
• Establish a security-champions network across engineering squads and leverage automation/AI-assisted tooling to scale code reviews effectively.
Workplace:
We are a remote-first company with teams located around the Globe.
Also, the HQ office is in Berlin, where the team often meets.
Requirements
Who you are:
• You bring 5+ years in AppSec (or 3+ years plus a strong software engineering/web-pentesting background), with a track record of true ownership.
• You read and write production code (Python, Go, TypeScript, Ruby, etc.) and deeply understand web frameworks, CI/CD, and Kubernetes.
• You have deep knowledge of web and API security, specifically authentication/authorization models (OAuth2, JWT), rate limiting, tenant isolation, IDOR, and XSS.
• You have strong cloud security fundamentals (GCP preferred), specifically regarding public exposure, secrets hygiene, and WAF rules.
• You prioritize by real-world risk, propose trade-offs rather than demanding perfection, and communicate complex risks plainly to engineers and leadership.
• Bonus Points: You have experience securing high-volume, multi-tenant B2B APIs and utilizing AI tooling to accelerate triage and review.
What you can expect:
• You will join a fast-paced travel tech company with a flat organizational structure.
• You will have exciting opportunities, ownership, and responsibility and contribute directly to the success of the company.
• You will join an international team of talented and driven people with a clear mission. Expect your colleagues to inspire, support and challenge you every day!
• We have a flexible work policy with the option of working remotely and international opportunities arising as we continue to expand our global footprint – Our heart is in Berlin, but you’ll find us across the globe.
• You will get a competitive salary.
Our hiring team for this role:
Your Talent Partner (TP) and point of contact is Lorena Rebenciuc, and the Hiring Manager (HM) is Ilya Isakov.
For any queries, contact your Talent Partner at .
Do you want to work on a product that is used by millions of people daily with a high load, availability and scalability, and most advanced technology? Come join us!
Originally posted on Himalayas