Senior Application Security Engineer (all genders)
Distribusion Technologies GmbH
WorldwideremotePosted 1 month ago
Skill Required
Application-Security-EngineerApplication-SecuritySecurity-EngineeringCybersecurityInfosecSenior-Application-Security-EngineerLead-Application-Security-EngineerApplication-Security-LeadApplication-Security-ArchitectSenior-DevSecOps-EngineerSecurity-EngineerSenior-Information-Security-EngineerSenior-Cloud-Security-Software-EngineerSenior-Principal-Security-EngineerSecurity EngineerApplication Developersecuritysoftware engineeringCloud SecurityEngineeringTypeScriptKubernetesautomationGitHub Actionsbuildingetc.)PythondesignDevOpsGitOAuthCI/CDCloudRubyAPIsOWASPGCPIAMJWTandGoFulltime
Key highlights
- Salary: competitive salary
- Company: Distributed is the world's leading ground transportation marketplace, backed by TQ Ventures, Lightrock, Creandum, and Northzone, with a recent $80m Series C
- Location: Remote-first with HQ in Berlin, Germany; teams located globally
- Scope: First dedicated AppSec hire, building the practice from the ground up for ~150 engineers
- Experience: 5+ years in AppSec (or 3+ years plus strong software engineering/web-pentesting background)
- Impact: See the impact of your work in production within weeks
Role overview
Distribusion is the world's leading ground transportation marketplace, connecting bus, rail, and ferry operators in 70+ countries with major online retailers including Google Maps and Booking.com. Headquartered in Berlin, Germany, the company is one of the fastest-growing startups in travel, backed by leading venture capital investors including TQ Ventures, Lightrock, Creandum, and Northzone, following a recent $80m Series C funding round.
Responsibilities
- Build the AppSec practice from the ground up (first dedicated Application Security Engineer)
- Lead threat modeling and secure design reviews for high-risk changes, partner integrations, and payment flows
- Implement, tune, and enforce security gates in GitLab CI/CD (SAST, SCA, secrets scanning, and DAST) while minimizing developer friction
- Act as the primary technical owner for triaging, reproducing, and prioritizing findings from bug bounties, partner pentests, and automated scanners
- Work hands-on with the DevOps team to implement GCP organizational policies, IAM least-privilege architectures, and Cloud Armor (WAF/rate limiting)
- Establish a security-champions network across engineering squads and leverage automation/AI-assisted tooling to scale code reviews effectively
- Own secure development, define what gets reviewed, and implement security gates
- See the impact of your work in production within weeks
Requirements
- 5+ years in AppSec (or 3+ years plus a strong software engineering/web-pentesting background), with a track record of true ownership
- Read and write production code (Python, Go, TypeScript, Ruby, etc.) and deeply understand web frameworks, CI/CD, and Kubernetes
- Deep knowledge of web and API security, specifically authentication/authorization models (OAuth2, JWT), rate limiting, tenant isolation, IDOR, and XSS
- Strong cloud security fundamentals (GCP preferred), specifically regarding public exposure, secrets hygiene, and WAF rules
- Prioritize by real-world risk, propose trade-offs rather than demanding perfection, and communicate complex risks plainly to engineers and leadership
Nice to have
- Experience securing high-volume, multi-tenant B2B APIs
- Utilizing AI tooling to accelerate triage and review
Benefits
- Competitive salary
- Remote-first company with flexible work policy
- International opportunities arising as the company expands its global footprint
- Opportunities, ownership, and responsibility; contribute directly to the success of the company
- Join an international team of talented and driven people with a clear mission; expect colleagues to inspire, support, and challenge you every day
- Flat organizational structure in a fast-paced travel tech company
- HQ office in Berlin where the team often meets
Additional details
- The role involves a real attack surface: public partner-facing APIs, payment flows, and active bug bounties
- You will be building the 'paved road' for ~150 engineers
- Your Talent Partner (TP) and point of contact is Lorena Rebenciuc, and the Hiring Manager (HM) is Ilya Isakov
- For any queries, contact the Talent Partner at [email]
- The product is used by millions of people daily with a high load, availability and scalability, and most advanced technology
- Team members are located around the globe
- Originally posted on Himalayas