Описание:
Distribusion operates a ground transportation marketplace that gives travellers online access to search for and purchase tickets. Its B2B technology platform connects bus, rail, and ferry operators in over 70 countries with online retailers.
Задачи:
- Lead threat modeling and secure design reviews for high-risk changes, partner integrations, and payment flows
- Implement, tune, and enforce security gates in GitLab CI/CD, including SAST, SCA, secrets scanning, and DAST, while minimizing developer friction
- Triage, reproduce, and prioritize findings from bug bounties, partner penetration tests, and automated scanners as the primary technical owner
- Work with the DevOps team to implement GCP organizational policies, least-privilege IAM architectures, and Cloud Armor WAF and rate limiting
- Establish a security-champions network across engineering squads and use automation and AI-assisted tooling to scale code reviews
- Own end-to-end vulnerability management, including a risk-ranked backlog, remediation SLAs, an escalation path, and closing findings with teams
- Scope and coordinate the annual external penetration test and produce secure-development evidence for PCI-DSS and ISO 27001
Требования:
- 5+ Years of AppSec experience, or 3+ years plus a strong software engineering or web penetration testing background
- Track record of taking ownership
- Ability to read and write production code in languages such as Python, Go, TypeScript, or Ruby
- Deep understanding of web frameworks, CI/CD, and Kubernetes
- Deep knowledge of web and API security, including OAuth2, JWT, rate limiting, tenant isolation, IDOR, and XSS
- Strong cloud security fundamentals, preferably GCP, including public exposure, secrets hygiene, and WAF rules
- Experience running threat modeling and secure design reviews on real systems, using STRIDE or similar
- Hands-on experience with SAST, SCA, and secrets scanning in CI, using Aikido, Semgrep, Snyk, or similar
- Ability to prioritize real-world risk, propose trade-offs, and communicate complex risks clearly to engineers and leadership
- Будет плюсом: experience securing high-volume, multi-tenant B2B APIs, using AI tooling to accelerate triage and review
Условия:
Competitive salary Flexible work policy with the option to work remotely and international opportunities as the company expands globally
#J-18808-Ljbffr
application security engineer Arbeitgeber: Distribusion Technologies
Distribusion ist ein hervorragender Arbeitgeber, der seinen Mitarbeitern die Möglichkeit bietet, in einem dynamischen und innovativen Umfeld zu arbeiten. Mit einer starken Unternehmenskultur, die auf Zusammenarbeit und kontinuierlicher Verbesserung basiert, fördern wir das Wachstum unserer Mitarbeiter durch spannende Projekte und die Nutzung modernster Technologien. Unsere zentrale Lage in Berlin und die Flexibilität von hybriden oder remote Arbeitsmodellen machen uns zu einem attraktiven Arbeitsplatz für talentierte Fachkräfte, die die Zukunft des Reisens mitgestalten möchten.
Kontaktdaten:
Distribusion Technologies Recruiting-Team
