Software built by the teams we review is now bought by many German companies, and those buyers ask detailed questions about access and data separation. That is why we are hiring an Application Security Engineer in Germany. Full-time and remote from anywhere in Germany; the San Francisco team is nine hours behind.
You review the parts of an application that decide who can use it and what they can see, and you write down exactly how to reproduce what you find.
In scope
- Review authorization in APIs: role checks, tenant boundaries and object ownership
- Test sign-in, session expiry and whether access ends after sign-out, a password change or account removal
- Check webhook signatures, replay handling and how credentials for outside services are stored
- Trace which vulnerable dependencies are reachable from production code paths
- Write findings that name the route handler, query or token check involved, with steps to reproduce
Out of scope
- Network penetration tests and red-team exercises
- Production access, unless agreed in writing
Before you apply, check
- A degree in computer science, IT security or a related field, or comparable training
- You read code in at least one of Python, JavaScript or TypeScript, Java or Go
- Working knowledge of the OWASP Top 10 and of how authentication and sessions work
- First security experience: an internship, CTFs, bug bounty reports or a thesis count
Also counts
Burp Suite, OSCP or eWPT, threat modelling, code reviews on a product team.
What Latchform covers
- Permanent full-time contract, from home anywhere in Germany
- 30 days' holiday a year plus public holidays
- A company pension (bAV) that Latchform pays into
- A yearly budget for training, certifications and conference tickets
- A laptop, a second screen and a home office allowance
- Flexible hours, with team calls agreed in advance
Company note
Latchform is an application security consultancy in San Francisco. We review the code and design decisions that control who can use an application and what it lets them reach, and every finding comes with steps an engineer can repeat.
#LI-Remote
Application Security Engineer in Berlin Arbeitgeber: Latchform
Latchform bietet eine dynamische Arbeitsumgebung, die Remote-Arbeit unterstützt und ein gesundes Gleichgewicht zwischen Berufs- und Privatleben fördert. Das Unternehmen legt Wert auf berufliche Entwicklung und bietet Möglichkeiten zur Verbesserung der Fähigkeiten seiner Mitarbeiter.
