IT Security Engineer (m/f/d) - Application Security, SBOM & CRA
Hybrid: mostly remote within Germany, occasionally at our Bonn office.
You bring security into everyday development: from the first commit to a CRA-ready release - with VamiAppSec and VamiDAST.
- Integrate SAST, SCA, secrets, IaC and DAST scans (including Semgrep, Trivy, Grype, Gitleaks, Checkov and VamiDAST) into our clients' CI/CD pipelines
- Triage and assess findings, run reachability analyses and advise development teams on remediation
- Generate SBOMs (CycloneDX/SPDX), monitor vulnerabilities and prepare reporting obligations under CRA Art. 14
- Security reviews and assessments along OWASP ASVS, MASVS and SAMM, complemented by threat modeling
- Evolve VamiAppSec together with the product team
Your profile
- Several years of experience in application security, DevSecOps or security-focused software development
- In-depth knowledge of the OWASP Top 10 and ASVS, secure development processes and at least one programming language (e.g. Python, Java, TypeScript or Go)
- Hands-on experience with CI/CD (GitHub Actions, GitLab CI or Azure DevOps) and container and cloud environments
- Excellent German (at least C1) and good English
- A plus: knowledge of the CRA, IEC 62443-4-1 or ISO/SAE 21434 and certifications such as OSWE, GWEB or CSSLP
Your responsibilities
- Integrate SAST, SCA, secrets, IaC and DAST scans (including Semgrep, Trivy, Grype, Gitleaks, Checkov and VamiDAST) into our clients' CI/CD pipelines
- Triage and assess findings, run reachability analyses and advise development teams on remediation
- Generate SBOMs (CycloneDX/SPDX), monitor vulnerabilities and prepare reporting obligations under CRA Art. 14
- Security reviews and assessments along OWASP ASVS, MASVS and SAMM, complemented by threat modeling
- Evolve VamiAppSec together with the product team
Your profile
- Several years of experience in application security, DevSecOps or security-focused software development
- In-depth knowledge of the OWASP Top 10 and ASVS, secure development processes and at least one programming language (e.g. Python, Java, TypeScript or Go)
- Hands-on experience with CI/CD (GitHub Actions, GitLab CI or Azure DevOps) and container and cloud environmentsExcellent German (at least C1) and good English
- A plus: knowledge of the CRA, IEC 62443-4-1 or ISO/SAE 21434 and certifications such as OSWE, GWEB or CSSLP
Your contact Valeri Milke Founder & CEO, VamiSec
valeri.milke@vamisec.com LinkedIn
Flexible work from anywhere in Germany - we trust in results.
Professional Development
Certifications, training, and conferences - we invest in your growth.
Responsibility
Autonomous work on exciting projects for renowned clients.
Team
Small, highly motivated team with flat hierarchies and direct communication.
Competitive salaries, bonuses, and benefits - transparent and performance-based.
Impact
Your work makes organizations and critical infrastructure more secure.
#J-18808-Ljbffr
IT Security Engineer (m/f/d) – Application Security, SBOM & CRA in Bonn Arbeitgeber: VamiSec GmbH
VamiSec GmbH ist ein hervorragender Arbeitgeber, der seinen Mitarbeitern nicht nur ein dynamisches und innovatives Arbeitsumfeld bietet, sondern auch flexible Arbeitsmodelle, die eine ausgewogene Work-Life-Balance fördern. Mit über 15 Jahren Erfahrung in der IT-Sicherheitsbranche und einem engagierten Team von Experten haben Mitarbeiter die Möglichkeit, sich kontinuierlich weiterzuentwickeln und an spannenden Projekten zu arbeiten, die den neuesten Standards entsprechen. Die Unternehmenskultur legt großen Wert auf Zusammenarbeit, Kreativität und individuelle Entwicklung, was VamiSec zu einem attraktiven Arbeitsplatz in Bonn macht.
