Senior Product Security Engineer (all genders)
Job description
First dedicated Senior Product/Application Security Engineer to build the AppSec practice from the ground up, owning secure development for public partner-facing APIs and payment flows. The role defines review processes, implements security gates, and builds a paved road for ~150 engineers.
At a glance
- Work mode
- Remote · Berlin, Germany
- Languages
- English
What you'll do
- Lead threat modeling and secure design reviews for high-risk changes, partner integrations, and payment flows
- Implement, tune, and enforce security gates in GitLab CI/CD (SAST, SCA, secrets scanning, and DAST) while minimizing developer friction
- Act as the primary technical owner for triaging, reproducing, and prioritizing findings from bug bounties, partner pentests, and automated scanners
- Work hands-on with the DevOps team to implement GCP organizational policies, IAM least-privilege architectures, and Cloud Armor (WAF/rate limiting)
- Establish a security-champions network across engineering squads and leverage automation/AI-assisted tooling to scale code reviews effectively
- Own vulnerability management end to end: a risk-ranked backlog, remediation SLAs, an escalation path, and closing findings together with the teams
- Scope and coordinate the annual external penetration test and produce secure-development evidence for PCI-DSS and ISO 27001
What we're looking for
- 5+ years in Product/Application Security (or 3+ years plus a strong software engineering/web-pentesting background), with a track record of true ownership
- Read and write production code (Python, Go, TypeScript, Ruby, etc.) and deeply understand web frameworks, CI/CD, and Kubernetes
- Deep knowledge of web and API security, specifically authentication/authorization models (OAuth2, JWT), rate limiting, tenant isolation, IDOR, and XSS
- Strong cloud security fundamentals (GCP preferred), specifically regarding public exposure, secrets hygiene, and WAF rules
- Have run threat modelling and secure design reviews on real systems (STRIDE or similar)
- Hands-on with SAST/SCA/secrets scanning in CI (Aikido, Semgrep, Snyk or similar)
- Prioritize by real-world risk, propose trade-offs rather than demanding perfection, and communicate complex risks plainly to engineers and leadership
Nice to have
- Experience securing high-volume, multi-tenant B2B APIs
- Utilizing AI tooling to accelerate triage and review
Benefits
Flexible work policy with the option of working remotely and international opportunities arising as we continue to expand our global footprint
- Join a fast-paced travel tech company with a flat organizational structure
- Exciting opportunities, ownership, and responsibility and contribute directly to the success of the company
- Join an international team of talented and driven people with a clear mission
- Competitive salary
Apply
Direct apply at Distribusion Technologies
Opens the job posting at Distribusion Technologies
About Distribusion Technologies
The world's leading ground transportation marketplace
Distribusion gives travellers seamless access to ground transportation online, from search to ticket purchase. It has built a B2B technology platform that connects bus, rail and ferry operators in 70+ countries with the biggest online retailers including Google Maps and Booking.com.
Key facts
- Berlin, Germany
- ground transportation marketplace / travel tech
- Connects bus, rail and ferry operators in 70+ countries with online retailers including Google Maps and Booking.com
- One of the fastest growing startups in travel
- Backed by leading venture capital investors including TQ Ventures, Lightrock, Creandum, and Northzone
- Recently raised $80m Series C funding
- Remote-first company with teams located around the Globe and a HQ in Berlin
Partners & customers