About the Position

IT Security Engineer (m/f/d) – Application Security, SBOM & CRA

Join our team as an IT Security Engineer specializing in application security, SBOM, and CRA. Work remotely with occasional office visits in Bonn.

Responsibilities

Integrate SAST, SCA, secrets, IaC, and DAST scans (including Semgrep, Trivy, Grype, Gitleaks, Checkov, and VamiDAST) into our clients' CI/CD pipelines
Triage and assess findings, run reachability analyses, and advise development teams on remediation
Generate SBOMs (CycloneDX/SPDX), monitor vulnerabilities, and prepare reporting obligations under CRA Art. 14
Conduct security reviews and assessments along OWASP ASVS, MASVS, and SAMM, complemented by threat modeling
Evolve VamiAppSec together with the product team

Several years of experience in application security, DevSecOps, or security-focused software development
In-depth knowledge of the OWASP Top 10 and ASVS, secure development processes, and at least one programming language (e.g., Python, Java, TypeScript, or Go)
Hands-on experience with CI/CD (GitHub Actions, GitLab CI, or Azure DevOps) and container and cloud environments
Excellent German (at least C1) and good English

Remote-First: Flexible work from anywhere in Germany – we trust in results.
Professional Development: Certifications, training, and conferences – we invest in your growth.
Responsibility: Autonomous work on exciting projects for renowned clients.
Team: Small, highly motivated team with flat hierarchies and direct communication.
Fair Compensation: Competitive salaries, bonuses, and benefits – transparent and performance-based.
Impact: Your work makes organizations and critical infrastructure more secure.

Valeri Milke

Founder & CEO, VamiSec

Questions about the role? Email Valeri directly or apply via the form – we will get back to you within 3 working days.