Senior Application Security Engineer (all genders)

About the Position

Senior Application Security Engineer (all genders)

Distribusion is the world’s leading ground transportation marketplace, providing seamless access to ground transportation online. We connect bus, rail, and ferry operators in over 70 countries with major online retailers like Google Maps and Booking.com. We are seeking a dedicated Application Security Engineer to build our AppSec practice from the ground up. This is a greenfield opportunity with a real attack surface: public partner-facing APIs and payment flows. You will own secure development, define what gets reviewed, implement security gates, build the "paved road" for ~150 engineers, and see the impact of your work in production within weeks.

Responsibilities

• Lead threat modeling and secure design reviews for high-risk changes, partner integrations, and payment flows.
• Implement, tune, and enforce security gates in GitLab CI/CD (SAST, SCA, secrets scanning, and DAST) while minimizing developer friction.
• Act as the primary technical owner for triaging, reproducing, and prioritizing findings from bug bounties, partner pentests, and automated scanners.
• Work hands-on with the DevOps team to implement GCP organizational policies, IAM least-privilege architectures, and Cloud Armor (WAF/rate limiting).
• Establish a security-champions network across engineering squads and leverage automation/AI-assisted tooling to scale code reviews effectively.
• Own vulnerability management end to end: a risk-ranked backlog, remediation SLAs, an escalation path, and closing findings together with the teams.
• Scope and coordinate the annual external penetration test and produce secure-development evidence for PCI-DSS and ISO 27001.

Requirements

• 5+ years in AppSec (or 3+ years plus a strong software engineering/web-pentesting background), with a track record of true ownership.
• You read and write production code (Python, Go, TypeScript, Ruby, etc.) and deeply understand web frameworks, CI/CD, and Kubernetes.
• You have deep knowledge of web and API security, specifically authentication/authorization models (OAuth2, JWT), rate limiting, tenant isolation, IDOR, and XSS.
• You have strong cloud security fundamentals (GCP preferred), specifically regarding public exposure, secrets hygiene, and WAF rules.
• You have run threat modelling and secure design reviews on real systems (STRIDE or similar).
• Hands-on with SAST/SCA/secrets scanning in CI (Aikido, Semgrep, Snyk or similar).
• You prioritize by real-world risk, propose trade-offs rather than demanding perfection, and communicate complex risks plainly to engineers and leadership.
• Bonus Points: Experience securing high-volume, multi-tenant B2B APIs and utilizing AI tooling to accelerate triage and review.

We Offer

• Join a fast-paced travel tech company with a flat organizational structure.
• Exciting opportunities, ownership, and responsibility to contribute directly to the company's success.
• Join an international team of talented and driven people with a clear mission.
• Flexible work policy with the option of working remotely and international opportunities.
• Competitive salary.

About the Company

Distribusion is headquartered in Berlin, Germany, and is one of the fastest-growing startups in travel, backed by leading venture capital investors including TQ Ventures, Lightrock, Creandum, and Northzone. Following our recent $80m Series C funding, we are ready to push beyond.

Workplace

We are a remote-first company with teams located around the globe and a headquarters in Berlin, Germany.

Contact

For any queries, contact your Talent Partner at [email protected].

Do you want to work on a product that is used by millions of people daily with a high load, availability, and scalability, and the most advanced technology? Come join us!