Product-Security-Engineer, Application-Security-Engineer, Security-Engineer Jobs

Distribusion is the world’s leading ground transportation marketplace and gives travellers seamless access to ground transportation online, from search to ticket purchase. We have built a cutting-edge B2B technology platform that connects bus, rail and ferry operators in 70+ countries with the biggest online retailers including Google Maps and Booking.com.

We are shaping the future of travel and building the largest global network of transport providers and retailers. We are one of the fastest growing startups in travel, backed by leading venture capital investors including TQ Ventures, Lightrock, Creandum, and Northzone, and are headquartered in Berlin, Germany. Following our recent $80m Series C funding, we are ready to push beyond.

We are looking for our first dedicated Senior Product/Application Security Engineer to build our AppSec practice from the ground up. This is a greenfield opportunity with a real attack surface: public partner-facing APIs and payment flows. You will own secure development, define what gets reviewed, implement security gates, build the "paved road" for ~150 engineers, and see the impact of your work in production within weeks.

What you will do:

• Lead threat modeling and secure design reviews for high-risk changes, partner integrations, and payment flows.

• Implement, tune, and enforce security gates in GitLab CI/CD (SAST, SCA, secrets scanning, and DAST) while minimizing developer friction.

• Act as the primary technical owner for triaging, reproducing, and prioritizing findings from bug bounties, partner pentests, and automated scanners.

• Work hands-on with the DevOps team to implement GCP organizational policies, IAM least-privilege architectures, and Cloud Armor (WAF/rate limiting).

• Establish a security-champions network across engineering squads and leverage automation/AI-assisted tooling to scale code reviews effectively.

• Own vulnerability management end to end: a risk-ranked backlog, remediation SLAs, an escalation path, and closing findings together with the teams.

• Scope and coordinate the annual external penetration test and produce secure-development evidence for PCI-DSS and ISO 27001.

Workplace:

We are a remote-first company with teams located around the Globe and a HQ in Berlin.

Requirements

Who you are:

• You bring 5+ years in Product/Application Security (or 3+ years plus a strong software engineering/web-pentesting background), with a track record of true ownership.

• You read and write production code (Python, Go, TypeScript, Ruby, etc.) and deeply understand web frameworks, CI/CD, and Kubernetes.

• You have deep knowledge of web and API security, specifically authentication/authorization models (OAuth2, JWT), rate limiting, tenant isolation, IDOR, and XSS.

• You have strong cloud security fundamentals (GCP preferred), specifically regarding public exposure, secrets hygiene, and WAF rules.

• You have run threat modelling and secure design reviews on real systems (STRIDE or similar).

• Hands-on with SAST/SCA/secrets scanning in CI (Aikido, Semgrep, Snyk or similar).

• You prioritize by real-world risk, propose trade-offs rather than demanding perfection, and communicate complex risks plainly to engineers and leadership.

• Bonus Points: You have experience securing high-volume, multi-tenant B2B APIs and utilizing AI tooling to accelerate triage and review.

What you can expect:

• You will join a fast-paced travel tech company with a flat organizational structure.

• You will have exciting opportunities, ownership, and responsibility and contribute directly to the success of the company.

• You will join an international team of talented and driven people with a clear mission. Expect your colleagues to inspire, support and challenge you every day!

• We have a flexible work policy with the option of working remotely and international opportunities arising as we continue to expand our global footprint – Our heart is in Berlin, but you’ll find us across the globe.

• You will get a competitive salary.

Our hiring team for this role:
Your Talent Partner (TP) and point of contact is Lorena Rebenciuc, and the Hiring Manager (HM) is Ilya Isakov.

For any queries, contact your Talent Partner at .

Do you want to work on a product that is used by millions of people daily with a high load, availability and scalability, and most advanced technology? Come join us!

Originally posted on Himalayas

Job Description:

DataRobot delivers AI that maximizes impact and minimizes business risk. Our platform and applications integrate into core business processes so teams can develop, deliver, and govern AI at scale. DataRobot empowers practitioners to deliver predictive and generative AI, and enables leaders to secure their AI assets. Organizations worldwide rely on DataRobot for AI that makes sense for their business — today and in the future.

DataRobot is seeking an experienced Staff Product Security Engineer to drive security innovation while ensuring our platform meets the rigorous demands of our Federal and Commercial customers. This is a highly technical, high-impact role where you will operate at the intersection of engineering, automation, and federal compliance (FedRAMP High / DoD IL5).

You will serve as a subject matter expert for our Federal group, handle high-stakes customer security inquiries, and build automation using Python and Go. This role requires a unique blend of technical expertise, regulatory fluency, and diplomatic communication skills to navigate complex customer conversations.

Key Responsibilities:

Federal Compliance & Strategy

• Lead Federal Security: Serve as a primary technical lead for the DataRobot Federal Group, driving the acquisition and maintenance of Authority to Operate (ATO) at FedRAMP High and DoD IL5 levels.

• Compliance Engineering: Translate complex federal controls (NIST 800-53) into actionable engineering requirements for commercial developers.

• Audit & Policy Management: Write and maintain security policies (SSPs) and procedures. Develop, track, and remediate Plans of Action and Milestones (POA&Ms) and provide technical evidence during third-party audits.

Security Engineering & Automation

• Automate Everything: Develop custom automation to manage security tooling and implement "Secure-by-Design" processes in the CI/CD pipeline using Python or Go.

• Container Security: Identify, design, and implement controls to safeguard our containerized production environments.

• Tooling Management: Deploy and manage security testing tools for SAST, DAST, and SCA analysis (e.g., Semgrep, Trivy, Burp Suite).

• Threat Modeling: Review technical designs for new features, performing threat models to prioritize risks and educate developer teams on secure coding practices.

Customer Trust & Vulnerability Management

• Customer Engagement: Act as the external face of DataRobot Security. Work directly with customers' security teams to resolve concerns regarding CVE exposure and architecture.

• Customer-Centric Communication: Balance business needs with security rigor. You must be able to stand firm on security policies while maintaining strong professional relationships through clear, diplomatic, and solutions-oriented communication.

Knowledge, Skills, and Abilities:

• Federal Fluency: Deep understanding of the FedRAMP authorization process, NIST 800-53, and DoD Cloud Computing Security Requirements Guide (SRG).

• Technical Proficiency:

  • Fluent in writing code using Python or Go to build security automation.

  • Must have a deep understanding of Linux containers (internals, security isolation).

  • Familiarity with Kubernetes orchestration is strongly preferred.

  • Hands-on experience with common security tools such as Semgrep, Trivy, and Burp Suite.

• Strategic Mindset: Experience determining not just how to fix a bug, but why it happened and how to prevent it systemically.

• Soft Skills: Strong leadership skills for guiding teams and liaising with various stakeholders.

Requisite Education and Experience:

• 8+ years of experience working in Information Security, with significant time spent in Product Security or AppSec roles.

• Bachelor's or Master's degree in Computer Science, Cybersecurity, Information Systems, or a related field (or equivalent experience).

The talent and dedication of our employees are at the core of DataRobot’s journey to be an iconic company. We strive to attract and retain the best talent by providing competitive pay and benefits with our employees’ well-being at the core. Here’s what your benefits package may include depending on your location and local legal requirements: Medical, Dental & Vision Insurance, Flexible Time Off Program, Paid Holidays, Paid Parental Leave, Global Employee Assistance Program (EAP) and more!

DataRobot Operating Principles:

• Wow Our Customers
• Set High Standards
• Be Better Than Yesterday
• Be Rigorous
• Assume Positive Intent
• Have the Tough Conversations
• Be Better Together
• Debate, Decide, Commit
• Deliver Results
• Overcommunicate

Research shows that many women only apply to jobs when they meet 100% of the qualifications while many men apply to jobs when they meet 60%. At DataRobot we encourage ALL candidates, especially women, people of color, LGBTQ+ identifying people, differently abled, and other people from marginalized groups to apply to our jobs, even if you do not check every box. We’d love to have a conversation with you and see if you might be a great fit.

DataRobot is proud to be an Equal Employment Opportunity and Affirmative Action employer. We do not discriminate based upon race, religion, color, national origin, gender (including pregnancy, childbirth, or related medical conditions), sexual orientation, gender identity, gender expression, age, status as a protected veteran, status as an individual with a disability, or other applicable legally protected characteristics. DataRobot is committed to working with and providing reasonable accommodations to applicants with physical and mental disabilities. Please see the United States Department of Labor’s EEO poster and EEO poster supplement for additional information.

Use of Artificial Intelligence in Our Hiring Process

DataRobot uses approved AI-powered tools to support the hiring process in selected regions. These tools may assist in writing job descriptions, reviewing applications, assessing qualifications, and evaluating candidate materials. All decisions regarding applications are made by members of the DataRobot team.

All applicant data submitted is handled in accordance with our Applicant Privacy Policy.

Originally posted on Himalayas

Product Security Engineer IV

College Board – Technology – Product Security

Location: 1) This is a fully remote role. Candidates who live near CB offices have the option of being fully remote or hybrid (Tuesday and Wednesday in office).

Type: This is a full-time position

About the Team 

The College Board Product Security team is a close-knit and enthusiastic group of technologists with a thirst for knowledge in security and cloud. We collaborate closely to investigate and solve problems and have strong alignment with our product teams to be a step ahead in securing the organization’s suite of products. We are an agile organization, embracing AI and cloud-native systems, and are focused on improving speed and security of service delivery in support of our important mission. Our team comes from a wide variety of backgrounds as well as experience within the security space and we work to ensure everyone on the team has a voice.

Product Security Engineers work closely with Product teams as well as other organizational stakeholder groups to achieve product and security business objectives. They support threat modelling, architecture design, and implementation of secure development practices. In addition, they help define organizational security standards and organizational capability and tooling adoption decisions.

About the Opportunity  

As a Product Security Engineer IV, you will work alongside other security engineers to support security across the development lifecycle for assigned College Board product teams. You will participate in threat modeling, vulnerability assessment, and design review—including for products that incorporate AI-powered features and use AI coding tools in development. You will build and apply your security knowledge on real work and document your findings clearly.

Day-to-day, you will conduct security code reviews, operate assigned security tooling, and support the remediation of identified vulnerabilities. You will also contribute to the Product Security Partners program, helping product engineers understand and apply secure development practices.

This is hands-on product security work with real stakes—your contributions help protect platforms that serve millions of students and educators worldwide.

In this role, you will:

Support Product Team Partnerships (55%)

• Participate in planning, grooming, and design sessions for assigned product teams; contribute to security discussions.

• Contribute to threat models and risk registers for assigned products; document findings clearly and escalate issues to leadership as needed.

• Conduct vulnerability assessments on assigned products; apply exploitability frameworks to support accurate risk prioritization.

• Apply CB's security policies, audit requirements (SOC 2, ISO 27002, PCI, PII), and GRC standards—with guidance—to support compliance activities.

• Review code and security design documentation; identify security issues and contribute feedback in design reviews.

• Support remediation of security gaps in assigned products; track and report progress against Product Security Framework requirements.

Support the Product Security Program (20%)

• Participate in security training sessions; help product engineers apply secure coding practices, including responsible use of AI coding tools.

• Support the Product Security Partners program by contributing to security champion activities in assigned product teams.

• Document security learnings and patterns; contribute to the team's shared knowledge base.

• Invest in developing your security expertise: learn from industry advancement, attend team learning events, apply new skills in your daily work, and contribute to Hackathons.

Contribute to Operational Improvement (25%)

• Operate and monitor assigned security tooling across cloud environments; support the integration of security controls into CI/CD pipelines.

• Contribute to security metrics tracking and reporting; collect and organize data that measures partner team security posture.

• Participate in agile ceremonies; manage assigned stories and tasks with clear documentation and timely delivery.

• Serve as on-call first responder for security tooling your team owns; support the Information Security team on incident response.

About you, you have

• 4+ years of experience in product security, application security, cloud security, or software engineering with security responsibilities.

• Deep application security knowledge, including common vulnerability classes (OWASP Top 10), secure coding practices, and security testing.

• Solid experience with securing AWS Services, AWS Secure Architectures, Application Security and Cloud Applications, including Software Supply Chain and micro service architecture

• Familiarity with cloud environments (AWS preferred) and CI/CD pipelines; developing knowledge of how security controls integrate into software delivery.

• Familiarity with audit and compliance frameworks such as SOC 2, ISO 27002, PCI, and PII, and the ability to apply them with guidance to product teams.

• Experience reading and reviewing code; proficiency or active development of skills in JavaScript/TypeScript or Python is a plus.

• Clear, concise written and verbal communication; the ability to document findings and explain security concepts to technical peers.

• A growth mindset: you seek feedback, apply it, and invest actively in developing your security expertise.

• Ability to travel 2-3 times per year to College Board offices in New York or Reston, VA.

All roles at College Board require:

• A passion for expanding educational and career opportunities and mission-driven work

• Curiosity and enthusiasm for emerging technologies, with a willingness to experiment with and adopt new AI-driven solutions and comfort with learning and applying new digital tools independently and proactively.

• Clear and concise communication skills, written and verbal

• A learner's mindset and a commitment to growth: welcoming diverse perspectives, giving and receiving timely, respectful feedback, and continuously improving through iterative learning and user input.

• A drive for impact and excellence: solving complex problems, making data-informed decisions, prioritizing what matters most, and continuously improving through learning, user input, and external benchmarking.

• A collaborative and empathetic approach: working across differences, fostering trust, and contributing to a culture of shared success

• Authorization to work in the United States

About Our Process

• Application review will begin immediately and will continue until the position is filled. This role is expected to accept applications for a minimum of 5 business days.

• While the hiring process may vary, it generally includes: resume and application submission, recruiter phone/video screen, hiring manager interview, performance exercise such as live coding, a panel interview, a conversation with leadership and reference checks.

What We Offer

At College Board, we offer more than a paycheck: we provide a meaningful career, a supportive team, and a comprehensive package designed to help you thrive. We’re a self-sustaining nonprofit that believes in fair and competitive compensation grounded in your qualifications, experience, impact, and the market.

A Thoughtful Approach to Compensation

• The hiring range for this role is $140,000 to $151,000.

• Your exact salary will depend on your location, experience, and how your background compares to others in similar roles at the College Board.

• We aim to make our best offer upfront, rooted in fairness, transparency, and market data.

• We adjust salaries by location to ensure fairness, no matter where you live.

You’ll have open, transparent conversations about compensation, benefits, and what it’s like to work at College Board throughout your hiring process. Check out our careers page for more.

Originally posted on Himalayas