Senior Product Security Engineer
MAM Gruppe
Ansprechpartner: Richard Brady
Berlin, Deutschland
ITHelmISO 27001Kubernetes-SicherheitAtlassian JiraDevOpsGitHubVulnerability ManagementTechnische Sicherheit
Beschreibung
Senior Product Security Engineer (f/m/d) – Remote/Berlin
Join a leading end-to-end encrypted communication platform revolutionizing secure collaboration for businesses, critical infrastructure, and governments. Our client provides organizations across the technology, finance, healthcare, and government sectors with the most secure communication experience possible, and is looking for a Senior Product Security Engineer to join their Information Security Team.
You will play an essential role in transforming how organisations and governments communicate securely, working closely with the Director of Information Security and interacting regularly with engineering, product, and other teams. This role has two areas of focus: Product Security and Platform Security.
Product Security
- Review security- or privacy-critical changes and implement or propose solutions to potential issues
- Help maintain security documentation of the product, with a focus on product certifications
- Communicate with internal and external stakeholders on product security topics
- Support new feature development from a security perspective, identifying possible security or privacy pitfalls early in the process
- Contribute to internal security audits, risk assessments, and threat modelling workshops
- Conduct security awareness training within your area of responsibility
Platform Security
- Own Platform Security controls
- Support technical due diligence to ensure compliance with information security and data protection requirements
- Oversee the incident management process and the team members involved in resolving incidents
- Help maintain documentation of security- and privacy-related processes
- Support identity and access management
- Drive the implementation and maintenance of SecOps measures for the platform
Essential
- Proficient understanding of secure software development practices, including threat modelling and security architecture review for products
- Hands-on experience assessing security and privacy risks in product features (e.g. authentication, encryption, data handling, APIs)
- Working knowledge of cloud security fundamentals (e.g. AWS) and common infrastructure tools (Kubernetes, Terraform, Helm)
- Experience supporting security certifications/compliance frameworks (e.g. ISO 27001, GDPR)
- Strong communication skills and experience engaging both technical and non-technical stakeholders on security and privacy topics
Strong Plus
- Relevant security and/or DevOps certifications (e.g. CKS)
- Familiarity with GitHub, Jira, and Confluence
Further Qualifications
- Good communicator, enjoys working in a team
- Interested in and keeps up with InfoSec trends and news
- Self-motivated to identify security problems and engage with teams to find solutions
- Programming experience, preferably with one or more of JavaScript, TypeScript, Swift, Kotlin, Java, Rust, or Haskell
- Thorough understanding of security code reviews, CVSS-based bug triage, and vulnerability management
- Practical, working understanding of cryptographic ciphers/algorithms and protocols (Elliptic Curve, TLS, PKI, Messaging Layer Security)
- Strong understanding of application security frameworks (OWASP Top 10)
- Thorough knowledge of OAuth, SSO, and Identity and Access Management systems
- Willing to undergo the S2 security check of the German Government
- Location: Remote from Germany or another EU country, with regular travel to Berlin for workshops and in-person collaboration
- Experience: 5-7 years in Product Security
Interested? Get in touch to find out more.