9 hours ago
Remote, WorldwideMid Level
H1B sponsor
Responsibilities
- Triage vulnerabilities from SCA, container, code-scanning, external-report, and internal-testing sources and coordinate remediation, mitigation, or acceptance through release.
- Run threat-modeling sessions and security design reviews with R&D teams and convert findings into prioritized actions.
- Use and improve LLM-assisted tools, agents, prompts, and reusable skills for code review, finding validation, and issue reproduction.
- Build and maintain the CVE registry and security automation connecting scanners, engineering teams, and customer communications.
- Review pull requests, answer security questions, improve secure-development guidance, and lead occasional security workshops.
- Participate in the InfoSec on-call rotation and investigate and resolve security incidents.
- Write security advisories, answer customer security questions, and support audits.
Requirements
- Around 3+ years of experience in security or software engineering, including at least 2 years in application or product security.
- Experience at a SaaS or software product company working with engineering teams shipping through modern CI/CD and cloud environments.
- Hands-on vulnerability triage experience with tools such as Snyk, Trivy, Semgrep, or CodeQL, including assessing exploitability and false positives.
- Experience with threat modeling and design reviews, ideally for web applications, APIs, or distributed services.
- Ability to read Java sufficiently to follow data flow and identify security bugs, write scripts and small tools, and contribute to an existing codebase.
- Daily experience using AI coding agents such as Claude Code, Cursor, or Copilot, with judgment to validate their output.
- Clear and collaborative communication with software engineers and the ability to explain security risks to non-specialists.
- Some Python or JavaScript experience or experience building internal tools is preferred.
- Willingness to learn and use Camunda; prior BPMN or workflow experience is a plus.
- Experience with security incident response, on-call rotations, security advisories, CVE disclosure, or bug bounty programs is preferred.
- Knowledge of AI and LLM security risks, including OWASP Top 10 for LLMs or agentic applications, prompt injection, and tool abuse, is preferred.
- Experience securing Kubernetes or container-based workloads, open-source software, or B2B software is preferred.
Benefits
- Fully remote and global work arrangement with flexible working time.
- Home office budget, coworking-space support, and flexible time off.
- Annual kickoff events, team offsites, Camundi Connection Budgets, meetup support, and local gatherings.
- Locally tailored healthcare, Modern Health mental-wellbeing support, and the Live Well Lifestyle Spending Account.
- Retirement and pension plans, often with company contributions, plus life and disability insurance where applicable.
- Up to $/€/£1,000 per year for self-directed learning such as courses, certifications, and books.
- Equity through the Virtual Stock Option Plan where applicable.
Tech Stack
Categories
About Camunda
Camunda builds a process orchestration platform (Camunda 8) for enterprises to model, automate, and monitor complex workflows and decisions across systems, people, and AI agents. It sells commercial subscriptions and cloud services on top of its open-source Zeebe workflow engine, with governance and audit features suited to regulated environments. Founded in 2008 and headquartered in Berlin, it is privately held and serves large organizations across finance, insurance, and other industries.