Information Security Engineer - Application Security
Camunda · Remote
About this role
## Information Security Engineer — Application Security ### About the role Camunda is hiring an **Information Security Engineer (Application Security)** to join the Information Security team. You’ll work closely with R&D engineers to review designs, perform threat modeling for new features, analyze code, and help teams make **risk-based decisions** about vulnerabilities. This is a **hands-on** role focused on AppSec and internal security tooling—supporting work such as a **CVE registry** and **LLM-assisted workflows** used to analyze code and triage findings. Camunda is **AI-first**, and AI agents are part of how the team reviews code, assesses vulnerabilities, and builds tools. You’ll also participate in an **on-call rotation** and **incident response**, gaining exposure to other security areas, though most of your time will be spent with engineers and building/maintaining internal processes and tools. --- ### What you will do - **Vulnerability management:** triage findings from SCA, container and code scanning, external reports, and internal security testing; assess impact; agree on fix/mitigate/accept with engineering; follow through to release. - **Threat modeling & security reviews:** run threat modeling sessions and design reviews with R&D teams; turn results into concrete, prioritized actions. - **Code analysis with LLMs:** use and improve LLM-assisted tooling to review code, validate findings, reproduce issues—while applying your own judgment. - **Build internal security tooling:** contribute to the **CVE registry** and automation connecting scanners, engineering teams, and customer communication. - **Enable secure development:** answer questions, review pull requests, improve guidelines, and occasionally run workshops. - **On-call & incident response:** investigate and resolve security incidents as part of the InfoSec rotation. - **Support the wider team:** help write security advisories, answer customer security questions, and support audits. --- ### What you will bring - **3+ years** in security or software engineering, with **at least 2 years** in application/product security (AppSec, product security, pentesting, or a security-focused developer role). - Experience at a **SaaS or software product company**, working closely with engineering teams shipping via **modern CI/CD** and cloud environments. - Strong **vulnerability triage** experience (e.g., Snyk, Trivy, Semgrep, CodeQL or similar), including explaining exploitability in context (e.g., CVSS, configuration). - **Threat modeling/design review** experience (e.g., STRIDE), ideally for web apps, APIs, or distributed services. - Ability to **read and write code** (Java is important here) and contribute to an existing codebase. - Experience using **AI coding agents** (e.g., Claude Code, Cursor, Copilot) and knowing when outputs need verification—especially for security. - Clear, friendly communication with engineers; you see yourself as an **enabler**, not a gatekeeper. --- ### Nice to haves - Some **Python and/or JavaScript** experience; experience building internal tools. - Willingness to learn **Camunda** (they build much of their security automation on it); BPMN/workflow experience is a plus. - Incident response / on-call experience. - Exposure to **security advisories, CVE disclosure, or bug bounty** programs. - Knowledge of **AI/LLM security risks** (e.g., OWASP Top 10 for LLMs/agentic apps, prompt injection, tool abuse). - Experience securing **Kubernetes/co
Listing freshness
CronJobs last confirmed this listing 1h ago. If its source stops confirming the opening for seven days, this page is removed from active inventory.