Information Security Engineer - Application Security

The role

You will review designs, threat model new features and triage vulnerabilities with R&D engineers. You will also build internal security tools, including a CVE registry and LLM-assisted code analysis workflows.

What you will do

• Triage findings from SCA, container and code scanning, external reports and internal testing, and agree fix, mitigate or accept with engineering.
• Run threat modeling sessions and design reviews with R&D teams for new features and architecture changes.
• Use and improve LLM-assisted tooling to review code, validate findings and reproduce issues.
• Contribute to the CVE registry and related security automation built on Camunda.
• Answer engineer questions, review pull requests, improve guidelines and occasionally run workshops.
• Share the InfoSec on-call rotation and help investigate and resolve security incidents.
• Help write security advisories, answer customer security questions and support audits.

Required qualifications

• Around 3+ years in security or software engineering, with at least 2 years in application or product security.
• Experience at a SaaS or software product company working with teams that ship often through CI/CD and cloud environments.
• Hands-on vulnerability triage with tools such as Snyk, Trivy, Semgrep or CodeQL, including assessing exploitability (CVSS, configuration).
• Threat modeling and design review experience (e.g. STRIDE) on real systems.
• Able to read Java well enough to follow a data flow and spot a security bug; can write scripts and small tools.
• Uses AI coding agents in daily work and reviews their output for security issues.
• Clear, friendly communication with engineers and non-specialists.

Nice to have

• Some Python and/or JavaScript experience, or experience building internal tools.
• Willingness to learn Camunda; prior BPMN or workflow experience.
• Experience responding to security incidents or being on an on-call rotation.
• Exposure to security advisories, CVE disclosure or bug bounty programmes.
• Knowledge of AI/LLM security risks.
• Experience securing Kubernetes or container-based workloads, or open-source or B2B software.

Benefits

• Work from anywhere with a home office budget and co-working space support.
• Flexible time off.
• Annual Kickoff, team offsites and Camundi Connection Budgets for in-person meetups.
• Locally tailored healthcare and Modern Health for mental wellbeing.
• Live Well Lifestyle Spending Account, launching in 2026 and scaling to €1,000 annually from 2027.
• Retirement and pension plans, often with company contributions, plus life and disability insurance where relevant.
• Up to $/€/£1,000 per year for self-driven learning.

Before you apply

• Camunda may use AI tools to aid screening of applications and during interviews.
• Hiring is location-based; candidates outside listed markets are hired via Remote.com.

About the company

Camunda is an enterprise platform for agentic orchestration, coordinating AI agents, people and systems across business processes. It is trusted by over 700 organizations worldwide.