Staff Security Engineer (all genders

Staff Security Engineer (all genders) Arbeitsort

Berlin

We are looking for a
Staff Security Engineer
to join the Security Tribe and help shape the next generation of security capabilities at Hello Fresh.

This is a senior individual contributor role for someone who is deeply technical, pragmatic, and builder‑minded. You will work across
Cloud Security, Application & Product Security, Offensive Security, and GenAI Security
, with a strong focus on creating scalable internal security products, paved roads, guardrails, and self‑service capabilities for Hello Fresh teams.

You will not only identify risks, but also build the systems, automation, and platforms that help engineering teams move faster and safer.

Above all, we are looking for people who will
make Hello Fresh
better.We believe there are many different ways of developing skills and we love diverse experiences! So even if you don’t “tick all the boxes” but think you’d thrive in this role, we would really like to learn more about you.

• Own and elevate secure design and architecture at scale across Hello Fresh
  — championing a security‑by‑design culture by defining, driving, and embedding robust architectural patterns, reference designs, and guardrails that enable teams to build secure systems by default across the organization.
• Define and drive security architecture across our cloud environments, with a strong focus on AWS, Kubernetes, IAM, network security, workload protection, secrets management, and secure‑by‑default infrastructure.
• Build and scale cloud security guardrails using automation, policy‑as‑code, Infrastructure as Code, and platform‑native controls.
• Partner with engineering and product teams to embed security into the SDLC through threat modeling, secure design reviews, security testing, and developer‑friendly remediation workflows.
• Build internal security products and capabilities that make security self‑serviceable for Hello Fresh employees and engineering teams.
• Lead initiatives across SAST, DAST, SCA, IaC scanning, secret detection, vulnerability management, and software supply chain security.
• Drive offensive security activities including penetration testing, adversary simulation, purple teaming, and validation of detection and response capabilities.
• Establish security patterns and controls for GenAI and AI/ML systems, including LLM applications, AI agents, RAG systems, model integrations, prompt injection risks, data leakage, and AI governance.
• Coordinate with external security partners, auditors and consultants to properly scope, conduct and review external security engagements.
• Use GenAI as a force multiplier to reduce operational toil, improve security workflows, automate analysis, and accelerate internal capability building.
• Mentor senior engineers, influence technical direction, and act as a trusted security advisor across engineering, product, platform, data, and leadership teams.

• 8+ years of experience in security engineering, software engineering, cloud security, application security, or offensive security.
• Deep hands‑on experience securing cloud‑native environments, preferably AWS, with strong knowledge of IAM, Kubernetes, networking, logging, detection, and infrastructure security.
• Strong application and product security experience, including threat modeling, secure architecture reviews, OWASP risks, API security, and SDLC security.
• Practical offensive security experience, including penetration testing, vulnerability research, exploitability analysis, or red/purple team exercises.
• Strong engineering skills in
  one or more programming languages (e.g., Python, Go, Java, Type Script), with the ability to build production‑grade systems and security tooling.
• Experience building automation, internal tools, developer platforms, security guardrails, or self‑service security capabilities.
• Experience securing GenAI, LLM, AI agent, RAG, or ML systems.
• Familiarity with OWASP Top 10 for LLMs, MITRE ATLAS, NIST AI RMF, AI gateways, LLM guardrails, prompt evaluation, or AI red teaming.
• Familiarity with modern security tooling such as CNAPP/CSPM, SAST, DAST, SCA, IaC scanning, secret scanning, WAF, SIEM, EDR, or…