IT Security Engineer; m​/f​/d Application Security, SBOM & CRA

Hybrid: mostly remote within Germany, occasionally at our Bonn office.

You bring security into everyday development: from the first commit to a CRA-ready release - with Vami App Sec  and VamiDAST.

• Integrate SAST, SCA, secrets, IaC and DAST scans (including Semgrep, Trivy, Grype, Gitleaks, Checkov and VamiDAST) into our clients' CI/CD pipelines
• Triage and assess findings, run reachability analyses and advise development teams on remediation
• Generate SBOMs (CycloneDX/SPDX), monitor vulnerabilities and prepare reporting obligations under CRA Art. 14
• Security reviews and assessments along OWASP ASVS, MASVS and SAMM, complemented by threat modeling
• Evolve Vami App Sec  together with the product team

• Several years of experience in application security, Dev Sec Ops  or security-focused software development
• In-depth knowledge of the OWASP Top 10 and ASVS, secure development processes and at least one programming language (e.g. Python, Java, Type Script or Go)
• Hands-on experience with CI/CD (Git Hub Actions, Git Lab CI or Azure Dev Ops) and container and cloud environments
• Excellent German (at least C1) and good English
• A plus: knowledge of the CRA, IEC 62443-4-1 or ISO/SAE 21434 and certifications such as OSWE, GWEB or CSSLP

• Integrate SAST, SCA, secrets, IaC and DAST scans (including Semgrep, Trivy, Grype, Gitleaks, Checkov and VamiDAST) into our clients' CI/CD pipelines
• Triage and assess findings, run reachability analyses and advise development teams on remediation
• Generate SBOMs (CycloneDX/SPDX), monitor vulnerabilities and prepare reporting obligations under CRA Art. 14
• Security reviews and assessments along OWASP ASVS, MASVS and SAMM, complemented by threat modeling
• Evolve Vami App Sec  together with the product team

• Several years of experience in application security, Dev Sec Ops  or security-focused software development
• In-depth knowledge of the OWASP Top 10 and ASVS, secure development processes and at least one programming language (e.g. Python, Java, Type Script or Go)
• Hands-on experience with CI/CD (Git Hub Actions, Git Lab CI or Azure Dev Ops) and container and cloud environments
  
  Excellent German (at least C1) and good English
• A plus: knowledge of the CRA, IEC 62443-4-1 or ISO/SAE 21434 and certifications such as OSWE, GWEB or CSSLP

Your contact Valeri Milke Founder & CEO, Vami Sec

Linked In

Flexible work from anywhere in Germany - we trust in results.

Certifications, training, and conferences - we invest in your growth.

Autonomous work on exciting projects for renowned clients.

Small, highly motivated team with flat hierarchies and direct communication.

Competitive salaries, bonuses, and benefits - transparent and performance-based.

Your work makes organizations and critical infrastructure more secure.