Senior Application Security Engineer (Remote)

About the role

Distribusion Technologies, a Berlin-headquartered travel tech company providing a B2B platform that connects bus, rail and ferry operators across more than 70 countries, is hiring a Senior Application Security Engineer. The position is fully remote and serves as the technical lead for application security, the main point of contact for vulnerability management and risk assessment. The role cultivates a security-first culture by building a network of security champions across engineering squads and embedding security tooling into the development lifecycle.

Key responsibilities

• Integrate and tune security gates (SAST, SCA, DAST) in GitLab CI/CD pipelines so that developers face minimal friction.
• Own vulnerability management end to end: risk ranking, prioritisation, remediation SLAs and escalation paths.
• Work with DevOps on GCP organisational policies, IAM least-privilege architectures and Cloud Armor WAF rules.
• Lead design reviews for high-risk system changes, payment flows and new partner connections.
• Coordinate annual external penetration tests and help meet PCI-DSS and ISO 27001 requirements.
• Lead triage and reproduction of findings from bug bounty programmes and external pentests.

Required profile

• At least five years in product or application security, or three years plus a strong background in software engineering or web pentesting.
• Comfortable reading and writing production code in Python, Go, TypeScript or Ruby.
• Able to explain complex security risks clearly to engineers and management.

Required skills

• API security: OAuth2, JWT, tenant isolation, XSS and IDOR.
• GCP security fundamentals, including secret hygiene and public exposure management.
• Experience with automated scanners such as Semgrep, Aikido or Snyk.