Senior Product Security Engineer

Location: Remote-first; conditions list Berlin and Germany. The role is remote, with a flexible policy that also mentions hybrid work and a Berlin headquarters.

Company

hirify.global operates a B2B ground transportation marketplace and technology platform connecting bus, rail, and ferry operators with online retailers in more than 70 countries.

What you will do

• Build the AppSec practice from the ground up, owning secure development standards, review scope, security gates, and a secure “paved road” for approximately 150 engineers.
• Lead threat modeling and secure design reviews for high-risk changes, partner integrations, and payment flows.
• Implement and tune GitLab CI/CD security gates covering SAST, SCA, secrets scanning, and DAST while minimizing developer friction.
• Tri­age, reproduce, prioritize, and remediate findings from bug bounties, partner penetration tests, and automated scanners.
• Work with DevOps on GCP organizational policies, least-privilege IAM architectures, Cloud Armor, WAF rules, and rate limiting.
• Own vulnerability management, coordinate the annual external penetration test, develop a security-champions network, and produce secure-development evidence for PCI-DSS and ISO 27001.

Requirements

• 5+ years of Product/Application Security experience, or 3+ years combined with a strong software engineering or web penetration-testing background, including demonstrated ownership.
• Ability to read and write production code in languages such as Python, Go, TypeScript, or Ruby.
• Deep understanding of web frameworks, CI/CD, and Kubernetes.
• Deep knowledge of web and API security, including OAuth2, JWT, authentication and authorization models, rate limiting, tenant isolation, IDOR, and XSS.
• Strong cloud security fundamentals, preferably in GCP, including public exposure, secrets hygiene, and WAF rules.
• Experience running threat modeling and secure design reviews on real systems using STRIDE or a similar approach.
• Hands-on experience with SAST, SCA, and secrets scanning in CI, using tools such as Aikido, Semgrep, Snyk, or similar.
• Ability to prioritize by real-world risk, propose trade-offs, and communicate complex risks clearly to engineers and leadership.

Nice to have

• Experience securing high-volume, multi-tenant B2B APIs.
• Experience using AI tooling to accelerate triage and security reviews.

Culture & Benefits

• Remote-first, flexible work policy with remote and hybrid options.
• International team distributed across the globe, with a headquarters in Berlin.
• Fast-paced travel technology environment with a flat organizational structure.
• Opportunities for ownership, responsibility, and direct contribution to the product used by millions of people daily.
• Competitive salary.
• Full-time, permanent employment.