Security Engineer II (Product Security)

Location: Berlin, Germany; hybrid work with two days per week on the Berlin campus

Company

hirify.global operates a local delivery and quick-commerce platform across around 65 countries, with technology supporting millions of users and vendors.

What you will do

• Run security assessments and code reviews for web and mobile applications, helping product teams remediate application-layer vulnerabilities including OWASP Top 10 issues.
• Support Bug Bounty and Vulnerability Disclosure Programs by triaging, validating, reproducing, routing, and tracking vulnerability reports against MTTR and SLA targets.
• Implement and maintain automated SAST, DAST, and SCA security testing in CI/CD pipelines.
• Participate in threat modeling and architecture reviews for new features and microservices using frameworks such as STRIDE.
• Use AI-driven tools to accelerate vulnerability triage, code analysis, security scripting, and daily workflows.
• Guide software engineers on secure coding standards, security best practices, and secure library use.

Requirements

• Solid knowledge of web and mobile application security, common vulnerability types including OWASP Top 10, and basic web/API security architectures.
• Ability to read and understand code in at least one modern language, such as Java, Python, Go, or TypeScript.
• Experience reproducing vulnerabilities such as XSS, SQL injection, IDOR, and authentication bypasses using tools such as Burp Suite or OWASP ZAP.
• Basic understanding of CI/CD systems such as GitHub Actions or GitLab CI, including how SAST and SCA scanners fit into developer workflows.
• Basic understanding of cloud concepts across AWS, GCP, or Azure, and container concepts including Docker and Kubernetes.
• Eagerness to use AI-driven tools, including LLM coding assistants, for security automation, triage, and analysis.
• Collaborative and empathetic communication skills for helping engineers resolve security issues without slowing development.

Nice to have

• Experience with Bug Bounty programs as a reporter or triager, or participation in CTF competitions.
• Familiarity with OAuth 2.0, OIDC, or SAML authentication and authorization standards.
• Foundational security certifications such as Security+, eJPT, or GWAPT.

Culture & Benefits

• Hybrid work with face-to-face collaboration at the Berlin campus two days per week.
• 27 days of annual holiday, plus an additional day in the second and third years of service.
• €1,000 educational budget, language courses, parental support, and access to Udemy Business.
• Health checkups, meditation and gym support, life and accident insurance, and a corporate pension plan.
• Employee Share Purchase Plan, sabbatical bank, public transportation ticket discount, and digital or food vouchers.
• Relocation support and information for moving to Berlin; benefits may vary for intern, working student, fixed-term, and part-time roles.

Hiring process

• Apply through the hirify.global careers application process.
• Interview preparation resources are available, including common interview questions and answers.
• Accessibility support can be requested during the interview process.