Information Security Engineer - Application Security

About this role

Join Camunda’s Information Security function in a hands-on application security role working closely with R&D. You’ll review designs and code, assess vulnerabilities, and build AI-assisted security workflows and internal tooling. The role also includes shared on-call and incident response duties.

About the company

Camunda is a software company that provides process management and automation solutions, enabling organizations to model, execute, and optimize business processes. They serve a range of industries with a focus on improving operational efficiency and collaboration.

The team

Information Security team

Stack

What you'll do

• Triage and validate findings from code, dependency, container, and external security reports; agree on remediation and track fixes through release.
• Lead threat-modeling sessions and security design reviews with R&D teams.
• Use and improve LLM-assisted code review and vulnerability-analysis workflows.
• Build and maintain the CVE registry and related security automation.
• Review code, advise engineers, and improve secure-development guidance.
• Participate in the InfoSec on-call rotation and investigate security incidents.
• Help prepare customer security advisories, respond to security questions, and support audits.

What we're looking for

• Around 3+ years in security or software engineering, including at least 2 years in application or product security.
• Experience at a SaaS or software product company working with engineering teams and modern CI/CD and cloud environments.
• Hands-on vulnerability triage and ability to assess exploitability and distinguish real issues from false positives.
• Practical threat-modeling and security design-review experience.
• Able to read Java code, follow data flows, write scripts and small tools, and contribute to an existing codebase.
• Regular use of AI coding tools for engineering or security work, with careful verification of their output.
• Clear, collaborative communication with engineers.

Nice to have

• Python or JavaScript experience, or experience building internal tools.
• BPMN or workflow experience, or willingness to learn Camunda.
• Incident-response or on-call experience.
• Experience with security advisories, CVE disclosure, or bug bounty programs.
• Knowledge of LLM and agentic-application security risks.
• Experience securing Kubernetes, containers, open-source software, or B2B products.

Benefits

• Remote work, flexible time off, home-office budget, and coworking-space support.
• Equity through a Virtual Stock Option Plan, where applicable.
• Annual learning budget of up to $/€/£1,000.
• Locally tailored healthcare, global mental-wellbeing support, and a lifestyle spending account.
• Retirement or pension plans, plus life and disability insurance where relevant.
• Annual company kickoff, team offsites, and connection budgets.