Application security engineer

Software built by the teams we review is now bought by many German companies, and those buyers ask detailed questions about access and data separation. That is why we are hiring an Application Security Engineer in Germany. Full-time and remote from anywhere in Germany; the San Francisco team is nine hours behind. Latchform is an application security consultancy in San Francisco. We review the code and design decisions that control who can use an application and what it lets them reach, and every finding comes with steps an engineer can repeat.

• Review authorization in APIs: role checks, tenant boundaries and object ownership
• Test sign-in, session expiry and whether access ends after sign-out, a password change or account removal
• Check webhook signatures, replay handling and how credentials for outside services are stored
• Trace which vulnerable dependencies are reachable from production code paths
• Write findings that name the route handler, query or token check involved, with steps to reproduce

• A degree in computer science, IT security or a related field, or comparable training
• You read code in at least one of Python, JavaScript or TypeScript, Java or Go
• Working knowledge of the OWASP Top 10 and of how authentication and sessions work
• First security experience: an internship, CTFs, bug bounty reports or a thesis count
• Будет плюсом: Burp Suite, OSCP or eWPT, threat modelling, code reviews on a product team

• Permanent full-time contract, from home anywhere in Germany
• 30 days' holiday a year plus public holidays
• A company pension (bAV) that Latchform pays into
• A yearly budget for training, certifications and conference tickets
• A laptop, a second screen and a home office allowance
• Flexible hours, with team calls agreed in advance