application security engineer

Bundesdruckerei-Gruppe is a technology company of the German federal government that contributes to Germany's and Europe's digital sovereignty through digital and security expertise. The group develops solutions for secure identities, modern public administration, and AI.

• Integrate security throughout the software development lifecycle, from design and threat modeling through secure implementation, release, and operations;
• Build and operate SAST, DAST, SCA, and secret-scanning tools in CI/CD pipelines;
• Conduct code reviews, vulnerability assessments, and threat modeling with development teams;
• Assess, prioritize, and track vulnerabilities, including remediation support;
• Support and coach Security Champions in development teams under central professional leadership;
• Contribute to quality gates and define security-related acceptance criteria;
• Advise business units on secure architecture and implementation decisions;
• Help develop standards, policies, and activity-oriented requirements for code security.

• Completed degree in computer science, information security, or IT security, or vocational training with several years of practical experience in information and IT security;
• Several years of experience in application security or software development with a security focus;
• Strong understanding of common vulnerability classes, including OWASP Top 10, secure development practices, and secure software architectures;
• Experience with threat modeling and AppSec tooling, especially SAST, DAST, and SCA, including CI/CD integration;
• Knowledge of at least one relevant programming language, such as Java, C#, Python, or JavaScript;
• Strong analytical thinking, prioritization skills, willingness to learn, and openness to new security threats and technologies;
• Moderation and consulting skills, teamwork, communication skills, and the ability to communicate security requirements appropriately in German and English at C1 level;
• Nice to have: knowledge of BSI IT-Grundschutz, especially BSI 200-2 and 200-3, relevant standards such as ISO 27001, certifications such as OSCP, OSWE, or GWAPT.

• Flexible working models and working hours;
• 30 Days of vacation per year;
• Modern equipment, agile development methods, and collaboration tools;
• Individual training opportunities and professional and leadership development programs;
• Sports partnerships, prevention courses, and running events;
• Company pension scheme;
• Capital-forming benefits;
• Support with childcare and care for relatives.