Senior Application Security Engineer (all genders)

Distribusion Technologies is currently scaling its global ground transportation marketplace following a significant $80 million Series C funding round. As one of the fastest-growing entities in the travel tech sector, they provide a B2B platform that integrates bus, rail, and ferry operators across more than 70 countries. With high-profile partners like Google Maps and Booking.com, the firm is seeking a Senior Application Security Engineer to fortify their digital infrastructure as they expand their international network.

About the role

This position is fully remote, offering a unique opportunity to join a Berlin-headquartered team that operates at the intersection of high-volume travel logistics and advanced software engineering. You will serve as the technical lead for application security, acting as the primary point of contact for vulnerability management and risk assessment.

The role requires someone who balances technical rigour with a pragmatic approach to development. Rather than simply acting as a gatekeeper, you will be expected to cultivate a culture of security by establishing a "security-champions" network across various engineering squads and integrating security tooling directly into the development lifecycle.

Your primary objective is to harden the platform against threats while ensuring that the developer experience remains fluid and efficient. Key responsibilities include:

• **Secure Development Lifecycle:** Integrating and tuning security gates—such as SAST, SCA, and DAST—within GitLab CI/CD pipelines to ensure automated protection with minimal friction.
• **Vulnerability Governance:** Owning the end-to-end management of vulnerabilities, from risk ranking and prioritization to defining remediation SLAs and managing escalation paths.
• **Cloud & Infrastructure Security:** Collaborating with the DevOps team to manage GCP organisational policies, implementing IAM least-privilege architectures, and configuring WAF rules via Cloud Armor.
• **Threat Modelling:** Leading design reviews for high-risk system changes, payment flow integrations, and new partner connections.
• **Compliance:** Coordinating annual external penetration tests and ensuring the organization meets stringent security standards like PCI-DSS and ISO 27001.
• **Incident Response:** Serving as the technical lead for triaging and reproducing security findings from bug bounty programmes and external pentests.

What they're looking for

The ideal candidate will have at least five years of experience in product or application security, or three years of experience combined with a strong background in software engineering or web pentesting. You should be comfortable reading and writing production-grade code in languages such as Python, Go, TypeScript, or Ruby.

Additional technical requirements include:

• **Deep Web Security Expertise:** Proficiency in API security, specifically concerning OAuth2, JWT, tenant isolation, XSS, and IDOR vulnerabilities.
• **Cloud Proficiency:** Strong fundamentals in Google Cloud Platform (GCP) security, specifically regarding secret hygiene and public exposure management.
• **Communication Skills:** The ability to translate complex security risks into actionable advice for engineers and management, prioritizing real-world threats over abstract perfection.
• **Tooling Experience:** Hands-on experience with automated security scanners like Semgrep, Aikido, or Snyk.

For South African tech professionals, this role represents an excellent opportunity to join a high-growth European startup in a fully remote capacity. Roles of this nature, particularly those focusing on high-volume B2B API security and cloud governance, typically command competitive, market-related remuneration packages that align with international standards. In the current SA landscape, senior security engineers who combine coding proficiency with cloud-native security knowledge are in high demand across the fintech, travel, and logistics sectors, offering a clear growth path toward Principal Security Engineer or Head of Security roles.

• You bring 5+ years in Product/Application Security (or 3+ years and a strong software engineering/web-pentesting background), with a track record of true ownership.
• You read and write production code (Python, Go, TypeScript, Ruby, etc.) and deeply understand web frameworks, CI/CD, and Kubernetes.
• You have deep knowledge of web and API security, specifically authentication/authorization models (OAuth2, JWT), rate limiting, tenant isolation, IDOR, and XSS.
• You have strong cloud security fundamentals (GCP preferred), specifically regarding public exposure, secrets hygiene, and WAF rules.
• You have run threat modelling and secure design reviews on real systems (STRIDE or similar).
• Hands-on with SAST/SCA/secrets scanning in CI (Aikido, Semgrep, Snyk or similar).
• You prioritize by real-world risk, propose trade-offs rather than demanding perfection, and communicate complex risks plainly to engineers and leadership.
• Bonus Points: You have experience securing high-volume, multi-tenant B2B APIs and utilizing AI tooling to accelerate triage and review.