[Hiring] Information Security Engineer @Camunda

Role Description

Hi there! We're hiring an Information Security Engineer with a focus on Application Security to join our Information Security team at Camunda. We are a team that takes security seriously without making it feel like a locked door. We work in a transparent, straightforward way, and we care about doing the work right rather than just checking a compliance box.

You will work side by side with our R&D engineers:

• Reviewing designs, threat modeling new features, digging into code and helping teams make good, risk-based decisions about vulnerabilities.
• Building internal tools that scale, including our CVE registry and LLM-assisted workflows for code analysis and triage.

This is a hands-on role for someone who already has solid AppSec foundations and wants to grow. You will also take part in our on-call rotation and incident response, gaining exposure to other areas of security.

What You Will Do

• Vulnerability management: Triage findings from SCA, container and code scanning, external reports and internal security testing; assess whether Camunda is affected; agree on fix/mitigate/accept with engineering and follow through to release.
• Threat modeling and security reviews: Run threat modeling sessions and design reviews with R&D teams for new features and architecture changes, turning results into concrete, prioritized actions.
• Code analysis with LLMs: Use and improve LLM-assisted tooling to review code, validate findings and reproduce issues, applying your own judgement.
• Build internal security tooling: Contribute to the CVE registry and related automation that connects scanners, engineering teams, and customer communication.
• Help engineers do the secure thing by default: Answer questions, review pull requests, improve guidelines, and occasionally run a session or workshop.
• On-call and incident response: Share the InfoSec on-call rotation and help investigate and resolve security incidents.
• Support the wider team: Help write security advisories for customers, answer customer security questions, and support audits.

Qualifications

• Around 3+ years in security or software engineering, with at least 2 years in application or product security.
• Experience at a SaaS or software product company, working closely with engineering teams.
• Hands-on vulnerability triage experience with tools like Snyk, Trivy, Semgrep, CodeQL.
• Threat modeling and design review experience (e.g., STRIDE) on real systems, ideally web apps, APIs, or distributed services.
• Ability to read and write code, particularly in Java.
• Experience using AI coding agents in daily work.
• Clear, friendly communication with engineers.

Requirements

• Some Python and/or JavaScript experience, or experience building internal tools.
• Willingness to learn and use Camunda.
• Experience responding to security incidents or being part of an on-call rotation.
• Exposure to security advisories, CVE disclosure, or bug bounty programmes.
• Knowledge of AI/LLM security risks.
• Experience securing Kubernetes or container-based workloads.

Benefits

• Competitive, fair, and transparent compensation.
• Equity through our Virtual Stock Option Plan (VSOP).
• Remote & Flexible work options.
• In-person connection opportunities through annual kickoffs and team offsites.
• Access to locally tailored healthcare and mental wellbeing support.
• Retirement and pension plans, plus life and disability insurance.
• Up to $/€/£1,000 per year for self-driven learning.