Find your next opportunity
Browse fresh openings from leading companies and apply with a resume tailored to the role.
Browse expert rolesBrowse expert rolesBrowse fresh openings from leading companies and apply with a resume tailored to the role.
Browse expert roles14303 openings
7385-7392 of 14303
Distribusion Technologies
Free to start · No card · 5 credits the moment you sign up
Distribusion is the world’s leading ground transportation marketplace and gives travellers seamless access to ground transportation online, from search to ticket purchase. We have built a cutting-edge B2B technology platform that connects bus, rail and ferry operators in 70+ countries with the biggest online retailers including Google Maps and Booking.com.
We are shaping the future of travel and building the largest global network of transport providers and retailers. We are one of the fastest growing startups in travel, backed by leading venture capital investors including TQ Ventures, Lightrock, Creandum, and Northzone, and are headquartered in Berlin, Germany. Following our recent $80m Series C funding, we are ready to push beyond.
We are looking for our first dedicated Senior Product/Application Security Engineer to build our AppSec practice from the ground up. This is a greenfield opportunity with a real attack surface: public partner-facing APIs and payment flows. You will own secure development, define what gets reviewed, implement security gates, build the "paved road" for ~150 engineers, and see the impact of your work in production within weeks.
What you will do:
Lead threat modeling and secure design reviews for high-risk changes, partner integrations, and payment flows.
Implement, tune, and enforce security gates in GitLab CI/CD (SAST, SCA, secrets scanning, and DAST) while minimizing developer friction.
Act as the primary technical owner for triaging, reproducing, and prioritizing findings from bug bounties, partner pentests, and automated scanners.
Work hands-on with the DevOps team to implement GCP organizational policies, IAM least-privilege architectures, and Cloud Armor (WAF/rate limiting).
Establish a security-champions network across engineering squads and leverage automation/AI-assisted tooling to scale code reviews effectively.
Own vulnerability management end to end: a risk-ranked backlog, remediation SLAs, an escalation path, and closing findings together with the teams.
Scope and coordinate the annual external penetration test and produce secure-development evidence for PCI-DSS and ISO 27001.
Workplace:
We are a remote-first company with teams located around the Globe and a HQ in Berlin.
Who you are:
You bring 5+ years in Product/Application Security (or 3+ years plus a strong software engineering/web-pentesting background), with a track record of true ownership.
You read and write production code (Python, Go, TypeScript, Ruby, etc.) and deeply understand web frameworks, CI/CD, and Kubernetes.
You have deep knowledge of web and API security, specifically authentication/authorization models (OAuth2, JWT), rate limiting, tenant isolation, IDOR, and XSS.
You have strong cloud security fundamentals (GCP preferred), specifically regarding public exposure, secrets hygiene, and WAF rules.
You have run threat modelling and secure design reviews on real systems (STRIDE or similar).
Hands-on with SAST/SCA/secrets scanning in CI (Aikido, Semgrep, Snyk or similar).
You prioritize by real-world risk, propose trade-offs rather than demanding perfection, and communicate complex risks plainly to engineers and leadership.
Bonus Points: You have experience securing high-volume, multi-tenant B2B APIs and utilizing AI tooling to accelerate triage and review.
What you can expect:
You will join a fast-paced travel tech company with a flat organizational structure.
You will have exciting opportunities, ownership, and responsibility and contribute directly to the success of the company.
You will join an international team of talented and driven people with a clear mission. Expect your colleagues to inspire, support and challenge you every day!
We have a flexible work policy with the option of working remotely and international opportunities arising as we continue to expand our global footprint – Our heart is in Berlin, but you’ll find us across the globe.
You will get a competitive salary.
Our hiring team for this role:
Your Talent Partner (TP) and point of contact is Lorena Rebenciuc, and the Hiring Manager (HM) is Ilya Isakov.
For any queries, contact your Talent Partner at talent@distribusion.com.
Do you want to work on a product that is used by millions of people daily with a high load, availability and scalability, and most advanced technology? Come join us!
Start with a role or skill you want to use in your next job. Use the location and role filters to narrow the results, then open a listing to review the description. A title alone rarely explains the level of responsibility, working arrangement, or experience a team needs. Compare those details before deciding which opportunities deserve a tailored application.
Employers use different titles for similar work. If an exact phrase produces no results, try a shorter title, a core skill, or an alternative name for the role. Remove one filter at a time to understand which requirement is narrowing your search. A broader search can reveal suitable work without asking you to change your actual qualifications.
For each promising listing, read the responsibilities and separate essential requirements from preferences. Note the location, schedule, employment type, and compensation when provided. Missing details are questions to confirm with the employer. A remote opening may still require a particular country, work authorization, or time-zone overlap, so check the full posting before treating it as a location-independent opportunity.
Choose a few examples that demonstrate the skills this employer names. Explain your contribution and its outcome, using accurate numbers where available. Put the most relevant experience first and keep your resume easy to scan. Avoid adding technologies, qualifications, or achievements simply because they appear in a description. Your application should make your existing strengths easier to understand.
Follow the employer’s instructions for resumes, cover letters, work samples, and screening questions. Review the exported file before submitting it: confirm that contact details are correct, text can be selected, and links reach the intended pages. A resume check can help you spot unclear writing before you apply. Its feedback is advisory and does not predict a hiring decision.
Listings are collected from external sources and may change after they appear here. The employer or recruiting destination controls whether applications are open. If an original link is unavailable, check the company’s careers page for the title or move to another opening. An employer website link is a place to check current vacancies, rather than confirmation that a particular job is still accepting applications.
Keep a simple record of the company, role, job reference, application date, and documents you sent. Record any follow-up instructions and the next action you plan to take. This makes it easier to prepare for interviews, compare opportunities, and avoid applying repeatedly to the same opening through different boards. Review your shortlist as employers update their listings and prioritize opportunities with clear requirements that match the work you want to do.