Distribusion Technologies

Senior Product Security Engineer (all genders)

Work from home

Remote role where the employee must remain based in a particular country.

Listed for Germany

From the employer's advert: We are one of the fastest growing startups in travel, backed by leading venture capital investors including TQ Ventures, Lightrock, Creandum, and Northzone, and are headquartered in Berlin, Germany.

Employer listed it 7 weeks ago · Added 5 weeks ago

Been open since 7 weeks ago. Long-running listings are sometimes left up after the role is filled.

Salary

Not stated

Location

Listed for Germany

Timezone

Not stated

Contract

Full-time

Experience

Senior

What the advert says

Quoted word for word from the employer's advert. Where it says nothing, we say so.

Working hours: Not mentioned in the advert
Where you can work from: Location eligibility not confirmed
Contract: Not mentioned in the advert
Experience asked for: Not mentioned in the advert
Pay: You will get a competitive salary.

Remote flexibility

Work from home

This is a remote role, but the employee must be based in Germany. It is work from home rather than work from anywhere.

What the employer says

Source listing states candidate location: "Remote job, Berlin, Germany, All, Remote"

What Nomaders makes of it

Residency required in Germany
Payroll and tax are likely handled in that country only

The quotes above are the employer's own words; the reading is ours. Always check the original listing and employment terms before working from another country.

Before you apply

Experience: employer states

Written as a requirement

“You bring 5+ years in Product/Application Security (or 3+ years plus a strong software engineering/web-pentesting background), with a track record of true ownership.”

Written as a nice-to-have

“Bonus Points: You have experience securing high-volume, multi-tenant B2B APIs and utilizing AI tooling to accelerate triage and review.”

Questions worth asking: Nomaders interpretation

The advert does not say where you can be based. Ask which countries they can legally employ or contract you from.
The advert does not say whether this is employment or a contractor arrangement. Ask, as it affects tax and benefits.

Produced automatically from this advert's text; not reviewed by a person. The employer's own page is the final word.

About the role

Distribusion is the world’s leading ground transportation marketplace and gives travellers seamless access to ground transportation online, from search to ticket purchase. We have built a cutting-edge B2B technology platform that connects bus, rail and ferry operators in 70+ countries with the biggest online retailers including Google Maps and Booking.com.

We are shaping the future of travel and building the largest global network of transport providers and retailers. We are one of the fastest growing startups in travel, backed by leading venture capital investors including TQ Ventures, Lightrock, Creandum, and Northzone, and are headquartered in Berlin, Germany. Following our recent $80m Series C funding, we are ready to push beyond.

We are looking for our first dedicated Senior Product/Application Security Engineer to build our AppSec practice from the ground up. This is a greenfield opportunity with a real attack surface: public partner-facing APIs and payment flows. You will own secure development, define what gets reviewed, implement security gates, build the "paved road" for ~150 engineers, and see the impact of your work in production within weeks.

What you will do:

Lead threat modeling and secure design reviews for high-risk changes, partner integrations, and payment flows.

Implement, tune, and enforce security gates in GitLab CI/CD (SAST, SCA, secrets scanning, and DAST) while minimizing developer friction.

Act as the primary technical owner for triaging, reproducing, and prioritizing findings from bug bounties, partner pentests, and automated scanners.

Work hands-on with the DevOps team to implement GCP organizational policies, IAM least-privilege architectures, and Cloud Armor (WAF/rate limiting).

Establish a security-champions network across engineering squads and leverage automation/AI-assisted tooling to scale code reviews effectively.

Own vulnerability management end to end: a risk-ranked backlog, remediation SLAs, an escalation path, and closing findings together with the teams.

Scope and coordinate the annual external penetration test and produce secure-development evidence for PCI-DSS and ISO 27001.

Workplace:

We are a remote-first company with teams located around the Globe and a HQ in Berlin.

Who you are:

You bring 5+ years in Product/Application Security (or 3+ years plus a strong software engineering/web-pentesting background), with a track record of true ownership.

You read and write production code (Python, Go, TypeScript, Ruby, etc.) and deeply understand web frameworks, CI/CD, and Kubernetes.

You have deep knowledge of web and API security, specifically authentication/authorization models (OAuth2, JWT), rate limiting, tenant isolation, IDOR, and XSS.

You have strong cloud security fundamentals (GCP preferred), specifically regarding public exposure, secrets hygiene, and WAF rules.

You have run threat modelling and secure design reviews on real systems (STRIDE or similar).

Hands-on with SAST/SCA/secrets scanning in CI (Aikido, Semgrep, Snyk or similar).

You prioritize by real-world risk, propose trade-offs rather than demanding perfection, and communicate complex risks plainly to engineers and leadership.

Bonus Points: You have experience securing high-volume, multi-tenant B2B APIs and utilizing AI tooling to accelerate triage and review.

What you can expect:

You will join a fast-paced travel tech company with a flat organizational structure.

Requirements

The employer hasn't listed requirements separately, they're described in the role summary above and on the original listing.

Benefits

No benefits package published with this listing. Ask about it at first interview.

How to apply

1Check the flexibility label above, work from home, matches where you plan to live and work.
2Tailor your CV to the role at Distribusion Technologies, mentioning your remote working experience.
3Apply directly on the employer's careers page using the button below. Nomaders never handles your application.

Found 1mo ago. Last checked today. Always confirm the details on the original posting, salary and location can change after publication.

Listing sourced from Company boards.