Job Summary

Responsibilities
Build automation to continuously assess security risks around our AWS/Google cloud infrastructure and further SaaS tools we integrate with like GitHub
Triage reports from our bug-bounty program with the development teams and coordinate a responsible disclosure with the reporters
Organize pen-testing and audits of our software and infrastructure
Define security requirements (encryption, backups, data retention, …) together with our backend and web teams and automate their enforcement
Extend our CI/CD process with automatic security scanning for vulnerable dependencies, static code analysis and compliance checks
Support new projects and features early in the process with your expertise; Create security requirements and test cases where needed

Why you will love it
You’ll work in a flat hierarchy structure, where ideas are heard and implemented without multiple levels of gatekeeping.
You have the freedom to organize yourself the way you work best, using the tools you love.
With 20mio users from our own apps and external integrations we face massive traffic and continuous attempts for finding vulnerabilities
You join a new team with the opportunity to influence and design new approaches and processes.
Your effort matters: You will protect the personal data of millions of cyclists, hikers and outdoor enthusiasts all over the world.
We let you work from wherever you want, be it a beach, the mountains, our headquarters in Potsdam or anywhere that lies between the time zones UTC-1 and UTC+3.

Requirements
Have 3+ years of experience managing AWS organizations. You know the ins and outs of AWS when it comes to security.
Have 3+ years of experience security a typical web-stack environment – you’re familiar with typical risks in development and operations, and how to address them
You are not afraid of using wireshark to debug an issue
Are highly self-driven, responsible and keen to learn and improve
Have solid programming skills for automation in python and bash
Can read and understand code snippets in java/javascript/c
Java development and oauth2 experience is a plus