Information Security Engineer - Application Security

About Camunda

Camunda is the enterprise platform for agentic orchestration, enabling organizations to coordinate AI agents, people, and systems across complex, end-to-end business processes. With built-in governance, auditability, and human oversight, Camunda gives enterprises the control they need to move AI from pilots to production safely and at scale. Trusted by over 700 organizations worldwide, including 9 of top 10 US banks, Camunda helps enterprises boost operational efficiency, accelerate time-to-value, and deliver better customer experiences.

Fully remote and global, we are transforming into an AI-first organization built on our own platform. We use Agentic AI to automate, orchestrate intelligent processes, and elevate human contribution across every team.

About the Role

We are hiring an Information Security Engineer with a focus on Application Security to join our Information Security team. We are a team that takes security seriously without making it feel like a locked door. We work in a transparent, straightforward way, and care about doing the work right rather than just checking a compliance box.

You will work side-by-side with R&D engineers reviewing designs, threat modeling new features, digging into code, and helping teams make good, risk-based decisions about vulnerabilities. You will also help build internal security tools, including our CVE registry and LLM-assisted workflows used to analyze code and triage findings.

This is a hands-on generalist security role for someone with solid AppSec foundations looking to grow. You will also take part in our on-call rotation and incident response.

What You Will Do

• Vulnerability Management: Triage findings from SCA, container and code scanning, external reports, and internal security testing; assess impact on Camunda; agree on fix/mitigate/accept decisions with engineering and follow through to release.
• Threat Modeling & Design Reviews: Conduct threat modeling sessions and design reviews with R&D teams for new features and architecture changes, turning results into prioritized actions.
• Code Analysis with LLMs: Utilize and refine LLM-assisted tooling (agents, prompts, reusable skills) to review code, validate findings, and reproduce issues while maintaining critical human judgment.
• Build Internal Security Tooling: Contribute to the CVE registry and automation connecting scanners, engineering teams, and customer communication (much of it built on Camunda itself).
• Enable Engineering: Answer security questions, review pull requests, improve guidelines, and run workshops.
• On-Call & Incident Response: Share on-call rotation with other InfoSec engineers and assist in investigating and resolving security incidents.
• Team Support: Write security advisories for customers, respond to customer security questions, and support compliance audits.

What You Will Bring

• Experience: ~3+ years in security or software engineering, with at least 2 years focused on application or product security (AppSec, product security, pentesting, or security-focused development).
• SaaS / Cloud Context: Experience working closely with engineering teams in SaaS/software environments shipping frequently via modern CI/CD and cloud setups.
• Hands-on Triage: Proficiency with tools like Snyk, Trivy, Semgrep, CodeQL or similar; ability to distinguish false positives and evaluate real-world exploitability (CVSS, configuration, context).
• Threat Modeling: Experience conducting design reviews and threat modeling (e.g., STRIDE) on web apps, APIs, or distributed services.
• Code Literacy: Ability to read Java (Camunda’s core stack) well enough to trace data flows and spot security bugs. Capability to write scripts, small tools, and contribute code.
• AI Tooling: Daily use of AI coding agents (Claude Code, Cursor, Copilot, etc.) to automate tasks, build tools, or analyze code, with an understanding of AI security limitations.
• Communication: Friendly, enabler-focused mindset with clear communication skills to explain security risks to non-security specialists.

Nice to Haves

• Experience with Python, JavaScript, or internal tooling development.
• Willingness to learn BPMN / Camunda to build security automation.
• Experience with security incident response, on-call rotations, CVE disclosures, or bug bounty programs.
• Familiarity with AI/LLM security risks (OWASP Top 10 for LLMs, prompt injection, tool abuse).
• Experience securing Kubernetes, containerized workloads, or B2B open-source software.

Compensation & Benefits

Total Target Cash Ranges

• United States: $119,900.00 – $193,200.00 USD
• United Kingdom: £75,300.00 – £123,800.00 GBP
• Singapore: S$148,900.00 – S$223,300.00 SGD
• For candidates based elsewhere, hiring is conducted via Remote.com with localized offer details.

Benefits & Perks

• Equity: Virtual Stock Option Plan (VSOP).
• Remote Work Setup: Home office budget, co-working space stipend, and flexible time off.
• In-Person Connection: Annual company kickoffs, team offsites, and meetup travel budgets.
• Health & Wellbeing: Local health plans, global mental health support (Modern Health), and Live Well Lifestyle Spending Account (LSA).
• Financial Security: Retirement and pension plans with company contributions, plus life/disability insurance where applicable.
• Professional Growth: Up to $/€/£1,000 annually for self-directed learning (courses, books, certifications).