Senior Information Security Engineer - Application Security

Join us for our upcoming webinar, How to Be a Leader, Not Just a Manager. A practical session with a powerhouse panel on leading modern, remote teams.

Register here!

Camunda is the leader in enterprise agentic automation, orchestrating complex business processes, including high-value knowledge work, across agents, people, and systems. By creating production-ready, enterprise-grade agents with built-in governance, Camunda uniquely delivers trusted AI agents for business-critical processes. Over 700 leading innovators like Atlassian, ING, and Vodafone, rely on Camunda to slash time-to-value from months to days, boost operational efficiency, and elevate customer experiences. Camunda was named a Visionary in the inaugural 2025 Gartner® Magic Quadrant™ for Business Orchestration and Automation Technologies (BOAT).

As a fully remote, global company, we’re rewriting the rules of modern business. Named GP Bullhound’s 2024 Top 100 Next Unicorn list, certified as a Great Place to Work, and recognized by Flexa for true flexibility, we’re growing fast and looking for top talent to join our team. If you’re excited to do meaningful work and make real impact, keep reading, this role could be the one you’ve been waiting for.

About the Role

Senior Information Security Engineer (AppSec) at Camunda, you’ll join a small, senior, and highly collaborative InfoSec team that lives our FAITH values – Focus, Ambition, Integrity, Talent and Humor – every day. You’ll work hand-in-hand with our product and engineering teams across the entire SDLC to make sure our platform is designed, built, and shipped securely as we continue to grow. This is a hands-on, developer-centric role where you’ll shape how we build secure Java services in a modern CI/CD, SaaS environment, strengthen our AppSec tooling and practices, and directly influence how customers trust and adopt Camunda. You can be based anywhere that allows you to collaborate effectively within CET to Eastern Time working hours.

What you'll be doing

• Partner with engineering teams throughout the SDLC – from early design and architecture discussions, through implementation and testing, to deployment – to embed security by design in our products.
• Lead and evolve our AppSec tooling and workflows by implementing, tuning, and integrating SAST, DAST, SCA, and container/image scanning into CI/CD pipelines, and making sure findings are actionable for developers.
• Drive vulnerability management for our applications and supply chain, including triaging and prioritizing issues, coordinating with teams on fix/mitigate/accept decisions, and ensuring we continuously improve our security posture.
• Perform secure design and architecture reviews and threat modeling for distributed, API- and microservices-based systems, helping teams understand security trade-offs and make sound, risk-based decisions.
• Support and help coordinate application-layer security incidents and escalations, working closely with Engineering, Support, and other stakeholders to investigate, contain, and learn from issues.
• Together with the rest of InfoSec team, help with security audits, customer assurance, and other processes

What you bring

• Ability and/or willingness to use our product.
• Strong Java engineering and secure coding background, with substantial hands-on experience building and reviewing Java services, working in CI/CD environments, and shipping SaaS or other cloud-based applications securely.
• Secure SDLC, architecture & risk assessment experience, including secure design reviews, threat modeling for distributed/API/microservices systems, and performing risk assessments on product changes or new features.
• Vulnerability management & security tooling expertise, with a proven track record of implementing and tuning SAST/DAST/SCA and container/image scanning, evaluating and triaging findings (including false positives), and driving fix/mitigate/accept decisions with engineering teams.
• Cross-team collaboration & communication skills, enabling you to work effectively with Engineering, Support, Sales, and other stakeholders while explaining complex security issues and trade-offs in a clear, pragmatic way to both technical and non-technical audiences.
• Developer-centric, incident-savvy mindset, meaning you are comfortable managing and supporting security incidents and escalations, you see yourself as an enabler (not a gatekeeper), and you influence teams toward risk-based, practical security improvements.

Nice-to-haves

• Experience developing in Python, JavaScript, or TypeScript in addition to Java.
• Hands-on experience securing Kubernetes- or container-based workloads and modern cloud environments.
• Prior work in a B2B software company, especially in high-availability or multi-tenant contexts.
• Experience running security training, talks, or workshops for engineering teams

Come join us and be part of Camunda’s incredible journey: Make an impact at a pivotal moment in our story!

AI Disclaimer: Camunda may use AI tools to aid the screening of applications.