> Markdown version of [/jobs/ext/2725364-security-engineer](https://www.wearedevelopers.com/jobs/ext/2725364-security-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Security Engineer

- **Company:** Trade Republic
- **Location:** Berlin, Germany
- **Experience:** Expert
- **Contract:** Permanent contract
- **Skills:** Kubernetes Security, Amazon Web Services, Microsoft Azure, Cloud Computing, Cloud Computing Security, Cyber Security, Customer Data Management, Python (Programming Language), Security Information and Event Management, EndPointSecurity, Scripting, Multi-Cloud, Marisk, Purple Team (Cyber Security), SentinelOne Expertise
- **Published:** September 5, 2026
- **Apply:** https://startup.jobs/senior-security-engineer-purple-teaming-trade-republic-2-7974383

## About the Role

Core Experience

 * 5+ years as a Security Engineer with 3+ years specializing in Purple/Red/Blue Teaming.
 * Experience running or leading purple team exercises in enterprise environments
 * Strong understanding of real-world attacker behavior, not just theoretical frameworks
 * Experience operating in regulated or compliance-driven environments (MaRisk, BAIT, GDPR)

Technical Experience

 * Strong understanding of cloud security (AWS) and Kubernetes security
 * Good understanding of macOS security
 * Experience with SIEM solutions, preferably Google SecOps
 * Experience with Endpoint Detection & Response (EDR) tools such as SentinelOne or CrowdStrike
 * Proficiency in Python, Go or other scripting language
 * Multi-cloud experience (GCP, Azure) is advantageous

## Description

As a Senior Security Engineer in Purple Teaming, you'll plan and execute purple team exercises aligned to real-world threat actors to protect Trade Republic's critical systems and customer data. Your responsibilities include:

 * Design attack scenarios covering initial access, persistence, lateral movement, privilege escalation, command-and-control, and exfiltration.
 * Coordinate with business and engineering teams to gather requirements, understand operational constraints, and ensure testing activities align with business risk.
 * Assess existing security controls to ensure they aren't just "active," but actually effective.
 * Conduct deep-dive assessments of internal networks, applications, and cloud infrastructure.
 * Develop and tune SIEM detections, analytics rules, and alerts based on attack simulations and real incidents together with the Security Operations team.
 * Validate alert quality, reduce false positives, and improve signal-to-noise ratio.
 * Validate coverage of detections against known TTPs and identify detection gaps.
 * Support and enhance incident response playbooks, escalation paths, and response automation.
 * Conduct hypothesis-driven threat hunts based on attacker tradecraft and threat intelligence.


## Related Videos

- [You can’t hack what you can’t see](https://www.wearedevelopers.com/videos/41-you-can-t-hack-what-you-can-t-see)
- [The Open-source Java SDK for Multi-Cloud Development - Sandeep Pal](https://www.wearedevelopers.com/videos/2113-the-open-source-java-sdk-for-multi-cloud-development-sandeep-pal)
- [The Missing Layer Between Enterprise Data and AI Agents](https://www.wearedevelopers.com/videos/100286-the-missing-layer-between-enterprise-data-and-ai-agents)
- [JavaScript? No. Java Scripts! - Scripting with Java](https://www.wearedevelopers.com/videos/2094-javascript-no-java-scripts-scripting-with-java)
- [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers)
- [Leverage Cloud Computing Benefits with Serverless Multi-Cloud ML ](https://www.wearedevelopers.com/videos/78-leverage-cloud-computing-benefits-with-serverless-multi-cloud-ml)

## Related Articles

- [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed)
- [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing)
- [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking)
- [The Biggest German Tech Companies](https://www.wearedevelopers.com/magazine/424-the-biggest-german-tech-companies)
- [Best Coding Boot Camps in Germany](https://www.wearedevelopers.com/magazine/237-best-coding-boot-camps-in-germany)
- [Dev Digest 138 - Are you secure about this?](https://www.wearedevelopers.com/magazine/486-dev-digest-138-are-you-secure-about-this)