Application Security Engineer

Software built by the teams we review is now bought by many German companies, and those buyers ask detailed questions about access and data separation. That is why we are hiring an Application Security Engineer in Germany. Full-time and remote from anywhere in Germany; the San Francisco team is nine hours behind. You review the parts of an application that decide who can use it and what they can see, and you write down exactly how to reproduce what you find. In scope

• Review authorization in APIs: role checks, tenant boundaries and object ownership
• Test sign-in, session expiry and whether access ends after sign-out, a password change or account removal
• Check webhook signatures, replay handling and how credentials for outside services are stored
• Trace which vulnerable dependencies are reachable from production code paths
• Write findings that name the route handler, query or token check involved, with steps to reproduce

Out of scope

• Network penetration tests and red-team exercises
• Production access, unless agreed in writing

• A degree in computer science, IT security or a related field, or comparable training
• You read code in at least one of Python, JavaScript or TypeScript, Java or Go
• Working knowledge of the OWASP Top 10 and of how authentication and sessions work
• First security experience: an internship, CTFs, bug bounty reports or a thesis count

Also counts Burp Suite, OSCP or eWPT, threat modelling, code reviews on a product team. What Latchform covers

• Permanent full-time contract, from home anywhere in Germany
• 30 days’ holiday a year plus public holidays
• A company pension (bAV) that Latchform pays into
• A yearly budget for training, certifications and conference tickets
• A laptop, a second screen and a home office allowance
• Flexible hours, with team calls agreed in advance

Latchform is an application security consultancy in San Francisco. We review the code and design decisions that control who can use an application and what it lets them reach, and every finding comes with steps an engineer can repeat. #LI-Remote