> Markdown version of [/jobs/ext/4701229-application-security-engineer](https://www.wearedevelopers.com/jobs/ext/4701229-application-security-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Application Security Engineer

- **Company:** Latchform
- **Location:** Berlin, Germany (Remote available)
- **Contract:** Permanent contract
- **Skills:** Java (Programming Language), JavaScript (Programming Language), Application Programming Interfaces (APIs), Software System Penetration Testing, Cyber Security, Python (Programming Language), Open Web Application Security, TypeScript, Software Security, Information Technology, Production Code
- **Published:** November 13, 2026
- **Apply:** https://www.careerjet.de/jobad/de0d9a6869ca87a15f6c9d393607ed4fbc

## About the Role

* A degree in computer science, IT security or a related field, or comparable training
 * You read code in at least one of Python, JavaScript or TypeScript, Java or Go
 * Working knowledge of the OWASP Top 10 and of how authentication and sessions work
 * First security experience: an internship, CTFs, bug bounty reports or a thesis count

## Description

Software built by the teams we review is now bought by many German companies, and those buyers ask detailed questions about access and data separation. That is why we are hiring an Application Security Engineer in Germany. Full-time and remote from anywhere in Germany; the San Francisco team is nine hours behind.
You review the parts of an application that decide who can use it and what they can see, and you write down exactly how to reproduce what you find.
In scope

 * Review authorization in APIs: role checks, tenant boundaries and object ownership
 * Test sign-in, session expiry and whether access ends after sign-out, a password change or account removal
 * Check webhook signatures, replay handling and how credentials for outside services are stored
 * Trace which vulnerable dependencies are reachable from production code paths
 * Write findings that name the route handler, query or token check involved, with steps to reproduce

Out of scope

 * Network penetration tests and red-team exercises
 * Production access, unless agreed in writing