{"id":142361,"url":"https://alion.io/job/solaris-cyber-security-staff-engineer-application-security","title":"Cyber Security Staff Engineer - Application Security","company":{"id":51793,"name":"Solaris","domain":"solarisgroup.com","url":"https://alion.io/company/solaris","size_band":"201-500","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Greenhouse","truth_index":{"grade":"A","score":91,"open_postings":20,"ghost_share":0.15,"stale_share":0,"repost_share":0,"time_to_fill_p50_days":50,"computed_at":"2026-10-17T05:46:00Z"}},"role":"Security","role_family":"Security","seniority":"staff","employment_type":null,"work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Berlin, Germany"],"countries":["DE"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":85000,"max_usd":207000,"period":"year","method":"global_role_cell_scaled_by_country","sample_n":617},"experience_years_min":6,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"LLM","optional":false},{"name":"OWASP Top 10","optional":false},{"name":"Threat Modeling","optional":false},{"name":"Agile","optional":true},{"name":"AWS","optional":true},{"name":"Azure","optional":true},{"name":"CI/CD","optional":true},{"name":"CWE","optional":true},{"name":"Docker","optional":true},{"name":"GCP","optional":true},{"name":"GitHub Actions","optional":true},{"name":"GitLab CI","optional":true},{"name":"Go","optional":true},{"name":"Java","optional":true},{"name":"Jenkins","optional":true},{"name":"Kubernetes","optional":true},{"name":"Python","optional":true},{"name":"Rust","optional":true},{"name":"Semgrep","optional":true},{"name":"Snyk","optional":true},{"name":"TypeScript","optional":true}],"status":"live","first_seen_at":"2026-07-09T05:44:03Z","employer_posted_date":"2026-10-01","last_verified_at":"2026-10-18T22:19:30Z","board_verified":true,"closed_at":null,"days_open":101,"trust":{"level":"ok","repost_count":0,"flags":["company_stale"],"days_open":100},"description":"Solaris is Europe's leading embedded finance platform. Solaris’ full German banking license and proprietary modular B2B tech stack empowers its partners - from SMEs to large, multinational, non-financial companies - to offer compliant, customer-centric banking services, providing seamless experiences to customers across all industries. Founded in 2016, Solaris pioneered the Banking-as-a-Service market with an unparalleled combination of tech and banking. Solaris is headquartered in Berlin and employs 300 people in Europe.\nYour Role\nIntegrate security seamlessly into the Software Development Lifecycle (SDLC) and DevSecOps pipelines by automating security gates (SAST, DAST, SCA, and container scanning).\nConduct thorough threat modeling and architectural security reviews for complex applications, APIs, and microservices prior to deployment.\nPerform deep-dive manual and automated secure code reviews across various codebases to identify logic flaws and subtle implementation vulnerabilities.\nBuild and maintain \"secure-by-default\" internal libraries, frameworks, and developer tools to systematically eliminate entire classes of vulnerabilities.\nTake ownership of the application vulnerability lifecycle, including triaging, validating, and prioritizing vulnerabilities originating from internal testing, penetration tests, and external bug bounty programs.\nAct as a strategic partner to product and engineering teams, providing pragmatic mitigation guidance that balances product velocity with security assurance.\nDesign and deliver modern, hands-on secure coding training and security awareness initiatives for engineering teams (e.g., addressing OWASP Top 10, LLM/AI security risks).\nSupport incident response and detection teams during application-level security incidents or potential data breaches, leading post-mortem analysis for software flaws.\nEnsure application security controls remain fully compliant with relevant financial data protection regulations, fintech standards, and internal tech policies.\nOwners of this function make sure that they follow the defined Policies & Procedures for the institution (which includes explicit processes defined for Tech, which are properly defined in the respective confluence spaces).\nTake ownership of the tech responsibilities as described in our Change Management Policies.\nWe'd love to see \nDepending on your level of experience, your responsibilities and scope of role will range. We don’t care much about fancy titles, but rather about real personal and professional development, as laid out in our learning framework. Let’s figure together out how you can contribute to our team.\nA degree in Computer Science, Software Engineering, Information Technology, Cybersecurity, or equivalent professional experience.\n6+ years of experience in dedicated Application Security, DevSecOps, or Software Engineering roles with a strong focus on security in high-growth cloud environments (Fintech or highly regulated environment is a plus).\nProven experience analyzing and securing code written in our core tech stack/modern languages (e.g., Java, Go, Python, TypeScript, or Rust).\nDeep understanding of web application vulnerabilities, API security, and exploitation techniques (OWASP Top 10, CWE).\nHands-on experience integrating security testing tools into modern CI/CD pipelines (e.g., GitHub Actions, GitLab CI, Jenkins, Snyk, Semgrep).\nExperience with cloud computing infrastructure (AWS, GCP, or Azure), containerization (Docker), and orchestration (Kubernetes).\nExperience managing or triaging external penetration testing reports and crowdsourced bug bounty programs.\nUnderstands agile workflows and lean principles.\nExperience by doing threat modeling.\nIndividual Contributor, technical mentorship focus.\nBusiness proficient written and spoken English. German is a plus.\nAbility to translate complex cryptographic or technical security vulnerabilities into business risk for non-technical stakeholders and actionable fixes for developers.\nEmpathic collaborator who builds bridges between security goals and engineering targets, avoiding the \"department of No\" stereotype.\nStrong analytical mindset capable of finding creative ways to secure cutting-edge application architectures.\nAbility to thrive in a fast-paced environment and adapt security strategies to evolving product frameworks.\nProactive peer that helps the growth of the team.\nCurious, constant learner that is willing to share learning with others\nBenefits \nHome office budget.\nLearning & development budget of €1000 per year and a transparent growth framework to support your career goals.\nCompetitive salary and a variable remuneration program.\nMonthly meal allowance.\nDeutschland ticket subsidy.\n28 vacation days, increasing by 2 days after 2 years and 3 days after 3 years with Solaris.\nOpportunity to work abroad for up to 12 weeks per year.\nWhile job ads usually paint an ideal picture of a candidate, studies show that most applicants meet an average of 60% of the criteria. Unfortunately, many promising candidates tend to apply only if they meet all the criteria. So if you think you have what it takes, but don't necessarily meet every single item in the job description, please contact us anyway. We'd love to talk with you and find out if you might be a good fit for us.\nAt Solaris, we are committed to nurturing an inclusive environment, where all Solarians feel valued, respected and supported. We are dedicated to building a diverse workforce that reflects the diversity of our communities. We are committed to equal employment opportunity regardless of color, ethnicity, religion, sex, origin, disability, marital status, citizenship, or gender identity. We are proud to be an equal opportunity workplace. If you have a disability or special need that requires accommodation, please let us know.\nInformation on data processing:\nDE: https://www.solarisgroup.com/gdpr_notice_de\nEN: https://www.solarisgroup.com/gdpr_notice_en\nThe annual gross salary range for this position is:\n€85.000—€110.000 EUR","description_format":"text","description_chars":6040,"description_truncated":false,"requirements":{"experience_years_min":6,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[{"language":"English","level":"All levels","optional":false}]},"benefits":["Home office","Professional development"],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Cybersecurity","Application Security","Financial Services","Cards & Card Issuing"],"lifecycle":[{"event":"open","at":"2026-07-09T05:44:03Z"}],"visa":[],"liveness":{"score":23,"band":"cold","label":"Long shot","p_open":1,"p_active":0.804,"p_room":0.28,"age_days":100,"expected_fill_days":50,"reasons":["conf:1","urgency","velocity","win:tail","crowd:"],"computed_at":"2026-10-17T05:46:00Z"},"pay":null,"html_url":"https://alion.io/job/solaris-cyber-security-staff-engineer-application-security","json_url":"https://alion.io/job/solaris-cyber-security-staff-engineer-application-security.json","meta":{"generated_at":"2026-10-18T23:57:00Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":26459,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-19T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":51793},"rest":"https://alion.io/mcp/rest/get_company?id=51793"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fsolaris-cyber-security-staff-engineer-application-security"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fsolaris-cyber-security-staff-engineer-application-security"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fsolaris-cyber-security-staff-engineer-application-security"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/solaris-cyber-security-staff-engineer-application-security\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fsolaris-cyber-security-staff-engineer-application-security"}]}