About Delivery Hero
As the world's pioneering local delivery platform, our mission is to deliver an amazing experience, fast, easy, and to your door. We operate in around 65 countries worldwide, powered by tech, designed by people. As one of Europe's largest tech platforms, headquartered in Berlin, Germany, Delivery Hero has been listed on the Frankfurt Stock Exchange since 2017 and is part of the MDAX stock market index.
Tasks
As a Security Engineer II, you'll work alongside senior engineers and product teams to build security into web, mobile and backend applications from the start. You'll test, triage and fix real vulnerabilities, and automate the checks that catch them early, helping keep a platform used across around 65 countries safe. You'll join the team that protects Delivery Hero's ecosystem, customer trust, and global platforms, tackling high-impact challenges across cyber defense, application security, cloud governance, and risk mitigation. Your work will directly safeguard millions of users and vendors worldwide, ensuring the technology scales securely and complies with global standards.
•Test and remediate: Run security assessments and code reviews, and help product teams fix application-layer vulnerabilities (such as the OWASP Top 10) across web and mobile apps.
•Triage and track: Help run Bug Bounty and Vulnerability Disclosure Programs. Triage, validate and reproduce reports, route them to the right teams, and track fixes against MTTR and SLA adherence.
•Automate in CI/CD: Help implement and maintain automated security testing (SAST, DAST, SCA) in pipelines so vulnerabilities are caught early.
•Threat model: Partner with senior security engineers to run threat modeling sessions and architecture reviews for new features and microservices, using frameworks like STRIDE.
•Use AI and automation: Support team initiatives that use AI-driven tools to speed up vulnerability triage, code analysis and daily security workflows.
•Enable developers: Guide software engineers on secure coding standards, best practices and secure library use.
Requirements
•Solid knowledge of web and mobile application security principles, common vulnerability types (OWASP Top 10) and basic web/API security architectures.
•Ability to read and understand code in at least one modern language (e.g. Java, Python, Go or TypeScript) to help find and fix security flaws.
•Experience reproducing vulnerabilities (e.g. XSS, SQLi, IDOR, authentication bypasses) using tools like Burp Suite or OWASP ZAP.
•Basic understanding of CI/CD systems (e.g. GitHub Actions, GitLab CI), of how SAST/SCA scanners fit into developer workflows, and of cloud (AWS, GCP or Azure) and container (Docker, Kubernetes) concepts.
•Eagerness to use AI-driven tools (such as LLM coding assistants) to automate security scripts, triage and analysis.
•Collaborative, empathetic communication that helps engineers solve security issues without slowing them down.
•Experience in Bug Bounty programs (as a reporter or triager) or CTF competitions.
•Familiarity with authentication/authorization standards like OAuth 2.0, OIDC or SAML.
•Foundational security certifications (e.g. Security+, eJPT or GWAPT).
Additional Information
•Hybrid working model: join the team for face-to-face connection and collaboration on the Berlin campus 2 days a week.
•27 days holiday with an extra day on the 2nd and 3rd year of service.
•1.000 € Educational Budget, Language Courses, Parental Support and access to the Udemy Business platform.
•Health Checkups, Meditation & Gym.
•Employee Share Purchase Plan, Sabbatical Bank, Public Transportation Ticket Discount, Life & Accident Insurance, Corporate Pension Plan.
•Digital Meal Vouchers and Food Vouchers.
•Note: exact benefits may differ for intern, working student, fixed-term, and part-time roles.
