EU remote
Security Engineer, Product Security team
About this role
Big systems. Exciting challenges. Real impact. As a Security Engineer II, you’ll work alongside senior engineers and product teams to build security into our web, mobile and backend applications from the start. You’ll test, triage and fix real vulnerabilities, and automate the checks that catch them early. That helps keep a platform used across around 65 countries safe. As a member of the Security Team, you’ll support Delivery Hero’s rapid innovation and growth.
You’ll work on foundational systems that enable faster feature development, security, and reliability across our global engineering community. Every enhancement you make will contribute to our teams’ ability to build, scale, and deliver quality features—ultimately impacting millions of users worldwide. Test and remediate: Run security assessments and code reviews, and help product teams fix application-layer vulnerabilities (such as the OWASP Top 10) across our web and mobile apps.
Triage and track: Help run our Bug Bounty and Vulnerability Disclosure Programs. Triage, validate and reproduce reports, route them to the right teams, and track fixes against MTTR and SLA adherence. Automate in CI/CD: Help implement and maintain automated security testing (SAST, DAST, SCA) in our pipelines so vulnerabilities are caught early. Threat model: Partner with senior security engineers to run threat modeling sessions and architecture reviews for new features and microservices, using frameworks like STRIDE.
Use AI and automation: Support team initiatives that use AI-driven tools to speed up vulnerability triage, code analysis and daily security workflows. Enable developers: Guide software engineers on secure coding standards, best practices and secure library use. What you need to be successful Solid knowledge of web and mobile application security principles, common vulnerability types (OWASP Top 10) and basic web/API security architectures.
Ability to read and understand code in at least one modern language (e.g. Java, Python, Go or TypeScript) to help find and fix security flaws. Experience reproducing vulnerabilities (e.g. XSS, SQLi, IDOR, authentication bypasses) using tools like Burp Suite or OWASP ZAP. Basic understanding of CI/CD systems (e.g. GitHub Actions, GitLab CI), of how SAST/SCA scanners fit into developer workflows, and of cloud (AWS, GCP or Azure) and container (Docker, Kubernetes) concepts.