Security Engineer (Bug Bounty & Vulnerability Response) - DC30

YOUR NEW ROLE This role is for CODE LEAP's client company - JTL-Software JTL-Software is one of Germany's leading providers of e-commerce and ERP solutions. More than 50,000 retailers rely on JTL every day to run their business. Our global development center in Vietnam is looking for talented people to build the next generation of these products. You'll work in an international team that pairs German software quality and Vietnamese speed to innovate.

JTL-Software builds e-commerce software that our customers run their businesses on. We work with the security research community to keep it secure. This role sits in JTL's security team and works closely with our product engineering teams.

This role runs JTL's bug bounty and vulnerability disclosure program end to end: intake of reports from external researchers, verification and severity rating, coordination of fixes with engineering, disclosure, and researcher rewards. It also widens the program in scope and reach, and manages its budget. This is a hands-on role without management responsibility.

You report to the Director Cybersecurity & IT in Germany. You work with the security team and the engineering teams in Germany and Vietnam, and with external security researchers. The role includes a daily overlap with German business hours, typically 14:00 to 17:30 Vietnam time.

YOUR EXCITING TASKS

• Be the point of contact for external security researchers, from first response to closure
• Triage incoming reports: reproduce them, filter duplicates and out-of-scope submissions, and rate severity
• Verify findings hands-on in our web applications and on-premise software
• Work with the senior security engineers in the team on complex vulnerability triage
• Hand confirmed vulnerabilities to the responsible engineering team with a clear, reproducible report
• Enable the engineering teams to fix within agreed timelines, and drive every report to a conclusion
• Verify fixes and coordinate disclosure, security advisories and CVE requests
• Manage the program budget and process researcher rewards in line with the program policy
• Report on program performance: volume, severity and time to fix
• Widen the program: extend its scope, keep the policy current, and promote it in the security research community

YOUR PROFILE AND YOUR PERSONALITY

• At least two years in security, including at least one year of hands-on triaging and verifying vulnerabilities yourself
• You can reproduce a reported vulnerability in a web application on your own and rate its severity, for example with CVSS
• Solid knowledge of common vulnerability classes, such as the OWASP Top 10
• You have driven findings to resolution with teams that did not report to you
• Hands-on experience using AI agents and AI tools to support vulnerability triage, verification and reporting
• Clear written communication, with external researchers as well as with engineers
• Fluent English, written and spoken

Nice To Have

• You have run or triaged reports for a bug bounty or vulnerability disclosure program
• A track record as a bug bounty researcher, such as acknowledged reports or CVEs
• Experience with PHP, .NET or TypeScript web applications, or Microsoft Azure
• Familiarity with coordinated vulnerability disclosure, CVE assignment and security advisories
• German

Benefits Await You At Code Leap

• Competitive salary and benefits
• Year-end bonus (13th-month salary)
• Generous annual leave of up to 18 days
• Additional premium health insurance
• Enjoy an endless selection of delicious refreshments, including gourmet coffee, beverages, snacks, and fresh fruits, all complimentary
• 1-on-1 coaching with experienced professionals
• Flexible work policy, which provides flexible hours to accommodate personal schedules and commitments
• Dynamic, fun, and agile environment, perfect for sharing and creativity
• Open-minded, kind & humble colleagues

CONTACT Come to talk to us at [email protected]

About Us With our expert teams spread across two continents, CODE LEAP provides innovative software solutions for venture-backed companies and leading enterprise businesses in Germany. Our teams in Berlin (Germany) and Ho Chi Minh City (Vietnam) work hand in hand to develop state-of-the-art solutions of the highest quality.

Because collaborating with the right people is the secret to our successful growth.

We future-proof organizations - be part of it!