Senior Ruby (on Rails) Engineer (Trust & Safety)

• Your mission:
• Nebenan.de connects real neighbours under their real names
• That only works if people feel safe here
• Your mission is to keep our users safe: with technical safeguards built into our platform and API, with product features that help neighbours protect themselves, and in close partnership with our Community Management team
• You look at everything security first
• You ask how someone could attack the trust of our users, and you prevent it before it happens
• At the same time you think in products, not only in backend systems: a well-placed warning in the interface, a clear reporting flow, or a safer default setting often protects more people than another rule on the server
• Build safety into the platform:
• You will be the first hire in a new team of three, safeguarding our users. Becoming a team lead is an option
• Design and implement technical safeguards in our API and backend: abuse detection, rate limiting, verification checks, and the signals that catch fake accounts and scams early
• Ship user-facing safety features. Reporting flows, warnings on suspicious messages, blocking and privacy controls, safer defaults. Safety that users can see and use
• Threat-model new features before they ship. Ask how a bad actor would abuse them, and design the friction and detection against it
• Assess and implement third party integrations to improve our way of working with threats
• Think security first:
• Stay current on how attacks on social platforms evolve: account takeover, fake accounts, romance and marketplace scams, phishing and QR lures, spam rings, coordinated harassment
• Lead the response when something is spreading or someone is at risk: decide, act, then close the route it came through
• Decide what we build ourselves and what we buy. Where the market already solves a problem, such as content scanning, evaluate it, buy it and integrate it. Build where the problem is specific to nebenan
• Work as one with Community Management:
• Our moderation team handles cases day to day. You build the tooling and the standards they work with, so the highest-risk cases move first and similar cases get similar outcomes
• Turn what moderation learns into product and platform improvements, and turn platform signals into better moderation decisions
• Keep us compliant, with evidence:
• Own the platform-side obligations under the Digital Services Act and GDPR: notice and action, statements of reasons, complaint mechanisms, transparency reporting. Keep the evidence audit-ready as you go. Legal owns the interpretation; you make the platform meet it
• Measure safety honestly: how much harm actually reaches users, how fast we act, and how accurate our decisions are

Benefits

• Additional vacation days
• Company pension plan
• Pets allowed
• Company laptop
• Flexible working hours
• Sabbatical- A plus: a security background in threat modelling, incident response or offensive security
• A plus: hands-on experience of a fraud, scam or impersonation wave at scale
• Strong SQL and a real understanding of how databases behave; you can find an abuse pattern in the data yourself
• Excellent English skills for working in our international team
• Uses AI deliberately as leverage: directs and reviews generated code to production quality
• A plus: experience selecting and integrating vendor tooling in a safety or security stack
• A plus: German language and German-market moderation context
• If you are not full-stack yet, you want to move into that direction and learn other stacks
• A firm grasp of client–server architecture: what the client can and can’t be trusted with, where the risk actually lives, and how an API fails under attack
• Solid Ruby on Rails experience in production
• A user- and product-centric view: you care how safety feels in the interface, and you are comfortable shaping frontend features that help users stay safe
• Infrastructure fluency: AWS, logging, observability, queues. You can reason about a system under attack, not only under load
• A security-first mindset: you threat-model by instinct, probe how features can be abused, and stay current on attack vectors against social networks
• Judgment under pressure: you keep users’ safety and freedom in balance, and you decide quickly when someone may be at risk
• Works well with non-engineers: moderators, product, legal. You can explain a technical risk in plain language and take a moderation insight back into code