Senior Security Engineer

• Capmo is the digital partner on construction sites, with over 100k projects delivered faster and more successfully with the help of our platform
• We enable architects, engineers, project managers and contractors to collaborate efficiently and run lean and optimized projects
• We are one of the fastest-growing B2B SaaS companies in Europe and stay true to our mission of making hard things in construction feel easy
• Thousands of project managers run their construction sites on Capmo every day — which means our customers trust us with data that is critical to their business
• Keeping that trust is the job you’d own
• Help us continue to revolutionize the industry!
• Find out more about us and come join us in our engineering hubs in Berlin and Munich
• As a Senior Security Engineer at Capmo, you will get to:
• Own product and cloud security end to end — threat modeling, security reviews, secure-by-default patterns, and the tooling in our CI/CD pipelines (SAST, dependency and container scanning, secret detection) that keeps findings from piling up
• Harden our AWS infrastructure: IAM architecture, network segmentation, encryption, logging, workload security — and encode the baselines as policy-as-code instead of a wiki page nobody reads
• Build our detection and response capability from the ground up, and be the technical lead when something actually happens — from detection through containment to the post-incident review
• Own our vulnerability disclosure and pentest programs, and drive remediation with the product teams rather than filing tickets and hoping
• Back our compliance work (ISO 27001, SOC 2, GDPR) with real technical controls and evidence, and support customer security reviews together with Sales
• Shape the direction of security at Capmo as a hands-on senior IC — building guardrails that engineers adopt because they’re good, not because they’re mandated

Benefits

• Flexible Work Setup: Flexible hybrid or remote setups, depending on the role.
• Development Budget: 1.500€ development budget per year for your personal and professional development as well as two Development Days off. You decide what you invest your budget in.
• Virtual Share Options: With our employee share program you are a share holder of Capmo. That way you’re participating directly in our success while taking business ownership.
• Relocation Budget: We know no (national) borders and welcome talents from all over the world!
• Permanent Contract: Job security through VC funding and a permanent employment contract.
• Capmo Culture Days: Free day for your Culture Day! To be able to celebrate the most important festival of your culture, we will give you this day off!
• Fitness, Food, or Free Rides?: The choice is yours! With EGYM Wellpass, you can work out all over Germany; with Lunchit, you can save money every day on the lunch of your choice; and with the Deutschlandticket, you can travel freely on public transport across the country.
• Potential to Grow: The chance to play a decisive role in shaping a construction tech startup with growth potential and a living feedback culture.
• Capmo Pension Scheme: Financial security even after retirement via the Capmo Pension Scheme.
• Wellbeing Matters!: Through our partnership with OpenUp, you and your family members get easy access to professional support for your mental and physical health!- Nice to have: building up a security function in a scale-up, detection engineering, ISO 27001 / SOC 2 certification experience, certs like OSCP or CISSP (valued, but hands-on skills matter more)
• The judgment to make risk-based calls under ambiguity, and the influence to get teams to act on them without formal authority
• 7+ years of hands-on security engineering, including several years owning application and cloud security for a production SaaS platform end to end
• Deep experience hardening cloud infrastructure at scale (AWS ideally, GCP or Azure fine): IAM, network segmentation, container security, security-as-code — designed by you, not inherited
• A track record of building security programs — SDLC, vulnerability management, detection and response — not just operating tools someone else set up
• Strong software engineering skills — you write production-quality code, build automation from scratch, and hold your own in architecture discussions with senior engineers
• Expert-level understanding of vulnerability classes and attack techniques well beyond the OWASP Top 10: you can threat-model a new feature, spot the subtle authz flaw in review, and explain the exploit path to the engineer who wrote it
• Proven incident response leadership: you’ve been the technical lead when things went wrong
• Excellent English; German is a plus. Willingness to be on-site 3 days per week in Munich or Berlin