Trust & Safety Lead (Technical)

• This is a new team. You start hands-on and as the only person on it, and you will build it out from there into a small team of up to three – hiring, shaping the roles, and leading it day to day. How that team looks is a decision you will help make, not one you inherit
• Design and implement technical safeguards in our API and backend: abuse detection, rate limiting, verification checks, and the signals that catch fake accounts and scams early
• Ship user-facing safety features. Reporting flows, warnings on suspicious messages, blocking and privacy controls, safer defaults. Safety that users can see and use
• Threat-model new features before they ship. Ask how a bad actor would abuse them, and design the friction and detection against it
• Set up the trust & safety function from scratch: define what the team owns, where it sits, and what it needs to be effective
• Hire and grow a small team of up to three, and lead it – you stay technical and keep shipping yourself
• Set the standards the team works to, and make trust & safety visible and understood across the company
• Stay current on how attacks on social platforms evolve: account takeover, fake accounts, romance and marketplace scams, phishing and QR lures, spam rings, coordinated harassment
• Lead the response when something is spreading or someone is at risk: decide, act, then close the route it came through
• Decide what we build ourselves and what we buy. Where the market already solves a problem, such as content scanning, evaluate it, buy it and integrate it. Build where the problem is specific to nebenan
• Our moderation team handles cases day to day. You build the tooling and the standards they work with, so the highest-risk cases move first and similar cases get similar outcomes
• Turn what moderation learns into product and platform improvements, and turn platform signals into better moderation decisions
• Own the platform-side obligations under the Digital Services Act and GDPR: notice and action, statements of reasons, complaint mechanisms, transparency reporting. Keep the evidence audit-ready as you go. Legal owns the interpretation; you make the platform meet it
• Measure safety honestly: how much harm actually reaches users, how fast we act, and how accurate our decisions are

Benefits

• Additional vacation days
• Company pension plan
• Pets allowed
• Company laptop
• Flexible working hours
• Sabbatical- A user- and product-centric view: you care how safety feels in the interface, and you are comfortable shipping or shaping frontend features (we use React and TypeScript) that help users stay safe
• Strong SQL and a real understanding of how databases behave; you can find an abuse pattern in the data yourself
• A security-first mindset: you threat-model by instinct, probe how features can be abused, and stay current on attack vectors against social networks
• Works well with non-engineers: moderators, product, legal. You can explain a technical risk in plain language and take a moderation insight back into code
• A plus: hands-on experience of a fraud, scam or impersonation wave at scale
• A firm grasp of client–server architecture: what the client can and can’t be trusted with, where the risk actually lives, and how an API fails under attack
• Uses AI deliberately as leverage: directs and reviews generated code to production quality
• Judgment under pressure: you keep users’ safety and freedom in balance, and you decide quickly when someone may be at risk
• A plus: German language and German-market moderation context
• Solid Ruby on Rails experience in production, or clear evidence you pick up a new language and its ecosystem fast and well
• A plus: experience selecting and integrating vendor tooling in a safety or security stack
• A plus: a security background in threat modelling, incident response or offensive security
• Excellent English skills for working in our international team
• Several years of experience building and operating production web platforms, ideally with a focus on trust & safety, anti-abuse, fraud prevention or application security
• Infrastructure fluency: AWS, logging, observability, queues. You can reason about a system under attack, not only under load