Cyber Security Staff Engineer

Solaris is Europe's leading embedded finance platform. Solaris’ full German banking license and proprietary modular B2B tech stack empowers its partners – from SMEs to large, multinational, non-financial companies – to offer compliant, customer-centric banking services, providing seamless experiences to customers across all industries. Founded in 2016, Solaris pioneered the Banking-as-a-Service market with an unparalleled combination of tech and banking. Solaris is headquartered in Berlin and employs 300 people in Europe.

Your Role

• Integrate security seamlessly into the Software Development Lifecycle (SDLC) and DevSecOps pipelines by automating security gates (SAST, DAST, SCA, and container scanning).
• Conduct thorough threat modeling and architectural security reviews for complex applications, APIs, and microservices prior to deployment.
• Perform deep-dive manual and automated secure code reviews across various codebases to identify logic flaws and subtle implementation vulnerabilities.
• Build and maintain "secure-by-default" internal libraries, frameworks, and developer tools to systematically eliminate entire classes of vulnerabilities.
• Take ownership of the application vulnerability lifecycle, including triaging, validating, and prioritizing vulnerabilities originating from internal testing, penetration tests, and external bug bounty programs.
• Act as a strategic partner to product and engineering teams, providing pragmatic mitigation guidance that balances product velocity with security assurance.
• Design and deliver modern, hands‑on secure coding training and security awareness initiatives for engineering teams (e.g., addressing OWASP Top 10, LLM/AI security risks).
• Support incident response and detection teams during application‑level security incidents or potential data breaches, leading post‑mortem analysis for software flaws.
• Ensure application security controls remain fully compliant with relevant financial data protection regulations, fintech standards, and internal tech policies.
• Owners of this function make sure that they follow the defined Policies & Procedures for the institution (which includes explicit processes defined for Tech, which are properly defined in the respective confluence spaces).
• Take ownership of the tech responsibilities as described in our Change Management Policies.

We’d love to see

• A degree in Computer Science, Software Engineering, Information Technology, Cybersecurity, or equivalent professional experience.
• 6+ years of experience in dedicated Application Security, DevSecOps, or Software Engineering roles with a strong focus on security in high‑growth cloud environments (Fintech or highly regulated environment is a plus).
• Proven experience analyzing and securing code written in our core tech stack/modern languages (e.g., Java, Go, Python, TypeScript, or Rust).
• Deep understanding of web application vulnerabilities, API security, and exploitation techniques (OWASP Top 10, CWE).
• Hands‑on experience integrating security testing tools into modern CI/CD pipelines (e.g., GitHub Actions, GitLab CI, Jenkins, Snyk, Semgrep).
• Experience with cloud computing infrastructure (AWS, GCP, or Azure), containerization (Docker), and orchestration (Kubernetes).
• Experience managing or triaging external penetration testing reports and crowdsourced bug bounty programs.
• Understands agile workflows and lean principles.
• Experience by doing threat modeling.
• Individual Contributor, technical mentorship focus.
• Business proficient written and spoken English. German is a plus.
• Ability to translate complex cryptographic or technical security vulnerabilities into business risk for non-technical stakeholders and actionable fixes for developers.
• Empathic collaborator who builds bridges between security goals and engineering targets, avoiding the "department of No" stereotype.
• Strong analytical mindset capable of finding creative ways to secure cutting‑edge application architectures.
• Ability to thrive in a fast‑paced environment and adapt security strategies to evolving product frameworks.
• Proactive peer that helps the growth of the team.
• Curious, constant learner that is willing to share learning with others

Benefits

• Home office budget.
• Learning & development budget of €1000 per year and a transparent growth framework to support your career goals.
• Competitive salary and a variable remuneration program.
• Monthly meal allowance.
• Deutschland ticket subsidy.
• 28 vacation days, increasing by 2 days after 2 years and 3 days after 3 years with Solaris.
• Opportunity to work abroad for up to 12 weeks per year.