Information Security Engineer, Application Security at Camunda

About Camunda

Camunda is the enterprise platform for agentic orchestration, enabling organizations to coordinate AI agents, people, and systems across complex, end to end business processes. With built in governance, auditability, and human oversight, Camunda gives enterprises the control they need to move AI from pilots to production safely and at scale. Trusted by over 700 organizations worldwide, including 9 of the top 10 US banks, Camunda helps enterprises boost operational efficiency, accelerate time to value, and deliver better customer experiences.

Camunda is fully remote and global, and is in the middle of transforming into an AI first organisation built on its own platform. The company uses Agentic AI to automate, orchestrate intelligent processes, and elevate human contribution across every team. Camunda has been named to GP Bullhound's Top 100 Next Unicorn list, is 2025 Great Place to Work certified, was named a Visionary in the 2025 Gartner Magic Quadrant for Business Orchestration and Automation Technologies, and ranked 3rd in Flexa's 2026 Most Flexible Companies.

About the Role

Camunda is hiring an Information Security Engineer with a focus on Application Security to join its Information Security team. The team takes security seriously without making it feel like a locked door. They work in a transparent, straightforward way and care about doing the work right rather than just checking a compliance box.

You will work side by side with R&D engineers: reviewing designs, threat modeling new features, digging into code, and helping teams make good, risk based decisions about the vulnerabilities that come in. You will also help build the internal tools that make this work scale, including the CVE registry and the LLM assisted workflows used to analyse code and triage findings. Camunda is an AI first company, and InfoSec is no exception: AI agents are part of how the team reviews code, assesses vulnerabilities, and builds tools. You will help shape how that works.

This is a hands on role for someone who already has solid AppSec foundations and wants to grow. The team is a generalist team, so you will also take part in the on call rotation and incident response and get exposure to other areas of security. Most of your time will be spent with engineers and building and maintaining internal tools and processes.

What You Will Do

• Vulnerability management: triage findings from SCA, container and code scanning, external reports, and internal security testing; assess whether Camunda is actually affected; agree fix, mitigate, or accept with engineering and follow through to release.
• Threat modeling and security reviews: run threat modeling sessions and design reviews with R&D teams for new features and architecture changes, and turn the results into concrete, prioritised actions.
• Code analysis with LLMs: use and improve LLM assisted tooling (agents, prompts, reusable skills) to review code, validate findings, and reproduce issues, while applying your own judgement to know when the model is wrong.
• Build internal security tooling: contribute to the CVE registry and related automation that connects scanners, engineering teams, and customer communication. Much of it is built on Camunda itself.
• Help engineers do the secure thing by default: answer questions, review pull requests, improve guidelines, and occasionally run a session or workshop.
• On call and incident response: share the InfoSec on call rotation with the other engineers and help investigate and resolve security incidents.
• Support the wider team: help write security advisories for customers, answer customer security questions, and support audits.

What You Will Bring to the Role

• Around 3+ years in security or software engineering, with at least 2 of them working on application or product security (AppSec, product security, pentesting, or a security focused developer role all count).
• Experience at a SaaS or software product company, working closely with engineering teams that ship often through modern CI/CD and cloud environments.
• Hands on vulnerability triage: experience with tools like Snyk, Trivy, Semgrep, CodeQL, or similar; able to tell a real issue from a false positive and explain how exploitable something actually is in context (CVSS, exploitability, configuration).
• Threat modeling and design review experience (e.g. STRIDE) on real systems, ideally web apps, APIs, or distributed services.
• You read and write code. You are comfortable reading Java (Camunda is built on it) well enough to follow a data flow and spot a security bug. You can write scripts and small tools and contribute to an existing codebase with review.
• You build with AI, not just chat with it. You use AI coding agents (Claude Code, Cursor, Copilot, or similar) in your daily work to write tools, analyse code, or automate tasks, and you know their output still needs a second look, especially when it comes to security.
• Clear, friendly communication with engineers. You see yourself as an enabler, not a gatekeeper, and you can explain risk to people who are not security specialists.

Nice to Haves

• Some Python and/or JavaScript experience, or experience building internal tools.
• Willingness to learn and use Camunda, since much of the security automation is built on it. Prior BPMN or workflow experience is a plus.
• Experience responding to security incidents or being part of an on call rotation.
• Exposure to security advisories, CVE disclosure, or bug bounty programmes.
• Knowledge of AI/LLM security risks (OWASP Top 10 for LLMs and agentic apps, prompt injection, tool abuse).
• Experience securing Kubernetes or container based workloads, or open source or B2B software.

Compensation

Camunda offers competitive, fair, and transparent compensation. Salary ranges are location based, with Standard and Major markets (global tech hubs) reflecting local competition. The Annual Total Target Cash (base salary plus 100% variable target, where applicable) spans from the minimum in a Standard market to the maximum in a Major market. Final offers depend on skills, experience, and location, and Camunda typically hires in the first half of the range to allow room for growth:

• United States: $119,900.00 to $193,200.00
• United Kingdom: £75,300.00 to £123,800.00
• Singapore: S$148,900.00 to S$223,300.00

If you are based elsewhere, you will be hired via Remote.com (Camunda's global employer partner), and your Talent Acquisition Partner will provide a personalized Total Rewards Calculator after your first interview.

Equity: Camunda also offers equity (where applicable) through its Virtual Stock Option Plan (VSOP).

Benefits and Perks

• Remote and Flexible: Work from anywhere with the setup that suits you, home office budget, co working space support, and flexible time off to recharge when you need it.
• In Person Connection: Meaningful face time through the Annual Kickoff (Vienna in 2025, Madrid in 2026), team offsites, and Camundi Connection Budgets, including contributing to meetups while travelling and local gatherings with fellow Camundi.
• Health and Wellbeing: Locally tailored healthcare, Modern Health for global mental wellbeing, and the Live Well Lifestyle Spending Account (LSA), a flexible global benefit covering staying active, caring for family, personal passions, meaningful experiences, and financial wellbeing. The Live Well program launches in 2026 and scales to 1,000 EUR annually from 2027.
• Financial Security: Retirement and pension plans (often with company contributions), plus life and disability insurance where relevant.
• Professional Growth: Up to $/€/£1,000 per year for self driven learning such as courses, certifications, and books.

Equal Opportunity

Everyone is welcome at Camunda and it is a celebrated component of the culture. Camunda strives to create an inclusive environment that empowers its people, honours diverse cultures and backgrounds, and is proud to be an equal opportunity employer. All qualified applicants will receive consideration without regard to gender, race, ethnicity, religion, belief, sexual orientation, age, disability, or any other protected characteristics under applicable law.