About the role

Codesphere runs cloud infrastructure that enterprises and governments depend on – security is not an afterthought, it's a foundation. As a Senior Security & Compliance Engineer (m/f/d), you own the security posture of our platform: from vulnerability management and incident response to compliance frameworks and developer enablement.

What you'll drive

You conduct security assessments, penetration testing, and vulnerability scanning – and drive remediation with development teams
You manage security scanning tooling (DAST/SAST) and perform security code reviews
You design and implement security controls across our full technology stack, defining and enforcing standards for development, infrastructure, and data
You integrate security into our CI/CD pipelines and development processes – Shift Left and DevSecOps in practice, not just on paper
You develop and maintain our Security Incident Response Plan, monitor security logs via SIEM, and lead forensic analysis when needed
You ensure compliance with relevant standards and regulations – including GDPR and ISO 27001
You manage IAM systems with a least privilege approach
You develop and deliver security awareness training for the whole company – and specialised secure coding training for engineering teams

What makes you a great fit

5+ years in a security engineering or similar role, ideally in a cloud or SaaS environment
Hands-on experience with penetration testing, vulnerability management, and DAST/SAST tooling
Solid understanding of DevSecOps principles and CI/CD security integration
Familiarity with SIEM tools, incident response, and forensic analysis
Knowledge of relevant compliance frameworks – GDPR, ISO 27001, and ideally BSI IT-Grundschutz
Strong communicator – able to translate security risks into clear guidance for both technical and non-technical audiences
Fluent in English; German is a strong plus given the nature of our compliance landscape

Responsibilities

About the role

What you'll drive

You conduct security assessments, penetration testing, and vulnerability scanning – and drive remediation with development teams
You manage security scanning tooling (DAST/SAST) and perform security code reviews
You design and implement security controls across our full technology stack, defining and enforcing standards for development, infrastructure, and data
You integrate security into our CI/CD pipelines and development processes – Shift Left and DevSecOps in practice, not just on paper
You develop and maintain our Security Incident Response Plan, monitor security logs via SIEM, and lead forensic analysis when needed
You ensure compliance with relevant standards and regulations – including GDPR and ISO 27001
You manage IAM systems with a least privilege approach
You develop and deliver security awareness training for the whole company – and specialised secure coding training for engineering teams

What makes you a great fit

5+ years in a security engineering or similar role, ideally in a cloud or SaaS environment
Hands-on experience with penetration testing, vulnerability management, and DAST/SAST tooling
Solid understanding of DevSecOps principles and CI/CD security integration
Familiarity with SIEM tools, incident response, and forensic analysis
Knowledge of relevant compliance frameworks – GDPR, ISO 27001, and ideally BSI IT-Grundschutz
Strong communicator – able to translate security risks into clear guidance for both technical and non-technical audiences
Fluent in English; German is a strong plus given the nature of our compliance landscape