Lead Security Engineer (m/w/d)

• Vulnerability management – scanners and dependency updates across repos, plus the process that gets findings closed.
• Partner to Platform – review security-sensitive infrastructure decisions and explore options like customer-managed keys or HSMs. Platform still owns architecture.
• Certifications, technical side – control design and assessments for our ISO 27001 and C5 setup, the security case for a potential upcoming Class IIa medical device (MDR), and pentest scoping and follow-up, with regulation like the EU Cyber Resilience Act on the horizon. This is roughly a quarter to a third of the role, and we say it openly: for the right person in healthcare security, it's a draw, not a chore.
• Customer security – reusable docs, evidence, and AI-assisted questionnaires, so the tenth enterprise deal costs a fraction of the first. You join the call when a hospital CISO asks something new about our AI architecture.
• Incident response – process, runbooks, and escalation, and you lead when it's real. We're too small for a SOC, so you design on-call that fits a company our size. Product incidents and platform bugs have their own owners in engineering.
• Company-wide security – watch the threat landscape, turn this week's supply-chain mess into concrete actions, and set the baselines IT applies to devices and accounts.

How we work:

Your profile

• You're a hands-on security engineer with 6+ years across software and security engineering, and you can point to a security program (or a big part of one) you've owned.
• You've been the technical counterpart through at least one ISO 27001, C5, or SOC 2 certification cycle: you've designed controls, faced an auditor, and written the technical side of a Statement of Applicability. This is a hard requirement.
• You've run vulnerability management somewhere real: scanners, dependency bots, triage, and the follow-through that gets things fixed.
• You follow the security scene closely (podcasts, advisories, incident write-ups) and usually have an opinion on this week's incident before it reaches the news.
• You're genuinely curious about AI security – both securing AI systems (agents, sandboxing, data flows) and using AI tooling to work at leverage.
• You can talk to engineers, auditors, and hospital security teams in English without a slide deck translating for you.

Nice to have:

• German language skills, since our customers and the C5 world are German-speaking.
• Experience in healthcare or another regulated domain.
• Offensive security experience.
• Security certifications such as OSCP, CISSP, or similar.

We offer

• Purposeful work – your role will have a positive impact on patients, their families, and healthcare professionals.
• Company culture – we believe in flat hierarchies that promote high performance and strong team dynamics. We foster an environment characterized by mutual respect, loyalty, and recognition. Together, we strive for our goals – and expect the same from you.
• Flexibility – want to pick up your child from daycare? Like to exercise during lunch? We'll support you. We are a remote-friendly company offering flexible working hours. Workations are also possible by arrangement.
• Edenred card – which you can use according to your needs.
• Extra vacation day – so you can celebrate your birthday with your loved ones, you'll have the day off.

We show an excerpt and a link, and the full text when the source allows it. Brands and logos shown belong to their owners.

Posted Oct 16, 2026