Application Security Engineer (m/f/d)

LOCATION: Stuttgart, Munich, Hamburg (hybrid remote work possible)
START: Immediately

Blockbrain is a secure, AI-powered B2B SaaS platform that extends human knowledge with responsible AI. We help companies develop customized GenAI systems to access and leverage knowledge faster, automate a variety of knowledge-intensive tasks, and protect sensitive data—on our no-code platform or via API. Security is built in from the start: we comply with GDPR, ISO 27001, and EU AI law. Our VC-backed team brings decades of experience in AI, B2B SaaS, big data, automation, and data security.

We are looking for a highly motivated and entrepreneurial Senior Security Full Stack Engineer to join our dynamic team. In this hands-on position, you will focus on integrating security principles directly into our full-stack development processes, ensuring robust protection for our TypeScript-based backend (Hono, Node.js, Nest.js), our Python services (FastAPI) and our Next.js/React frontend. You will integrate security best practices into code, architecture and infrastructure while working on DevSecOps initiatives. As a Senior Engineer, you will apply secure design principles to build resilient systems and have expertise in databases (SQL/NoSQL/Graph), Kubernetes/AWS security, and AI/Knowledge Graph protection. The ideal candidate is a proactive problem solver who is committed to seamlessly integrating security into development workflows and reducing risk without slowing down innovation.

Secure full-stack development:

• Design, implement and verify secure backend services with TypeScript (Hono, Node.js, Nest.js) and Python (FastAPI) as well as frontend applications with Next.js, React and web components. Integrate security functions such as authentication, encryption and input validation directly into the code to avoid vulnerabilities.

Security policies and architecture:

• Apply secure software engineering principles (e.g. OWASP guidelines, least privilege, secure-by-design) and design patterns to develop robust systems. Perform threat modeling, code reviews and vulnerability analysis to ensure scalability, modularity and compliance (e.g. GDPR, ISO 27001, EU AI law)

DevSecOps and infrastructure security:

• Secure and optimize our Kubernetes-based infrastructure, including securing container runtimes (e.g. Docker), access controls with ArgoCD and AWS deployments. Implement security in CI/CD pipelines with Terraform for IaC, automate scans (e.g. SAST/DAST) and manage monitoring, incident response and secrets (e.g. via Vault or AWS Secrets Manager).

Database and data security:

• Secure data management across databases, including general SQL databases (e.g. PostgreSQL, SQLite), NoSQL databases (e.g. MongoDB) and graph databases (e.g. Dgraph). Implement access controls, encryption and secure queries to protect sensitive data and knowledge graph integrations.

Secure API development:

• Design and maintain secure REST APIs and GraphQL endpoints, integrate safeguards against common threats (e.g. injection, XSS, CSRF) and ensure secure integrations across the entire stack.

AI and security of knowledge graphs:

• Work collaboratively to secure AI models and implementations, including LLMs for vector search and graph-based querying. Protect knowledge graph approaches from risks such as data leaks or attacks while contributing to secure data integration and intelligent features.

• At least 4-7 years of experience in security engineering or full-stack development with a focus on security, including hands-on experience in leading secure projects from design to production.
• Mastery of TypeScript across the stack; backend experience with Hono, Node.js, Nest.js and Python (FastAPI); frontend expertise in Next.js, React and Web Components. Ability to integrate security into these technologies.
• Sound knowledge of best practices for secure development (e.g. OWASP Top 10, standards for secure programming), principles of software design (e.g. SOLID, DRY), threat modeling and architecture security (e.g. Zero Trust models).
• Expertise in securing database technologies, including SQL (e.g. PostgreSQL, SQLite) for relational data, NoSQL (e.g. MongoDB) and graph databases (e.g. Dgraph) with knowledge graph approaches for semantic data protection and secure data retrieval.
• Hands-on experience with securing REST APIs and GraphQL schemas, including authentication (e.g. OAuth, JWT) and mitigating API-specific vulnerabilities.
• Knowledge of securing Kubernetes (e.g. RBAC, Pod security policies), ArgoCD, AWS (e.g. IAM, GuardDuty), Terraform for secure IaC and tools for automated security testing, logging and monitoring (e.g. Falco, Splunk).
• Familiarity with securing LLMs, vector embeddings, graph-based search and knowledge graph approaches, including defenses against AI-specific threats.

• Entrepreneurial mindset: An independent problem solver who enjoys advising others on safety issues and driving safety initiatives.
• Resilient and goal-oriented: You set yourself ambitious safety goals and can prove that you can achieve them in fast-paced environments.
• Innovator: Enthusiastic about proposing new security ideas, experimenting with new tools and learning from incidents.
• Pragmatic executor: action-oriented, with enthusiasm for the rapid integration of security without hindering development.
• Communicative: Confident in addressing risks, cross-functional collaboration and clear explanation of safety concepts. Fluency in English is required, knowledge of German is an advantage. Certifications such as CISSP, CSSLP or OSCP are a plus.

Join a fast-growing company at the forefront of AI-powered knowledge management.

• Growth opportunities: Significant opportunities for professional growth and development. Work with successful serial founders and technology experts.
• Hybrid work: flexible work structure.
• Culture: A flat hierarchy with unfiltered feedback loops.
• International: A global environment with regular team events and offsite meetings.
• Remuneration: Competitive remuneration package with upward potential.

If you are passionate about contributing to our mission and want to be a

growing DeepTech AI startup, we look forward to receiving your application. Please

send your CV and a short letter of motivation to: dominik@theblockbrain.ai.

Blockbrain is an equal opportunities employer. We celebrate diversity and are committed to an inclusive working environment.