Security Engineer – Sicherheit von Drittsoftware - Specialist IT Security Management (m/w/d)
- Deutsche Pfandbriefbank AG
- Garching bei München
Deutsche Pfandbriefbank AG (pbb) is an international specialized commercial bank with over 800 employees from 37 countries. We offer our customers a wide range of financing and investment solutions for the entire real estate value chain. Our goal is to contribute to a more sustainable world of real estate.
For our CIO/COO business area based in Garching near Munich, we are currently seeking to hire, with immediate effect, a
Security Engineer – Third-Party Software Security - Specialist IT Security Management (m/f/d)
This is a hands-on engineering role within Security Governance, with guidance from experienced colleagues and opportunities to develop your skills. You will help assess the security of third-party software, open-source components and packages used in software development and infrastructure, and contribute to practical controls and technical recommendations. The focus is software and component security—not supplier questionnaires, commercial vendor assessments or ownership of third-party risk management (TPRM).
Your responsibilities
- Help evaluate third-party software, commercial products, open-source libraries, packages and container images before introduction and throughout their use. Follow established assessment steps to review technical documentation, dependencies and security findings, and carry out targeted checks with guidance from experienced colleagues
- Support the technical vulnerability-management process for third-party components across software development and infrastructure engineering. Help identify and validate findings, track remediation and verify fixes using established procedures
- Review component provenance, software composition and dependency chains, including Software Bills of Materials (SBOMs) where available. Investigate known vulnerabilities and unsupported components, and discuss suitable versions or alternatives with the team
- Apply established security evaluation criteria, minimum technical requirements and software onboarding checks. Document findings to support approval decisions by accountable owners, and help maintain records of exceptions and compensating controls
- Use and help configure security tooling such as Tenable, Aikido Security, Microsoft Defender and Nexus Repository Firewall. Support the integration of component checks into development pipelines and package repositories
- Help validate findings and assess remediation priorities using exploitability, exposure, asset criticality and deployment context, with guidance on CVSS, EPSS and CISA KEV. Work with developers and infrastructure engineers on agreed fixes, escalating complex findings to experienced colleagues
- Support secure deployment and hardening reviews of third-party software in relevant Windows, Linux, network, VMware, Kubernetes, AWS or Microsoft Azure environments. Use checklists to review permissions, configuration and integration boundaries, with support where needed
- Assist with reviews of AI-related third-party software, packages and integrations, including data handling, permissions and external services. Check AI-assisted analysis with experienced colleagues and flag uncertain results
- Help automate repeatable assessment tasks, collect evidence and track remediation. Maintain clear technical records and contribute to reporting on findings, exceptions and remediation progress for Security Governance and audit stakeholders
- Work with software engineering, infrastructure, architecture and application owners to apply agreed security requirements during software development. Help prepare technical findings for TPRM and compliance colleagues when needed, without owning their supplier-risk processes
How to convince us
- Some hands-on experience in security, software development or IT infrastructure, gained through a role, internship, apprenticeship, studies or personal projects. A specific degree or formal qualification is not required; curiosity, practical foundations and willingness to learn matter most
- Basic understanding of software vulnerabilities and dependencies, with an interest in learning how to investigate findings and support remediation. You do not need to have owned a vulnerability-management process or meet a minimum number of years of experience
- Foundational knowledge of software development or IT infrastructure, and an interest in building skills across both. Familiarity with topics such as the SDLC, OWASP Top 10, dependency management, package repositories or CI/CD is useful. Exposure to Windows/Linux, networking, Active Directory, VMware, Kubernetes or cloud platforms is welcome; you do not need experience across every area. An interest in AI-enabled software and its security risks is a plus
- Initial exposure to vulnerability scanners, software composition analysis or repository controls is helpful. You will have the opportunity to learn tools such as Tenable, Microsoft Defender, Aikido Security and Nexus Repository Firewall. Experience with these specific tools or ServiceNow is not required
- Basic scripting skills and an interest in using APIs and automating repeatable tasks. You can explain what your scripts do and are willing to learn how to produce clear, reproducible results
- Willingness to learn how security requirements translate into technical checks and how to document findings, evidence and exceptions. Prior regulatory or IT compliance experience and certifications are welcome but not required
- A careful, analytical approach, willingness to ask questions and readiness to seek support when needed. You enjoy working with developers and infrastructure colleagues, follow through on agreed tasks and can explain your findings clearly
- Good written and spoken English (German a plus)
- Basic understanding of software permissions, secure settings and system hardening, with a willingness to learn how to apply benchmarks such as CIS. Prior penetration-testing or red-team experience is not required
Our values
We live our values and look for the same mindset in our colleagues. Together, we are forward-looking, reliable and collaborative.
What we offer
Join a sustainability-minded culture with varied, challenging projects, room to shape your work and flexibility. There is more to look forward to:
- Attractive salary and benefits
- Bike leasing and Wellpass
- guudcard employee benefits card
- Childcare and meal subsidies
- Company pension scheme
… and much more
work–life balance
- Flexible working hours and at least two days of home working
- 30 days of annual leave plus 5 flexitime days off
- Family support service for personal assistance
- A great location in Garching near Munich
- Underground rail connections and easy motorway access
- Staff restaurant and barista bar
Interested?
Help us shape the future of real estate—and keep it secure. Apply now in just a few clicks and join #teampbb!
Apply now!
- Hubert Lohr
- HR Business Partner
- +49 89 2880-10126
