Senior Security Engineer Sicherheit von Drittanbietersoftware - Senior Specialist IT Security Management (m/w/d)
- Deutsche Pfandbriefbank AG
- Garching bei München
Deutsche Pfandbriefbank AG (pbb) is an international specialized commercial bank with over 800 employees from 37 countries. We offer our customers a wide range of financing and investment solutions for the entire real estate value chain. Our goal is to contribute to a more sustainable world of real estate.
For our CIO/COO business area based in Garching near Munich, we are currently seeking to hire, with immediate effect, a
Senior Security Engineer Third-Party Software Security (m/f/d)
This is a hands-on individual-contributor engineering role within Security Governance. You will evaluate the security of third-party software, open-source components and packages used in software development and infrastructure, and turn your findings into practical controls and clear technical recommendations. The focus is software and component security—not supplier questionnaires, commercial vendor assessments or ownership of third-party risk management (TPRM).
Your responsibilities
- Evaluate third-party software, commercial products, open-source libraries, packages and container images before introduction and throughout their use. Review technical documentation, dependencies, security findings and deployment requirements, and perform targeted hands-on validation
- Own and improve the technical vulnerability-management process for third-party components across software development and infrastructure engineering—from identification and validation through prioritisation, remediation and verification.
Assess component provenance, software composition and dependency chains, including Software Bills of Materials (SBOMs) where available. Investigate vulnerabilities and suspicious or unsupported components, and recommend safer versions or alternatives - Define practical security evaluation criteria, minimum technical requirements and software onboarding checks. Document evidence-based recommendations to approve, restrict or reject software for decision by the accountable owners, and track exceptions and compensating controls
- Configure and improve security tooling such as Tenable, Aikido Security, Microsoft Defender and Nexus Repository Firewall, integrating component checks and security gates into development pipelines and package repositories
- Validate findings and prioritise remediation using exploitability, exposure, asset criticality and deployment context, supported by CVSS, EPSS and CISA KEV. Work with developers and infrastructure engineers to upgrade, replace, harden or isolate affected components
- Review secure deployment and hardening of third-party software across Windows, Linux, networks, VMware, Kubernetes, AWS and Microsoft Azure, including permissions, configuration and integration boundaries
- Assess AI-related third-party software, packages and integrations, including how they handle data, permissions and external services. Apply engineering judgement when using AI-assisted analysis and independently validate its outputs
- Automate repeatable assessments, evidence collection and remediation tracking. Maintain clear technical records and meaningful reporting on findings, exceptions and remediation progress for Security Governance and audit stakeholders
- Partner with software engineering, infrastructure, architecture and application owners to embed security requirements into the software development lifecycle. Provide technical findings to TPRM and compliance colleagues when needed, without owning their supplier-risk processes
How to convince us
- Demonstrated hands-on experience in security engineering, software development or infrastructure engineering, with examples of assessing and improving software security. A specific degree or formal qualification is not required; practical capability matters most
- Ability to investigate findings, understand technical impact and drive workable remediation for third-party software and dependencies. We assess depth of experience and engineering judgement rather than a minimum number of years
- Strong understanding of software development practices, the SDLC, OWASP Top 10, dependency management, package repositories and CI/CD pipelines. Practical knowledge of Windows/Linux, networking, Active Directory, VMware, Kubernetes, AWS and Azure/M365, together with the ability to assess AI-enabled software and integrations
- Hands-on experience with vulnerability scanners, software composition analysis and repository controls. Relevant tools include Tenable, Microsoft Defender, Aikido Security and Nexus Repository Firewall; equivalent tooling experience is welcome. ServiceNow experience is a plus
- Ability to write and maintain scripts, work with APIs and integrate security checks into engineering workflows, with clear, reproducible results
- Ability to translate security requirements into testable engineering controls, document assessment evidence and explain residual risk and exceptions. Familiarity with regulatory requirements or IT compliance standards is an advantage; certifications are welcome but not a substitute for practical experience
- Analytical, structured and accountable, with the confidence to challenge technical decisions constructively and collaborate with developers, infrastructure teams and software providers. You can explain findings and trade-offs clearly to technical and non-technical audiences
- Excellent written and spoken English (German a plus)
- Practical knowledge of system-hardening concepts and benchmarks such as CIS, and the ability to review software permissions and deployment configurations. Experience coordinating penetration tests or red-team exercises is a plus, not a requirement
Our values
We live our values and expect the same attitude from our employees. Together, we are future-oriented, reliable, and collaborative.
What you can expect
With us, you will encounter a sustainable corporate culture, diverse and challenging projects, as well as plenty of creative freedom and flexibility.
And what else?
There is more to look forward to:
- Attractive salary and benefits
- Bike leasing and Wellpass
- guudcard employee benefits card
- Childcare and meal subsidies
- Company pension scheme
… and much more
Work–life balance
- Flexible working hours and at least two days of home working
- 30 days of annual leave plus 5 flexitime days off
- Family support service for personal assistance
- A great location in Garching near Munich
- Underground rail connections and easy motorway access
- Staff restaurant and barista bar
Interested?
Help us shape the future of real estate—and keep it secure. Apply now in just a few clicks and join #teampbb!
Apply now!
- Hubert Lohr
- HR Business Partner
- +49 89 2880-10126
