Staff Security Engineer (m,f,x)

The role

We are looking for a Staff Security Engineer to join the Security Tribe and help shape the next generation of security capabilities at HelloFresh.

This is a senior individual contributor role for someone who is deeply technical, pragmatic, and builder-minded. You will work across Cloud Security, Application & Product Security, Offensive Security, and GenAI Security, with a strong focus on creating scalable internal security products, paved roads, guardrails, and self-service capabilities for HelloFresh teams.

You will not only identify risks, but also build the systems, automation, and platforms that help engineering teams move faster and safer.

Above all, we are looking for people who will make HelloFresh better. We believe there are many different ways of developing skills and we love diverse experiences! So even if you don’t “tick all the boxes” but think you’d thrive in this role, we would really like to learn more about you.

What you’ll do

• Own and elevate secure design and architecture at scale across HelloFresh — championing a security-by-design culture by defining, driving, and embedding robust architectural patterns, reference designs, and guardrails that enable teams to build secure systems by default across the organization.
• Define and drive security architecture across our cloud environments, with a strong focus on AWS, Kubernetes, IAM, network security, workload protection, secrets management, and secure-by-default infrastructure.
• Build and scale cloud security guardrails using automation, policy-as-code, Infrastructure as Code, and platform-native controls.
• Partner with engineering and product teams to embed security into the SDLC through threat modeling, secure design reviews, security testing, and developer-friendly remediation workflows.
• Build internal security products and capabilities that make security self-serviceable for HelloFresh employees and engineering teams.
• Lead initiatives across SAST, DAST, SCA, IaC scanning, secret detection, vulnerability management, and software supply chain security.
• Drive offensive security activities including penetration testing, adversary simulation, purple teaming, and validation of detection and response capabilities.
• Establish security patterns and controls for GenAI and AI/ML systems, including LLM applications, AI agents, RAG systems, model integrations, prompt injection risks, data leakage, and AI governance.
• Coordinate with external security