Purposeful work – your role will have a positive impact on patients, their families, and healthcare professionals.

Company culture – we believe in flat hierarchies that promote high performance and strong team dynamics. We foster an environment characterized by mutual respect, loyalty, and recognition. Together, we strive for our goals – and expect the same from you.

Flexibility – want to pick up your child from daycare? Like to exercise during lunch? We'll support you. We are a remote-friendly company offering flexible working hours. Workations are also possible by arrangement.

Edenred card – which you can use according to your needs.

Extra vacation day – so you can celebrate your birthday with your loved ones, you'll have the day off.

Vulnerability management – scanners and dependency updates across repos, plus the process that gets findings closed.

Partner to Platform – review security-sensitive infrastructure decisions and explore options like customer-managed keys or HSMs. Platform still owns architecture.

Certifications, technical side – control design and assessments for our ISO 27001 and C5 setup, the security case for a potential upcoming Class IIa medical device (MDR), and pentest scoping and follow-up, with regulation like the EU Cyber Resilience Act on the horizon. This is roughly a quarter to a third of the role, and we say it openly: for the right person in healthcare security, it's a draw, not a chore.

Customer security – reusable docs, evidence, and AI-assisted questionnaires, so the tenth enterprise deal costs a fraction of the first. You join the call when a hospital CISO asks something new about our AI architecture.

Incident response – process, runbooks, and escalation, and you lead when it's real. We're too small for a SOC, so you design on-call that fits a company our size. Product incidents and platform bugs have their own owners in engineering.

Company-wide security – watch the threat landscape, turn this week's supply-chain mess into concrete actions, and set the baselines IT applies to devices and accounts.

AI-native – our engineers use coding agents every day. Security should too: scanning, evidence, questionnaires.

AI is also our attack surface – agent sandboxing, prompt injection, voice data, computer-use automation inside hospitals. We deal with security questions most companies will only meet in a few years.

Human-in-the-loop by default – this is healthcare: AI proposes, people stay in control.

Ship and observe – we ship continuously and debug from telemetry, including in the open when that's the fastest path.

You're a hands-on security engineer with 6+ years across software and security engineering, and you can point to a security program (or a big part of one) you've owned.

You've been the technical counterpart through at least one ISO 27001, C5, or SOC 2 certification cycle: you've designed controls, faced an auditor, and written the technical side of a Statement of Applicability. This is a hard requirement.

You've run vulnerability management somewhere real: scanners, dependency bots, triage, and the follow-through that gets things fixed.

You follow the security scene closely (podcasts, advisories, incident write-ups) and usually have an opinion on this week's incident before it reaches the news.

You're genuinely curious about AI security – both securing AI systems (agents, sandboxing, data flows) and using AI tooling to work at leverage.

You can talk to engineers, auditors, and hospital security teams in English without a slide deck translating for you.

German language skills, since our customers and the C5 world are German-speaking.

Experience in healthcare or another regulated domain.

Offensive security experience.

Security certifications such as OSCP, CISSP, or similar.

Purposeful work – your role will have a positive impact on patients, their families, and healthcare professionals.

Company culture – we believe in flat hierarchies that promote high performance and strong team dynamics. We foster an environment characterized by mutual respect, loyalty, and recognition. Together, we strive for our goals – and expect the same from you.

Flexibility – want to pick up your child from daycare? Like to exercise during lunch? We'll support you. We are a remote-friendly company offering flexible working hours. Workations are also possible by arrangement.

Edenred card – which you can use according to your needs.

Extra vacation day – so you can celebrate your birthday with your loved ones, you'll have the day off.

Vulnerability management – scanners and dependency updates across repos, plus the process that gets findings closed.

Partner to Platform – review security-sensitive infrastructure decisions and explore options like customer-managed keys or HSMs. Platform still owns architecture.

Certifications, technical side – control design and assessments for our ISO 27001 and C5 setup, the security case for a potential upcoming Class IIa medical device (MDR), and pentest scoping and follow-up, with regulation like the EU Cyber Resilience Act on the horizon. This is roughly a quarter to a third of the role, and we say it openly: for the right person in healthcare security, it's a draw, not a chore.

Customer security – reusable docs, evidence, and AI-assisted questionnaires, so the tenth enterprise deal costs a fraction of the first. You join the call when a hospital CISO asks something new about our AI architecture.

Incident response – process, runbooks, and escalation, and you lead when it's real. We're too small for a SOC, so you design on-call that fits a company our size. Product incidents and platform bugs have their own owners in engineering.

Company-wide security – watch the threat landscape, turn this week's supply-chain mess into concrete actions, and set the baselines IT applies to devices and accounts.

AI-native – our engineers use coding agents every day. Security should too: scanning, evidence, questionnaires.

AI is also our attack surface – agent sandboxing, prompt injection, voice data, computer-use automation inside hospitals. We deal with security questions most companies will only meet in a few years.

Human-in-the-loop by default – this is healthcare: AI proposes, people stay in control.

Ship and observe – we ship continuously and debug from telemetry, including in the open when that's the fastest path.

You're a hands-on security engineer with 6+ years across software and security engineering, and you can point to a security program (or a big part of one) you've owned.

You've been the technical counterpart through at least one ISO 27001, C5, or SOC 2 certification cycle: you've designed controls, faced an auditor, and written the technical side of a Statement of Applicability. This is a hard requirement.

You've run vulnerability management somewhere real: scanners, dependency bots, triage, and the follow-through that gets things fixed.

You follow the security scene closely (podcasts, advisories, incident write-ups) and usually have an opinion on this week's incident before it reaches the news.

You're genuinely curious about AI security – both securing AI systems (agents, sandboxing, data flows) and using AI tooling to work at leverage.

You can talk to engineers, auditors, and hospital security teams in English without a slide deck translating for you.

German language skills, since our customers and the C5 world are German-speaking.

Experience in healthcare or another regulated domain.

Offensive security experience.

Security certifications such as OSCP, CISSP, or similar.