Security Engineer for Vulnerability Management & Application Security (m/f/d)

Deutsche Pfandbriefbank AG (pbb) is an international specialized commercial bank with over 800 employees from 37 countries. We offer our customers a wide range of financing and investment solutions for the entire real estate value chain. Our goal is to contribute to a more sustainable world of real estate.

For our CIO/COO business area based in Madrid, we are currently seeking to hire, with immediate effect, a

Security Engineer for Vulnerability Management & Application Security (m/f/d)

Your tasks

Help build security into cloud platforms, infrastructure and applications. In this hands‑on role, you will work with experienced colleagues and platform and development teams to implement secure configurations, identity and secrets management, and automated controls. Your focus is contributing to reliable security capabilities, including secure AI adoption, rather than day‑to‑day SOC alert handling.

Cloud & Infrastructure Security

• Help implement and improve AWS and Azure security controls across identity, networking, encryption and logging
• Contribute to cloud architecture and infrastructure code reviews; help harden systems, containers and Kubernetes workloads with engineering teams
  

Identity, Secrets & Key Management

• Help implement least‑privilege access for people and workloads, reducing shared and long‑lived credentials
• Support the integration of secrets management such as HashiCorp Vault or Azure Key Vault into applications and CI/CD; help automate credential and certificate lifecycles
  

Security Automation & Infrastructure as Code

• Develop and test security automation using Python, shell scripting and REST APIs, with support from colleagues
• Use Terraform, Git and policy‑as‑code to help embed secure defaults and automated checks into delivery pipelines
  

Security Tooling & Incident Support

• Help configure and maintain telemetry, detection and response integrations, including Cribl and Microsoft Sentinel, in collaboration with the SOC
• Support incident investigations alongside experienced colleagues and help implement fixes for cloud and infrastructure weaknesses
  

Application & AI Security

• Contribute to application design and code reviews; help integrate SAST/DAST, dependency and secrets checks into CI/CD and verify remediation
• Help assess AI applications, LLM integrations and agents for prompt injection, sensitive‑data exposure and excessive permissions; support the implementation and testing of access controls, output validation and approval gates for high‑impact actions
  

Technical Delivery & Documentation

• Support the review of provider deliverables and maintain practical architecture documentation, runbooks and operational handovers
• Help implement testable controls based on governance requirements and maintain audit evidence and remediation records

How to convince us

Must-have

• Cloud: Some hands‑on experience with AWS or Azure and an understanding of IAM, networking, encryption and logging
• Secrets and identity: Familiarity with secrets management concepts and tools such as HashiCorp Vault, Azure Key Vault or equivalent; willingness to develop practical integration and credential rotation skills
• Automation: Some experience with Python or shell scripting and Git, plus an interest in REST APIs and infrastructure as code such as Terraform
• Infrastructure: A working understanding of Linux or Windows, networking, DNS and TLS, plus an interest in container and Kubernetes security
• Delivery: Some experience implementing or testing technical controls, troubleshooting issues or contributing to technical reviews. Practical skills and willingness to learn matter more than degrees or years served
• Communication: Good English communication skills and the ability to explain technical topics clearly
• Only for holder of EU work permit
  

Nice-to-have

• Exposure to Vault, workload identity, PKI or privileged access management.
  Familiarity with multi‑cloud security, posture management, policy‑as‑code or automated remediation
• Interest or initial experience in AI security, including LLM threat modelling, prompt‑injection testing, data protection or agent permission controls
• Exposure to secure SDLC, Cribl/Microsoft Sentinel or incident investigation.
  Regulated‑industry experience or familiarity with DORA/NIS2

Our values

We live our values and expect the same attitude from our employees. Together, we are future‑oriented, reliable, and collaborative.

What you can expect

With us, you will encounter a sustainable corporate culture, diverse and challenging projects, as well as plenty of creative freedom and flexibility.

And what else?

• A hands‑on security engineering role with opportunities to develop your skills and take on responsibility over time
• Opportunities to contribute to cloud, automation and AI security work, with investment in tooling and development
• Competitive compensation and hybrid working (3 days per week in office / 2 days per week remote in Madrid at Torre Rioja near Plaza Castilla and Estadio Bernabeu