安全工程师负责人（男/女/其他）
Lead Security Engineer (m/w/d)
高级安全工程师（m/w/d）
关于Recare作为德国领先的健康科技公司，我们正在重塑出院管理——以技术驱动、以患者为中心，摆脱官僚主义。除了我们市场领先的SaaS平台，我们还开发人工智能解决方案，大幅简化医院和康复机构的流程，减轻医疗专业人员的负担，并重新将关注点放在患者身上。目前，我们已连接三分之二的德国医院，以及超过650家康复诊所和25,000家护理和居家护理机构。目前有约120名来自不同国家的员工，我们持续增长——并且现在正超越核心业务，通过一整套人工智能产品，致力于消除医院中的官僚主义和行政工作。
作为我们的高级安全工程师（m/w/d），您将获得：
- 有意义的工作——您的角色将对患者、他们的家人和医疗专业人员产生积极影响。
- 公司文化——我们相信扁平化结构能促进高绩效和强大的团队协作。我们营造一种相互尊重、忠诚和认可的环境。我们共同努力实现目标——并期望您同样如此。
- 灵活性——想接孩子放学？喜欢午餐时间锻炼？我们会支持您。我们是一家远程友好的公司，提供灵活的工作时间。经协商，也可以安排工作度假。
- Edenred卡——您可以根据自己的需求使用。
- 额外的假期——您可以与亲人庆祝生日，享有半天假期。
在这一职位中，您将与我们一同成长并发挥影响力：
您将是我们的第一位专职安全工程师：一位没有团队的资深技术人员。您将担任副首席信息安全官，向我们的技术总监（目前担任首席信息安全官）汇报，并从零开始构建安全工程。基础已经建立——ISO 27001、C5 Type II、定期的渗透测试以及产品中的加密。人工智能正在带来新的攻击面：语音记录、文档生成和代理工作流。您将构建并负责整个安全计划、工具链以及我们向客户传达的安全故事。
- 漏洞管理——跨仓库的扫描器和依赖项更新，以及关闭发现的流程。
- 与平台合作——审查安全敏感的基础设施决策，并探索如客户管理密钥或HSM等选项。平台仍负责架构。
查看英文原文
Lead Security Engineer (m/w/d)
About RecareAs one of the leading German HealthTech companies, we are reshaping discharge management – technology-driven, patient-centered, and free from bureaucracy. In addition to our market-leading SaaS platform, we develop AI solutions that radically simplify processes in hospitals and for aftercare providers, relieve healthcare professionals, and refocus attention on patients. Today, we already connect two-thirds of all German hospitals with over 650 rehabilitation clinics and 25,000 nursing and homecare providers. With currently around 120 employees from a broad range of nations, we continue to grow – and we're now going far beyond our core business, aiming to eliminate bureaucracy and admin in hospitals with a whole portfolio of AI products.
What to expect as our Lead Security Engineer (m/w/d):
- Purposeful work – your role will have a positive impact on patients, their families, and healthcare professionals.
- Company culture – we believe in flat hierarchies that promote high performance and strong team dynamics. We foster an environment characterized by mutual respect, loyalty, and recognition. Together, we strive for our goals – and expect the same from you.
- Flexibility – want to pick up your child from daycare? Like to exercise during lunch? We'll support you. We are a remote-friendly company offering flexible working hours. Workations are also possible by arrangement.
- Edenred card – which you can use according to your needs.
- Extra vacation day – so you can celebrate your birthday with your loved ones, you'll have the day off.
In this role, you can make an impact and grow with us as Lead Security Engineer (m/w/d):
You'll be our first dedicated security engineer: a senior IC with no team at the start. You join as Deputy CISO, report to our Director of Technology (currently acting CISO), and build security engineering from scratch. The baseline is already in place – ISO 27001, C5 Type II, regular penetration tests, and encryption in the product. AI is adding new surfaces: voice documentation, document generation, and agentic workflows. You build and own the security program, the tooling, and the security story we tell customers.
- Vulnerability management – scanners and dependency updates across repos, plus the process that gets findings closed.
- Partner to Platform – review security-sensitive infrastructure decisions and explore options like customer-managed keys or HSMs. Platform still owns architecture.
- Certifications, technical side – control design and assessments for our ISO 27001 and C5 setup, the security case for a potential upcoming Class IIa medical device (MDR), and pentest scoping and follow-up, with regulation like the EU Cyber Resilience Act on the horizon. This is roughly a quarter to a third of the role, and we say it openly: for the right person in healthcare security, it's a draw, not a chore.
- Customer security – reusable docs, evidence, and AI-assisted questionnaires, so the tenth enterprise deal costs a fraction of the first. You join the call when a hospital CISO asks something new about our AI architecture.
- Incident response – process, runbooks, and escalation, and you lead when it's real. We're too small for a SOC, so you design on-call that fits a company our size. Product incidents and platform bugs have their own owners in engineering.
- Company-wide security – watch the threat landscape, turn this week's supply-chain mess into concrete actions, and set the baselines IT applies to devices and accounts.
How we work:
- AI-native – our engineers use coding agents every day. Security should too: scanning, evidence, questionnaires.
- AI is also our attack surface – agent sandboxing, prompt injection, voice data, computer-use automation inside hospitals. We deal with security questions most companies will only meet in a few years.
- Human-in-the-loop by default – this is healthcare: AI proposes, people stay in control.
- Ship and observe – we ship continuously and debug from telemetry, including in the open when that's the fastest path.
Requirements
Here's how we picture you as our Lead Security Engineer (m/w/d):
- You're a hands-on security engineer with 6+ years across software and security engineering, and you can point to a security program (or a big part of one) you've owned.
- You've been the technical counterpart through at least one ISO 27001, C5, or SOC 2 certification cycle: you've designed controls, faced an auditor, and written the technical side of a Statement of Applicability. This is a hard requirement.
- You've run vulnerability management somewhere real: scanners, dependency bots, triage, and the follow-through that gets things fixed.
- You follow the security scene closely (podcasts, advisories, incident write-ups) and usually have an opinion on this week's incident before it reaches the news.
- You're genuinely curious about AI security – both securing AI systems (agents, sandboxing, data flows) and using AI tooling to work at leverage.
- You can talk to engineers, auditors, and hospital security teams in English without a slide deck translating for you.
Nice to have:
- German language skills, since our customers and the C5 world are German-speaking.
- Experience in healthcare or another regulated domain.
- Offensive security experience.
- Security certifications such as OSCP, CISSP, or similar.
Originally posted on Himalayas