Talon One

API-first platform for promotions and loyalty

Product Security Engineer

Security Engineering & ArchitectureConfirmed live in the last 24 hours

Full-timeBerlin, Germany

About the Job

Requirements

Experience shipping production code, either through software engineering or security work that includes coding.
Experience with authorization and tenant isolation models for a multi-tenant SaaS platform, and strong knowledge of automatically testing for broken object-level authorization.
Ability to design API security end to end, including authentication, credential lifecycle, rate limiting, abuse resistance, and webhook security.
Hands-on experience with threat-modeling methodologies such as STRIDE and translating identified threats into actionable engineering requirements and security tests.
Practical experience implementing and tuning Static Application Security Testing (SAST) and Dynamic Application Security Testing (DAST) tools in continuous integration and continuous delivery workflows, with useful developer feedback and effective vulnerability remediation.
Understanding of how AI features are built, including retrieval, context assembly, tool calling, and agent loops, and where indirect prompt injection can break multi-tenant isolation.
Hands-on experience with Google Cloud security, Kubernetes, and tools such as Wiz and Datadog.
Knowledge of building security monitoring and detections in in-house security information and event management (SIEM) tools, from signal design and tuning through runbook writing.
Strong knowledge of OWASP security guidance, including the OWASP Top 10, API Security Top 10, and Top 10 for Large Language Model Applications.
Ability to influence engineers who do not report to the role and work effectively in an early-stage function without an established playbook.

Responsibilities

Threat-model new product features, including AI-embedded features, before implementation and turn findings into engineering work.
Own tenant isolation and API security across the Rule Engine, Integration API, Management API, CAMA, UCP Predict features, Talon.One MCP, and third-party integrations.
Serve as security design authority for AI features in collaboration with the UCP and Predict teams.
Build automated cross-tenant and adversarial tests that run in continuous integration and check isolation on every build.
Build standard, frictionless, automated golden paths for code security checks in continuous integration workflows that developers can adopt without slowing delivery.
Run vulnerability management and coordinate patch response across squads outside Platform, including automated dependency updates and emergency response.
Build and own application and AI security monitoring with observability tools; develop real-time security detection rules, alerts, and security-event runbooks.
Design the security of the API integration between Talon.One and Adyen.
Run a security champions programme to build security capability across the tribes.
Experiment with AI and develop workflows to identify, prioritize, and remediate product security risks at scale.

Talon.One, an Adyen company, is the most powerful incentives engine that unifies loyalty, personalized promotions and offer management into a single platform.
Built for enterprise scale and security, Talon.One helps businesses design and deliver incentives that drive real customer behavior.

Today, over 300 of the world’s most-loved brands including Sephora, Gymshark and Costa Coffee work with Talon.One to turn their incentives into a reliable growth engine.

ABOUT THE ROLE:

You'll be one of Talon.One's first two security engineering hires, owning the security of everything we ship to our customers and third-party partners, from API authorization to the AI features going into our platform and their real-time observability and detections. You'll work hands-on, pairing directly with engineers and product managers rather than filing tickets, across a multi-tenant platform that powers promotions and loyalty for some of Europe's largest retail and travel brands. Based in Berlin, hybrid.

ONCE YOU ARE HERE YOU WILL:

Threat-model new product features before they're built, including AI-embedded ones, and turn what you find into real engineering work
Own tenant isolation and API security across our Rule Engine, Integration API, Management API, CAMA, UCP Predict features, Talon.One MCP and third-party integrations
Act as the security design authority for our AI features, working closely with the team behind UCP and Predict
Build automated cross-tenant and adversarial testing that runs in CI, so isolation gets checked on every build, not only during our external yearly Pentest iterations
Build standard, frictionless and automated golden paths for code security checks in CI workflows that developers can adopt by default without slowing down delivery
Run vulnerability and coordinate efficient patch response across every squad outside Platform, from automated dependency updates to drilled emergency response
Build and own application and AI security monitoring with our observability tools and build real-time security detection rules and alerts, and security events runbooks
Design the security of the API integration between Talon.One and Adyen as our products come together
Run a security champions programme so all our tribes build real security capability, not just the security team
Experiment with AI, leverage innovative ways and build new workflows to identify, prioritize, and remediate product security risks at scale.

WHAT WE NEED YOU TO BRING TO THE TABLE:

Experience with shipping production code, whether you come from software engineering or from security work that includes coding
Experience with a multi-tenant SaaS platform's authorization and tenant isolation model, and strong knowledge of how to test for broken object-level authorization automatically
Design API security end-to-end: authentication, credential lifecycle, rate limiting, abuse resistance and webhook security
Hands-on experience with threat-modelling methodologies such as STRIDE, translating identified threats into actionable engineering requirements and security tests
Practical experience implementing and tuning SAST and DAST tools in CI/CD workflows, with a focus on useful developer feedback and effective vulnerability remediation
Understanding how AI features actually get built, retrieval, context assembly, tool calling, agent loops, and know where indirect prompt injection breaks multi-tenant isolation
Hands-on experience with Google Cloud security, Kubernetes, and tools like Wiz and Datadog
Know how to build security monitoring and detections in-house tools (SIEM) yourself, from designing the signal through tuning it and writing the runbook
Strong knowledge of OWASP security guidance, including the OWASP Top 10, API Security Top 10, and Top 10 for Large Language Model Applications
Ability to influence engineers who don't report to you, and feel comfortable being early in a function with no existing playbook

WHAT'S IN IT FOR YOU:

A product & engineering team, now part of Adyen, building the incentives engine behind some of the world’s biggest brands
Adyen+, a significant monthly allowance to spend on whatever matters most to you and your wellbeing
28 days of paid annual leave
€115 monthly commuting allowance when you join us in the office 3 days per week
25% employer contribution to your pension
Annual all-company gathering at Adyen’s headquarters in Amsterdam, plus regional team events throughout the year
Opportunity to connect in person at Adyen offices across 29 locations worldwide

About the Company

Talon One

API-first platform for promotions and loyalty

Talon.One provides an API-first, headless platform for enterprises to create, manage, and monitor promotional campaigns, loyalty programs, and gamification through its Incentives Engine. The system integrates with a business’s CRM, ecommerce, and POS to exchange data in real time and uses a rules engine to tailor offers based on customer behavior, purchase history, and location. It stands out by plugging into existing tech stacks without heavy code, enabling real-time data sharing and scalable personalization across channels. Its goal is to help mid-market and enterprise brands run data-driven promotions worldwide, backed by funding to expand AI-powered insights and market reach.

Company size: 201-500
Company stage: Acquired
Total funding: $138.3M
Headquarters: Berlin, Germany
Founded: 2015

Recently Posted Jobs

Explore more opportunities at Talon One

See more jobs