· · ·
Book a Demo
Compliance SBOM & CRA Secure SDLC DAST OWASP Platform Sovereign AI Use cases Jobs
· · ·
Book a Demo
Powered by VamiSec · LLM-native AppSec · Hosted in Germany

From commit to compliance, in one secure SDLC platform.

VamiAppSec runs your secure CI/CD development lifecycle end-to-end — SAST, SCA, SBOM, dependency and secrets scanning, plus AI-powered DAST with the fully integrated VamiDAST — tracks every finding in the integrated DefectDojo or your own ticket system, and maps it to OWASP and to product-security regulations and standards such as CRA, MDR, RED, IEC 62443, UNECE R155 and ISO/SAE 21434. It runs as SaaS on T Cloud Public, exclusively in German data centers, or on-prem on your own Kubernetes cluster — with our local Qwen3.8 or a public LLM of your choice.

e.g. CRA MDR RED IEC 62443 UNECE R155 ISO/SAE 21434 + more
Book a Demo SBOM & CRA reporting
7scan types, one pipeline
OWASPASVS · ISVS · MASVS · AISVS
CI/CDGitLab · GitHub · Azure DevOps
Qwen3.8local LLM · Sankt Augustin
Scanners orchestrated natively
Semgrep Gitleaks Checkov Syft Grype Trivy ZAP by Checkmarx VamiDAST Nuclei
Findings tracked in DefectDojo — or Jira, Azure Boards, ServiceNow

IT security and compliance without AI is a vulnerability.

Valeri Milke Founder & CEO, VamiSec
02 · Compliance

Product-security requirements, mapped to your pipeline.

CRA, MDR, RED, IEC 62443, UNECE R155 and ISO/SAE 21434 are examples — not an exhaustive list. They all ask for the same thing in different words: a secure development lifecycle, a complete bill of materials and vulnerability handling you can prove. VamiAppSec turns every pipeline run into that evidence — for these and any comparable regime.

Examples — the list is not exhaustive

EU · Regulation (EU) 2024/2847

Cyber Resilience Act (CRA)

Annex I sets essential requirements: secure-by-design properties (Part I) and vulnerability handling (Part II) — SBOM, coordinated disclosure, timely security updates. Since 11 Sep 2026, actively exploited vulnerabilities must be reported to ENISA and the CSIRT (Art. 14); full application on 11 Dec 2027.

What VamiAppSec delivers
SBOM per release (CycloneDX / SPDX) Actively-exploited-vulnerability watch VEX / VDR exports 24 h / 72 h / 14-day report drafts
EU · Regulation (EU) 2017/745

Medical Device Regulation (MDR)

GSPR 17.2 demands software developed to the state of the art: lifecycle, risk management, information security, verification and validation. Notified bodies expect SOUP/SBOM inventories, vulnerability monitoring and traceable evidence (MDCG 2019-16, IEC 81001-5-1).

What VamiAppSec delivers
SOUP / SBOM inventory Lifecycle evidence per release Continuous CVE watch on released SBOMs Post-market vulnerability trail
EU · Directive 2014/53/EU · DR (EU) 2022/30

Radio Equipment Directive (RED)

Since 1 Aug 2025, connected radio equipment must protect the network (Art. 3(3)(d)), personal data (e) and against fraud (f). EN 18031-1/-2/-3 are the harmonised route — and expect secure update mechanisms, no default credentials and protected secrets.

What VamiAppSec delivers
Secrets scanning — no hard-coded credentials Update-mechanism & crypto review SBOM for connected devices Evidence for EN 18031 documentation
IEC · 62443-4-1 & 62443-4-2

IEC 62443 secure product lifecycle

62443-4-1 defines eight practices for a secure development lifecycle — from security management (SM) to security update management (SUM). 62443-4-2 adds technical component requirements at security levels 1–4.

What VamiAppSec delivers
SVV — verification & validation testing DM — defect management in DefectDojo SUM — patch & update evidence SI — secure implementation checks
UNECE · UN Regulation No. 155 (& 156)

UNECE R155 CSMS

Vehicle type approval requires a certified Cyber Security Management System across development, production and post-production — with threat mitigation per Annex 5. R156 adds a Software Update Management System.

What VamiAppSec delivers
CSMS evidence trail per release Annex 5 threat & mitigation mapping Post-production vulnerability monitoring R156 software-update evidence
ISO/SAE · 21434:2021

ISO/SAE 21434 cybersecurity engineering

The road-vehicle engineering standard behind R155: TARA, cybersecurity concept, product development, verification & validation, continual vulnerability management and distributed (supplier) activities.

What VamiAppSec delivers
Findings linked to TARA assets V&V evidence for cybersecurity cases Continual vulnerability management Supplier SBOM transparency
…and more

The same evidence serves every framework that asks for a secure SDLC, an SBOM and vulnerability handling.

NIS2 DORA EU AI Act · Art. 15 ISO/IEC 27001 SOC 2 IEC 81001-5-1 EN 18031 ETSI EN 303 645 BSI TR-03183 FDA § 524B GB 44495 OWASP SAMM

VamiAppSec doesn't certify your product — your notified body, technical service or auditor does. It gives them what they ask for: machine-generated, per-release evidence — SBOMs, scan results, gate decisions and vulnerability-handling records.

03 · SBOM & CRA reporting

Know what you ship. Know when it's exploited.

Since 11 September 2026, CRA Article 14 obliges manufacturers to report actively exploited vulnerabilities in their products — including products already on the market. You can only report what you can see: VamiAppSec generates an SBOM for every release and watches every shipped component for active exploitation, around the clock.

01

Generate an SBOM for every release

Syft builds CycloneDX and SPDX SBOMs in the pipeline — direct and transitive dependencies, versioned and stored with every release you ship.

SyftCycloneDXSPDX
02

Monitor for active exploitation

Every released SBOM is matched continuously against NVD, OSV and GitHub advisories — and against exploitation signals from CISA KEV and ENISA's EU Vulnerability Database (EUVD), prioritised with EPSS.

CISA KEVENISA EUVDNVDOSVGitHub AdvisoriesEPSS
03

Assess reachability & draft VEX

Qwen3.8 checks whether the vulnerable code path is reachable in your product and drafts the VEX status — affected, not affected, fixed or under investigation. Your PSIRT decides.

Qwen3.8DefectDojo
04

Start the reporting clock

When a shipped component is actively exploited, VamiAppSec starts the Art. 14 clock and pre-fills early warning, notification and final report — ready for submission via ENISA's Single Reporting Platform.

CRA Art. 14 · reporting clock for actively exploited vulnerabilities
24 hEarly warning
72 hVulnerability notification
14 dFinal report, once a fix or mitigation is available

Deadlines run from the moment you become aware. Reports go simultaneously to the coordinating CSIRT and ENISA via the Single Reporting Platform.

04 · Secure SDLC

Every stage of your CI/CD, secured.

One pipeline, six stages, seven scan types. VamiAppSec plugs into the CI/CD you already run — GitLab, GitHub or Azure DevOps — and puts a gate wherever a regulation expects one.

01 Plan

Requirements & policy

  • OWASP ASVS / ISVS / MASVS requirements
  • Policy-as-code gates
  • Threat-model inputs
OWASP
02 Code

Shift left

  • SAST — Semgrep + LLM review
  • Secrets scanning — Gitleaks
  • Pre-commit hooks & IDE SARIF
SemgrepGitleaks
03 Build

Supply chain

  • SCA & dependency scanning — Grype / Trivy
  • SBOM — Syft (CycloneDX / SPDX)
  • IaC & container — Checkov / Trivy
SyftGrypeTrivyCheckov
04 Test

Runtime

  • AI-DAST — VamiDAST, fully integrated
  • Web app & API — OWASP Top 10 / API Security Top 10
  • Additional DAST engine — ZAP
VamiDASTZAP by Checkmarx
05 Release

Quality gate

  • Block on critical / soft-fail on regressions
  • Signed SBOM, VEX & VDR per release
  • Per-release evidence bundle
CycloneDXSPDX
06 Operate

Defect tracking

  • DefectDojo — tracking, not scanning
  • Sync to Jira · Azure Boards · ServiceNow
  • Exploited-vulnerability watch on released SBOMs
  • VamiDAST in production — Passive or Safe mode
DefectDojoJiraAzure BoardsServiceNow
Gates where regulations expect them · PR gate for SAST and secrets · build gate for SCA and SBOM completeness · test gate for exploitable DAST findings · release gate for policy, VEX and evidence.

Runs where your code lives — tracks where your team works.

Source control & CI/CD

GitLab

CI/CD templates, MR approvals, security-dashboard feed.

GitHub

Actions workflow, PR checks, SARIF code scanning.

Azure DevOps

Pipelines task, PR policies, Repos integration.

BitbucketJenkinsGiteaForgejo+ SARIF · CycloneDX / SPDX · REST API
Defect tracking & ticket systems
Built in

DefectDojo

The system of record for every finding — not a scanner. Engagements per product, SLAs, deduplication, risk acceptance and a full audit trail.

Integration

Jira

Findings pushed as Jira issues to the owning team — status and resolution kept in sync with DefectDojo.

Integration

Azure DevOps Boards

Findings become work items next to your backlog — linked to the PR and the pipeline run that found them.

Integration

ServiceNow

Findings routed into ServiceNow — e.g. Vulnerability Response or ITSM tickets — for enterprise remediation workflows.

05 · Built-in DAST · VamiDAST

Attack your running build before attackers do.

VamiDAST, our AI-powered DAST, is fully integrated into VamiAppSec — as a fixed stage in your CI/CD, on demand via CLI, or continuously in production in Passive or Safe mode. It tests the live web app and API across 30+ vulnerability classes and backs every finding with payload and evidence, in the same DefectDojo backlog and behind the same gates as every other scan type.

VamiDASTFully integrated into VamiAppSec Product page: vamidast.com
01

Crawl the live attack surface

Maps the live web app and API from HTML, JavaScript, OpenAPI specs, robots.txt and wordlists — katana plus a headless browser that captures fetch/XHR endpoints with parameters and JSON bodies, including authenticated flows.

katana
02

Infer the vulnerability class

Path and parameter heuristics assign each endpoint its likely vulnerability class. Qwen3.8 is consulted only as a last resort — to name a class, never to decide what runs.

Qwen3.8
03

Run the attacker's playbook

Deterministic detectors and a class-independent injection sweep, plus sqlmap, dalfox, commix and Nuclei where a tool fits; the rest is fuzzed with tool or LLM-fallback payloads. A safety interlock gates every active request.

sqlmapDalfoxcommixNuclei
04

Confirm, don't guess

Unambiguous signatures decide first; Qwen3.8 triages only the grey zone. A second pass re-probes anomalies to confirm or drop them — what remains is reported as confirmed or anomaly.

Qwen3.8
05

Track, gate, prove

Findings arrive normalized — payload, evidence, confidence, remediation — in DefectDojo, next to SAST and SCA results. Confirmed ones can fail the test gate; coverage telemetry keeps a silent zero from passing as clean.

DefectDojoJiraAzure BoardsServiceNow
Safe active testing
  • Passive — crawl and inspect only; no state-changing request leaves the scanner.
  • Safe · default — read-only endpoints tested fully; state-changing ones only via precondition violation.
  • Aggressive — completes operations, only after explicit non-production confirmation.
Three ways to run VamiDAST

In your CI/CD

GitLab · GitHub · Azure DevOps

A fixed pipeline stage: every build that reaches staging is scanned, and confirmed findings at or above your severity threshold can fail the test gate before release.

On demand via CLI

any authorized target

Start a scan from the terminal whenever you need one — before a release, after a hotfix or for a one-off assessment — with the same safety modes and guardrails, and findings in the same backlog.

In production

passive · safe

Continuous or scheduled scans of live applications in Passive or Safe mode — Aggressive only after explicit non-production confirmation. New exposures land in the same backlog.

Coverage — an attacker's checklist

30+ · OWASP
Web application · OWASP Top 10
SQLi · error-based & blindXSS · reflected & DOMSSTILFICommand injectionSSRF · out-of-bandXXE · incl. blindOpen redirect / CRLFCSRFHost-header injectionFile upload → stored XSSNuclei · CVEs & exposures
API security · OWASP API Security Top 10
BOLA / IDORBroken authenticationJWT forgerySession fixationLogout invalidationMass assignmentBFLAResource consumptionGraphQL introspection & injectionBlind SQLi via DNS / HTTP
Passive & posture · every mode
Cookie flagsSecurity headersPlaintext transportWAF fingerprint
The model advises — it never steersCrawling, tool runs, detection and orchestration are deterministic. Qwen3.8 acts in three bounded places — classify, draft fallback payloads, triage. Every output is schema-validated; only 2 KB response snippets reach a prompt.
Authenticated and multi-userForms, JWT, cookies and API keys — plus a second identity to prove broken object-level authorization (BOLA/IDOR). Credentials are never stored, logged or put into a prompt.
Evidence your auditor can traceFindings carry OWASP WSTG test IDs, feed ASVS coverage and join the per-release evidence bundle — repeatable security testing as expected by e.g. CRA Annex I Part II (3), IEC 62443-4-1 SVV-3 or ISO/SAE 21434 clause 10.
06 · OWASP standards

Every OWASP standard, built into the scan.

VamiAppSec maps every finding to OWASP verification standards and testing guides — so an assessment shows coverage per requirement and level, not just a list of bugs. Built for compliance-oriented assessments that auditors, notified bodies and customers recognise.

ASVS
Application Security Verification Standard

SAST, DAST and review findings mapped to ASVS 5.0 requirements — with coverage per chapter and verification level L1–L3.

Web apps & APIsCRA Annex I · ISO 27001
ISVS
IoT Security Verification Standard

Requirements for connected devices — ecosystem, user-space apps, software platform, communication and hardware platform — as the checklist for firmware and device assessments.

IoT & embeddedRED / EN 18031 · IEC 62443-4-2
MASVS
Mobile Application Security Verification Standard

The OWASP MAS baseline for iOS and Android — storage, crypto, auth, network, platform, code, resilience and privacy — mapped from mobile static analysis and MASTG-based test results.

Mobile appsMDR companion apps · CRA
MASTG
Mobile Application Security Testing Guide (formerly MSTG)

The test cases behind MASVS — every mobile finding references the MASTG test that verifies it, so assessors can reproduce it.

Mobile testingMASVS evidence
WSTG
Web Security Testing Guide

The methodology behind our dynamic tests — VamiDAST and ZAP findings carry WSTG test IDs for traceable, repeatable web assessments.

Web testingASVS evidence · pentest reports
AISVS
Artificial Intelligence Security Verification Standard

Verification requirements for AI and LLM systems — model supply chain, prompt-injection defences, output handling and data protection — for teams shipping AI features.

AI & LLM systemsEU AI Act Art. 15 · CRA
Also covered: OWASP Top 10 · API Security Top 10 · Top 10 for LLM Applications · SCVS · SAMM · CycloneDX
07 · The platform

Every scan type your product needs, in one backlog.

SAST, SCA, SBOM, dependency and secrets scanning plus VamiDAST's AI-powered DAST — orchestrated, deduplicated, enriched by our local LLM and tracked in DefectDojo or the ticket system you already use.

— SAST

Static application security testing

Semgrep rules plus semantic review by our local Qwen3.8 for business-logic flaws — on every commit, with SARIF in the IDE and the PR, mapped to OWASP ASVS.

SemgrepQwen3.8
— SCA & dependency scanning

Know every dependency

Grype and Trivy match your direct and transitive dependencies against NVD, OSV, EPSS and KEV — with VEX statements so downstream consumers see what is actually affected.

GrypeTrivy
— SBOM & exploit watch

SBOM per release, watched 24/7

Syft generates CycloneDX and SPDX SBOMs at build time; every shipped SBOM is monitored for actively exploited vulnerabilities (CISA KEV, ENISA EUVD) — the trigger for CRA Art. 14 reporting.

SyftCycloneDXSPDX
— Secrets scanning

No credentials in Git

Gitleaks in pre-commit and CI catches API keys, tokens and certificates before they ship — with age, exposure and rotation guidance for every hit.

Gitleaks
— DAST · fully integrated

VamiDAST — AI-powered DAST, built in

In your CI/CD, on demand via CLI or in production (Passive or Safe mode): a deterministic engine tests web app and API across 30+ vulnerability classes, Qwen3.8 only advises — every finding with payload and evidence.

VamiDASTsqlmapDalfoxcommixNuclei
How VamiDAST works
— Defect tracking

DefectDojo built in — your tracker welcome

DefectDojo is the integrated system of record for every finding — not a scanner: engagements, SLAs, deduplication, risk acceptance. Findings sync to Jira, Azure DevOps Boards or ServiceNow.

DefectDojoJiraAzure BoardsServiceNow
— LLM enrichment · Qwen3.8 local

Context from the LLM you choose

Each finding gets a plain-language explanation, an exploitability assessment and a stack-aware fix — from the local Qwen3.8 in Sankt Augustin or on your own GPUs (no third-country API), or from a public LLM of your choice.

Qwen3.8
— DevSecOps

CI/CD & quality gates

Block merges on critical findings, soft-fail on regressions, attach SARIF to PRs. Native GitLab, GitHub and Azure DevOps — plus Bitbucket and Jenkins.

GitLabGitHubAzure DevOps
— Reporting & evidence

Reports for every audience

Developer fix-lists, executive risk briefings, OWASP coverage reports — and audit exports mapped to CRA, IEC 62443, MDR, R155, ISO 27001, NIS2 and more.

OWASP
08 · How it works

From raw findings to actionable security intelligence.

Four layers, one continuous pipeline. Every scan produces normalized, deduplicated, AI-enriched output ready for triage.

i
Step 01

Scan

Run seven scan types across code, dependencies, IaC, containers and the running build — including AI-powered DAST with VamiDAST — each at the pipeline stage where it fits.

ii
Step 02

Aggregate

Every finding is mapped into one unified schema — CWE, CVSS, OWASP requirement, file, line, fingerprint — and tracked in DefectDojo.

iii
Step 03

Enrich

Qwen3.8, running in our Sankt Augustin data center or on your own GPUs, adds context: exploitability, business impact, and a fix written for your stack.

iv
Step 04

Track & report

Quality gates, tickets in DefectDojo, Jira, Azure Boards or ServiceNow, compliance evidence — and an API for everything else.

09 · Sovereign AI

Keep your code in Germany.

Every LLM task — triage, remediation and VamiDAST's three bounded AI steps — can run on Qwen3.8, an open-weight model we operate in our own data center in Sankt Augustin, Germany, or on your own GPUs on-prem; with the local model, no third-country API is involved. Or use a public LLM from Anthropic or OpenAI. Either way: no AI training on your data.

Qwen3.8Local LLM · Sankt Augustin, DE
  • Qwen3.8, self-operatedAn open-weight model from the latest Qwen generation, served on GPUs we own and run — no per-token calls to an external AI provider.
  • Hosted on T Cloud PublicExclusively in German data centers, operated by Deutsche Telekom — EU jurisdiction, no US parent, GDPR by design.
  • On-prem & air-gapKubernetes-native, with no proprietary cloud-provider services: run the full stack — scanners, VamiDAST, DefectDojo and the LLM — on your own Kubernetes cluster, air-gapped if needed.
  • Auditable promptsEvery LLM call is logged with model version, prompt and output — evidence-grade traceability for your assessor.
Qwen3.8
open-weight LLM, operated by VamiSec
DE
T Cloud Public · German data centers only
0
third-country transfers with the local LLM
Air-gap
option: full stack on your own cluster & GPUs
10 · Why VamiAppSec

Five fragmented dashboards. One source of truth.

Most AppSec teams don't have a tooling problem — they have a translation problem. VamiAppSec collapses the layers between scanner output, developer action and the evidence your auditor asks for.

  • Reduce tool sprawlReplace seven scanner dashboards and a spreadsheet with one DefectDojo-backed workspace — the scanners run in the background.
  • Faster triageDeduplication, fingerprinting and AI summaries cut median triage time in half.
  • Closer dev / sec collaborationFindings arrive in PRs with the fix already drafted — not a CSV in someone's inbox.
  • Compliance as a by-productSBOMs, gate decisions and vulnerability-handling records are generated by the pipeline — not assembled the week before the audit.
−54%
median triage time vs. raw scanner output
7
scan types orchestrated through a single API
93%
duplicate findings collapsed by fingerprinting
∞
Kubernetes-native scaling — SaaS or on your own cluster
11 · Architecture

Four layers. One feedback loop.

The platform is built as a transparent pipeline — every stage is observable, replayable, and auditable.

L1 · Scanners Detection surface
Semgrep · SAST Gitleaks · Secrets Grype / Trivy · SCA & containers Syft · SBOM Checkov · IaC VamiDAST · AI-DAST ZAP · additional DAST
L2 · Aggregator Normalize & dedupe
Unified schema → Fingerprint → CWE / CVSS map → OWASP mapping → Stable IDs
L3 · LLM Engine · Qwen3.8 Enrich with context
Exploitability scoring Plain-language summary Stack-aware fix SOP grounding Mentor mode Control mapping (CRA / 62443) Alternative: Anthropic / OpenAI
L4 · Tracking & reporting Track & deliver
DefectDojo Jira Azure Boards ServiceNow SARIF / IDE PR comments Compliance evidence CycloneDX / SPDX REST API
Quality-gate feedback loop · Triage decisions, false-positives and fix outcomes flow back into the LLM context for future runs.
12 · Use cases

Where teams put VamiAppSec to work.

One platform — six operating modes. From shift-left in the IDE to the evidence file at type approval.

01

Secure CI/CD pipelines

Run on every PR. Block merges on critical findings, soft-fail on regressions, attach SARIF for the IDE.

GitLabGitHubAzure DevOps
02

Vulnerability triage

Cluster duplicates, surface exploitability, route by code-owner, and let the local LLM draft the remediation note — tracked to closure in DefectDojo, Jira, Azure Boards or ServiceNow.

DedupDefectDojoJiraServiceNow
03

CRA & product-security programs

Stand up Annex I vulnerability handling in weeks: SBOM per release, actively-exploited-vulnerability watch, VEX/VDR and 24 h / 72 h / 14-day report drafts.

CRAMDRRED
04

Automotive & industrial

CSMS and IEC 62443-4-1 evidence from the same pipeline — findings linked to TARA assets, defects managed to closure, updates documented.

R155ISO/SAE 21434IEC 62443
05

OWASP-based assessments

Compliance-oriented assessments against ASVS, ISVS, MASVS, WSTG, MASTG or AISVS — with coverage per requirement for web, IoT, mobile and AI products.

ASVSISVSMASVSAISVS
06

Audit-ready evidence

Exportable reports and a full audit trail per finding — for notified bodies, technical services and ISO 27001 / NIS2 auditors alike.

CRAIEC 62443ISO 27001
Jobs at VamiSec

We're hiring for VamiAppSec.

Your expertise meets our AI platform: you work on real client engagements and feed your experience straight into the evolution of VamiAppSec.

IT Security Engineer (m/f/d) – Application Security, SBOM & CRA

You bring security into everyday development: from the first commit to a CRA-ready release – with VamiAppSec and VamiDAST.

Full-time Professional–Senior Remote-first · Bonn German C1+

Your responsibilities

  • Integrate SAST, SCA, secrets, IaC and DAST scans (including Semgrep, Trivy, Grype, Gitleaks, Checkov and VamiDAST) into our clients' CI/CD pipelines
  • Triage and assess findings, run reachability analyses and advise development teams on remediation
  • Generate SBOMs (CycloneDX/SPDX), monitor vulnerabilities and prepare reporting obligations under CRA Art. 14
  • Security reviews and assessments along OWASP ASVS, MASVS and SAMM, complemented by threat modeling
  • Evolve VamiAppSec together with the product team

Your profile

  • Several years of experience in application security, DevSecOps or security-focused software development
  • In-depth knowledge of the OWASP Top 10 and ASVS, secure development processes and at least one programming language (e.g. Python, Java, TypeScript or Go)
  • Hands-on experience with CI/CD (GitHub Actions, GitLab CI or Azure DevOps) and container and cloud environments
  • Excellent German (at least C1) and good English
  • A plus: knowledge of the CRA, IEC 62443-4-1 or ISO/SAE 21434 and certifications such as OSWE, GWEB or CSSLP
Application SecurityOWASP ASVSSASTDASTSBOMCRADevSecOps
Apply now All open positions

IT Security Engineer & Evangelist (m/f/d) – Application Security, SBOM & CRA

You bring security into our clients' development teams with VamiAppSec and VamiDAST – and you make the topic visible: in webinars, talks, articles and conversations with prospects. The focus stays on the technical work.

Full-time Professional–Senior Remote-first · Bonn German C1+

Your responsibilities

  • Integrate SAST, SCA, secrets, IaC and DAST scans into CI/CD pipelines, triage findings and advise development teams on remediation
  • Generate SBOMs, monitor vulnerabilities and prepare reporting obligations under CRA Art. 14
  • Product demos, proofs of concept and expert advice in first calls – as the technical counterpart alongside sales
  • Create expert content for content marketing and social media: blog posts, white papers, LinkedIn posts and short demo videos
  • Host webinars and give talks at conferences and events, and contribute to outreach campaigns

Your profile

  • Several years of experience in application security, DevSecOps or security-focused software development
  • In-depth knowledge of the OWASP Top 10 and ASVS, secure development processes and CI/CD
  • You enjoy explaining complex topics clearly – to clients, in webinars and on stage
  • Excellent German (at least C1) and good English – confident presenting in both
  • A plus: knowledge of the CRA or IEC 62443-4-1 and experience with articles, social media (e.g. LinkedIn) or pre-sales
Application SecurityOWASP ASVSSBOMCRAPre-SalesContent MarketingWebinars & Talks
Apply now
13 · Get started

Ready to ship products that pass the next audit?

30-minute walkthrough. We connect to a sample repo, run the full pipeline from SAST to VamiDAST's AI-powered DAST against a staging URL, and show you the DefectDojo board, an OWASP ASVS coverage report and the CRA SBOM export.

Book a Demo Talk to the team
No credit card · SaaS from Germany or on-prem on Kubernetes · SaaS live in 24h
— Brand identity

The VamiAppSec logo system.

The approved V+A symbol carries a small magnifier — a quiet nod to the platform's core function: scanning, triaging, and securing application code at scale.

Lockup · dark
Lockup · light
— Design system

Style guide summary.

· Palette

Approved logo · forest-teal & aqua

Five tones, sampled directly from the approved VamiAppSec logo. Deep teal for the V's body, mid teal for the wordmark, aqua highlight for AI/LLM accents and CTAs.

· Typography

Geist · Fraunces · JetBrains Mono

Geist for UI & body — engineered, neutral, modern.

Fraunces italic for editorial accents.

JetBrains Mono uppercase for tags, labels and technical metadata.

· UI direction

Quiet, technical, premium

  • The V+A symbol always sits left of the wordmark.
  • Minimum clear-space around the symbol equals the height of the lowercase "a".
  • Aqua bright (#5EEAD4) is reserved for AI/LLM moments, primary CTAs, and active states.
  • Borders sit at 10–18% accent opacity; full saturation only on CTAs.
  • Mockups always show real data — never lorem ipsum.