
Location	Hamburg, Germany (Hybrid)
Employment Type	Full-Time
Reports To	CTO
Start Date	As soon as possible

About IDM

IDM gGmbH is a nonprofit health-tech company building AI-powered products that physicians use every day. Our technology runs at University Medical Center Hamburg-Eppendorf (UKE) and at further university hospitals, hospital groups and practices across Germany.

We develop two core products: ARGO, a platform for clinical documentation built on FHIR that connects a hospital's existing systems, and ORPHEUS, AI speech recognition and ambient documentation for clinical notes. As an agile startup, we move fast, ship often, and give our team real ownership over their domain.

The Role

You are an engineer first. You build in our product team, and security is the thing you care about most. You review and write code, model threats before a feature ships, secure our cloud and Kubernetes setup as code, and help us build the security regime that hospitals expect from us (BSI C5, ISO 27001, medical device security).

This is not an admin or audit role. You shape how we build, and you will grow with the topic: security is becoming one of the biggest themes at IDM. Health data deserves the best security there is, and we want it built into the product from the first line of code.

What You Will Do

Build security into ARGO and ORPHEUS: secure design reviews, threat modeling, code reviews, fixing what you find
Own the secure development lifecycle: dependency and container scanning, secrets handling, signed builds in CI/CD
Harden our cloud and Kubernetes infrastructure, written as code
Design identity and access for our products and our own platform (Entra ID, SSO, OIDC, RBAC)
Turn the requirements of BSI C5, ISO 27001 and IEC 81001-5-1 into working controls and evidence, not just documents
Run pentests and bug reports with external partners and make sure the findings get closed

What We Are Looking For

Must Have

You build things yourself: code, infrastructure as code, automation
Real interest in security, visible in your work, side projects, CTFs, bug bounties or open source
German language skills (B2+) for work with clinical partners and compliance documentation
Hamburg or close by, and happy to be in the office regularly

Strong Plus

Application security, threat modeling, pentesting
Cloud or Kubernetes security, DevSecOps
Experience with ISO 27001, BSI C5, NIS-2 or medical device security (MDR, IEC 81001-5-1)
Health IT context (HIS, FHIR, gematik/TI)

Seniority is not the point. If you are early in your career and security is clearly your thing, apply.

What We Offer

Security work that protects patient data in hospitals every day
Real ownership: you help define how security works at IDM
A small team with short paths to the CTO and the managing directors
Hybrid work with our office in Hamburg-Eppendorf, right next to UKE
Professional development budget and conference attendance
And yes, a Nintendo Switch with Mario Kart for breaks

Product Security Engineer