Related: cybersecurity in France, learn penetration testing, who is a pentester, stages of penetration testing, how to become an Application Security Engineer, mentoring, from QA to cybersecurity.
People write to me about Germany with roughly the same story. Someone hears that the country badly needs people in security, opens LinkedIn, and freezes within an hour: it is unclear which city to look at, whether German is needed from day one, and what to show at the interview if the CV so far only has QA or development.
The demand is real. In 2026 German teams still lack people who can test applications and clearly explain business risk. At the same time, security budgets have grown noticeably because of the NIS2 and DORA regulations.
This article is a practical breakdown for those switching from QA, development, or adjacent IT. If you are ready to study regularly, grind labs, and collect real proof of your skills, this path is completely clear and realistic. But if the plan is to stack up certificates and wait for an easy offer, it will be hard.
The market in 2026: what is really happening
German companies still struggle to hire Mid-level specialists: AppSec engineers, Product Security people, and pentesters who write clear reports rather than just forwarding exports from automated scanners. Junior positions exist too, but competition for them is higher: here they usually expect either ready cases/labs or strong adjacent experience. The stance of “I read a couple of books and want into cybersecurity” no longer works.
Demand is driven noticeably by two European regulations:
- NIS2 — an EU law that significantly expanded cybersecurity requirements for key sectors: energy, transport, healthcare, digital infrastructure, manufacturing, and their whole supply chain.
- DORA — a regulation for the financial sector: banks, insurers, and their IT contractors must manage technology risk in their systems and during incidents much more strictly.
Inside companies this looks mundane: the backlog gets more security tickets, a mandatory retest appears after pentests, audits ask concrete questions about identity and APIs, and the procurement department sends questionnaires that require clear technical answers.
For a switcher this is good news, if you can test applications. Even an ordinary SaaS service now feels the pressure: a client from a regulated industry asks to see a pentest and to close all findings by a specific date. If you can turn an access bug into a clear ticket and then confirm the fix, you solve exactly the problem the employer pays for.
The most realistic entry right now is where engineering meets security: Application Security, Product Security, and Web/API pentest.
Where to look for jobs: a breakdown by region
Germany is not one monolithic market. The city and the type of employer directly affect which language you will be required to have, how much you will be paid, and how the interview will go.
Berlin
This is where most startups, scale-ups, and international product teams are concentrated. Berlin is where it is easiest to join a team with English alone. Salary ranges are scattered: some give options, some just offer a solid base. The city is ideal if you are specifically interested in Product Security and already speak the same language as developers.
A tip: at the interview always clarify the scope of responsibilities. If the answer about your tasks is something like “everything security-related plus handing out laptops to staff,” it is better to keep looking. A clear AppSec role in a team with experienced colleagues will give you far more growth than a fancy job title in chaos.
Munich
Munich is dominated by enterprise, industrial software, and large companies around the automotive sector. Salaries here are often higher than in Berlin, but German is required much more often — at least for meetings with clients and management, even if engineering communication is in English. It is a great choice if you are drawn to systematic AppSec inside mature processes.
Frankfurt am Main
Frankfurt is banks, fintech, insurance, and their many IT contractors. Because of the DORA regulation, they are very strict about documentation, processes, and vendor control. There is enough English in international departments, but without German a significant part of the banking market will be closed.
Consulting and MSSP
Service companies and integrators hire across the whole country. In pentest or advisory they periodically take on capable juniors — especially those who can write clean reports. For a first role you do not have to aim straight for a famous pentest boutique: testing in consulting, Product AppSec, or Security Engineering in the finance-adjacent sector is a great start. The main thing is having strong colleagues nearby to learn from.
Salary orientation (2026, gross per year)
These numbers reflect realistic ranges for the private sector, so you can orient yourself among offers:
- Junior / first security role: usually €45k – €60k.
- Mid (roughly 2–5 years of relevant experience): €65k – €90k, once you can independently own AppSec or pentest tasks.
- Senior / Lead: €90k – €120k+ (more common in Munich, Frankfurt, and at strong Berlin product companies).
In Munich and Frankfurt salaries are above the national average, but the cost of living there is noticeable too. In Berlin you will find both excellent product ranges and underpaid “one person for everything” positions. Evaluate the offer as a whole: remote work, on-call, bonuses, insurance, and the contract type (an open-ended unbefristeter Vertrag feels very different from project work).
For a switcher, the first number is not the main thing. It is much more valuable to pick a place where over 1–2 years you gain strong practical experience than to try to squeeze the maximum out of a junior portfolio and collect rejections.
German or English: how to handle it?
Many international and product teams (especially in Berlin, but also in Munich and Frankfurt) hire in English. This path is completely realistic for AppSec and web pentest if you have a strong practical portfolio.
However, banks, insurers, the automotive sector, the public sector, and classic consulting expect German: incident calls, tickets, and reports for management are in it.
- Level B1: enough for simple work communication.
- Level B2: lets you take part in meetings freely and keep clear correspondence.
A practical compromise: keep your technical portfolio and CV in English. Learn German in parallel. In interviews say it plainly: “I do work tasks in English, I'm actively learning German (currently B1), and I can handle correspondence and tickets.” This is received completely normally. A vague “I'll learn it somehow later,” on the other hand, sounds weak.
What to show at the technical interview
German specialists are rarely impressed by a nice list of certificates. What matters to them is whether you can, in practice, dissect an API, prove an access bug, write a clean report, and calmly discuss risk.
- HTTP and API basics: response codes (the difference between 401 and 403), session structure, cookies, JWT, OAuth, redirects. If there are gaps here, the technical round is hard to pass.
- Access Control: the main practical skill. Can user A open user B's object just by changing the ID in the request (IDOR / BOLA)? Can you escalate a role? Did they hide a button on the frontend while leaving the API open? Three worked cases on access control say more about you than half a dozen certificates.
- Working with Burp Suite: the ability to intercept a request, replay it, change a parameter, and record the result. A scanner only helps; it does not think for you.
- A clear report: reproduction steps, proof (PoC), risk assessment in plain words, and a fix recommendation.
- Talking about risk: a conversation without panic or exaggeration. Explain what exactly can go wrong, who it affects, and how to prioritize the fix.
A useful trick: prepare in advance one detailed 8–10 minute story about your best practical case: what you tested, what you found, why it is critical, and how you discussed it with development. A second useful story is about your own mistake (for example, when you overstated severity and corrected it yourself in time). Calm self-criticism always builds trust.
How to get in from QA or development
From QA / SDET
You already have a base: an understanding of test design, how APIs work, CI/CD, and the habit of arguing bugs. Shift the focus toward security: add checks for ID tampering, work with weak tokens and permission logic. Put together a simple authorization checklist. German product teams understand the move from SDET to AppSec perfectly — you simply show how your testing skills help protect the product.
From development
The easiest target for you is Product Security or AppSec. You can read code and make fixes, so developer colleagues find it easy to work with you. Start with practical things at your current job: go through the security of one feature, clean up secret storage in the repositories, and show examples of secure code. For a product, a developer who can think like an attacker is often more valuable than someone with certificates alone.
A realistic preparation plan (up to 1 year)
If you study regularly in the evenings and on weekends, the optimal schedule looks like this:
- Months 1–2 (Foundation): HTTP practice, confident work in Burp Suite, focus on authorization and access control. Update your LinkedIn profile with a focus on Web/API Security.
- Months 3–5 (Portfolio): prepare two clean reports on bugs you found. Run at least one full cycle: a small training target → test → report → retest.
- Months 6–9 (Interviews): targeted applications (Product AppSec, consulting, fintech). Record the reasons for rejections and specifically fix weak spots (report quality, argumentation in the technical round, or language).
- Months 10–12: choose an offer in a team where there are experienced colleagues for further growth.
A note on visas (EU Blue Card)
For non-EU specialists, the main route remains the EU Blue Card. To get it you need: an employment contract with a German company, a matching salary, and confirmed qualifications (a degree or recognized experience).
Companies differ: a large Berlin scale-up will handle your paperwork easily, while a small firm without an HR department may have no experience with it. Discuss visa questions in the early stages of the interview — concrete timelines are always received better by an employer than uncertainty.
If you need structured practice in Application Security and hands-on pentest with real report reviews for your background, see the program on the Application Security Engineer page, and message me on WhatsApp. More on the format: cybersecurity mentoring.
Also: cybersecurity in France, learn penetration testing, who is a pentester, stages of penetration testing, how to become an Application Security Engineer, mentoring, from QA to cybersecurity.
I teach Application Security and practical pentesting for people targeting real jobs — including the German market. Want a plan for your background? Message me on WhatsApp.
