CYAN Security Group GmbH

Established Company

Show all Videos

Alexander Zlatnik, Head of Product & Technology von cyan Digital Security

Alexander Zlatnik von cyan Digital Security gibt im Interview Einblicke in die Developer Teams, die Technologien die dort zum Einsatz kommen und wie das Recruiting im Unternehmen gestaltet ist.

By playing the video, you agree to data transfer to YouTube and acknowledge the privacy policy.

Video Summary

In "Alexander Zlatnik, Head of Product & Technology von cyan Digital Security," Alexander Zlatnik outlines a ~50-person tech organization with product-based Product Owners, a Scrum Master, two-week sprints using Scrum or Kanban, and integrated QA and Operations that run their own platforms. He details a lean hiring flow with fast decisions—HR/team lead screening, a team-lead interview to align expectations, a practical case for developers/PM, and a 4–6-eyes panel—plus structured onboarding where newcomers meet all departments, start with smaller tasks, and are expected to be independent after 3–6 months. The stack balances proven and modern tech for security: Java backends, high-performance C++ at customer sites, Kotlin/Swift cores with Flutter frontends, Postgres and MongoDB, Angular UIs, QA automation via Cucumber/Selenium, and Ansible with an internal Kubernetes project, underpinned by ISO processes and maintained libraries.

Pragmatic Security Engineering at CYAN Security Group GmbH: Inside the Product, People, and Process with Alexander Zlatnik, Head of Product & Technology von cyan Digital Security

Context: A product-led tech organization with end-to-end responsibility

In our session with “Alexander Zlatnik, Head of Product & Technology von cyan Digital Security” at CYAN Security Group GmbH, we saw a refreshingly clear operating model for building and running security products. The technology department comprises roughly 50 people, organized around product outcomes rather than silos. Development, Quality Assurance, Solution Architecture, Project Management, and Operations sit within one coherent structure—because CYAN not only builds its platforms, it also operates them.

Two dedicated Product Owners steward the company’s two products. A Scrum Master supports the Product Owners and the organization. Solution Architects co-create and align solutions with customers. QA validates every increment. Operations, embedded in the technology group, ensures real-world stability and observability are part of everyday engineering, not an afterthought.

Delivery cadence and methods: Two-week cycles, Scrum or Kanban depending on context

CYAN runs in two-week rhythms and adapts practices to the work at hand:

Internal product feature development: Scrum in two-week sprints.
Customer-facing delivery: Kanban or a project cadence aligned to the client’s workflow.

“Our teams are set up with two-week sprints … depending on whether you work with the customer or do pure product development, we have either Kanban or Scrum implemented.”

Within each sprint, packages move to QA. Ideally, QA approves all tickets by the end; if not, items roll into the next sprint. In a security product environment, this discipline safeguards quality and predictability without forcing artificial finishes.

Team composition: Cross-functional by design, close to the customer and the run phase

Zlatnik outlines the key building blocks of the technology organization:

Project Management: Coordination and oversight.
Software Development: Java backend, C++ for on-customer-prem filter engines, mobile, and web.
Solution Architecture: Direct engagement with customers to shape and agree on solutions.
Quality Assurance: Currently heavy on manual testing, with a clear automation roadmap.
Operations: Embedded in the tech team since CYAN operates its own platforms.

This end-to-end approach fosters shared ownership. When operations live within engineering, deployments, monitoring, and reliability become collaborative efforts. For an ISO-certified security company, this tight alignment between build and run is a competitive strength.

The tech stack: Proven where it matters, modern where it helps

Zlatnik is open about the core trade-off in security product development: candidates often seek the latest technologies; in security, you frequently need proven stacks for stability and risk control.

“In the security environment, we rely on tried-and-tested technologies … also from a security standpoint.”

The stack is broad yet purposeful:

Backend: Java
Security-critical filter engines (deployed at customers): C++ with a strict performance focus
Mobile: Kotlin (Android) and Swift (iOS) for the core; Flutter for the front-end layer
Web front-ends: Angular
Datastores: Postgres for large platform domains; MongoDB for smaller and speed-sensitive parts
QA automation: Cucumber and Selenium (an active internal initiative)
Infrastructure: Ansible; internal work on Kubernetes

The mobile architecture stands out. CYAN deliberately separates core and UI: the core remains native for performance and secure platform integration, while Flutter drives cross-platform UI speed and consistency.

“For the mobile apps … we’ve separated the core and the front-end … Core uses Kotlin and Swift; for the front end we use Flutter. This has proven itself, because we can work very flexibly and dynamically.”

This structure also solves a resourcing problem—no need for parallel, large Android and iOS teams—while preserving the strengths of native development where it counts.

Quality and security: ISO discipline, automation with intent, and realistic boundaries

CYAN is ISO-certified and applies the related processes, including regular library maintenance even where open source is used. In testing, the organization still relies heavily on manual efforts today, but is actively pushing automation with Cucumber and Selenium to increase coverage and repeatability, especially around mobile and UI flows.

“Libraries are regularly maintained, even if we use open source in parts … these processes are very important for us, also from a security aspect.”

Kubernetes is explored internally, but with a sober caveat: customers must be able to support the technology. Cutting-edge stacks are valuable—but only if they bring real advantages in customer environments.

“Great if we can do it internally … whether we can use it immediately, or only in one or two years, we don’t know.”

This stance protects the team from tool-churn and keeps the focus where it belongs: product outcomes, customer constraints, and security.

Hiring: Lean, human, and decisive—with real team involvement

The hiring process is compact and well-calibrated:

Application: Directly via the website or through various channels.
Initial screening: By HR or the relevant team lead.
First interview: With the team lead, usually via video, preferably in person. Purpose: align expectations on both sides and probe the candidate’s profile and skillset. Shorter stints or frequent changes are openly discussed to understand context.
Second round (role-dependent): A case exercise—for software engineers and product managers alike—derived from previous projects. The focus is on how candidates handle ambiguity, make assumptions, and structure their approach. It is explicitly not a line-by-line code test.
Review and team conversation: The case is reviewed by the team lead or Product Owner, and the candidate meets the team (typically 3–4 people).

“We keep a four-, six-, eight-eyes principle … because personal sympathy can bias decisions … with more perspectives we get to a decision quickly.”

Decisions follow within one or two days. Offers go out by email, and once accepted, paperwork wraps up the process. For candidates, this feels lean and respectful—few hoops, real conversations, tangible feedback.

Onboarding: Structured, cross-functional, and honest about the ramp-up

CYAN runs a defined onboarding program:

Cross-department tour: New hires meet all departments, with a roughly two-hour session led by each team lead.
Product and Sales immersion: Product Management walks through products, customers, and rollout patterns; Sales covers sales materials and presentations.
Early productivity: New engineers start hands-on early with smaller, non-core tasks to touch interfaces and code paths, then advance step-by-step.

Crucially, expectations are realistic. No one is expected to ship on day one.

“We don’t expect someone to come in and deliver 100 lines of code on the first day … it usually takes three to six months before someone can work independently on a project.”

This clarity reduces stress and fosters sustainable growth.

Customer collaboration: Solution Architects as the bridge, QA as the guardrail

Solution Architects partner with customers to shape solutions up front. Delivery then runs in two-week increments, feeding QA within the sprint. If tickets aren’t ready at sprint end, they move forward without drama. In a security product company, this conservatism is a feature, not a bug: it favors stability, traceability, and the kind of predictability customers rely on.

Engineering culture: Ownership, judgment, and respect for constraints

Three cultural signals stand out:

Ownership over buzzwords: Decisions are grounded in customer outcomes, security, and maintainability, not trend-chasing.
Measured modernization: Flutter on mobile UIs and test automation in QA are introduced where they truly improve flow; native cores remain for security and performance.
Reality-aware adoption: Technologies like Kubernetes are adopted only when customers can support them. CYAN invests in internal know-how first, then advocates externally based on evidence.

This culture appeals to engineers who want to build real, durable systems—teams that value reliability and product impact more than a laundry list of shiny tools.

Why join CYAN? What stood out to us

From a DevJobs.at employer-brand perspective, several points make CYAN compelling:

Fast, fair decisions: Offers can go out within one or two days after the final round. This respects candidate time and momentum.
Thoughtful onboarding: Cross-functional introductions, early hands-on with smaller tasks, and a realistic three-to-six-month runway to autonomy.
End-to-end responsibility: Engineering and Operations under one roof. You build it, you help run it—especially important in security.
Pragmatic stack: Native mobile cores (Kotlin/Swift) plus Flutter for UI agility, Java on the backend, C++ for performance-critical engines, Angular on the web, Postgres and MongoDB where each fits best.
Real quality posture: ISO certification, disciplined library maintenance, and a concrete path to QA automation with Cucumber and Selenium.
Practical agility: Two-week sprints, QA within the sprint, Kanban where customer workflows demand it.
Customer proximity: Solution Architecture brings the voice of the customer right into the design and delivery process.

If you prefer substance over hype—modern tools where they add value, proven technologies where safety and performance demand it—CYAN offers the kind of environment where your engineering decisions matter.

What the hiring case studies reveal about the work

Zlatnik’s description of second-round case studies is telling: they are designed to surface a candidate’s problem-solving method, not to nitpick code syntax.

How do you handle missing information?
What assumptions do you make, and how do you communicate them?
How do you structure your approach when requirements are incomplete?

“It’s not about code lines … it’s about making assumptions when something is missing and understanding the approach.”

These are exactly the muscles teams use daily when building security products with real customers. If that excites you, the work will feel meaningful here.

Mobile strategy: A scalable best-of-both-worlds

CYAN’s decision to keep the core native (Kotlin/Swift) and use Flutter for the UI front ends emerged from practical team realities. It preserves performance and platform integration while accelerating cross-platform UI delivery. It also avoids the staffing knot of maintaining parallel, large native teams.

Zlatnik notes that the setup has changed “drastically” over recent years—evolution driven by product needs rather than trend-chasing.

Data and performance: The right tool for the job

Postgres underpins the big platform domains; MongoDB supports smaller, speed-focused workloads. The pattern is pragmatic and familiar to modern product teams. Meanwhile, C++ powers the on-customer filter engines with a clear mandate: speed and throughput first.

This combination of proven and targeted technologies minimizes risk and supports the reliability bar demanded in security markets.

QA transition: From manual-heavy to automation where it counts

While manual testing remains significant today, CYAN is investing in automation with Cucumber and Selenium. The approach is incremental and value-driven: automate flows with the highest repetition and stability needs, especially around mobile apps. This avoids the trap of automating everything indiscriminately and keeps efforts tied to product impact.

Infrastructure: Ansible as a staple, Kubernetes with caution

Ansible anchors provisioning and configuration management. Kubernetes is an internal initiative rather than a customer default—because not every customer can support it yet. For a company that both builds and runs platforms in a sensitive domain, this prioritization is sensible and respectful of real-world constraints.

Quote highlights

“Two-week sprints … Kanban or Scrum depending on the project.”
“QA ideally approves all tickets by the end of the sprint—otherwise items move to the next sprint.”
“Case exercises to see the approach—not counting code lines.”
“A four-, six-, eight-eyes principle over gut feel—decisions in one or two days.”
“Onboarding with department tours and early small tasks—three to six months to autonomy.”
“Core native (Kotlin/Swift), UI with Flutter—flexible and dynamic.”
“C++ for on-customer filter engines—performance first.”
“ISO processes, open-source hygiene, automation with Cucumber/Selenium.”
“Kubernetes internally—customer use only when supportable.”

Conclusion: A security-first product organization that treats responsibility seriously

Follow “Alexander Zlatnik, Head of Product & Technology von cyan Digital Security” closely and a coherent picture emerges. CYAN Security Group GmbH builds and operates security products—and aligns processes, tooling, and team structures to that responsibility.

Technically: A deliberate mix of Java, C++, Kotlin/Swift, Flutter, Angular, Postgres, MongoDB, and Ansible—with Kubernetes explored pragmatically.
Process-wise: Two-week sprints, QA within the sprint, Kanban for customer-facing work, ISO-compliant hygiene for dependencies and libraries.
Culturally: Ownership for run as well as build, strong quality guardrails, and realistic expectations for new joiners.
As an employer: Lean, respectful hiring with quick decisions; onboarding that orients and enables real autonomy over three to six months.

For engineers, QA, and operations professionals who value impact over buzzwords, CYAN offers substance: modern tools where they genuinely help, proven stacks where safety and performance demand them. It’s a combination that builds trust—with customers and with the teams who ship the software.

More Tech Lead Stories

More Dev Stories