Security Engineer (m/f/d)

Shopware is a leading e-commerce system that enables companies worldwide to scale quickly and efficiently in digital commerce. As a future-oriented open-source solution, Shopware is already used by some of the largest European brands, retailers, and manufacturers in the B2C and B2B sectors.

Help make Shopware products more secure by uncovering and reducing security risks throughout the entire product development lifecycle. You will work with product development teams to investigate vulnerabilities, improve secure concepts and tests, and build practical measures that prevent recurring problems in Commerce Core, Services, and adjacent product areas.

Product Security Engineering is an engineering function. Product teams remain responsible for correcting and testing their own code. This team brings targeted security expertise, a shared roadmap for prevention, and clear coordination for cross-product security work.

• Investigate vulnerability reports, security advisories, internal findings, and follow-ups to security incidents. Assess the technical impact and support forwarding confirmed tasks to the responsible Product Owners.

• Work directly with developers on secure design, threat models, code reviews, root cause analyses, fixes, and regression tests for particularly high-risk product areas.

• Develop and improve reusable security controls, developer guidelines, abuse case tests, and practical automation for detecting and remediating vulnerabilities.

• Support the clear documentation of responsibilities, severity levels, response targets, affected versions, and completion evidence for product security findings.

• Work with the engineering teams of Commerce Core and Services on security tasks across various repositories, supported versions, APIs, integrations, and the extension ecosystem.

• Support coordinated security releases: Identify affected areas, review technical fixes, and coordinate with Engineering, Product Operations, Quality, InfoSec, and DevRel.

• Translate learnings from security incidents and releases into concrete changes in engineering, tests, or tools. Subsequently, track whether these measures are adopted.

• Communicate clearly for time-critical tasks and document decisions in the agreed-upon GitHub and Confluence entries, so teams don't have to reconstruct the status from Slack conversations.

• Participate in shared team practices and represent the other product area if necessary.

What you bring to the table:

• Solid experience in software development and an interest in product or application security.

• Practical knowledge of typical application security risks, such as vulnerabilities in authentication and authorization, access control, data separation, API security, credential management, injection, and dependencies.

• The ability to read and modify production code and tests, explain risks to developers in an understandable way, and implement maintainable fixes.

• Experience with threat modeling, security testing, vulnerability analysis, or secure code reviews; you have in-depth knowledge in some areas and wish to develop further in others.

• Good judgment in assessing severity, customer impact, and exploitability, as well as when a problem needs to be escalated immediately.

• Clear written communication and the ability to collaborate across teams on unclear or urgent tasks.

• Knowledge of PHP and Shopware's products, services, or extension ecosystem is helpful.

• Experience with security automation, such as dependency scanning, SAST, fuzzing, or abuse case testing, is a plus.

How you will recognize your success:

• Findings are consistently evaluated, quickly forwarded to the responsible parties, and provided with a visible response target and proof of completion.

• Product teams receive timely, practical support on security topics while retaining responsibility for implementation.

• Security checks and tests identify relevant risks before release. Where appropriate, fixes include corresponding regression tests.

• Follow-ups to security incidents and releases result in concrete, accountable prevention measures rather than exclusively one-off patches.

• Scope of security releases, affected versions, technical responsible parties, and validation needs are clearly documented for Engineering, Product Operations, Quality, InfoSec, and DevRel.

• In the engineer's primary product area, security expertise grows. At the same time, the team shares standards and supports each other across product boundaries as needed.

What we offer you:

• Company Culture: Open culture, flat hierarchies, initiative is encouraged.

• Employment Contracts: Permanent positions offer long-term security.

• Flexibility: Flexible working hours and options for mobile working and full-remote contracts.

• Equipment: Free choice of work hardware.

• Onboarding: Well-structured onboarding with support from a personal "Buddy".

• Work Environment: Inspiring environment with dedicated colleagues and a dynamic community.

• Development Opportunities: Diverse opportunities for personal growth and development.

• Additional Benefits: Attractive benefits such as company pension plans, health programs, and regular team events.

... and much more!
You can get a detailed insight on our career page.

Your contact person for this position is Josephine Scheffler, who is happy to assist you with any questions!

The protection of your personal data is our top priority. You can find our applicant information here.

Find more English Speaking Jobs in Germany on Arbeitnow