Security Engineering Lead (m/f/d)

Shopware is a leading e-commerce system that enables companies worldwide to scale quickly and efficiently in digital commerce. As a future-oriented open-source solution, Shopware is already used by some of the largest European brands, retailers, and manufacturers in the B2C and B2B sectors.

Build a sustainable product security engineering function for Shopware products. The team prevents recurring vulnerability classes, establishes clear responsibilities and response times for security tasks, and supports product teams in addressing risks before they turn into security incidents affecting customers.

Product Security Engineering is distinct from the existing SecOps or Information Security function. The function is responsible for the results in the area of Product Security Engineering and the operating model for this work. It neither replaces governance by InfoSec nor the responsibility of the engineering domains, release by Quality, or Product Operations.

• Develop and lead a risk-based product security roadmap for Commerce Core, Services, and other product areas. Ensure a balanced weighting of prevention, detection, incident readiness, and remediation.

• Be responsible for the model for intake and triage of product security findings from external reports, bug bounty programs, penetration tests, dependency security advisories, internal discoveries, and follow-ups to security incidents. Agree on severity levels and response targets with domain owners and InfoSec, forward each case to the responsible code owner, and make ongoing response deadlines visible.

• Actively contribute yourself: Create threat models for security-critical changes, review high-risk designs, investigate vulnerabilities, and implement particularly effective security controls in shared product components or develop them jointly with others.

• Establish repeatable processes for secure design, security reviews, abuse case testing, dependency and code scanning, vulnerability disclosure, and incident readiness.

• Coordinate cross-product security work through agreed-upon documentation: GHSA for disclosure information, a private GitHub issue or epic for fixes and backports, and a Confluence page for security incidents or releases covering roles, decisions, QA status, and communication readiness. Use Slack for operational coordination and link decisions made back to the documentation.

• Together with the engineering leads, assign a technically responsible person and a due date for each confirmed issue. Escalate blocked remediations and remaining risks through the established decision paths of Product, InfoSec, and management.

• Improve security coverage for supported versions and associated products, including the Security Plugin, Commercial components, Services, and relevant app and extension interfaces.

• Lead the technical follow-up after security incidents and releases. Transform root causes into concrete prevention measures with clear responsibility, tests, tools, or design changes, and track whether these changes reduce recurrences.

• Foster and develop the two engineers, ensure coverage for Commerce Core and Services, and make the team's work visible in product planning.

• Collaborate with InfoSec, Product Operations, Quality Operations, DevRel, Legal, Customer Support, and Product Management on decisions regarding security policies, responses, releases, and communication.

What you bring:

• Sound practical experience in software development and a proven track record of improving the security of products in production.

• Hands-on experience in application security, particularly with authentication, authorization, access control, data separation, API security, credential management, secure integrations, and common vulnerability classes.

• Experience in investigating vulnerability reports and developing a tested and prioritized remediation plan for multiple teams or supported versions.

• The ability to work directly with code and tests and to use and improve security tools such as SAST, dependency scanning, fuzzing, or abuse case testing.

• Good judgment in assessing exploitability, customer impact, severity, coordinated disclosure, and incident response.

• Clear technical documentation and confident, calm collaboration with various teams on urgent and unclear tasks.

• Experience in mentoring engineers or leading a small technical team. Formal line management responsibility is helpful; technical leadership and coaching are essential.

• Knowledge of open-source products, extension ecosystems, cloud services, and release models with multiple supported versions is an advantage.

How you will recognize your success:

• For product security findings, there is a uniform intake, a named technical owner, a severity level, a response target, and visible proof of completion.

• Teams can understand who is affected, what is being fixed, and what has been tested, without having to reconstruct the status from Slack.

• Security-critical changes receive timely technical support. Recurring vulnerability classes lead to concrete controls and regression tests.

• Security releases have an agreed scope, central coordination documentation, clearly named technical and QA owners, and verified release artifacts.

• Security work is represented in planning with clear trade-offs and escalation paths when it competes with already committed product work.

• Developers, Product Operations, Quality, InfoSec, and DevRel know where Product Security Engineering takes the lead and what the respective partners remain responsible for.

What we offer you:

• Company Culture: Open culture, flat hierarchies, initiative is encouraged.

• Employment Contracts: Permanent positions offer long-term security.

• Flexibility: Flexible working hours and options for remote work and full remote contracts.

• Equipment: Free choice of work hardware.

• Onboarding: Well-structured onboarding with support from a personal 'buddy'.

• Work Environment: Inspiring environment with dedicated colleagues and a dynamic community.

• Development Opportunities: Diverse opportunities for personal growth and development.

• Additional Benefits: Attractive benefits such as company pension plans, health programs, and regular team events.

... and much more!
You can get a detailed insight on our career page.

Your contact person for this position is Josephine Scheffler, who will be happy to assist you with any questions!

The protection of your personal data is our top priority. You can find our applicant information here.

Find more English Speaking Jobs in Germany on Arbeitnow