Security Engineer (m/w/d)
Primary stack
Job description
About the Position
Security Engineer (m/w/d)
- On-site, Remote, Hybrid
- Schöppingen, Germany
- Product
About the Role
Shopware is a leading e-commerce system that enables companies worldwide to scale quickly and efficiently in the digital commerce space. As a forward-looking open-source solution, Shopware is already used by some of the largest European brands, retailers, and manufacturers in the B2C and B2B sectors.
Help make Shopware products more secure by identifying and reducing security risks throughout the product development process. You will work with product development teams to investigate vulnerabilities, improve secure concepts and tests, and build practical measures that prevent recurring issues in Commerce Core, Services, and adjacent product areas.
Product Security Engineering is an engineering function. The product teams remain responsible for correcting and testing their own code. This team brings targeted security expertise, a shared roadmap for prevention, and clear coordination for cross-product security work.
Responsibilities
- Investigate vulnerability reports, security alerts, internal findings, and follow-ups on security incidents. Assess the technical impact and help forward confirmed tasks to the responsible Product Owners.
- Work directly with developers on secure design, threat models, code reviews, root cause analyses, fixes, and regression tests for particularly high-risk product areas.
- Develop and improve reusable security controls, guidelines for developers, misuse scenario tests, and practical automation for detecting and addressing vulnerabilities.
- Help establish clear responsibilities, severity levels, response goals, affected versions, and evidence of completion for product security findings.
- Collaborate with the engineering teams of Commerce Core and Services on security tasks across different repositories, supported versions, APIs, integrations, and the extension ecosystem.
- Support coordinated security releases: Identify affected areas, verify technical fixes, and coordinate with engineering, product operations, quality, infosec, and developer relations.
- Translate insights from security incidents and releases into concrete changes in engineering, testing, or tools. Follow up to ensure these measures are adopted.
- Communicate clearly and document decisions in agreed-upon GitHub and Confluence entries for time-critical tasks, so teams do not have to reconstruct the status from Slack threads.
- Participate in shared team practices and represent the other product area when needed.
Requirements
- Solid experience in software development and interest in product or application security.
- Practical knowledge of typical application security risks, such as vulnerabilities in authentication and authorization, access control, data separation, API security, credential management, injection, and dependencies.
- Ability to read and modify production code and tests, explain risks to developers in an understandable way, and implement maintainable fixes.
- Experience with threat modeling, security testing, vulnerability analysis, or secure code reviews; you bring in-depth knowledge in some areas, while you aim to develop further in others.
- Good judgment in assessing severity, impact on customers, and exploitability, as well as when an issue needs to be escalated immediately.
- Clear written communication and the ability to collaborate cross-functionally on unclear or urgent tasks.
- Knowledge of PHP and Shopware's products, services, or the extension ecosystem is beneficial.
- Experience with security automation, such as dependency scanning, SAST, fuzzing, or misuse scenario tests, is a plus.
We Offer
- Company Culture: Open culture, flat hierarchies, initiative is encouraged.
- Employment Contracts: Unlimited contracts offer long-term security.
- Flexibility: Flexible working hours and options for mobile work and full remote contracts.
- Equipment: Free choice of work hardware.
- Onboarding: Well-structured onboarding with support from a personal "buddy".
- Work Environment: Inspiring environment with committed colleagues and a dynamic community.
- Development Opportunities: Numerous opportunities for personal growth and development.
- Benefits: Attractive benefits such as company pension plans, health programs, and regular team events.
... and much more!
You can get a detailed insight on our careers page.
About the Company
Your contact person for this position is Josephine Scheffler, who is happy to answer any questions you may have!
The protection of your personal data is our top priority. You can find our applicant information here.
Contact Us
Josephine Scheffler
Yanina Schröer
Lena Holters
Have questions?
We will answer them!
Please submit your application exclusively digitally via our online application form. Simply click on the "Apply" button.
© Shopware. This job description was sourced from the employer's public career page. TheJob is not the employer — we index the posting and route candidates to the source. All content rights and hiring decisions belong to the employer.