Security Engineering Lead (m/w/d)

About the Position

Security Engineering Lead (m/w/d)

• Location: Schöppingen, Germany
• Employment Type: FULL_TIME
• Work Mode: On-site, Remote, Hybrid

---

Job Description

Shopware is a leading e-commerce system that enables companies worldwide to scale quickly and efficiently in digital commerce. As a forward-thinking open-source solution, Shopware is already used by some of the largest European brands, retailers, and manufacturers in the B2C and B2B sectors.

Build a permanent Product Security Engineering function for the Shopware products. The team will prevent recurring vulnerability classes, establish clear responsibilities and response times for security tasks, and support product teams in mitigating risks before they become security incidents affecting customers.

Product Security Engineering is distinct from the existing SecOps or Information Security function. The function is responsible for the results in the Product Security Engineering area and the operational model for this work. It neither replaces InfoSec governance nor the responsibility of the engineering domains, the approval by Quality or Product Operations.

---

Responsibilities

• Develop and lead a risk-based Product Security Roadmap for Commerce Core, Services, and other product areas. Ensure a balanced focus on prevention, detection, incident readiness, and remediation.
• Manage the model for receiving and triaging Product Security Findings from external reports, bug bounty programs, penetration tests, dependency security alerts, internal discoveries, and follow-ups on security incidents. Agree on severity levels and response targets with domain owners and InfoSec, assign each issue to the responsible code owner, and make ongoing response deadlines visible.
• Actively participate by creating threat models for security-critical changes, reviewing high-risk designs, investigating vulnerabilities, and implementing or co-developing highly effective security controls in shared product components.
• Establish repeatable processes for secure design, security reviews, misuse case testing, dependency and code scanning, vulnerability disclosure, and incident readiness.
• Coordinate cross-product security work through agreed documentation: GHSA for disclosure notices, a private GitHub issue or epic for fixes and backports, and a Confluence page for security incidents or releases for roles, decisions, QA status, and communication readiness. Use Slack for operational coordination and link decisions back to the documentation.
• Assign a technically responsible person and a due date to each confirmed issue in collaboration with the engineering leads. Escalate blocked remediations and remaining risks through the established decision-making processes of Product, InfoSec, and the executive team.
• Improve security coverage for supported versions and related products, including the Security Plugin, commercial components, services, and relevant app and extension interfaces.
• Lead the technical follow-up after security incidents and releases. Convert causes into concrete prevention measures with clear responsibility, tests, tools, or design changes, and track whether these changes reduce recurrences.
• Mentor and develop the two engineers, ensure coverage of Commerce Core and Services, and make the team's work visible in product planning.
• Collaborate with InfoSec, Product Operations, Quality Operations, DevRel, Legal, Customer Support, and Product Management on security policy decisions, responses, releases, and communication.

---

Requirements

• Proven practical experience in software development and demonstrable success in improving the security of production-deployed products.
• Practical knowledge in application security, particularly in authentication, authorization, access control, data separation, API security, credential management, secure integrations, and common vulnerability classes.
• Experience in investigating vulnerability reports and developing a tested and prioritized remediation plan for multiple teams or supported versions.
• Ability to work directly with code and tests and to deploy and improve security tools such as SAST, dependency scanning, fuzzing, or misuse case testing.
• Good judgment in assessing exploitability, customer impact, severity, coordinated disclosure, and incident response.
• Clear technical documentation and confident, calm collaboration with various teams on urgent and unclear tasks.
• Experience in mentoring engineers or leading a small technical team. Formal HR responsibility is beneficial; technical leadership and coaching are essential.
• Knowledge of open-source products, extension ecosystems, cloud services, and multi-version release models is advantageous.

---

Nice to Have

• Open-Source Products
• Extension Ecosystems
• Cloud Services
• Multi-Version Release Models

---

We Offer

• Company Culture: Open culture, flat hierarchies, initiative is encouraged.
• Employment Contracts: Unlimited contracts offer long-term security.
• Flexibility: Flexible working hours and options for mobile working and full remote contracts.
• Equipment: Free choice of work hardware.
• Onboarding: Well-structured onboarding with support from a personal "buddy".
• Work Environment: Inspiring environment with committed colleagues and a dynamic community.
• Development Opportunities: Numerous opportunities for personal growth and development.
• Benefits: Attractive benefits such as company pension scheme, health programs, and regular team events.

... and much more!

You can get a detailed insight on our careers page.

Your contact person for this position is Josephine Scheffler and is available to answer any questions you may have!

The protection of your personal data is our top priority. You can find our applicant information here.

---

Our Recruiting Team

• Josephine Scheffler
• Yanina Schröer
• Lena Holters

---

Have Questions?

We will answer them!

[email protected]

Please submit your application exclusively digitally via our online application form. Simply click on the "Apply" button.