Product Security & Engineering Lead (m/f/d)

Implico Group; Hamburg; Remote; EUR 110,000 - 150,000; Full time

Benefits offered by this job

Mobile and flexible working

30 days annual leave

JobRad bicycle program

WellPass wellness network

International work environment

Job summary

Implico Group seeks a Product Security & Engineering Lead to own security and compliance within Product & Engineering. You will fuse deep security expertise with pragmatic software development, translating PCI DSS into concrete standards and controls.

You will embed Security by Design, SSDLC and DevSecOps across delivery, enabling automated testing, dependency and container scanning, and secrets management.

Qualifications

• Several years of hands-on experience in Product Security, Application Security, Cloud Security, Security Architecture or DevSecOps.
• Strong technical understanding of APIs, microservices, containers, Kubernetes and CI/CD.
• Practical experience with Threat Modeling, Secure Coding, Security Testing, Vulnerability Management and Software Supply Chain Security.
• Good knowledge of PCI DSS and relevant standards and frameworks (OWASP ASVS, NIST, ISO 27001) and translating compliance into controls.
• Experience with Microsoft Azure and/or AWS; knowledge of SAP BTP, CAP or Kyma is a plus.
• Understanding of security risks related to Generative AI, LLMs and agentic systems.
• Ability to communicate regulatory and technical requirements clearly and drive implementation with stakeholders.

Responsibilities

• Own Product & Engineering Security and continuously develop standards, processes, controls.
• Embed Security by Design, SSDLC and DevSecOps into development processes with automated security testing and scanning.
• Translate PCI DSS and other requirements into technical measures and release criteria.
• Define security standards for software and cloud landscape (Azure, AWS, SAP BTP, Kyma/Kubernetes).
• Lead Threat Modeling, Security Architecture Reviews, Vulnerability Management and Penetration Tests; track remediation.
• Develop guardrails for Generative AI, LLM integrations and AI Agents (Access Control, Prompt Injection, Data Leakage).
• Support security assessments, audits and certifications; collaborate with cross-functional teams.

Skills

Threat Modeling

Security Architecture

DevSecOps

Secure Coding

Security Testing

Vulnerability Management

Software Supply Chain Security

APIs & Microservices

Tools

Microsoft Azure

AWS

SAP BTP

Kyma/Kubernetes

Job description

Your mission

Security should not be reviewed only at the end of a development process. It should be an integral part of our products and engineering processes from the very beginning.We are looking for aProduct Security & Engineering Leadwho will take functional ownership of Security and Compliance within Product & Engineering. You combine technical security expertise with a pragmatic understanding of modern software development and translate requirements such as PCI DSS into concrete technical standards, processes and controls.

• You ownProduct & Engineering Securityand continuously develop the related standards, processes, technical controls and guardrails.
• You embedSecurity by Design, SSDLC and DevSecOpsinto our development processes, including automated security testing, dependency and container scanning, and secrets management.
• You translatePCI DSSand other regulatory or contractual requirements into technical measures, engineering processes and clear release criteria.
• You define security standards for our software and cloud landscape, includingMicrosoft Azure, AWS, SAP BTP, CAP, Kyma/Kubernetes, APIs and integration architectures.
• You leadThreat Modeling, Security Architecture Reviews, Vulnerability Management and Penetration Tests, including the tracking of required remediation measures.
• You develop security guardrails forGenerative AI, LLM integrations and AI Agents, for example around Access Control, Prompt Injection and Data Leakage.
• You supportSecurity Assessments, Audits and Certificationsand work closely with Product, Engineering, Enterprise Architecture, Cloud/DevOps and Corporate Information Security.

What is important to us

We are not looking for a pureCompliance Manager, but for someone with enough technical depth to develop robust solutions together with Engineering teams. Your goal is to establish pragmatic security controls without turning Security into a delivery bottleneck. Security and Continuous Compliance should become an integral part of our product development.

Your profile

• Several years of hands-on experience in Product Security, Application Security, Cloud Security, Security Architecture or DevSecOps.
• Strong technical understanding of modern software architectures and development environments, particularlyAPIs, microservices, containers, Kubernetes and CI/CD.
• Practical experience withThreat Modeling, Secure Coding, Security Testing, Vulnerability Management and Software Supply Chain Security.
• Good knowledge ofPCI DSSand relevant standards and frameworks such asOWASP/OWASP ASVS, NIST or ISO 27001, as well as experience translating compliance requirements into technical controls and reliable audit evidence.
• Experience withMicrosoft Azure and/or AWS; knowledge ofSAP BTP, CAP or Kymais a plus.
• Understanding of security risks and protection mechanisms related toGenerative AI, LLMs and agentic systems.
• You are able to bring technical and regulatory requirements together pragmatically, communicate them clearly and drive implementation together with different stakeholders.

Why us?

• We support mobile and flexible working, including the option to work temporarily from abroad by agreement.
• Our working time account gives you the flexibility to balance work and personal commitments in a way that suits your life.
• Our Works Council is available to provide support and advice whenever needed.
  30 days of annual leave are standard for us.
• We support your personal and professional development through a transparent career framework as well as individual learning and development opportunities.
• Continuous learning is part of our company culture, which is why we actively support ongoing professional development.
• Through our JobRad program, you can lease a bicycle or e-bike of your choice, including more than one bike.
• With WellPass, you get access to a broad Germany-wide network of fitness, sports, wellness and health services.
• Regular team and company events strengthen our open culture and create opportunities for personal exchange.
• You can expect an international working environment with colleagues and customers from different countries and cultures.
• Our global team continues to grow. Join us and actively shape the next chapter of Implico's success story.