Security Engineer (m/f/d)

shopware AG; United States; Hybrid; USD 73,000 - 100,000; Full time

Benefits offered by this job

Company Culture

Permanent position

Flexible working hours

Mobile/remote work allowed

Equipment provided

Structured onboarding

Team events

Job summary

shopware AG is seeking a Security Engineer to strengthen the product security program. You will partner with product engineers to investigate vulnerabilities, improve secure design, and implement practical controls across Core, Services, and connected products.

The role emphasizes proactive security reviews, automation, and clear communication in time-sensitive scenarios. You will read production code and tests, perform threat modelling and security testing, and help drive fixes with appropriate

Qualifications

• Strong software engineering experience with a security mindset.
• Practical knowledge of common application-security risks including auth, access control, API security.

Responsibilities

• Investigate vulnerability reports, advisories, and incidents; assess impact and route work.
• Collaborate with developers on secure design, threat modelling, code fixes, and regression testing.
• Build reusable security controls, developer guidance, and automation for finding and remediating issues.
• Maintain clear ownership, severity, and closure evidence for findings.
• Coordinate security work across repositories, APIs, and extensions.
• Support coordinated security releases with teams across Engineering and QA.
• Turn incident and release lessons into engineering changes and tests.

Skills

Software engineering

App security

Threat modelling

Code review

Communication

PHP

Security automation

Tools

SAST tools

Dependency scanning

Job description

Security Engineer (m/f/d)

• On-site, Remote, Hybrid
• Schöppingen, Germany
• Product

Job description

Shopware is a leading ecommerce system that enables companies worldwide to scale quickly and efficiently in digital commerce. As a trendsetting open source solution, Shopware is already used by some of the largest European brands, retailers and manufacturers in the B2C and B2B industries.

Help make Shopware products safer by finding and reducing security risk throughout product development. You will work with product engineers to investigate vulnerabilities, improve secure design and testing, and build practical controls that prevent repeated issues across Commerce Core, Services, and connected product areas.

Product Security Engineering is an engineering function. Product teams remain accountable for fixing and testing their own code; this team brings focused security expertise, a shared prevention roadmap, and clear coordination for cross-product security work.

These are your tasks:

• Investigate vulnerability reports, security advisories, internal findings, and incident follow-ups; assess technical impact and help route confirmed work to the right product owner.
• Work directly with developers on secure design, threat models, code review, root-cause analysis, fixes, and regression tests for high-risk product areas.
• Build and improve reusable security controls, developer guidance, abuse-case tests, and practical automation for vulnerability discovery and remediation.
• Help maintain clear ownership, severity, response targets, affected-version scope, and closure evidence for product security findings.
• Partner with Commerce Core and Services engineers on security work across repositories, supported versions, APIs, integrations, and the extension ecosystem.
• Support coordinated security releases by identifying affected surfaces, reviewing technical remediation, and working with Engineering, Product Operations, Quality, InfoSec, and DevRel.
• Turn incident and release lessons into specific engineering changes, tests, or tooling, then follow through to confirm those changes are adopted.
• Communicate clearly during time-sensitive work and record decisions in the agreed GitHub and Confluence records so teams do not have to reconstruct status from Slack.
• Contribute to shared team practices and provide cross-coverage for the other product area when needed.

This is what you'll bring to the table:

• Strong software engineering experience and interest in product or application security.
• Practical knowledge of common application-security risks such as authentication and authorization flaws, access control, data isolation, API security, credential handling, injection, and dependency risk.
• Ability to read and change production code and tests, explain risk to engineers, and help deliver maintainable fixes.
• Experience with threat modelling, security testing, vulnerability analysis, or secure code review; depth in some areas and readiness to grow in others.
• Good judgment about severity, customer impact, exploitability, and escalation when an issue needs immediate attention.
• Clear written communication and the ability to collaborate across teams during ambiguous or urgent work.
• Familiarity with PHP and Shopware's product, services, or extension ecosystem is useful.
• Experience with security automation such as dependency scanning, SAST, fuzzing, or abuse-case testing is an advantage.

What success looks like:

• Findings are assessed consistently, reach the right domain owner quickly, and have a visible response target and closure record.
• Product teams can get timely, practical security support without losing ownership of their implementation.
• Security reviews and tests catch meaningful risks before release, and fixes include regression coverage where appropriate.
• Incident and release follow-ups produce owned prevention work rather than only one-time patches.
• Security release scope, affected versions, technical owners, and validation needs are clear to Engineering, Product Operations, Quality, InfoSec, and DevRel.
• The engineer's primary domain gains security depth while remaining part of a team that shares standards and cover across product boundaries.

This is what we offer you:

• Company Culture: Open culture with flat hierarchies, where individual initiative is encouraged.
• Employment Contracts: Permanent positions that offer long-term security.
• Flexibility: Flexible working hours and options for mobile work and full-remote contracts.
• Equipment: Freedom to choose your preferred work hardware.
• Onboarding: Well-structured onboarding with support from a personal "buddy."
• Work Environment: An inspiring environment with dedicated colleagues and a dynamic community.
• Development Opportunities: Diverse opportunities for personal growth and development.
• Additional Benefits: Attractive perks such as company pension plans, health programs, and regular team events.

... and much more!

You can get a detailed insight on our career page.

Protecting your personal data is a top priority for us. You can find our applicant information here.