Security Engineer: Remote, Flexible Hours + Product Security

shopware AG; United States; Hybrid; USD 73,000 - 100,000; Full time

Benefits offered by this job

Company Culture

Permanent position

Flexible working hours

Mobile/remote work allowed

Equipment provided

Structured onboarding

Team events

Job summary

shopware AG is seeking a Security Engineer to strengthen the product security program. You will partner with product engineers to investigate vulnerabilities, improve secure design, and implement practical controls across Core, Services, and connected products.

The role emphasizes proactive security reviews, automation, and clear communication in time-sensitive scenarios. You will read production code and tests, perform threat modelling and security testing, and help drive fixes with appropriate

Qualifications

• Strong software engineering experience with a security mindset.
• Practical knowledge of common application-security risks including auth, access control, API security.

Responsibilities

• Investigate vulnerability reports, advisories, and incidents; assess impact and route work.
• Collaborate with developers on secure design, threat modelling, code fixes, and regression testing.
• Build reusable security controls, developer guidance, and automation for finding and remediating issues.
• Maintain clear ownership, severity, and closure evidence for findings.
• Coordinate security work across repositories, APIs, and extensions.
• Support coordinated security releases with teams across Engineering and QA.
• Turn incident and release lessons into engineering changes and tests.

Skills

Software engineering

App security

Threat modelling

Code review

Communication

PHP

Security automation

Tools

SAST tools

Dependency scanning

Job description

shopware AG is seeking a Security Engineer to strengthen the product security program. You will partner with product engineers to investigate vulnerabilities, improve secure design, and implement practical controls across Core, Services, and connected products.

The role emphasizes proactive security reviews, automation, and clear communication in time-sensitive scenarios. You will read production code and tests, perform threat modelling and security testing, and help drive fixes with appropriate