Security Engineering Lead (m/f/d)

shopware AG; United States; Hybrid; USD 124,000 - 169,000; Full time

Benefits offered by this job

Company Culture

Permanent contract

Flexible working hours

Equipment allowance

Structured onboarding

Dynamic work environment

Development opportunities

Additional benefits

Job summary

Shopware AG is seeking a Security Engineering Lead to establish and lead a durable product security capability across Shopware products. You will own risk-based roadmaps, triage external reports, and collaborate with domain owners and InfoSec to drive timely remediation.

The role requires hands-on engineering, threat modeling, and mentoring a small team. As a key partner to Engineering, Product Operations, and Legal, you will shape secure design practices, incident readiness, and policy

Qualifications

• Strong hands-on software engineering experience in production systems.
• Practical application-security knowledge across authentication, authorization, data isolation, API security and vulnerability classes.
• Experience investigating vulnerability reports and turning findings into remediation plans.
• Ability to work directly in code and tests; familiarity with security tooling (SAST, dependency scanning, fuzzing).
• Sound judgment on exploitability, severity, disclosure and incident response.
• Clear technical writing and calm cross-functional leadership during urgent work.
• Experience mentoring engineers or leading a small technical team; leadership is essential.
• Familiarity with open-source products, extension ecosystems, cloud services, and multi-version release models.

Responsibilities

• Build and lead a risk-based product security roadmap across core products and services.
• Own the product-security intake and triage model for external reports, bug bounties, tests, and advisories.
• Stay hands-on: threat-model changes and review high-risk designs; implement or pair on high-leverage controls.
• Establish repeatable practices for secure design, security reviews, and vulnerability disclosure.
• Coordinate cross-product security work with governance records and communication channels.
• Assign technical owners and due dates to confirmed issues; escalate blocked remediation and residual risk.
• Improve security coverage across supported versions and related products; extend into plugins and extensions.
• Lead post-incident learning and convert root causes into prevention work with tests and tooling.
• Coach and develop engineers; maintain visibility of security work in planning.
• Partner with InfoSec, Product Ops, Quality Ops, DevRel, Legal, Support, and leadership on policy and release decisions.

Skills

hands-on software engineering

application security

threat modeling

security tooling

leadership

cross-functional collaboration

incident response

cloud services

Job description

Security Engineering Lead (m/f/d)

On-site, Remote, Hybrid Schöppingen, Germany Product

Job description

Shopware is a leading ecommerce system that enables companies worldwide to scale quickly and efficiently in digital commerce. As a trendsetting open source solution, Shopware is already used by some of the largest European brands, retailers and manufacturers in the B2C and B2B industries.

Establish a durable product security engineering capability across Shopware products. The team prevents recurring vulnerability classes, gives security work clear ownership and response times, and helps product teams resolve risk before it becomes a customer incident.

Product Security Engineering is distinct from the existing SecOps / Information Security function. It owns product security engineering outcomes and the operating model for that work. It does not replace InfoSec governance, domain engineering ownership, Quality approval, or Product Operations.

These are your tasks:

• Build and lead a risk-based product security roadmap across Commerce Core, Services, and other product areas; balance prevention, detection, incident readiness, and remediation.

• Own the product-security intake and triage model for external reports, bug bounty findings, penetration tests, dependency advisories, internal discoveries, and incident follow-ups. Agree severity and response targets with domain owners and InfoSec, route each item to the right code owner, and keep the response clock visible.

• Stay hands-on: threat-model security-sensitive changes, review high-risk designs, investigate vulnerabilities, and implement or pair on high-leverage controls in shared product components.

• Establish repeatable practices for secure design, security review, abuse-case testing, dependency and code scanning, vulnerability disclosure, and incident readiness.

• Coordinate cross-product security work through an agreed record: GHSA for disclosure details, a private GitHub issue or epic for fixes and backports, and a Confluence incident or release page for roles, decisions, QA status, and communication readiness. Keep Slack as operational discussion and link decisions back to the record.

• Work with Engineering leads to assign a technical owner and due date to every confirmed issue. Escalate blocked remediation and residual risk through the established Product, InfoSec, and leadership decision paths.

• Improve security coverage across supported versions and related products, including the Security Plugin, Commercial components, Services, and relevant app or extension boundaries.

• Lead technical learning after incidents and releases. Convert root causes into owned prevention work, tests, tooling, or design changes, and track whether the change reduces recurrence.

• Coach and develop the two engineers, maintain coverage across Commerce Core and Services, and keep the team's work visible in product planning.

• Partner with InfoSec, Product Operations, Quality Operations, DevRel, Legal, Customer Support, and Product leadership on security policy, response, release, and communication decisions.

This is what you'll bring to the table:

• Strong hands-on software engineering experience and a track record of improving the security of production products.

• Practical application-security knowledge across authentication, authorization, access control, data isolation, API security, credential handling, secure integrations, and common vulnerability classes.

• Experience investigating vulnerability reports and turning findings into a tested, prioritized remediation plan across multiple teams or supported versions.

• Ability to work directly in code and tests, and to use or improve security tooling such as SAST, dependency scanning, fuzzing, or abuse-case testing.

• Sound judgment about exploitability, customer impact, severity, coordinated disclosure, and incident response.

• Clear technical writing and calm cross-functional leadership during urgent, ambiguous work.

• Experience mentoring engineers or leading a small technical team. Formal people management experience is useful; technical leadership and coaching are essential.

• Familiarity with open-source products, extension ecosystems, cloud services, and multi-version release models is an advantage.

What success looks like:

• Product security findings have a consistent intake path, a named engineering owner, a severity and response target, and visible closure evidence.

• Teams can identify who is affected, what is being fixed, and what has been tested without reconstructing the answer from Slack.

• High-risk changes receive timely security input, and recurring vulnerability classes lead to concrete controls and regression coverage.

• Security releases have an agreed scope, a single coordination record, explicit technical and QA owners, and verified release artifacts.

• Security work is represented in planning with clear trade-offs and escalation when it competes with committed product work.

• Developers, Product Operations, Quality, InfoSec, and DevRel understand where Product Security Engineering leads and where each partner retains ownership.

This is what we offer you:

• Company Culture: Open culture with flat hierarchies, where individual initiative is encouraged.

• Employment Contracts: Permanent positions that offer long-term security.

• Flexibility: Flexible working hours and options for mobile work and full-remote contracts.

• Equipment: Freedom to choose your preferred work hardware.

• Onboarding: Well-structured onboarding with support from a personal "buddy."

• Work Environment: An inspiring environment with dedicated colleagues and a dynamic community.

• Development Opportunities: Diverse opportunities for personal growth and development.

• Additional Benefits: Attractive perks such as company pension plans, health programs, and regular team events.

... and much more!

You can get a detailed insight on our career page.

Your personal contact for this position is Josephine Scheffler and is happy to answer any questions you may have!

Protecting your personal data is a top priority for us. You can find our applicant information here.