Security Engineering Lead (m/f/d)

Shopware is a leading ecommerce system that enables companies worldwide to scale quickly and efficiently in digital commerce. As a trendsetting open source solution, Shopware is already used by some of the largest European brands, retailers and manufacturers in the B2C and B2B industries.

Establish a durable product security engineering capability across Shopware products. The team prevents recurring vulnerability classes, gives security work clear ownership and response times, and helps product teams resolve risk before it becomes a customer incident.

Product Security Engineering is distinct from the existing SecOps / Information Security function. It owns product security engineering outcomes and the operating model for that work. It does not replace InfoSec governance, domain engineering ownership, Quality approval, or Product Operations.

• Build and lead a risk-based product security roadmap across Commerce Core, Services, and other product areas; balance prevention, detection, incident readiness, and remediation.

• Own the product-security intake and triage model for external reports, bug bounty findings, penetration tests, dependency advisories, internal discoveries, and incident follow-ups. Agree severity and response targets with domain owners and InfoSec, route each item to the right code owner, and keep the response clock visible.

• Stay hands-on: threat-model security-sensitive changes, review high-risk designs, investigate vulnerabilities, and implement or pair on high-leverage controls in shared product components.

• Establish repeatable practices for secure design, security review, abuse-case testing, dependency and code scanning, vulnerability disclosure, and incident readiness.

• Coordinate cross-product security work through an agreed record: GHSA for disclosure details, a private GitHub issue or epic for fixes and backports, and a Confluence incident or release page for roles, decisions, QA status, and communication readiness. Keep Slack as operational discussion and link decisions back to the record.

• Work with Engineering leads to assign a technical owner and due date to every confirmed issue. Escalate blocked remediation and residual risk through the established Product, InfoSec, and leadership decision paths.

• Improve security coverage across supported versions and related products, including the Security Plugin, Commercial components, Services, and relevant app or extension boundaries.

• Lead technical learning after incidents and releases. Convert root causes into owned prevention work, tests, tooling, or design changes, and track whether the change reduces recurrence.

• Coach and develop the two engineers, maintain coverage across Commerce Core and Services, and keep the team’s work visible in product planning.

• Partner with InfoSec, Product Operations, Quality Operations, DevRel, Legal, Customer Support, and Product leadership on security policy, response, release, and communication decisions.

This is what you’ll bring to the table:

• Strong hands-on software engineering experience and a track record of improving the security of production products.

• Practical application-security knowledge across authentication, authorization, access control, data isolation, API security, credential handling, secure integrations, and common vulnerability classes.

• Experience investigating vulnerability reports and turning findings into a tested, prioritized remediation plan across multiple teams or supported versions.

• Ability to work directly in code and tests, and to use or improve security tooling such as SAST, dependency scanning, fuzzing, or abuse-case testing.

• Sound judgment about exploitability, customer impact, severity, coordinated disclosure, and incident response.

• Clear technical writing and calm cross-functional leadership during urgent, ambiguous work.

• Experience mentoring engineers or leading a small technical team. Formal people management experience is useful; technical leadership and coaching are essential.

• Familiarity with open-source products, extension ecosystems, cloud services, and multi-version release models is an advantage.

What success looks like:

• Product security findings have a consistent intake path, a named engineering owner, a severity and response target, and visible closure evidence.

• Teams can identify who is affected, what is being fixed, and what has been tested without reconstructing the answer from Slack.

• High-risk changes receive timely security input, and recurring vulnerability classes lead to concrete controls and regression coverage.

• Security releases have an agreed scope, a single coordination record, explicit technical and QA owners, and verified release artifacts.

• Security work is represented in planning with clear trade-offs and escalation when it competes with committed product work.

• Developers, Product Operations, Quality, InfoSec, and DevRel understand where Product Security Engineering leads and where each partner retains ownership.

This is what we offer you:

• Company Culture: Open culture with flat hierarchies, where individual initiative is encouraged.

• Employment Contracts: Permanent positions that offer long-term security.

• Flexibility: Flexible working hours and options for mobile work and full-remote contracts.

• Equipment: Freedom to choose your preferred work hardware.

• Onboarding: Well-structured onboarding with support from a personal "buddy."

• Work Environment: An inspiring environment with dedicated colleagues and a dynamic community.

• Development Opportunities: Diverse opportunities for personal growth and development.

• Additional Benefits: Attractive perks such as company pension plans, health programs, and regular team events.

... and much more!

You can get a detailed insight on our career page.

Your personal contact for this position is Josephine Scheffler and is happy to answer any questions you may have!

Protecting your personal data is a top priority for us. You can find our applicant information here.