Security Engineering Lead (m/f/d)

Shopware is a leading ecommerce system that enables companies worldwide to scale quickly and efficiently in digital commerce. As a trendsetting open source solution, Shopware is already used by some of the largest European brands, retailers and manufacturers in the B2C and B2B industries.

Establish a durable product security engineering capability across Shopware products. The team prevents recurring vulnerability classes, gives security work clear ownership and response times, and helps product teams resolve risk before it becomes a customer incident.

Product Security Engineering is distinct from the existing SecOps / Information Security function. It owns product security engineering outcomes and the operating model for that work. It does not replace InfoSec governance, domain engineering ownership, Quality approval, or Product Operations.

• Build and lead a risk-based product security roadmap across Commerce Core, Services, and other product areas; balance prevention, detection, incident readiness, and remediation.

• Own the product-security intake and triage model for external reports, bug bounty findings, penetration tests, dependency advisories, internal discoveries, and incident follow-ups. Agree severity and response targets with domain owners and InfoSec, route each item to the right code owner, and keep the response clock visible.

• Stay hands-on: threat-model security-sensitive changes, review high-risk designs, investigate vulnerabilities, and implement or pair on high-leverage controls in shared product components.

• Establish repeatable practices for secure design, security review, abuse-case testing, dependency and code scanning, vulnerability disclosure, and incident readiness.

• Coordinate cross-product security work through an agreed record: GHSA for disclosure details, a private GitHub issue or epic for fixes and backports, and a Confluence incident or release page for roles, decisions, QA status, and communication readiness. Keep Slack as operational discussion and link decisions back to the record.

• Work with Engineering leads to assign a technical owner and due date to every confirmed issue. Escalate blocked remediation and residual risk through the established Product, InfoSec, and leadership decision paths.

• Improve security coverage across supported versions and related products, including the Security Plugin, Commercial components, Services, and relevant app or extension boundaries.

• Lead technical learning after incidents and releases. Convert root causes into owned prevention work, tests, tooling, or design changes, and track whether the change reduces recurrence.

Protecting your personal data is a top priority for us. You can find our applicant information here.