Security Engineer (m/w/d)

Shopware is a leading ecommerce system that enables companies worldwide to scale quickly and efficiently in digital commerce. As a trendsetting open source solution, Shopware is already used by some of the largest European brands, retailers and manufacturers in the B2C and B2B industries.

Help make Shopware products safer by finding and reducing security risk throughout product development. You will work with product engineers to investigate vulnerabilities, improve secure design and testing, and build practical controls that prevent repeated issues across Commerce Core, Services, and connected product areas.

Product Security Engineering is an engineering function. Product teams remain accountable for fixing and testing their own code; this team brings focused security expertise, a shared prevention roadmap, and clear coordination for cross-product security work.

• Investigate vulnerability reports, security advisories, internal findings, and incident follow-ups; assess technical impact and help route confirmed work to the right product owner.

• Work directly with developers on secure design, threat models, code review, root-cause analysis, fixes, and regression tests for high-risk product areas.

• Build and improve reusable security controls, developer guidance, abuse-case tests, and practical automation for vulnerability discovery and remediation.

• Help maintain clear ownership, severity, response targets, affected-version scope, and closure evidence for product security findings.

• Partner with Commerce Core and Services engineers on security work across repositories, supported versions, APIs, integrations, and the extension ecosystem.

• Support coordinated security releases by identifying affected surfaces, reviewing technical remediation, and working with Engineering, Product Operations, Quality, InfoSec, and DevRel.

• Turn incident and release lessons into specific engineering changes, tests, or tooling, then follow through to confirm those changes are adopted.

• Communicate clearly during time-sensitive work and record decisions in the agreed GitHub and Confluence records so teams do not have to reconstruct status from Slack.

• Contribute to shared team practices and provide cross-coverage for the other product area when needed.

This is what you’ll bring to the table:

• Strong software engineering experience and interest in product or application security.

• Practical knowledge of common application-security risks such as authentication and authorization flaws, access control, data isolation, API security, credential handling, injection, and dependency risk.

• Ability to read and change production code and tests, explain risk to engineers, and help deliver maintainable fixes.

• Experience with threat modelling, security testing, vulnerability analysis, or secure code review; depth in some areas and readiness to grow in others.

• Good judgment about severity, customer impact, exploitability, and escalation when an issue needs immediate attention.

• Clear written communication and the ability to collaborate across teams during ambiguous or urgent work.

• Familiarity with PHP and Shopware’s product, services, or extension ecosystem is useful.

• Experience with security automation such as dependency scanning, SAST, fuzzing, or abuse-case testing is an advantage.

What success looks like:

• Findings are assessed consistently, reach the right domain owner quickly, and have a visible response target and closure record.

• Product teams can get timely, practical security support without losing ownership of their implementation.

• Security reviews and tests catch meaningful risks before release, and fixes include regression coverage where appropriate.

• Incident and release follow-ups produce owned prevention work rather than only one-time patches.

• Security release scope, affected versions, technical owners, and validation needs are clear to Engineering, Product Operations, Quality, InfoSec, and DevRel.

• The engineer’s primary domain gains security depth while remaining part of a team that shares standards and cover across product boundaries.

This is what we offer you:

• Company Culture: Open culture with flat hierarchies, where individual initiative is encouraged.

• Employment Contracts: Permanent positions that offer long-term security.

• Flexibility: Flexible working hours and options for mobile work and full-remote contracts.

• Equipment: Freedom to choose your preferred work hardware.

• Onboarding: Well-structured onboarding with support from a personal "buddy."

• Work Environment: An inspiring environment with dedicated colleagues and a dynamic community.

• Development Opportunities: Diverse opportunities for personal growth and development.

• Additional Benefits: Attractive perks such as company pension plans, health programs, and regular team events.

... and much more!

You can get a detailed insight on our career page.

Your personal contact for this position is Josephine Scheffler and is happy to answer any questions you may have!

Protecting your personal data is a top priority for us. You can find our applicant information here.