Security Engineer (m/f/d)

These are your tasks:

• Investigate vulnerability reports, security advisories, internal findings, and incident follow-ups; assess technical impact and help route confirmed work to the right product owner.
• Work directly with developers on secure design, threat models, code review, root-cause analysis, fixes, and regression tests for high-risk product areas.
• Build and improve reusable security controls, developer guidance, abuse-case tests, and practical automation for vulnerability discovery and remediation.
• Help maintain clear ownership, severity, response targets, affected-version scope, and closure evidence for product security findings.
• Partner with Commerce Core and Services engineers on security work across repositories, supported versions, APIs, integrations, and the extension ecosystem.
• Support coordinated security releases by identifying affected surfaces, reviewing technical remediation, and working with Engineering, Product Operations, Quality, InfoSec, and DevRel.
• Turn incident and release lessons into specific engineering changes, tests, or tooling, then follow through to confirm those changes are adopted.
• Communicate clearly during time-sensitive work and record decisions in the agreed GitHub and Confluence records so teams do not have to reconstruct status from Slack.
• Contribute to shared team practices and provide cross-coverage for the other product area when needed.

What success looks like:

• Findings are assessed consistently, reach the right domain owner quickly, and have a visible response target and closure record.
• Product teams can get timely, practical security support without losing ownership of their implementation.
• Security reviews and tests catch meaningful risks before release, and fixes include regression coverage where appropriate.
• Incident and release follow-ups produce owned prevention work rather than only one-time patches.
• Security release scope, affected versions, technical owners, and validation needs are clear to Engineering, Product Operations, Quality, InfoSec, and DevRel.
• The engineer’s primary domain gains security depth while remaining part of a team that shares standards and cover across product boundaries.

• Strong software engineering experience and interest in product or application security.
• Practical knowledge of common application-security risks such as authentication and authorization flaws, access control, data isolation, API security, credential handling, injection, and dependency risk.
• Ability to read and change production code and tests, explain risk to engineers, and help deliver maintainable fixes.
• Experience with threat modelling, security testing, vulnerability analysis, or secure code review; depth in some areas and readiness to grow in others.
• Good judgment about severity, customer impact, exploitability, and escalation when an issue needs immediate attention.
• Clear written communication and the ability to collaborate across teams during ambiguous or urgent work.
• Familiarity with PHP and Shopware’s product, services, or extension ecosystem is useful.
• Experience with security automation such as dependency scanning, SAST, fuzzing, or abuse-case testing is an advantage. We offer This is what we offer you:

• Company Culture: Open culture with flat hierarchies, where individual initiative is encouraged.
• Employment Contracts: Permanent positions that offer long-term security.
• Flexibility: Flexible working hours and options for mobile work and full-remote contracts.
• Equipment: Freedom to choose your preferred work hardware.
• Onboarding: Well-structured onboarding with support from a personal "buddy."
• Work Environment: An inspiring environment with dedicated colleagues and a dynamic community.
• Development Opportunities: Diverse opportunities for personal growth and development.
• Additional Benefits: Attractive perks such as company pension plans, health programs, and regular team events. ... and much more!

Protecting your personal data is a top priority for us. You can find our applicant information here.