Security Engineering Lead (m/f/d)

These are your tasks:

• Build and lead a risk-based product security roadmap across Commerce Core, Services, and other product areas; balance prevention, detection, incident readiness, and remediation.
• Own the product-security intake and triage model for external reports, bug bounty findings, penetration tests, dependency advisories, internal discoveries, and incident follow-ups. Agree severity and response targets with domain owners and InfoSec, route each item to the right code owner, and keep the response clock visible.
• Stay hands-on: threat-model security-sensitive changes, review high-risk designs, investigate vulnerabilities, and implement or pair on high-leverage controls in shared product components.
• Establish repeatable practices for secure design, security review, abuse-case testing, dependency and code scanning, vulnerability disclosure, and incident readiness.
• Coordinate cross-product security work through an agreed record: GHSA for disclosure details, a private GitHub issue or epic for fixes and backports, and a Confluence incident or release page for roles, decisions, QA status, and communication readiness. Keep Slack as operational discussion and link decisions back to the record.
• Work with Engineering leads to assign a technical owner and due date to every confirmed issue. Escalate blocked remediation and residual risk through the established Product, InfoSec, and leadership decision paths.
• Improve security coverage across supported versions and related products, including the Security Plugin, Commercial components, Services, and relevant app or extension boundaries.
• Lead technical learning after incidents and releases. Convert root causes into owned prevention work, tests, tooling, or design changes, and track whether the change reduces recurrence.
• Coach and develop the two engineers, maintain coverage across Commerce Core and Services, and keep the team’s work visible in product planning.
• Partner with InfoSec, Product Operations, Quality Operations, DevRel, Legal, Customer Support, and Product leadership on security policy, response, release, and communication decisions.

What success looks like:

• Product security findings have a consistent intake path, a named engineering owner, a severity and response target, and visible closure evidence.
• Teams can identify who is affected, what is being fixed, and what has been tested without reconstructing the answer from Slack.
• High-risk changes receive timely security input, and recurring vulnerability classes lead to concrete controls and regression coverage.
• Security releases have an agreed scope, a single coordination record, explicit technical and QA owners, and verified release artifacts.
• Security work is represented in planning with clear trade-offs and escalation when it competes with committed product work.
• Developers, Product Operations, Quality, InfoSec, and DevRel understand where Product Security Engineering leads and where each partner retains ownership.

• Strong hands-on software engineering experience and a track record of improving the security of production products.
• Practical application-security knowledge across authentication, authorization, access control, data isolation, API security, credential handling, secure integrations, and common vulnerability classes.
• Experience investigating vulnerability reports and turning findings into a tested, prioritized remediation plan across multiple teams or supported versions.
• Ability to work directly in code and tests, and to use or improve security tooling such as SAST, dependency scanning, fuzzing, or abuse-case testing.
• Sound judgment about exploitability, customer impact, severity, coordinated disclosure, and incident response.
• Clear technical writing and calm cross-functional leadership during urgent, ambiguous work.
• Experience mentoring engineers or leading a small technical team. Formal people management experience is useful; technical leadership and coaching are essential.
• Familiarity with open-source products, extension ecosystems, cloud services, and multi-version release models is an advantage. We offer This is what we offer you:

• Company Culture: Open culture with flat hierarchies, where individual initiative is encouraged.
• Employment Contracts: Permanent positions that offer long-term security.
• Flexibility: Flexible working hours and options for mobile work and full-remote contracts.
• Equipment: Freedom to choose your preferred work hardware.
• Onboarding: Well-structured onboarding with support from a personal "buddy."
• Work Environment: An inspiring environment with dedicated colleagues and a dynamic community.
• Development Opportunities: Diverse opportunities for personal growth and development.
• Additional Benefits: Attractive perks such as company pension plans, health programs, and regular team events. ... and much more!

Protecting your personal data is a top priority for us. You can find our applicant information here.