Security Engineer (m/f/d)

Shopware is a leading ecommerce system that enables companies worldwide to scale quickly and efficiently in digital commerce. As a trendsetting open source solution, Shopware is already used by some of the largest European brands, retailers and manufacturers in the B2C and B2B industries.

Help make Shopware products safer by finding and reducing security risk throughout product development. You will work with product engineers to investigate vulnerabilities, improve secure design and testing, and build practical controls that prevent repeated issues across Commerce Core, Services, and connected product areas.

Product Security Engineering is an engineering function. Product teams remain accountable for fixing and testing their own code; this team brings focused security expertise, a shared prevention roadmap, and clear coordination for cross-product security work.

• Investigate vulnerability reports, security advisories, internal findings, and incident follow-ups; assess technical impact and help route confirmed work to the right product owner.

• Work directly with developers on secure design, threat models, code review, root-cause analysis, fixes, and regression tests for high-risk product areas.

• Build and improve reusable security controls, developer guidance, abuse-case tests, and practical automation for vulnerability discovery and remediation.

• Help maintain clear ownership, severity, response targets, affected-version scope, and closure evidence for product security findings.

• Partner with Commerce Core and Services engineers on security work across repositories, supported versions, APIs, integrations, and the extension ecosystem.

• Support coordinated security releases by identifying affected surfaces, reviewing technical remediation, and working with Engineering, Product Operations, Quality, InfoSec, and DevRel.

• Turn incident and release lessons into specific engineering changes, tests, or tooling, then follow through to confirm those changes are adopted.

• Communicate clearly during time-sensitive work and record decisions in the agreed GitHub and Confluence records so teams do not have to reconstruct status from Slack.

• Contribute to shared team practices and provide cross-coverage for the other product area when needed.

• Strong software engineering experience and interest in product or application security.

• Practical knowledge of common application-security risks such as authentication and authorization flaws, access control, data isolation, API security, credential handling, injection, and dependency risk.

• Ability to read and change production code and tests, explain risk to engineers, and help deliver maintainable fixes.

• Experience with threat modelling, security testing, vulnerability analysis, or secure code review; depth in some areas and readiness to grow in others.

• Good judgment about severity, customer impact, exploitability, and escalation when an issue needs immediate attention.