Level
Experienced
Location
Schöppingen
Working Model
Full Remote, Hybrid, Onsite
Job Field
IT, Security
Employment Type
Full Time
Contract Type
Permanent employment

Job Summary

In this role, you analyze security risks during product development, work on secure designs, code reviews, and automation for detecting and fixing vulnerabilities in Shopware products.

Job Technologies

Your role in the team

Help make Shopware products more secure by identifying and reducing security risks throughout the entire product development process.
You work with the product development teams to investigate vulnerabilities, improve secure concepts and tests, and develop practical measures that prevent recurring issues in Commerce Core, Services, and related product areas.
Investigate vulnerability reports, security alerts, internal findings, and follow-up actions related to security incidents.
Assess the technical impact and assist in forwarding confirmed tasks to the responsible Product Owners.
Work directly with developers on secure design, threat models, code reviews, root cause analyses, fixes, and regression tests for high-risk product areas.
Develop and improve reusable security controls, developer guidelines, abuse scenario tests, and practical automation for detecting and fixing vulnerabilities.
Assist in documenting clear responsibilities, severity levels, response targets, affected versions, and evidence for Product Security Findings.
Collaborate with the engineering teams of Commerce Core and Services on security tasks across various repositories, supported versions, APIs, integrations, and the extension ecosystem.
Support coordinated security releases: identify affected areas, review technical fixes, and coordinate with Engineering, Product Operations, Quality, InfoSec, and DevRel.
Translate insights from security incidents and releases into concrete changes in engineering, testing, or tools.
Subsequently, monitor whether these measures are implemented.
Communicate clearly on time-critical tasks and document decisions in the agreed GitHub and Confluence entries so that teams do not have to reconstruct the status from Slack conversations.
Participate in joint team practices and represent the other product area if needed.

This text has been machine translated. Show original

Our expectations of you

Qualifications

Practical knowledge of typical security risks in application security, such as vulnerabilities in authentication and authorization, access control, data separation, API security, handling of credentials, injection, and dependencies.
The ability to read and modify productive code and tests, clearly explain risks to developers, and implement maintainable fixes.
Good judgment in assessing severity, impact on customers and exploitability, as well as when a problem must be escalated immediately.
Clear written communication and the ability to collaborate across teams on unclear or urgent tasks.
Knowledge of PHP as well as Shopware's products, services, or the extension ecosystem is helpful.

Experience

Solid experience in software development and an interest in product or application security.
Experience with Threat Modeling, Security Testing, Vulnerability Analysis, or Secure Code Reviews; in some areas you have solid knowledge, while in others you want to develop further.
Experience with security automation, such as dependency scanning, SAST, fuzzing, or testing for abuse scenarios, is a plus.

This text has been machine translated. Show original

What we offer

Permanent employment offers long-term security.
Flexible working hours and options for remote work and full-remote contracts.
Free choice of work hardware.
Well-structured onboarding with support from a personal "Buddy".
Inspiring environment with dedicated colleagues and a dynamic community.
Diverse opportunities for personal growth and development.
Attractive benefits such as company pension schemes, health programs, and regular team events.