Principal Engineer, Product Security (m/f/x)
commercetools3 months ago
Munich, GermanyStaff+
Responsibilities
- Formulate, evangelize, and drive adoption of the product security strategy.
- Assess and improve the organization’s security maturity posture.
- Create standardized security architecture and operational best practices.
- Track and drive remediation of security and technology risks.
- Educate product teams on risk assessments, threat modeling, and secure API-first application development.
- Review requirements and designs and help teams address security shortcomings.
- Embed security tooling into the development process.
- Review external penetration-test results and help prioritize fixes.
- Collaborate with product teams to improve security and resolve specific issues.
- Facilitate or lead customer conversations regarding product security.
- Triage and investigate new attack vectors and determine risk mitigation.
- Drive security and quality initiatives and support certification audits.
- Identify skills gaps and facilitate organization-wide knowledge sharing and training.
Requirements
- At least 5 years of hands-on Product Security experience.
- At least 2 years of experience improving Product Security in a leadership role.
- Experience with customer-facing security roles, influencing roadmaps in matrix organizations, and working in a scale-up environment.
- Experience with secure architecture design reviews, threat modeling, Static Analysis, secure code review implementations, and infusing security into the SDLC.
- Knowledge of Linux systems, Kubernetes, Terraform, Vault, API security, and web application security.
- Practical DevSecOps experience and proficiency in at least one scripting language such as JavaScript or Go.
- Project management experience on projects affecting multiple teams.
- Experience working in an Agile environment with a strong customer focus and running trainings or onboardings.
- Fluent English with clear written and verbal communication.
- Preferred qualifications include CISSP, CCSP, Certified Kubernetes Security Specialist, or GCP, AWS, or Azure security certifications.
- Curiosity about using AI tools and willingness to learn new technologies and leadership practices.
Benefits
- Comprehensive health benefits for employees and dependents, including access to OpenUp mental health support.
- Annual learning budget, self-paced learning platforms, language training, personalized coaching, mentorship, and leadership programs.
- Additional fully paid parental leave through Family Leave Plus.
- Equity participation program.
- Hybrid work arrangement with three days per week in the Berlin, London, or Valencia office.
Categories
About commercetools
commercetools builds a cloud-native, API-first commerce platform used by enterprises to run B2C and B2B storefronts across channels. Its SaaS products provide headless commerce, catalog, checkout, and order management that developers integrate via microservices and SDKs, sold by subscription with enterprise support. Founded in 2010 and headquartered in Munich, it serves global brands; public references include Sephora, Volkswagen Group, NBCUniversal, and Danone.