Principal Engineer, Product Security
commercetools4 months ago
London, United KingdomStaff+
Responsibilities
- Formulate, evangelize, and drive adoption of the product security strategy.
- Assess and improve security maturity, architecture, operational practices, and technology-risk remediation.
- Educate product teams on risk assessments, threat modeling, and secure API-first applications.
- Review requirements and designs, embed security tooling into development, and support secure code review and static analysis implementations.
- Review external penetration-test results, investigate attack vectors, and help teams prioritize risk mitigation.
- Lead security and quality initiatives, certification-audit support, customer security conversations, and cross-organizational knowledge sharing.
- Collaborate with product teams, Product Management, Principal Engineers, and legal/compliance teams.
Requirements
- 5+ years of hands-on Product Security experience.
- 2+ years of experience improving Product Security in a leadership role.
- Experience with customer-facing security roles, roadmap influence in matrix organizations, and scale-up environments.
- Experience with secure architecture design reviews, threat modeling, SDLC security, static analysis, and secure code review implementations.
- Knowledge of Linux systems, Kubernetes, Terraform, Vault, API security, and web application security.
- Practical DevSecOps experience and proficiency in at least one scripting language such as JavaScript or Go.
- Project management experience for projects affecting multiple teams.
- Experience with Agile environments, customer focus, training or onboarding, and clear written and verbal English communication.
- Preferred security certifications include CISSP, CCSP, Certified Kubernetes Security Specialist, or GCP, AWS, or Azure security certifications.
- Curiosity and willingness to use and learn AI tools.
Benefits
- Comprehensive health benefits for employees and dependents, including OpenUp mental health support.
- Annual learning budget, self-paced learning platforms, language training, coaching, mentorship, and leadership programs.
- Additional fully paid parental leave through Family Leave Plus.
- Equity participation program.
- Hybrid work arrangement requiring three days per week in the Berlin, London, or Valencia office.
Categories
About commercetools
commercetools builds a cloud-native, API-first commerce platform used by enterprises to run B2C and B2B storefronts across channels. Its SaaS products provide headless commerce, catalog, checkout, and order management that developers integrate via microservices and SDKs, sold by subscription with enterprise support. Founded in 2010 and headquartered in Munich, it serves global brands; public references include Sephora, Volkswagen Group, NBCUniversal, and Danone.