Security should not be reviewed only at the end of a development process. It should be an integral part of our products and engineering processes from the very beginning.
We are looking for a Product Security & Engineering Lead who will take functional ownership of Security and Compliance within Product & Engineering. You combine technical security expertise with a pragmatic understanding of modern software development and translate requirements such as PCI DSS into concrete technical standards, processes and controls.
- You own Product & Engineering Security and continuously develop the related standards, processes, technical controls and guardrails.
- You embed Security by Design, SSDLC and DevSecOps into our development processes, including automated security testing, dependency and container scanning, and secrets management.
- You translate PCI DSS and other regulatory or contractual requirements into technical measures, engineering processes and clear release criteria.
- You define security standards for our software and cloud landscape, including Microsoft Azure, AWS, SAP BTP, CAP, Kyma/Kubernetes, APIs and integration architectures.
- You lead Threat Modeling, Security Architecture Reviews, Vulnerability Management and Penetration Tests, including the tracking of required remediation measures.
- You develop security guardrails for Generative AI, LLM integrations and AI Agents, for example around Access Control, Prompt Injection and Data Leakage.
- You support Security Assessments, Audits and Certifications and work closely with Product, Engineering, Enterprise Architecture, Cloud/DevOps and Corporate Information Security.
What is important to us
We are not looking for a pure Compliance Manager, but for someone with enough technical depth to develop robust solutions together with Engineering teams. Your goal is to establish pragmatic security controls without turning Security into a delivery bottleneck. Security and Continuous Compliance should become an integral part of our product development.