Product Security & Engineering Lead (m/f/d)

Your mission

Security should not be reviewed only at the end of a development process. It should be an integral part of our products and engineering processes from the very beginning.We are looking for a Product Security & Engineering Lead who will take functional ownership of Security and Compliance within Product & Engineering. You combine technical security expertise with a pragmatic understanding of modern software development and translate requirements such as PCI DSS into concrete technical standards, processes and controls.

• You own Product & Engineering Security and continuously develop the related standards, processes, technical controls and guardrails.
• You embed Security by Design, SSDLC and DevSecOps into our development processes, including automated security testing, dependency and container scanning, and secrets management.
• You translate PCI DSS and other regulatory or contractual requirements into technical measures, engineering processes and clear release criteria.
• You define security standards for our software and cloud landscape, including Microsoft Azure, AWS, SAP BTP, CAP, Kyma/Kubernetes, APIs and integration architectures.
• You lead Threat Modeling, Security Architecture Reviews, Vulnerability Management and Penetration Tests, including the tracking of required remediation measures.
• You develop security guardrails for Generative AI, LLM integrations and AI Agents, for example around Access Control, Prompt Injection and Data Leakage.
• You support Security Assessments, Audits and Certifications and work closely with Product, Engineering, Enterprise Architecture, Cloud/DevOps and Corporate Information Security.

What is important to us

Your profile

• Several years of hands-on experience in Product Security, Application Security, Cloud Security, Security Architecture or DevSecOps.
• Strong technical understanding of modern software architectures and development environments, particularly APIs, microservices, containers, Kubernetes and CI/CD.
• Practical experience with Threat Modeling, Secure Coding, Security Testing, Vulnerability Management and Software Supply Chain Security.
• Good knowledge of PCI DSS and relevant standards and frameworks such as OWASP/OWASP ASVS, NIST or ISO 27001, as well as experience translating compliance requirements into technical controls and reliable audit evidence.
• Experience with Microsoft Azure and/or AWS; knowledge of SAP BTP, CAP or Kyma is a plus.
• Understanding of security risks and protection mechanisms related to Generative AI, LLMs and agentic systems.
• You are able to bring technical and regulatory requirements together pragmatically, communicate them clearly and drive implementation together with different stakeholders.

Why us?

• We support mobile and flexible working, including the option to work temporarily from abroad by agreement.
• Our working time account gives you the flexibility to balance work and personal commitments in a way that suits your life.
• Our Works Council is available to provide support and advice whenever needed.
  30 days of annual leave are standard for us.
• We support your personal and professional development through a transparent career framework as well as individual learning and development opportunities.
• Continuous learning is part of our company culture, which is why we actively support ongoing professional development.
• Through our JobRad program, you can lease a bicycle or e-bike of your choice, including more than one bike.
• With WellPass, you get access to a broad Germany-wide network of fitness, sports, wellness and health services.
• Regular team and company events strengthen our open culture and create opportunities for personal exchange.
• You can expect an international working environment with colleagues and customers from different countries and cultures.
• Our global team continues to grow. Join us and actively shape the next chapter of Implico's success story.