Product Security & Engineering Lead (m/f/d)

Implico Group is hiring a Product Security & Engineering Lead to take functional ownership of Security and Compliance within Product & Engineering. The role embeds security throughout product development, translates regulatory requirements into technical controls, and leads security architecture, assessments, and remediation.

Responsibilities:

• You own Product & Engineering Security and continuously develop the related standards, processes, technical controls and guardrails
• You embed Security by Design, SSDLC and DevSecOps into our development processes, including automated security testing, dependency and container scanning, and secrets management
• You translate PCI DSS and other regulatory or contractual requirements into technical measures, engineering processes and clear release criteria
• You define security standards for our software and cloud landscape, including Microsoft Azure, AWS, SAP BTP, CAP, Kyma/Kubernetes, APIs and integration architectures
• You lead Threat Modeling, Security Architecture Reviews, Vulnerability Management and Penetration Tests, including the tracking of required remediation measures
• You develop security guardrails for Generative AI, LLM integrations and AI Agents, for example around Access Control, Prompt Injection and Data Leakage
• You support Security Assessments, Audits and Certifications and work closely with Product, Engineering, Enterprise Architecture, Cloud/DevOps and Corporate Information Security

Requirements:

• Several years of hands-on experience in Product Security, Application Security, Cloud Security, Security Architecture or DevSecOps
• Strong technical understanding of modern software architectures and development environments, particularly APIs, microservices, containers, Kubernetes and CI/CD
• Practical experience with Threat Modeling, Secure Coding, Security Testing, Vulnerability Management and Software Supply Chain Security
• Good knowledge of PCI DSS and relevant standards and frameworks such as OWASP/OWASP ASVS, NIST or ISO 27001, as well as experience translating compliance requirements into technical controls and reliable audit evidence
• Experience with Microsoft Azure and/or AWS
• Understanding of security risks and protection mechanisms related to Generative AI, LLMs and agentic systems
• You are able to bring technical and regulatory requirements together pragmatically, communicate them clearly and drive implementation together with different stakeholders
• knowledge of SAP BTP, CAP or Kyma