Review third-party components, open-source dependencies, software bills of materials, and software supply-chain risks.
Maintain technical documentation, risk records, traceability, test evidence, and certification materials.
Support vulnerability management, disclosure, incident reporting, security updates, post-market monitoring, and regulatory changes.
About Shelly
We make smart devices and push the boundaries of the IoT sector every single day. Shelly is a strong company with a startup mindset — no bureaucracy, just bold ideas, creative problem-solving, and a team that genuinely loves what they do. We turn every spark of an idea into a real product — from first concept to full production — and bring smart automation to over 3 million households around the world. From heating, lighting, appliances, curtains, and more — if it runs on electricity, chances are we can automate it. We’ve built over 100 smart devices (and counting!), and everything happens right here at our headquarters in Sofia. Sounds exciting? Keep reading...
Information Security & Product Compliance Engineer
Your Role We are looking for an Information Security & Product Compliance Engineer to take ownership of cybersecurity compliance across Shelly’s connected products and services. A major focus is preparing our complete product ecosystem for the EU Cyber Resilience Act (CRA), from secure design and testing to compliant market release and continued support.
Your Responsibilities:
You own cybersecurity compliance and certification activities for Shelly products, with the CRA as a key priority
You lead Shelly’s CRA preparation across product controls, development processes, documentation, reporting, and post-market support
You identify compliance gaps and translate regulatory requirements into clear technical controls and acceptance criteria
You work with Hardware, Firmware, Backend, Frontend, Mobile App, Cloud, QA, and Product teams throughout the product lifecycle
You perform and coordinate risk assessments, threat modelling, and security architecture reviews
You define and verify security requirements for devices, firmware, applications, APIs, backend systems, and cloud services
You coordinate security testing, vulnerability assessments, penetration testing, code reviews, and remediation
You review third-party components, open-source dependencies, SBOMs, and software supply-chain risks
You maintain technical documentation, risk records, traceability, test evidence, and certification materials
You support vulnerability management, disclosure, incident reporting, security updates, post-market monitoring, and regulatory changes
What makes you a great fit:
You bring 3+ years of experience in product security, information security, application security, cloud security, embedded security, or a related field
You understand security across connected hardware, firmware, applications, APIs, backend services, and cloud infrastructure
You have hands-on experience with risk assessments, threat modelling, security reviews, vulnerability testing, or penetration testing
You understand the EU Cyber Resilience Act and the key stages of the product compliance lifecycle
You know secure development practices, including authentication, encryption, access control, key management, secure boot, and secure updates
You have experience with software supply-chain security, open-source dependencies, SBOMs, SAST, DAST, or SCA
You are familiar with standards and regulations such as RED, EN 18031, ETSI EN 303 645, IEC 62443, NIS2, GDPR, or ISO/IEC 27001
You turn regulatory and security requirements into clear, practical actions for engineering teams
You communicate confidently with internal teams, external laboratories, certification bodies, and security experts
You are proficient in English and bring a proactive, structured approach with strong attention to detail and ownership
What is in it for you
Work:
A welcoming, collaborative team
Meaningful products and services that people actually use and love.
Learning opportunities to sharpen your skills
Competitive salary + Performance bonuses
Modern office in a great location
Fun team buildings and company events
Lifestyle:
26 days of paid annual leave
Flexible working hours
Additional health insurance
Free access to all Shelly devices (yes, you can smarten up your whole home!)
Multisport Card
Fully sponsored yearly public transport card
Ready to join the Shelly Revolution? Let’s build the future of smart living together. Hit that Apply button — we can’t wait to meet you.