Information Security & Product Compliance Engineer

We make smart devices and push the boundaries of the IoT sector every single day. Shelly is a strong company with a startup mindset — no bureaucracy, just bold ideas, creative problem-solving, and a team that genuinely loves what they do.
We turn every spark of an idea into a real product — from first concept to full production — and bring smart automation to over 3 million households around the world. From heating, lighting, appliances, curtains, and more — if it runs on electricity, chances are we can automate it. We’ve built over 100 smart devices (and counting!), and everything happens right here at our headquarters in Sofia.
Sounds exciting? Keep reading...

Information Security & Product Compliance Engineer

Your Role
We are looking for an Information Security & Product Compliance Engineer to take ownership of cybersecurity compliance across Shelly’s connected products and services. A major focus is preparing our complete product ecosystem for the EU Cyber Resilience Act (CRA), from secure design and testing to compliant market release and continued support.

Responsibilities

• You own cybersecurity compliance and certification activities for Shelly products, with the CRA as a key priority
• You lead Shelly’s CRA preparation across product controls, development processes, documentation, reporting, and post-market support
• You identify compliance gaps and translate regulatory requirements into clear technical controls and acceptance criteria
• You work with Hardware, Firmware, Backend, Frontend, Mobile App, Cloud, QA, and Product teams throughout the product lifecycle
• You perform and coordinate risk assessments, threat modelling, and security architecture reviews
• You define and verify security requirements for devices, firmware, applications, APIs, backend systems, and cloud services
• You coordinate security testing, vulnerability assessments, penetration testing, code reviews, and remediation
• You review third-party components, open-source dependencies, SBOMs, and software supply-chain risks
• You maintain technical documentation, risk records, traceability, test evidence, and certification materials
• You support vulnerability management, disclosure, incident reporting, security updates, post-market monitoring, and regulatory changes

Requirements

• You bring 3+ years of experience in product security, information security, application security, cloud security, embedded security, or a related field
• You understand security across connected hardware, firmware, applications, APIs, backend services, and cloud infrastructure
• You have hands-on experience with risk assessments, threat modelling, security reviews, vulnerability testing, or penetration testing
• You understand the EU Cyber Resilience Act and the key stages of the product compliance lifecycle
• You know secure development practices, including authentication, encryption, access control, key management, secure boot, and secure updates
• You have experience with software supply-chain security, open-source dependencies, SBOMs, SAST, DAST, or SCA
• You are familiar with standards and regulations such as RED, EN 18031, ETSI EN 303 645, IEC 62443, NIS2, GDPR, or ISO/IEC 27001
• You turn regulatory and security requirements into clear, practical actions for engineering teams
• You communicate confidently with internal teams, external laboratories, certification bodies, and security experts
• You are proficient in English and bring a proactive, structured approach with strong attention to detail and ownership

Benefits

Work:

• A welcoming, collaborative team
• Meaningful products and services that people actually use and love.
• Learning opportunities to sharpen your skills
• Competitive salary + Performance bonuses
• Modern office in a great location
• Fun team buildings and company events

Lifestyle:

• 26 days of paid annual leave
• Flexible working hours
• Additional health insurance
• Free access to all Shelly devices (yes, you can smarten up your whole home!)
• Multisport Card
• Fully sponsored yearly public transport card

Ready to join the Shelly Revolution?
Let’s build the future of smart living together.
Hit that Apply button — we can’t wait to meet you.