Skip to content
CV Rocket
Get started
How it worksThe enginePricingBlogContactSign in

Open nowPosted 59 days ago

Information Security & Product Compliance Engineer

Shelly Group18 open roles

Where
Sofia- Main Office, Bulgaria
Work mode
On site
Get the CV for this job

From $25 per CV, paid once. No subscription.

Your applicationOpen nowInformation Security & Product Compliance EngineerShelly Group · Sofia- Main Office, Bulgaria

  1. YouYes, apply to this one.

  2. CV RocketCV written for this posting.

  3. 25 readersRecruiter, hiring manager, skeptic. Round after round.

  4. CV RocketApplied on Shelly Group's own form.

The reply lands in your private mailbox

3×more interviews than doing it yourself with ChatGPT.

The clock on this job

Early applications get read.

12.3% of postings close within 7 days. Measured by our own scanner across the market.

Share of postings closed within
  1. 2.1%1 day
  2. 4.5%3 days
  3. 12.3%7 days
  4. 19.3%14 days
  5. 35.6%30 days
  6. 57.8%60 days
This job: posted 59 days ago

The posting

Job description

We make smart devices and push the boundaries of the IoT sector every single day. Shelly is a strong company with a startup mindset — no bureaucracy, just bold ideas, creative problem-solving, and a team that genuinely loves what they do. We turn every spark of an idea into a real product — from first concept to full production — and bring smart automation to over 3 million households around the world. From heating, lighting, appliances, curtains, and more — if it runs on electricity, chances are we can automate it. We’ve built over 100 smart devices (and counting!), and everything happens right here at our headquarters in Sofia. Sounds exciting? Keep reading...

Information Security & Product Compliance Engineer

Your Role We are looking for an Information Security & Product Compliance Engineer to take ownership of cybersecurity compliance across Shelly’s connected products and services. A major focus is preparing our complete product ecosystem for the EU Cyber Resilience Act (CRA), from secure design and testing to compliant market release and continued support.

What makes you a great fit:

  • You bring 3+ years of experience in product security, information security, application security, cloud security, embedded security, or a related field
  • You understand security across connected hardware, firmware, applications, APIs, backend services, and cloud infrastructure
  • You have hands-on experience with risk assessments, threat modelling, security reviews, vulnerability testing, or penetration testing
  • You understand the EU Cyber Resilience Act and the key stages of the product compliance lifecycle
  • You know secure development practices, including authentication, encryption, access control, key management, secure boot, and secure updates
  • You have experience with software supply-chain security, open-source dependencies, SBOMs, SAST, DAST, or SCA
  • You are familiar with standards and regulations such as RED, EN 18031, ETSI EN 303 645, IEC 62443, NIS2, GDPR, or ISO/IEC 27001
  • You turn regulatory and security requirements into clear, practical actions for engineering teams
  • You communicate confidently with internal teams, external laboratories, certification bodies, and security experts
  • You are proficient in English and bring a proactive, structured approach with strong attention to detail and ownership

Your Responsibilities:

  • You own cybersecurity compliance and certification activities for Shelly products, with the CRA as a key priority
  • You lead Shelly’s CRA preparation across product controls, development processes, documentation, reporting, and post-market support
  • You identify compliance gaps and translate regulatory requirements into clear technical controls and acceptance criteria
  • You work with Hardware, Firmware, Backend, Frontend, Mobile App, Cloud, QA, and Product teams throughout the product lifecycle
  • You perform and coordinate risk assessments, threat modelling, and security architecture reviews
  • You define and verify security requirements for devices, firmware, applications, APIs, backend systems, and cloud services
  • You coordinate security testing, vulnerability assessments, penetration testing, code reviews, and remediation
  • You review third-party components, open-source dependencies, SBOMs, and software supply-chain risks
  • You maintain technical documentation, risk records, traceability, test evidence, and certification materials
  • You support vulnerability management, disclosure, incident reporting, security updates, post-market monitoring, and regulatory changes

Job benefits

Work:

  • A welcoming, collaborative team
  • Meaningful products and services that people actually use and love.
  • Learning opportunities to sharpen your skills
  • Competitive salary + Performance bonuses
  • Modern office in a great location
  • Fun team buildings and company events

Lifestyle:

  • 26 days of paid annual leave
  • Flexible working hours
  • Additional health insurance
  • Free access to all Shelly devices (yes, you can smarten up your whole home!)
  • Multisport Card
  • Fully sponsored yearly public transport card

Ready to join the Shelly Revolution? Let’s build the future of smart living together. Hit that Apply button — we can’t wait to meet you.

From $25, paid onceGet the CV for this job

What happens when you press

One press. We do the rest.

  1. A CV for this posting

    Written against Shelly Group's own wording, from every piece of relevant proof in your profile.

  2. 25 readers review it

    Recruiter, hiring manager, skeptic and more read every draft, round after round. You get the best round.

    The review screen in CV Rocket: how each CV was read, round by round.

  3. We apply on Shelly Group's form

    Our application engine gets through the hardest forms there are. Where a question needs you, AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

    An application in CV Rocket: every answer filled in on the employer's form.

  4. Every reply, sorted

    Shelly Group's answer lands in your private mailbox, and we classify it on arrival: interview, question, rejection.

    The CV Rocket inbox: each employer reply classified as an interview, an action or a rejection.

  5. Reply with AI

    AI helps you write the email, checks it and sends it. We show you whether the recruiter read it.

  6. The interview in your calendar

    Full integration with your calendar. The invitation goes straight in.

    An interview invitation in the CV Rocket inbox, added to the candidate's calendar.
Get the CV for this job

From $25 per CV, paid once. No subscription.

Why it works

3×

more interviews than doing it yourself with ChatGPT.

ChatGPT writes a CV and never learns what happened to it. We see every reply. For each CV we know:

  • How it was written, and how the review scored it
  • When we applied, and how long after the posting went up
  • Which posting, which company, which city
  • Who got the interview, and who heard nothing

That is how we know which CVs get called.

Get the CV for this job

From $25 per CV, paid once. No subscription.

The numbers game

More applications. More interviews.

Every application goes out with its own CV, written for that posting and paid once. Send enough of them and the law of large numbers finds you the job.

Get the CV for this job
By hand5–10
With CV Rocket100
applications a day

Nearby

Live postings like this one

Same employer first, then the same role elsewhere.

Before you press

Straight answers

Get the CV for this job

From $25 per CV, paid once. No subscription.

What if my background isn't good enough?

We make the most of the background you have. The CV uses every piece of relevant proof your profile holds, and one of the 25 readers reads your whole profile and flags what the CV left out.

Do you really apply for me?

Yes, on the employer's own form, the hardest ones included. Where a question needs you, you answer it right there and AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

Is it a subscription?

No. You pay once per CV, from $25. Every application goes out with its own CV, written for that posting.

One job. One CV.
Paid once.

Pick the posting you want. We write for it, apply for you and catch the reply.

Get the CV for this job

From $25 per CV, paid once. No subscription.