systemd can run the service as a user itself (no need for su):

serviceConfig.User = ...