Product Security Incident Response Program Manager (m/f/d)

Description

The company's product security incident response group handles reports of flaws in its hardware and software. This role runs the day-to-day response, from first report to closure, with a focus on leading the program, managing cases, coordinating stakeholders, communicating and improving processes over time.

You will work with engineering, product management, quality, legal, communications, customer-facing staff and outside security researchers so that each issue moves toward a timely fix.

Responsibilities

• Take ownership of each vulnerability case from intake until it is closed and disclosed.
• For every case, set the response plan, milestones, owners, dependencies, escalation route and update rhythm.
• Lead impact analysis and fix planning with engineering, product, quality, legal, communications and customer-facing groups.
• Log decisions, evidence, sign-offs, open tasks and delivery risks.
• Run vulnerability review meetings and push actions through to completion.
• Handle responsible and coordinated disclosure with researchers, customers, partners and other external bodies.
• Oversee CVE reservation and publication, working with technical experts.
• Organize drafting, review, approval and release of security advisories and customer notices.
• Refine PSIRT processes, templates, governance and audit readiness.
• Help prepare for coming rules such as the EU Cyber Resilience Act (CRA), along with future standards and vulnerability reporting duties.

Requirements

• Prior work in product security, embedded or semiconductor security, cybersecurity, vulnerability management or technical engineering programs.
• 3+ years of relevant work experience.
• Solid grasp of vulnerability management, coordinated disclosure, incident handling or product risk management.
• Ability to win over stakeholders across engineering, product management, quality and customer-facing teams.
• Proven record of running complex investigations that span several technical and business groups.
• Comfort running projects: managing dependencies, tracking risks, escalating issues, setting priorities and reporting.
• Clear communication and real motivation to protect advanced technology at scale.
• Fluent English.
• Preferred: PMP, PgMP, Scrum Master, SAFe or other project or program management certifications, though not required.
• Advantageous: familiarity with embedded, semiconductor, firmware, automotive, industrial or IoT products.

Conditions

Full-time position based in Gratkorn, Austria.

Pay is market competitive, benchmarked against the electronics and semiconductor industry.

The role is graded Employment Group V under the collective agreement "Kollektivvertrag für Angestellte Gewerbe und Handwerk und in der Dienstleistung", as the Austrian Equal Treatment Act requires.

Your individual experience and expectations will be taken into account during the application process.

The successful candidate may/will be responsible for security-related tasks.

The assignment may/will fall under security certifications, so you need a careful and dependable way of working.

Benefits

• Home office option.
• Flexible working hours.
• Meal benefits and other perks.