Senior Manager, Product Security Office

Description

The company builds software for mission-critical intelligent systems and has done so for more than 40 years.

Its software runs in automotive, aerospace, defense, industrial, medical and telecom products, including space missions and 5G networks.

You will lead and grow the product security office so that trust in the company's products keeps pace with business and security demands, and you will lead the PSIRT and vulnerability management team.

You will manage customer product security trust and work with customer, product, engineering and operations teams to keep that trust high across every product, using a scalable, compliance-focused approach.

Responsibilities

• Build and manage the product security office and its team.
• Design the product security trust roadmap and expand the compliance framework to meet current and future business goals.
• Drive product security compliance across engineering, working with the CTO office, product management, IT, legal, InfoSec and SecOps.
• Equip product security champions across product software engineering.
• Design and lead the rollout of company-wide product security assurance software platforms.
• Lead the PSIRT operations team.
• Own customer product security trust and compliance.
• Train, mentor and support development teams in secure development values, principles and practices.

Requirements

• Bachelor's degree in engineering, computer science, information security or a closely related technical field.
• 10+ years in software engineering, program management, governance, compliance or related leadership.
• 5+ years managing technical, compliance or program teams.
• Experience leading a software product security team.
• Hands-on experience applying security standards, certifications or frameworks such as FIRST.org, OWASP SAMM, IEC 62443, ISO 21434, NIST 800-218, FIPS 140-3, DISA STIG, Common Criteria, CMMC, FedRAMP or similar.
• Substantial practical work with the NIST 800 series, including 800-53, 800-171 and others.
• Practical use of a threat modeling framework such as TARA, STRIDE, PASTA, ATT&CK or similar.
• Broad practical use of secure testing methods and tools, including SAST, DAST, fuzzing, security feature testing and penetration testing.
• Working knowledge of vulnerability and incident coordination, including global vulnerability registers, CVSS scoring, CNA, VINCE, NVD or similar.
• Experience driving secure development practices across an organization.
• Experience using agile methods and frameworks to ship secure software.
• Experience leading full-stack software solutions, preferably for product security.
• Hands-on knowledge of product security assurance techniques such as threat modeling, security testing, vulnerability management and software composition analysis, or similar.
• Experience with software engineering models and techniques.
• Experience driving product security compliance widely across a large organization.
• Broad experience with global security regulations, frameworks and standards.
• Exposure to customer compliance and remediation work, such as questionnaires, audits and contracts.
• Strong verbal and written communication at management level and with customers.
• Ability to analyze quickly, think on your feet and resolve conflict.
• Strong interpersonal and mentoring skills.
• Ability to work effectively across the organization and adapt to change.
• Preferred: certified security professional (CSSLP, CISM, CISSP, CEH or similar).
• Preferred: experience with EU security regulation, including the Cyber Resilience Act (CRA).
• Preferred: experience with national security systems and standards such as CNSS.
• Preferred: working knowledge of risk management frameworks and risk-based secure software development.
• Preferred: experience with AI and machine learning, including their governance and provenance in secure software development.
• Preferred: working knowledge of quality and safety assurance standards such as ASPICE, ISO 26262, DO-178C or similar.

Conditions

Hybrid, on-site work in Walnut Creek, CA; Austin, TX; Troy, MI; Boston, MA; or Kanata, Ontario, Canada.

The company will also consider candidates in the San Diego, Walnut Creek, Boston, MA, Troy, MI or Austin, TX area, as a brick-and-mortar location there will be leased soon.

Eligibility requires US national or Canadian citizenship, without citizenship of another country.

You must go through a security clearance process tied to your citizenship to perform core duties under applicable law. Citizens of Belarus, Burma, China, Cuba, Iran, North Korea, Syria, Venezuela, Afghanistan, Cambodia, Central African Republic, Cyprus, Democratic Republic of Congo, Ethiopia, Eritrea, Haiti, Iraq, Lebanon, Libya, Russia, Somalia, South Sudan, Sudan or Zimbabwe may not be able to perform such core duties.

The clearance process can take a significant amount of time, and any offer is contingent on your legal ability to perform the core duties. The company meets its obligations under applicable human rights and privacy law.

Base salary is $200,000 to $240,000 plus bonus for residents of Colorado, New York and New Jersey, and $210,000 to $250,000 plus bonus for residents of California, Washington and the NYC area.

Pay is set through interviews and a review of education, experience, knowledge, skills, location and abilities, along with fairness to current team members.

The company values diversity, equity, inclusion and belonging.

Benefits

• Health, dental and vision insurance, plus life insurance, all under the terms of the company's plans.
• Flexible time off and 12 paid holidays.
• Eligibility to enroll in a 401k plan.