Lead Product Security

Essential Functions/Responsibilities

• Lead security architecture and design reviews for Black Duck SCA, Coverity, and adjacent product lines, delivering actionable feedback before implementation begins.
• Contribute to the threat modeling methodology and help scale its adoption: coach engineers to run their own models and review outputs, rather than serving as the sole modeler.
• Define security requirements, design gates, and product security baselines that give engineering a testable definition of secure-by-default.
• Build and measure the secure development lifecycle across SCA, SAST, secret scanning (GitGuardian), dependency hygiene, and build pipeline integrity.
• Perform deep secure code review on high-risk areas including authentication, authorization, cryptography, secrets handling, and input validation.
• Secure the product supply chain and release process, including SBOM generation and the integrity of build and distribution artifacts.
• Help mature and evolve the Security Champions program: recruit champions across product teams, grow the training and enablement curriculum, run office hours, and report on participation and outcomes.
• Mentor engineers and less experienced security staff on secure design, secure code review, and threat modeling, growing capability across the organization rather than absorbing the work.
• Assist with the scoping and coordination of penetration tests and third-party security assessments; triage findings and drive remediation to closure with engineering owners.
• Partner with PSIRT on triage and fix coordination for internally discovered and externally reported product vulnerabilities, feeding root causes back into design and SDLC controls.
• Measure product security maturity using BSIMM or SAMM style assessment and drive a prioritized improvement roadmap.
• Support EU Cyber Resilience Act secure-by-design and vulnerability handling obligations with the technical evidence and process changes engineering needs.
• Provide technical subject matter expertise on customer security questionnaires, audit requests, and security escalations, drafting accurate answers, gathering evidence from engineering, and building a reusable knowledge base of vetted responses.
• Support incident response for issues that touch product code, build systems, or product infrastructure, contributing product-specific context and remediation guidance.
• Lead discrete workstreams within larger product security initiatives, track milestones in Jira, and provide technical input into application security tooling evaluations and POCs.
• Other tasks and activities as assigned.

General office environment and responsibilities requiring