Manager, Product Security Engineering

Johnson Controls•Westford, MA

1d•$116,000 - $170,000•Hybrid

About The Position

Johnson Controls Fire Solutions is seeking a strategic and technical Manager, Product Security Engineering to lead product security execution across a global portfolio of fire detection and suppression products. The portfolio includes embedded firmware, connected devices, cloud platforms, mobile applications, and digital services. The role defines and advances the Fire Solutions product security strategy and roadmap in alignment with Global Cybersecurity standards and enterprise security objectives. The manager establishes scalable security processes, leads cybersecurity risk and vulnerability management programs, supports compliance with cybersecurity regulations and corporate initiatives, and develops AI security threat response and governance capabilities. The role provides leadership across hardware, firmware, software, cloud, and IoT systems, ensuring security is integrated throughout the product lifecycle. It translates cybersecurity requirements into practical engineering processes, improves operational efficiency, and promotes security ownership throughout Fire Solutions Engineering. This position is hybrid and based out of the JCI Westford office, with an expectation of working in the office three days per week. The hiring salary range is $116,000–$170,000, with a competitive bonus plan and benefits package. Salary is determined based on qualifications and other factors.

Requirements

Bachelor’s degree in computer science, cybersecurity, engineering, information technology, or a related technical discipline.
10+ years of combined experience in software engineering, cloud engineering, DevSecOps, product security, application security, or cybersecurity leadership roles, with demonstrated hands-on technical expertise.
Demonstrated success developing and executing product security strategies within complex technology organizations.
Strong knowledge of product security, secure development practices, cloud security, IoT security, and vulnerability management.
Experience working closely with enterprise cybersecurity teams to implement governance, standards, and risk management frameworks.
Proven ability to drive cross-functional initiatives across engineering, product management, quality, and regulatory organizations.
Excellent leadership, communication, stakeholder management, and executive presentation skills.

Nice To Haves

Master’s degree in cybersecurity, computer science, engineering, business, or a related field.
Industry certifications such as CISSP, CISM, CRISC, CSSLP, GIAC, or equivalent.
Experience supporting products subject to cybersecurity regulations and compliance frameworks.
Knowledge of cybersecurity standards and frameworks including NIST, IEC 62443, ISO 27001, UL cybersecurity standards, and related industry practices.
Experience with SBOM and software supply chain security.
Experience with threat modeling methodologies such as STRIDE.
Experience leading remediation of critical vulnerabilities and security incidents.

Responsibilities

Partner with Johnson Controls Enterprise Security to establish product portfolio security governance, policies, standards, and risk management frameworks.
Serve as the senior engineering leader for product cybersecurity and work with Global Cybersecurity to operationalize strategy, standards, governance, and risk management practices.
Promote security-by-design, accountability, and continuous improvement throughout the organization.
Serve as lead security architect for Fire Solutions Engineering, guiding secure architecture decisions across firmware, cloud, mobile, IoT, and enterprise-connected systems.
Drive adoption of DevSecOps practices, including automated security testing, software supply chain security, CI/CD security controls, secrets management, and approved developer security tooling.
Develop reusable security patterns, reference architectures, training materials, and engineering guidance.
Lead engineering adoption and execution of cybersecurity governance processes across the product development lifecycle.
Partner with Regulatory Affairs, Quality, Legal, and Engineering to operationalize cybersecurity requirements associated with emerging regulations and industry standards.
Translate regulatory cybersecurity requirements into scalable engineering processes, controls, documentation, and compliance evidence.
Support audit readiness, security assessments, certifications, and regulatory reviews.
Integrate cybersecurity requirements into product development, release, maintenance, and end-of-life processes.
Monitor industry trends, emerging threats, and evolving cybersecurity requirements and improve security capabilities accordingly.
Drive secure development lifecycle practices across hardware, firmware, software, cloud, mobile, and IoT product teams.
Lead threat modeling, security architecture reviews, risk assessments, and security design reviews.
Establish consistent security requirements for new product introductions and major platform enhancements.
Oversee security testing programs, penetration testing, and security validation processes.
Establish and oversee global product vulnerability management processes.
Lead coordinated vulnerability disclosure and external vulnerability response activities.
Coordinate engineering remediation of product cybersecurity incidents in partnership with Global Cybersecurity incident response teams.
Develop remediation prioritization frameworks and risk-based decision-making processes.
Support customer communications and executive briefings about cybersecurity issues and product security events.
Improve vulnerability response timelines and remediation effectiveness.
Act as engineering security lead during critical vulnerability investigations and product cybersecurity incidents, coordinating root cause analysis, containment, remediation, and executive communications.
Design scalable security processes for adoption across global engineering organizations.
Improve efficiency through process optimization, automation, and AI-assisted workflows.
Establish repeatable methods for security reviews, compliance evidence generation, risk assessments, and vulnerability tracking.
Define and measure operational performance indicators demonstrating program effectiveness and business impact.
Reduce friction in engineering processes while improving security outcomes and compliance readiness.
Define and maintain product security KPIs, including vulnerability remediation performance, threat modeling coverage, SSDLC adoption, penetration testing completion, software supply chain risk posture, and security defect escape rates.