Manager, Product Security Engineering

Johnson Controls•Westford, MA

1d•Hybrid

About The Position

Johnson Controls Fire Solutions is seeking a strategic and technical leader to direct product security engineering across its global portfolio of fire detection and suppression products. The portfolio includes embedded firmware, connected devices, cloud platforms, mobile applications, and digital services. The Manager will define and advance the Fire Solutions product security execution strategy and roadmap in alignment with Global Cybersecurity standards and enterprise security objectives. The role establishes scalable security processes, leads cybersecurity risk and vulnerability management programs, supports compliance with application cybersecurity regulations and corporate initiatives, and develops AI security threat response and governance capabilities. The Manager provides leadership across a global ecosystem of hardware, firmware, software, cloud, and IoT solutions, integrating security throughout the product lifecycle. The position translates cybersecurity requirements into practical engineering processes, improves operational efficiency, and promotes security ownership across the Fire Solutions Engineering organization. This is a hybrid position based out of the JCI Westford office, with an expectation of being in the office three days per week. The hiring salary range is $116,000–$170,000, with a competitive bonus plan based on individual, group, and corporate performance, and a competitive benefits package. Salary will depend on the applicant’s education, experience, knowledge, skills, abilities, internal equity, and market data. Johnson Controls may use technology-assisted tools, including AI, to help identify and evaluate candidates; hiring decisions are made by human reviewers.

Requirements

Bachelor’s degree in computer science, cybersecurity, engineering, information technology, or a related technical discipline.
At least 10 years of combined experience in software engineering, cloud engineering, DevSecOps, product security, application security, or cybersecurity leadership roles, with demonstrated hands-on technical expertise.
Demonstrated success developing and executing product security strategies within complex technology organizations.
Strong knowledge of product security, secure development practices, cloud security, IoT security, and vulnerability management.
Experience working with enterprise cybersecurity teams to implement governance, standards, and risk management frameworks.
Proven ability to drive cross-functional initiatives across engineering, product management, quality, and regulatory organizations.
Excellent leadership, communication, stakeholder management, and executive presentation skills.

Nice To Haves

Master’s degree in cybersecurity, computer science, engineering, business, or a related field.
Industry certifications such as CISSP, CISM, CRISC, CSSLP, GIAC, or equivalent.
Experience supporting products subject to cybersecurity regulations and compliance frameworks.
Knowledge of cybersecurity standards and frameworks including NIST, IEC 62443, ISO 27001, UL cybersecurity standards, and related industry practices.
Experience with SBOM and software supply chain security.
Experience with threat modeling methodologies such as STRIDE.
Experience leading remediation of critical vulnerabilities and security incidents.

Responsibilities

Partner with Johnson Controls Enterprise Security to establish product security governance, policies, standards, and risk management frameworks across the portfolio.
Serve as the senior engineering leader and lead security architect for product cybersecurity within Fire Solutions, advising on secure architecture across firmware, cloud, mobile, IoT, and enterprise-connected systems.
Operationalize product security strategy, standards, governance, and risk management practices in partnership with Global Cybersecurity.
Promote security-by-design, accountability, and continuous improvement throughout the organization.
Drive engineering adoption of DevSecOps practices, including automated security testing, software supply chain security, CI/CD security controls, secrets management, and approved developer security tooling.
Develop reusable security patterns, reference architectures, training materials, and engineering guidance.
Lead engineering adoption and execution of cybersecurity governance processes across the product development lifecycle.
Work with Regulatory Affairs, Quality, Legal, and Engineering to operationalize cybersecurity requirements associated with emerging regulations and industry standards.
Translate regulatory cybersecurity requirements into engineering processes, controls, documentation, and compliance evidence; support audit readiness, security assessments, certifications, and regulatory reviews.
Integrate cybersecurity requirements into product development, release, maintenance, and end-of-life processes, and monitor industry trends, threats, and changing requirements.
Drive adoption of secure development lifecycle practices across hardware, firmware, software, cloud, mobile, and IoT teams.
Lead threat modeling, security architecture reviews, risk assessments, and security design reviews.
Establish security requirements for new product introductions and major platform enhancements.
Oversee security testing, penetration testing, and security validation programs.
Establish and oversee global product vulnerability management processes, including coordinated vulnerability disclosure and external vulnerability response.
Coordinate engineering remediation of product cybersecurity incidents with Global Cybersecurity incident response teams; lead root cause analysis, containment, remediation, and executive communications during critical investigations and incidents.
Develop remediation prioritization frameworks and risk-based decision-making processes; support customer communications and executive briefings regarding cybersecurity issues and product security events.
Improve vulnerability response timelines and remediation effectiveness.
Design scalable security processes for global engineering organizations and improve efficiency through process optimization, automation, and AI-assisted workflows.
Establish repeatable methods for security reviews, compliance evidence generation, risk assessments, and vulnerability tracking.
Define and measure operational performance indicators and maintain product security KPIs covering vulnerability remediation, threat modeling, SSDLC adoption, penetration testing, software supply chain risk, and security defect escape rates.
Reduce friction in engineering processes while improving security outcomes and compliance readiness.