Product Cybersecurity Specialist

Hexagon Mining•Tucson, AZ

23h

About The Position

The Product Cybersecurity Specialist helps define internal cybersecurity processes and performs product cybersecurity analysis to ensure Hexagon Mining products and services meet compliance requirements, including ISO 27001 and the EU Cyber Resilience Act (CRA). The role supports product cybersecurity compliance across the Mining Division, working within established governance frameworks and processes. The Specialist conducts product cybersecurity audits and assessments, collaborates with Product Development teams to plan cybersecurity for product development, reviews and approves work products and services from a cybersecurity perspective, prepares audit reports, contributes to Engineering and Support & Services process development, and delivers internal training. The position provides technical guidance and leadership to Service & Support, Product, and Engineering teams and works across Product Management, Engineering, Quality, Support & Service, Legal, and Information Security.

Requirements

Bachelor's degree in Engineering, Computer Science, or a similar discipline.
At least 3 years of experience in product development involving cybersecurity activities.
Strong understanding of cybersecurity risk management.
Experience leading and/or working with cross-functional teams or programs.
Training record in internal product cybersecurity processes.
Working toward a Certified Cybersecurity Engineer qualification in accordance with relevant product cybersecurity standards.
Strong analytical and problem-solving skills.
Excellent communication and writing skills, with a professional and positive attitude.
Technical competence to articulate facts or findings and make design and process recommendations.
Ability to work cooperatively and productively with colleagues and cross-functional teams.
Ability to influence without authority and lead technical activities.
Resourcefulness in researching problems and finding information on related topics.
Ability to lead.
Willingness to travel domestically and internationally up to 10% of the time.

Nice To Haves

Knowledge of the EU Cyber Resilience Act (CRA).
Knowledge of NIS2.
Knowledge of ISO 27001.
Knowledge of IEC 62443.
Knowledge of Secure Software Development Lifecycle (SSDLC).
Knowledge of Vulnerability Disclosure Programs.
Knowledge of SBOM initiatives.
Experience with mining technology, SaaS, cloud platforms, or connected products.

Responsibilities

Perform service and product cybersecurity analysis and activities according to internal processes to ensure products meet compliance requirements.
Support third-party product cybersecurity audits and conduct internal product cybersecurity audits and assessments as needed.
Review and approve work products from a product cybersecurity perspective.
Develop cybersecurity plans for Product Management and Service & Support teams.
Apply and maintain product cybersecurity processes within a quality management system.
Establish and maintain regulatory compliance documentation, support technical file creation and evidence management, and coordinate compliance reviews and readiness activities.
Develop product cybersecurity metrics, dashboards, and reporting.
Prepare product cybersecurity audit reports and evaluate data to determine conformance to cybersecurity assurance levels.
Contribute to engineering process development and conduct or support internal product cybersecurity assessments.
Apply ISO 27001 and EU CRA requirements to assigned Mining products, software, cloud services, and connected systems.
Conduct product-level ISO 27001 and CRA applicability and gap assessments and document results.
Support vulnerability intake, assessment, prioritization, remediation tracking, and related compliance evidence activities.
Contribute to the Mining Division's input to the ISO 27001 and Hexagon CRA initiative and cross-functional working groups.
Establish product vulnerability management processes aligned with CRA requirements and coordinate vulnerability remediation activities.
Lead exploitation impact assessments and cross-functional response efforts.
Coordinate reporting of exploited vulnerabilities and severe incidents to applicable authorities when required.
Define customer communication, disclosure, and notification processes.
Deliver internal product cybersecurity training as required.
Serve as the Mining Division lead and subject matter expert for cybersecurity compliance, providing technical guidance and leadership.
Facilitate technical discussions and collaboration, identify issues and patterns in complex situations, and communicate technical content appropriately for the audience.
May set cybersecurity objectives, conduct performance evaluations, and assess employee development requirements.
Support SBOM and supplier security review activities.