Product Security Lead

Acronis•Burlington, MA

About The Position

Acronis is seeking an experienced Product Security Lead to drive its global product security strategy and assurance program across SaaS and on-premises products. The role oversees product security governance, secure development practices, security tooling and automation, vulnerability management, and remediation assurance. Working with R&D, Product, and Security leadership, the position embeds security throughout the software development lifecycle, strengthens the security posture, and supports compliance with industry standards and customer expectations. The Product Security Lead will oversee product assurance and governance across product lines; define security strategy, policies, standards, and secure development lifecycle requirements; and establish risk acceptance, exception, and escalation processes. The role also sets tooling strategy, implements automated security controls in CI/CD, and advances software supply chain security. It defines independent verification and validation processes, oversees design reviews and threat modeling, directs security assessments, and manages vulnerability response, remediation assurance, bug bounty, coordinated disclosure, and PSIRT activities. The role supports product compliance and customer assurance, including audits, questionnaires, and certification efforts. It advises Product Management and R&D, builds security champions and secure coding training, and embeds security guidance and reusable tooling in developer workflows. The position collaborates with teams across the Acronis Group and an international security team, while monitoring emerging threats and relevant security technologies.

Requirements

10–15 years of experience in information security, including at least 6–8 years in product security, application security, or secure SDLC.
Hands-on experience selecting, deploying, and tuning SAST, DAST, SCA, secrets scanning, and SBOM tooling in CI/CD environments, including setting enforcement policies at scale.
Experience building or maturing an application security program using frameworks such as OWASP SAMM, BSIMM, or NIST SSDF.
Proven experience with vulnerability management programs, including risk-based prioritization, SLA governance, and remediation verification.
Proven experience leading PSIRT or incident response for critical product vulnerabilities, including coordinated disclosure.
Proven experience managing a bug bounty program, including platform familiarity, researcher engagement, and incentive structuring.
Working knowledge of product regulatory and compliance requirements, including GDPR, HIPAA, and ISO/IEC 27001.
Strong understanding of technical and compliance issues for SaaS and on-premises security product companies.
Ability to analyze complex security data and trends, develop actionable plans with stakeholders, and communicate rationale and progress to senior leadership.
Strong verbal and written communication skills, including explaining complex security concepts to non-technical stakeholders and influencing engineering teams without direct authority.
Ability to develop long-term product security strategies aligned with business goals.
Familiarity with modern software architectures, including cloud-native systems, containers, microservices, and infrastructure as code.
High integrity and ethical standards when handling sensitive and confidential information.
Strong internal and external customer focus and desire to learn all aspects of the business.
Disciplined, detail-oriented, and able to meet deadlines in a fast-paced environment while maintaining accuracy.
Outstanding organizational, problem-solving, and multitasking skills.
Collaborative, self-motivated, and proactive, with the ability to work with minimal supervision.

Nice To Haves

Additional leadership experience.
CSSLP, CISSP, CISM, OSCP, or OSWE certification.
Experience with AI/ML security.
Experience in regulated or certified product environments.

Responsibilities

Lead and oversee the product assurance program, including governance, accountability, and metrics across SaaS and on-premises product lines.
Define and maintain product security strategy, policies, standards, and secure development lifecycle requirements aligned with business goals and product roadmaps.
Establish risk acceptance, exception, and escalation processes with clear ownership in Engineering and Product.
Report product security posture, risk trends, and program KPIs to senior leadership.
Assess product security tooling coverage and maturity, build business cases for investments, evaluate and recommend tools, and manage vendor relationships.
Select, configure, and set enforcement modes for SAST, DAST, SCA, secrets scanning, and SBOM generation in CI/CD pipelines.
Define security quality gates, severity thresholds, and break-the-build criteria, and oversee rule tuning and false-positive management.
Drive software supply chain security, including dependency governance, SBOM management and distribution, build integrity, artifact signing, and provenance.
Define the independent verification and validation code review process, including scope, triggers, reviewer qualifications, and approval thresholds for high-risk changes.
Oversee security design reviews and threat modeling for new features, architectures, and third-party integrations.
Direct penetration testing, red-team engagements, and external product security assessments.
Define and oversee vulnerability intake, triage, risk scoring, SLAs, and remediation processes.
Verify remediation effectiveness and completeness, track SLA adherence, identify regressions, and escalate overdue vulnerabilities.
Manage bug bounty and coordinated vulnerability disclosure programs, including researcher engagement, platform management, and incentive structuring.
Lead the PSIRT function, including security advisories, CVE publication, and customer communication for critical vulnerabilities.
Ensure compliance with relevant regulations, standards, and best practices, and align products with applicable product security frameworks.
Support customer security questionnaires, audits, and certification efforts.
Advise Product Management and R&D on security requirements, customer expectations, and product roadmaps.
Build a security champions program and deliver secure coding training to developers.
Embed security guidance, reusable patterns, and paved-road tooling into developer workflows.
Collaborate with R&D, Product, IT/Corporate Security, Legal, other Acronis Group teams, and international security professionals across time zones.
Stay current on emerging threats, attack techniques, supply chain risks, AI/ML security, and technologies relevant to the product portfolio.