Product Security Lead

Acronis•Burlington, MA

2d•$200,000 - $300,000

About The Position

Acronis is seeking an experienced Product Security Lead to drive its global product security strategy and assurance program across SaaS and on-premises products. The role oversees product security governance, secure development practices, security tooling and automation, vulnerability management, and remediation assurance. It partners with R&D, Product, and Security leadership to embed security throughout the software development lifecycle, strengthen security posture, and meet industry standards and customer expectations. The Product Security Lead owns product assurance governance and metrics, defines security policies and secure development requirements, and establishes risk acceptance and escalation processes. The role also guides toolchain procurement, automated security controls in CI/CD, software supply chain security, independent verification and validation, design reviews, threat modeling, penetration testing, vulnerability response, PSIRT, and compliance and customer assurance efforts. It enables engineering teams through security champions, training, reusable guidance, and developer tooling, while collaborating with international teams across time zones.

Requirements

10–15 years of experience in information security, including at least 6–8 years in product security, application security, or secure SDLC.
Hands-on experience selecting, deploying, and tuning SAST, DAST, SCA, secrets scanning, and SBOM tools in CI/CD environments, including setting enforcement policies at scale.
Experience building or maturing an application security program using frameworks such as OWASP SAMM, BSIMM, or NIST SSDF.
Experience with vulnerability management programs, including risk-based prioritization, SLA governance, and remediation verification.
Experience leading PSIRT or incident response efforts for critical product vulnerabilities, including coordinated disclosure.
Experience managing a bug bounty program, including platform familiarity, researcher engagement, and incentive structuring.
Working knowledge of product regulatory and compliance requirements, including GDPR, HIPAA, and ISO/IEC 27001.
Strong understanding of technical and compliance issues for SaaS and on-premises security product companies.
Ability to analyze complex security data and trends, develop actionable plans with stakeholders, and communicate rationale and progress to senior leadership.
Strong verbal and written communication skills, including explaining complex security concepts to non-technical stakeholders and influencing engineering teams without direct authority.
Ability to develop long-term product security strategies aligned with business goals.
Familiarity with modern software architectures, including cloud-native systems, containers, microservices, and infrastructure as code.
High integrity and ethical standards when handling sensitive and confidential information.
Strong internal and external customer focus and willingness to learn all aspects of the business.
Disciplined, detail-oriented, and able to meet deadlines in a fast-paced environment while maintaining accuracy.
Strong organizational, problem-solving, and multitasking skills.
Collaborative, self-motivated, proactive, and able to work with minimal supervision.

Nice To Haves

Additional leadership experience.
CSSLP, CISSP, CISM, OSCP, or OSWE certification.
Experience with AI/ML security.
Experience with regulated or certified product environments.

Responsibilities

Lead and oversee the product assurance program, including governance, accountability, and metrics across SaaS and on-premises product lines.
Define and maintain product security strategy, policies, standards, and secure development lifecycle requirements aligned with business goals and product roadmaps.
Establish risk acceptance, exception, and escalation processes with clear ownership in Engineering and Product.
Report product security posture, risk trends, and program KPIs to senior leadership.
Assess Product Security toolchain gaps, identify coverage and maturity needs, build business cases for tooling investments, evaluate and recommend tools, and manage vendor relationships.
Select and configure SAST, DAST, SCA, secrets scanning, and SBOM-generation tools and enforcement modes in CI/CD pipelines.
Define CI/CD quality gates, severity thresholds, and break-the-build criteria; oversee rule tuning and false-positive management.
Drive software supply chain security, including dependency governance, SBOM management and distribution, build integrity, artifact signing, and provenance.
Define the independent verification and validation code review process, including scope, triggers, reviewer qualifications, and approval thresholds for high-risk changes.
Oversee security design reviews and threat modeling for new features, architectures, and third-party integrations.
Direct product penetration testing, red team engagements, and external security assessments.
Define and oversee vulnerability intake, triage, risk scoring, SLAs, and remediation processes.
Verify that vulnerability fixes are effective, complete, and free of regressions; track SLA adherence and escalate overdue items.
Manage bug bounty and coordinated vulnerability disclosure programs, including researcher engagement, platform management, and incentive structuring.
Lead the PSIRT function, including security advisories, CVE publication, and customer communication for critical vulnerabilities.
Ensure compliance with relevant regulations, standards, and best practices, including GDPR, HIPAA, and ISO/IEC 27001, and align products with other applicable frameworks.
Support customer security questionnaires, audits, and certification efforts.
Advise Product Management and R&D on security requirements, customer expectations, and product roadmaps.
Build a security champions program and deliver secure coding training to developers.
Embed security guidance, reusable patterns, and paved-road tooling into developer workflows.
Collaborate with R&D, Product, IT/Corporate Security, Legal, and other Acronis Group teams.
Coordinate with international security professionals across multiple time zones and stay current on emerging threats, supply chain risks, AI/ML security, and relevant security technologies.