Product Security Leader (Seaport/Boston Onsite)

Cielo Projects•Boston, MA

2h•$175,000 - $210,000•Onsite

About The Position

Velotic is seeking a dynamic and technically driven Product Security Leader to establish and lead the product security function for our newly formed organization. This is a unique greenfield opportunity to build a world-class product security program from the ground up while navigating the complexity of integrating two carved-out companies in the industrial software space. The Product Security Leader will be a hands-on builder and leader who will be responsible for interfacing software development engineers who will be embedding security throughout the software development lifecycle (SDLC), establishing secure development practices, and ensuring with product managers that Velotic's products are built with security as a foundational principle. This role also requires close coordination with technical support, customer success, IT and infrastructure teams, and external partners including System Integrators and MSSP providers. Role Description: The Product Security Leader at Velotic will play a pivotal role in building security into the DNA of our products during a unique and complex organizational formation. As Velotic brings together engineering teams from two carved-out companies, each with their own development practices, tech stacks, and security maturity levels, this role requires exceptional technical depth, strong relationship-building skills, and the ability to navigate ambiguity while driving toward a unified vision. This is a true greenfield opportunity where you will define what "good" looks like for product security at Velotic. You'll establish the secure SDLC framework, select and implement security tooling, build a security champions network, and create the processes that will scale with the company's growth. The challenge and opportunity lie in harmonizing security practices across two different engineering cultures while maintaining development velocity and building something better than either organization had before. The successful candidate will work at the intersection of security, engineering, and product management. You'll need to be technical enough to earn the respect of senior engineers, strategic enough to influence product roadmaps, and pragmatic enough to balance security ideals with business realities. This role requires coordination with external partners—System Integrators who are helping stand up development infrastructure and MSSP providers who deliver security monitoring services—requiring strong vendor management skills alongside technical expertise. Day-to-day, you'll lead threat modeling sessions, review security architectures, triage vulnerabilities, guide remediation efforts, implement security automation, and work hands-on with development teams to embed security throughout the development process. You'll also be responsible for managing security assessments from customers, responding to security questionnaires, coordinating penetration tests, and ensuring Velotic's products meet compliance requirements for key certifications like SOC 2 and ISO 27001. A key aspect of this role is building security in a developer-friendly way. You'll need to shift security left without slowing teams down, automate security checks within CI/CD pipelines, provide clear and actionable security guidance, and celebrate security wins to build momentum. You'll establish metrics that demonstrate both security improvements and the business value of the product security program. This role reports to the Chief Product Officer and collaborates closely with the CISO, VP/Directors of Engineering, Product Management leaders, Infrastructure/Cloud teams, and external security partners. You'll regularly present product security metrics, risk assessments, and program updates to executive leadership, particularly around critical vulnerabilities, security incidents, and program maturity progress. The ideal candidate for this role is someone who thrives at the intersection of security and engineering, loves building programs from scratch, and is energized by the challenge of bringing together different organizations with a shared security vision. You should be comfortable with ambiguity, excellent at influencing without authority, and passionate about making security an enabler of innovation rather than a blocker. If you want to leave a lasting mark by building a world-class product security program during a critical formative period, this is the opportunity for you. This position offers significant autonomy, direct impact on product strategy, close collaboration with executive leadership and private equity stakeholders, and the satisfaction of building something meaningful from the ground up in a well-funded, growth-oriented environment.

Requirements

Bachelor's degree in Computer Science, Cybersecurity, Software Engineering, or related technical field; Master's preferred
8+ years of experience in application security, product security, or secure software development, with at least 3 years in a leadership role
Proven experience building or scaling product security programs in SaaS, B2B software, B2C software, or product-focused technology companies
Deep technical expertise in application security, including secure coding practices, security architecture, threat modeling, and vulnerability management
Strong knowledge of common vulnerabilities and attack patterns (OWASP Top 10, SANS Top 25, etc.) and modern application security testing methodologies
Experience with application security testing tools and methodologies including SAST, DAST, IAST, SCA, container security scanning, and penetration testing
Hands-on experience with modern development practices including CI/CD pipelines, DevSecOps, cloud-native architecture, microservices, APIs, and infrastructure-as-code
Strong understanding of cloud security across major platforms (AWS, Azure, GCP) and containerization technologies (Docker, Kubernetes)
Experience with security automation, security tooling integration, and shifting security left in the development process
Knowledge of secure software development frameworks (NIST SSDF, OWASP SAMM, BSIMM, ISO/IEC 27034) and ability to implement them in practical, developer-friendly ways
Maintains a deep understanding of the compliance requirements relevant to software products (SOC 2, ISO 27001, PCI DSS, GDPR, CCPA, etc.)
Proven ability to work effectively with engineering teams, influence without direct authority, and build security champions programs
Strong communication skills with ability to translate technical security concepts for both technical and non-technical audiences
Experience harmonizing security tools, processes, and practices across a large development organization with different tech stacks and maturity levels
Proven ability to balance, prioritize and roadmap security initiatives with business velocity and developer capacity

Nice To Haves

Master's degree preferred
Preferred experience leading product security through organizational transitions such as carve-outs, mergers, acquisitions, or multi-entity integrations
Relevant certifications such as CSSLP, CEH, OSCP, GWAPT, AWS/Azure/GCP Security certifications, or similar credentials preferred

Responsibilities

Build and lead Velotic's product security program from the ground up, establishing security practices, tools, processes, and culture across engineering teams
Build and maintain a security champions program to embed security expertise within engineering teams and foster a culture of security ownership
Develop and deliver security training tailored to developers, covering secure coding practices, common vulnerabilities, and security tooling
Develop and implement a unified secure SDLC framework that harmonizes security practices across both carved-out entities while respecting existing development workflows and gradually elevating security maturity
Oversee the selection, implementation, and management of application security testing tools (SAST, DAST, SCA, container scanning, etc.) across multiple development environments and tech stacks
Work with infrastructure and cloud teams to ensure secure deployment practices, container security, Kubernetes security, and cloud security best practices
Lead software supply chain security initiatives, including open-source security management, dependency scanning, and software bill of materials (SBOM) generation
Coordinate product security initiatives across internal engineering teams, System Integrators, and MSSP providers to ensure consistent security controls and effective vulnerability management
Establish and lead threat modeling practices for new features, products, and architectural changes, working closely with engineering and product teams
Manage vulnerability disclosure programs, coordinate security issue triage and remediation, and establish SLAs for vulnerability resolution based on risk
Establish incident response procedures for product security vulnerabilities, coordinating with engineering teams on remediation and customer communication
Partner with product management to incorporate security requirements into product roadmaps and ensure security enhances rather than impedes product innovation
Define and implement security requirements for all stages of the software development lifecycle, from design through deployment and maintenance
Ensure compliance for products with regulatory and certification requirements (SOC 2, ISO 27001, etc.)
Lead security architecture reviews for new products, features, and infrastructure changes, providing actionable guidance to engineering teams
Lead security testing initiatives including penetration testing coordination, bug bounty program management, and red team exercises
Establish metrics and KPIs to measure product security posture, track vulnerability trends, and demonstrate program effectiveness to leadership
Manage third-party security assessments of Velotic's products, including customer security reviews, vendor questionnaires, and independent audits
Serve as the primary product security liaison with SI partners implementing development infrastructure and MSSP providers delivering security monitoring services
Build and manage the product security budget, including tooling investments, third-party testing services, and team resources
Stay current with emerging threats, vulnerabilities, and security technologies relevant to the product software industry