Senior Manager, Product Security Office

Aptiv•Boston, MA

1d•$210,000 - $250,000•Hybrid

About The Position

Wind River Systems seeks an experienced secure software engineering professional to lead and grow its Product Security Office. The role is responsible for scaling product security trust to address evolving business and technology needs, architecting product security initiatives, managing customer product security trust, and leading the Product Security Incident Response Team (PSIRT) and vulnerability management team. The position collaborates with customer, product, engineering, and operations teams to promote scalable, compliance-driven product security across the company’s products. It also works across engineering and with the CTO Office, Product Management, IT, Legal, InfoSec, and SecOps to establish and maintain product security compliance and assurance.

Requirements

Bachelor’s degree in Engineering, Computer Science, Information Security, or a related technical field.
10+ years of experience in software engineering, program management, governance, compliance, or related leadership roles.
5+ years of people management experience leading technical, compliance, or program teams.
Experience leading software product security teams.
Direct experience with product security assurance techniques, including threat modeling, security testing, vulnerability management, and software composition.
Experience with software engineering models and techniques.
Experience promoting product security compliance across an organization.
Broad experience with global security regulations, frameworks, and standards.
Exposure to customer compliance and remediation work, including questionnaires, audits, and contracts.
Excellent verbal and written communication skills for management and customer audiences.
Ability to analyze and think quickly, resolve conflict, work effectively across an organization, and adapt to change.
Strong communication, interpersonal, and mentoring skills.
Direct experience mobilizing one or more security standards, certifications, or frameworks such as FIRST.org, OWASP SAMM, IEC 62443, ISO 21434, NIST 800-218, FIPS 140-3, DISA STIG, Common Criteria, CMMC, or FedRAMP.
Broad practical experience with NIST 800-series security standards, including 800-53 and 800-171.
Practical experience with one or more threat modeling frameworks such as TARA, STRIDE, PASTA, or ATT&CK.
Broad practical experience with secure software testing techniques and tools, including SAST, DAST, fuzzing, security feature testing, and penetration testing.
Working knowledge of vulnerability and incident management coordination, including Global Vulnerability Registers, CVSS scoring, CNA, VINCE, and NVD.
Experience mobilizing secure software development techniques across an organization.
Experience using agile techniques and frameworks to deliver secure software.
Experience leading full-stack software solutions.

Nice To Haves

Certified security professional, such as CSSLP, CISM, CISSP, or CEH.
Experience with the European Union security regulatory environment, including the Cyber Resilience Act (CRA).
Experience with national security systems and standards, such as CNSS.
Working knowledge of risk management frameworks and risk-based secure software development.
Experience with AI and machine learning and their governance and provenance in a secure software development environment.
Working knowledge of related quality and safety assurance standards such as ASPICE, ISO 26262, or DO-178C.

Responsibilities

Lead, manage, and grow the Product Security Office and team.
Architect the product security trust roadmap and scale the compliance framework to meet emerging and future business priorities.
Promote product security compliance across engineering and in alignment with the CTO Office, Product Management, IT, Legal, InfoSec, and SecOps.
Develop product security champions throughout product software engineering.
Architect and lead execution of organization-wide product security assurance software platforms.
Lead Product Security Incident Response Team (PSIRT) operations.
Manage customer product security trust and compliance.
Train, mentor, and support development teams in secure development values, principles, and practices.