VP, Product Security

Blue Shield of California•Oakland, CA

25d

About The Position

The Vice President, Product Security will establish and lead Stellarus’ enterprise product security strategy, governance framework, and operating model. The role is responsible for protecting commercial products, customer data, and digital ecosystems while enabling innovation and business growth. The executive will partner with Product, Engineering, Risk Management, Privacy, Compliance, and Legal leaders to build secure-by-design capabilities across Stellarus’ healthcare technology portfolio. The position oversees product security engineering, application security, cloud security, DevSecOps, vulnerability management, security architecture, and product security governance. It also leads the Product Security organization, sets technical security requirements and standards, advances security automation and continuous monitoring, and provides executive visibility into security risk, program maturity, and effectiveness. The role manages budgets, investments, vendors, and strategic initiatives, and represents Product Security in executive, customer, regulatory, and industry settings.

Requirements

Bachelor’s degree in Computer Science, Engineering, or a related technical field, or 18+ years of relevant experience in lieu of a degree.
12+ years of relevant experience in information security, cybersecurity, product security, application security, cloud security, software engineering security, or related disciplines, including a record of leading enterprise-scale security programs and technical organizations.
7+ years of leadership experience leading managers and/or large-scale security organizations, with a record of building high-performing teams and developing talent.
At least one industry-standard certification, such as CISSP, CISM, or CCSP.
Executive leadership experience developing and scaling enterprise Product Security programs in complex, highly regulated environments.
Deep expertise in secure software development lifecycle (SSDLC), application security, DevSecOps, cloud security, API security, and software supply chain security.
Strong understanding of modern cloud platforms, microservices architectures, containerized environments, and platform engineering practices.
Experience implementing and operationalizing security frameworks and standards such as NIST CSF, NIST SSDF, ISO 27001, CIS Controls, SOC 2, and OWASP.
Demonstrated success integrating security into agile and product-centric operating models.
Strong knowledge of threat modeling, vulnerability management, penetration testing, code analysis, and secure architecture review methodologies.
Experience managing security risks associated with customer-facing products, digital platforms, APIs, and cloud-native applications.
Ability to translate business strategy into actionable security roadmaps, investment plans, and measurable outcomes.
Strong financial and operational acumen, including experience managing budgets, prioritizing investments, and optimizing organizational performance.
Excellent communication, stakeholder management, and executive presentation skills, with the ability to influence technical and non-technical audiences.
Experience collaborating with executive leadership, boards, customers, regulators, and external auditors.

Nice To Haves

Experience in healthcare, health plans, healthcare technology, payer/provider ecosystems, or other highly regulated industries.
Experience securing SaaS platforms, healthcare data products, AI/ML solutions, and cloud-native digital services.
Familiarity with healthcare regulatory requirements, including HIPAA, HITRUST, CMS regulations, and emerging healthcare cybersecurity guidance.
Experience leading product security programs supporting commercial software products and enterprise platforms.
Professional certifications such as CISSP, CISM, CCSP, CSSLP, GIAC, or equivalent.
Advanced degree in Cybersecurity, Computer Science, Engineering, Information Systems, or a related field.
Experience serving as a security executive, security officer, or equivalent leader in a technology-driven organization.

Responsibilities

Establish and execute the enterprise commercial Product Security vision, strategy, and multi-year roadmap aligned with business objectives, technology priorities, customer commitments, and product growth strategy.
Build and lead a high-performing Product Security organization focused on security engineering excellence, scalable practices, operational rigor, and measurable risk reduction.
Partner with Product Management, Engineering, Architecture, Compliance, and Platform teams to embed security requirements into the product development lifecycle.
Drive adoption of secure-by-design and secure-by-default principles across products, platforms, APIs, cloud services, and technology solutions.
Define and govern technical product security requirements for authentication, authorization, identity, API security, encryption, key and secrets management, tenant isolation, secure configuration, logging, abuse prevention, and data protection.
Oversee application security, cloud security, DevSecOps, software supply chain security, threat modeling, penetration testing, and vulnerability management programs.
Establish cloud-native product security standards for infrastructure-as-code, containers, Kubernetes, serverless architectures, CI/CD pipelines, cloud identity, network segmentation, workload protection, runtime security, and continuous control monitoring.
Drive security automation across the software delivery lifecycle, including testing and scanning, SBOM generation, artifact signing, policy-as-code, CI/CD security gates, and automated vulnerability triage.
Lead security assessments and reviews for new products, strategic initiatives, acquisitions, partnerships, and technology implementations.
Develop enterprise-wide product security metrics, reporting, and executive dashboards covering risk posture, security maturity, and program effectiveness.
Partner with Legal, Privacy, Compliance, Internal Audit, and Risk Management to align with applicable regulatory requirements and industry standards.
Champion security automation and continuous monitoring to improve efficiency and reduce organizational risk.
Represent Product Security in executive leadership forums, customer engagements, regulatory discussions, and industry events as needed.
Foster security awareness, accountability, and continuous improvement across the technology organization.
Manage product security budgets, investments, vendor relationships, and strategic initiatives to maximize business value and risk reduction.