Overview You lead the enterprise product security strategy for a growing portfolio of connected energy solutions, embedding security by design across the lifecycle. You will define and govern security frameworks (IEC 62443) and evolve the secure development lifecycle to achieve certification readiness and strong customer trust. You'll translate complex regulations into practical engineering requirements, partnering with engineering, legal, and leadership to turn security into a competitive advantage. This role combines strategic influence with hands-on governance to protect products in a global, regulatory landscape.
Responsibilities- Define enterprise product security strategy and multi-year roadmap; embed secure by design across portfolio
- Establish IEC 62443 as the primary framework and apply it across product lines
- Drive customer trust and competitive differentiation through security leadership with stakeholders
- Collaborate with engineering and product leadership to integrate security requirements, threat models, and risk decisions into design and release
- Define and operationalize a secure development lifecycle with threat modeling, secure coding, testing, and gates
- Lead certification efforts for IEC 62443-4-1 and related components (4-2, 3-3); advance process maturity
- Drive SBOM, software supply chain security, and vulnerability management within the lifecycle
- Build and lead Product Security Incident Response capabilities; establish coordinated vulnerability disclosure per ISO/IEC 29147 and ISO/IEC 30111
- Lead regulatory response to EU Cyber Resilience Act, UK regime, and other markets; translate obligations into engineering evidence and documentation
- Manage governance, policies, and evidence to demonstrate compliance to auditors, customers, and regulators
- Build and develop a world-class product security organization; foster a culture of ownership and engineering rigor
- Oversee tooling, services, and external partners; align investments to reduce top risks
Key requirements- Bachelor degree in Engineering, Computer Science, Cybersecurity, or related field
- 12 years in cybersecurity, product security, or secure engineering with progressive leadership responsibility
- 7 years of leadership experience; experience across multiple regions preferred
- Proven track record building or maturing product security programs for connected/embedded/industrial products
- Hands-on leadership of secure development lifecycle and product security incident response
- Familiarity with IEC 62443 in real products and path to 62443-4-1 certification
- Experience navigating EU Cyber Resilience Act or similar global regulations
- Strong executive communication and ability to influence board, customers, auditors
- Experience aligning product security with enterprise security and governance
- Knowledge of vulnerability disclosure, regulatory reporting timelines (24h/72h/final)
- Executive communication
- Cross-functional collaboration
- Strategic leadership
- IEC 62443 family (4-1, 4-2, 3-3)
- Secure development lifecycle
- Threat modeling
