Senior Manager, Product Security Office

Wind River Systems is seeking a leader to manage and grow its Product Security Office and strengthen product security trust across the organization. The role oversees product security initiatives, compliance, customer trust, and the Product Security Incident Response Team (PSIRT), while supporting secure software development across teams.

Responsibilities:

• Manage, Lead, and Grow the Product Security Office and Team
• Architect the product security trust roadmap and scale the compliance framework to meet emerging and future business priorities
• Empower product security compliance across engineering and aligned to the CTO Office, Product Management, IT, Legal, InfoSec, and SecOps
• Empower product security champions throughout product software engineering
• Architect, and lead execution of organization-wide product security assurance software platforms
• Lead the Product Security Incident Response Team (PSIRT) operations team
• Manage customer product security trust and compliance
• Training, mentoring, and supporting development teams to follow secure development values, principles, and practices

Requirements:

• USA National or Canada Citizen, without citizenship of another country
• The successful candidate will have experience in software security techniques, broad-based security standards and regulatory experience, and have mature cross-functional leadership, teamwork, and communications capabilities
• Experience Leading Software Product Security Team(s)
• Direct experience with product security assurance techniques including Threat Modeling, Security Testing, Vulnerability Management, Software Composition, etc
• Experience in software engineering models and techniques
• Experience empowering product security compliance broadly across an organization
• Broad-based experience with global security regulations, frameworks, and standards
• Exposure to customer compliance and remediations (Questionnaire's, Audits, Contracts, etc.)
• Excellent verbal and written, management level and customer communication skills
• Ability to analyze and think quickly and to resolve conflict
• Strong communication, interpersonal, and mentoring skills
• Ability to work effectively across the organization
• Ability to adapt to a changing environment
• Bachelor's degree in Engineering, Computer Science, Information Security, or a related technical field
• 10+ years of experience in software engineering, program management, governance, compliance, or related leadership roles
• 5+ years of people management experience leading technical, compliance, or program teams
• Direct experience mobilizing one or more security standards/certifications/frameworks like FIRST.org, OWASP SAMM, IEC 62443, ISO 21434, NIST 800-218, FIPS 140-3, DISA STIG, Common Criteria, CMMC, Fed Ramp, or similar
• Broad practical experience with the NIST 800 series of security standards, including 800-53, 800-171, and others
• Practical experience with one or more threat modeling frameworks such as: TARA, STRIDE, PASTA, ATT&CK, or similar
• Broad practical experience with secure software testing techniques and tools including: SAST, DAST, Fuzz, Security Feature, and Penetration Testing
• Working knowledge of vulnerability and incident management coordination: Global Vulnerability Registers, CVSS Scoring, CNA, VINCE, NVD, and similar
• Experience mobilizing secure software development techniques across an organization
• Experience using agile techniques and frameworks to deliver secure software
• Experience leading full-stack software solutions
• preferably for product security
• Certified security professional (CSSLP, CISM, CISSP, CEH, or similar)
• Experience with the European Union (EU) security regulatory environment including the Cyber Resilience Act (CRA)
• Experience with national security systems and standards (CNSS, etc.)
• Working knowledge of risk management frameworks and risk-based secure software development
• Experience with AI and Machine learning and their governance and provenance in a secure software development environment
• Working knowledge of related quality and safety assurance standards such as ASPICE, ISO 26262, DO-178C, or similar