10-15 years of experience in information security, with 6-8 years in product security or secure SDLC.
Hands-on experience with SAST, DAST, SCA, and SBOM tooling in CI/CD environments.
Experience building application security programs using frameworks like OWASP SAMM or NIST SSDF.
Proven track record in vulnerability management and remediation verification.
Experience leading PSIRT or incident response for critical vulnerabilities.
Familiarity with regulatory requirements such as GDPR and HIPAA.
Strong communication skills to convey complex security concepts to non-technical stakeholders.
Responsibilities
Lead the product assurance program, ensuring governance and accountability across product lines.
Define and maintain product security strategy and secure development lifecycle requirements.
Establish risk acceptance and escalation processes within Engineering and Product.
Report on product security posture and program KPIs to senior leadership.
Conduct gap analysis of the Product Security toolchain and manage vendor relationships.
Select and configure security tools for CI/CD pipelines, balancing risk and developer velocity.
Oversee the end-to-end vulnerability management process and manage bug bounty programs.
Benefits
Opportunity to shape global product security strategy.
Collaborative work environment with international security professionals.
Access to cutting-edge security tools and technologies.
Professional development through training and security champions programs.
Engagement with diverse teams across R&D, Product, and IT security.
Full Job Description
We are seeking an experienced Product Security Lead to drive Acronis' global product security strategy and assurance program across our SaaS and on-premises portfolio. This role will oversee product security governance, secure development practices, security tooling and automation, vulnerability management, and remediation assurance. Working closely with R&D, Product, and Security leadership, you will embed security throughout the software development lifecycle, strengthen our security posture, and ensure compliance with industry standards and customer expectations. The ideal candidate combines deep technical expertise with strong leadership skills and a proven ability to build scalable security programs in a global software environment.
WHAT YOU'LL DO
Product Assurance Leadership and Governance
Lead and provide oversight of the product assurance program, including governance, accountability, and metrics across all product lines (SaaS and on-premises).
Define and maintain the product security strategy, policies, standards, and secure development lifecycle (SDL) requirements, aligned with business goals and product roadmaps.
Establish risk acceptance, exception, and escalation processes with clear ownership in Engineering and Product.
Report product security posture, risk trends, and program KPIs to senior leadership.
Toolchain Strategy and Procurement
Conduct gap analysis of the Product Security toolchain, identify coverage and maturity gaps, and build the business case for tooling investments.
Evaluate, select, and recommend appropriate tools, and manage vendor relationships.
Secure CI/CD and Automated Security Controls
Select, configure, and set enforcement modes (audit, warn, block) for SAST, DAST, SCA, secrets scanning, and SBOM generation in CI/CD pipelines.
Define quality gates, severity thresholds, and break-the-build criteria that balance risk reduction with developer velocity.
Oversee tuning of rules and false-positive management to maintain developer trust and adoption.
Drive software supply chain security, including dependency governance, SBOM management and distribution, build integrity, artifact signing, and provenance.
Independent Verification and Validation
Define the independent verification and validation (IV&V) code review process, including scope, triggers, reviewer qualifications, and approval thresholds for high-risk changes.
Oversee security design reviews and threat modeling for new features, architectures, and third-party integrations.
Direct penetration testing, red team engagements, and external security assessments of products.
Vulnerability Management and Remediation Assurance
Define and oversee the end-to-end vulnerability management process: intake, triage, risk scoring (e.g., CVSS, EPSS, exploitability context), SLAs, and remediation.
Provide remediation assurance by verifying that fixes are effective, complete, and free of regressions, and by tracking SLA adherence and escalating overdue items.
Manage the bug bounty and coordinated vulnerability disclosure programs, including researcher engagement, platform management, and incentive structuring.
Lead the Product Security Incident Response Team (PSIRT) function, including security advisories, CVE publication, and customer communication for critical vulnerabilities.
Compliance and Customer Assurance
Ensure compliance with relevant regulations, industry standards, and best practices, including GDPR, HIPAA, and ISO/IEC 27001.
Align products with additional product-relevant frameworks as applicable (e.g., SOC 2, NIST SSDF, OWASP ASVS/SAMM, SLSA, EU Cyber Resilience Act, NIS2).
Support customer security questionnaires, audits, and certification efforts (e.g., Common Criteria, FedRAMP, or other market-specific requirements).
Engineering Enablement and Culture
Advise Product Management and R&D on security requirements, customer expectations, and product roadmaps.
Build a security champions program and deliver secure coding training to developers.
Embed security guidance, reusable patterns, and paved-road tooling into developer workflows.
Work closely with R&D, Product, IT/Corporate Security, Legal, and other teams within the Acronis Group.
Team Collaboration and Industry Awareness
Coordinate and collaborate with an international team of security professionals across multiple time zones.
Stay current on emerging threats, attack techniques, supply chain risks, AI/ML security, and security technologies relevant to the product portfolio.
WHO WE'RE LOOKING FOR
10-15 years of experience in information security, with at least 6-8 years in product security, application security, or secure SDLC. Additional leadership experience preferred.
Hands-on experience selecting, deploying, and tuning SAST, DAST, SCA, secrets scanning, and SBOM tooling in CI/CD environments, including setting enforcement policies at scale.
Experience building or maturing an application security program using frameworks such as OWASP SAMM, BSIMM, or NIST SSDF.
Proven experience with vulnerability management programs, including risk-based prioritization, SLA governance, and remediation verification.
Proven experience leading PSIRT or incident response efforts for critical product vulnerabilities, including coordinated disclosure.
Proven experience managing a bug bounty program, including platform familiarity, researcher engagement, and incentive structuring.
Working knowledge of regulatory and compliance requirements for products, including GDPR, HIPAA, and ISO/IEC 27001.
Strong understanding of technical and compliance issues for SaaS and on-premises security product companies.
Ability to analyze complex security data and trends, build actionable plans with key stakeholders, and communicate rationale and progress to senior leadership.
Strong verbal and written communication skills, including the ability to explain complex security concepts to non-technical stakeholders and influence engineering teams without direct authority.
Ability to develop long-term product security strategies aligned with business goals.
Familiarity with modern software architectures, such as cloud-native, containers, microservices, and infrastructure as code.
High integrity and ethical standards in handling sensitive and confidential information.
Strong internal and external customer focus, with a desire to learn all aspects of the business.
Disciplined, detail-oriented, and able to meet deadlines in a fast-paced environment while maintaining accuracy.
Outstanding organizational, problem-solving, and multitasking skills.
Collaborative team player, self-motivated and proactive, able to work with minimal supervision.
Nice to have: CSSLP, CISSP, CISM, or OSCP/OSWE; experience with AI/ML security; experience with regulated or certified product environments
About Acronis
Acronis is a global technology company that provides a range of data protection solutions for personal and business use. The company's flagship product is Acronis True Image, a backup and recovery software that allows users to protect their data from loss due to hardware failure, malware, or other disasters. Acronis also offers cloud backup and disaster recovery services, as well as solutions for secure file sharing and collaboration. Founded in 2003, the company is headquartered in Switzerland and has offices in the United States, Europe, and Asia.
