Manager - Product Security at Maxonic, Inc.

Job description

Maxonic maintains a close and long-term relationship with our direct client. In support of their needs, we are looking for a Manager - Product Security Job Title: Manager - Product Security Job Type: Fulltime Job Location: Chandler, AZ Work Schedule: Onsite Responsibilities • Product Security Governance, Risk & Regulatory Readiness • Define and guide the deployment of product security governance frameworks across Business Units. • Establish consistent methodologies for product security risk classification, threat modeling, and regulatory scoping. • Translate evolving cybersecurity regulations, standards, and guidance into actionable internal requirements and governance expectations. • Support company-wide readiness for the EU Cyber Resilience Act and other applicable global cybersecurity requirements. • Align product security governance with Corporate Quality workflows, new product development processes and product release governance. • Define security checkpoints for new products, new features and software releases. • Serve as an escalation point for complex product security classifications, threat scenarios, and interpretation questions. • Maintain product security governance dashboards, maturity metrics, and executive reporting inputs. • Coordinate with notified bodies, certification labs, and relevant industry associations and external partners, as needed. • PSIRT & Vulnerability Management Governance • Define and govern product vulnerability management processes within the Product Security Office. • Establish governance frameworks for vulnerability intake, triage, validation, severity assessment, remediation coordination, disclosure, advisory publication, and regulatory reporting. • Guide alignment of PSIRT practices with applicable international standards for vulnerability disclosure, handling and coordinated response. • Support consistent vulnerability handling across company-developed products, third-party components, open-source software, and supplier-provided software or IP. • Define escalation criteria for actively exploited vulnerabilities, critical product security incidents, supplier compromises, and customer-impacting issues. • Support CVE assignment and CNA-related activities, where applicable. • Establish metrics and KPIs for vulnerability handling, including intake volume, triage timeliness, remediation progress, advisory publication timelines, and overdue actions. • Partner with Legal, Engineering, Customer Support, Field Applications, and Business Units to support coordinated handling of sensitive vulnerability cases. • Threat Modeling & Product Risk Classification • Define and govern the enterprise framework for threat modeling and product risk classification within the Product Security Office. • Develop and maintain threat modeling templates, decision trees, risk libraries, and assessment criteria for use across Business Units. • Train and enable Business Unit security champions, product architects, and engineering teams on threat modeling methodologies. • Guide the integration of threat modeling into product lifecycle and quality processes in partnership with Business Units. • Provide guidance on the use of applicable threat intelligence, emerging attack techniques, and relevant frameworks such as MITRE ATT&CK, EMB3D, STRIDE, OWASP, IEC 62443-4-1, and ISO 21434. • Support product teams and security champions in complex threat modeling and product risk assessments, as needed. • Promote consistent interpretation of product risk classifications across semiconductor product categories, including MCUs, MPUs, secure elements, firmware, software tools, development kits, and reference designs. • Standards, Industry Engagement & External Representation • Monitor and assess evolving cybersecurity regulations, standards, regulatory guidance, and industry expectations relevant to company products. • Participate in, and help coordinate, engagement in relevant standards development organizations, industry consortia, and working groups in collaboration with Business Units and subject matter experts. • Support representation of company product security perspectives in relevant external cybersecurity and standards discussions. • Translate key developments from standards and regulatory discussions into actionable insights for internal governance, product security strategy, and compliance planning. Qualifications: • Required • Bachelor's or Master's degree in Electrical Engineering, Computer Science, Cybersecurity, Embedded Systems, or a related field. • 12.5+ years of experience in cybersecurity, product security, embedded security, semiconductor security, or related technical disciplines. • 5+ years of experience in product security governance, secure development lifecycle, security program management, or regulatory readiness roles. • 3+ years in a leadership or senior role driving cross-functional security initiatives across multiple teams or Business Units. • Strong understanding of embedded systems, semiconductor products, firmware, software, hardware security, cryptography, and product lifecycle processes. • Experience with the EU Cyber Resilience Act, RED cybersecurity requirements, NIS2, EUCC, SESIP, Common Criteria, or related cybersecurity regulatory frameworks. • Experience with product security governance frameworks, threat modeling, risk assessment, vulnerability management, or PSIRT processes. • Familiarity with standards and frameworks such as IEC 62443, ISO 21434, OWASP, STRIDE, MITRE ATT&CK, EMB3D, or similar frameworks.] • Experience translating regulatory, customer, and standards requirements into practical engineering and governance processes. • Strong stakeholder management skills across engineering, quality, legal, compliance, sales, field applications, and executive audiences. • Ability to lead cross-functional initiatives and influence stakeholders across global Business Units without direct authority. • Strong written and verbal communication skills, including executive reporting and customer-facing security communications. • Preferred • Experience in semiconductor, embedded systems, industrial automation, automotive, IoT, medical, or security certification domains. • Experience with threat modeling tools. • Experience with SBOM tooling, CVE processes, CNA operations, vulnerability databases, and open-source vulnerability monitoring. • Experience participating in standards bodies, working groups, industry associations, or regulatory consultations. • Experience working with notified bodies, cybersecurity labs, certification bodies, or external assessors. • Program management experience, including KPI dashboards, governance cadence, cross-Business Unit execution tracking, and maturity models. About Maxonic: Since 2002 Maxonic has been at the forefront of connecting candidate strengths to client challenges. Our award winning, dedicated team of recruiting professionals are specialized by technology, are great listeners, and will seek to find a position that meets the long-term career needs of our candidates. We take pride in the over 10,000 candidates that we have placed, and the repeat business that we earn from our satisfied clients. Interested in Applying? Please apply with your most current resume. Feel free to contact Jhankar Chanda (jhankar@maxonic.com/(408) 400-2310) for more details.

Requirements

Must-haves

Maxonic maintains a close and long-term relationship with our direct client. In support of their needs, we are looking for a Manager - Product Security
Job Title: Manager - Product Security
Job Type: Fulltime
Job Location: Chandler, AZ
Work Schedule: Onsite
Product Security Governance, Risk & Regulatory Readiness
Define and guide the deployment of product security governance frameworks across Business Units.
Establish consistent methodologies for product security risk classification, threat modeling, and regulatory scoping.
Translate evolving cybersecurity regulations, standards, and guidance into actionable internal requirements and governance expectations.
Support company-wide readiness for the EU Cyber Resilience Act and other applicable global cybersecurity requirements.
Align product security governance with Corporate Quality workflows, new product development processes and product release governance.
Define security checkpoints for new products, new features and software releases.
Serve as an escalation point for complex product security classifications, threat scenarios, and interpretation questions.
Maintain product security governance dashboards, maturity metrics, and executive reporting inputs.
Coordinate with notified bodies, certification labs, and relevant industry associations and external partners, as needed.
PSIRT & Vulnerability Management Governance
Define and govern product vulnerability management processes within the Product Security Office.
Establish governance frameworks for vulnerability intake, triage, validation, severity assessment, remediation coordination, disclosure, advisory publication, and regulatory reporting.

Nice-to-haves

Experience in semiconductor, embedded systems, industrial automation, automotive, IoT, medical, or security certification domains.
Experience with threat modeling tools.
Experience with SBOM tooling, CVE processes, CNA operations, vulnerability databases, and open-source vulnerability monitoring.
Experience participating in standards bodies, working groups, industry associations, or regulatory consultations.
Experience working with notified bodies, cybersecurity labs, certification bodies, or external assessors.
Program management experience, including KPI dashboards, governance cadence, cross-Business Unit execution tracking, and maturity models.

Application prep

Use the role’s language and application details while tailoring your materials.

Platform: careers-html
Effort: medium

Benefits

Benefits detected in the listing.

Pto