About the role
Principal Product Security Architect & Engagement Lead
Role Summary
* Lead and govern the end-to-end product lifecycle cybersecurity assessment engagement for the customer product including: * CRA-aligned security evaluation, architecture assessment, threat modelling, technical oversight, evidence traceability, and executive reporting. * Accountable for leading all the discussions during the assessment including product applicability, intended use analysis, classification, Risk-based decisions, test-plan quality, change control, customer workshops, executive reporting, and escalation of material risks. * Serve as the primary customer interface and ensure all assessment activities are executed in compliance with export-control requirements.
Key Responsibilities
* Lead overall engagement delivery, governance, and customer coordination, including multidisciplinary team leadership, workstream ownership, estimation, change control, customer workshops, executive reporting, and difficult-risk communication * Conduct product security architecture assessments and threat modelling activities, including attack-tree, abuse-case, misuse-case, secure-update, rollback, recovery and safe-state architecture analysis * Perform trust boundary analysis and review data flows across product components and external integrations * Oversee CRA-aligned assessment methodology, compliance traceability, and lifecycle security evaluation, including CRA product scope, applicability and classification analysis, essential-requirement interpretation, conformity-assessment strategy, technical-documentation readiness, and compliance-evidence readiness * Evaluate operational resilience, recovery considerations, and lifecycle security controls across deployed product environments * Review secure-by-design implementation and product security governance practices * Guide technical testing activities and validate risk prioritization and exploitability context * Review security findings and ensure consistency across technical and compliance outputs * Lead executive reporting, release readiness assessment, and remediation discussions * Ensure evidence collection and assessment outputs align to CRA requirements, with control traceability, findings calibration, residual-risk governance, release-readiness conclusions, and defensible evidence mapping * Review lifecycle security considerations including secure decommissioning and data disposal practices * Assess security support-period commitments, update strategy, coordinated vulnerability disclosure, post-market vulnerability handling, incident-reporting readiness, and product logging, monitoring and auditability architecture * Evaluate connected-system and ecosystem-impact considerations, data minimization, sensitive-data handling, security-control design, and control effectiveness across product environments * Enforce export-control compliant handling of personnel, systems, and data * Provide final quality assurance and assessment signoff oversight
Required Skills & Experience
Mandatory:
* Strong experience in product cybersecurity and secure-by-design principles, including product security architecture, secure-by-design governance, security-control design and effectiveness evaluation * Expertise in threat modelling, architecture review, and trust boundary analysis, including attack-tree, abuse-case, misuse-case, data-flow, data-minimization and sensitive-data analysis * Strong understanding of product lifecycle security and operational resilience concepts * Familiarity with secure SDLC, SBOM governance, and vulnerability management practices * Strong executive communication and stakeholder management capability * Control traceability, evidence management, release readiness, residual-risk assessment, findings calibration, negotiation, executive escalation, and material-risk communication * CRA product scope, applicability and classification analysis; CRA essential-requirement interpretation; conformity-assessment strategy and readiness; technical-documentation and compliance-evidence readiness * PSIRT and vulnerability handling processes, coordinated vulnerability disclosure, security support-period and update-strategy assessment, post-market vulnerability and incident-reporting readiness * NIST SSDF OR IEC 62443-4-1/4-2 frameworks; compliance and regulatory security assessments; product cybersecurity risk assessment; connected-device, embedded, IoT or regulated-product environments * Experience across both offensive security and security architecture domains * US Citizen or Green Card holder (US Person)
Good to have:
* Experience leading CRA, regulated product security, or compliance-driven cybersecurity assessments * Experience leading engagement in export-controlled environments * FedRAMP or regulated environment experience preferred
Preferred Certifications
IEC 62443 (OT Security) or Certified DevSecOps Professional or any other relevant product-security credentials
Years of Required Experience
* 12+ years in Product Security Architecture * 5+ years in complex customer assessment and regulatory assessment engagements * Five years leading complex customer security and regulatory assessment engagements * Demonstrated leadership of multidisciplinary product-security teams; experience defining assessment scope, effort estimates, workstream ownership and experience approving security reports