Product Security Leader (SeaportBoston Onsite)

Role Description:

The Product Security Leader at Velotic will play a pivotal role in building security into the DNA of our products during a unique and complex organizational formation. As Velotic brings together engineering teams from two carved-out companies each with their own development practices tech stacks and security maturity levels this role requires exceptional technical depth strong relationship-building skills and the ability to navigate ambiguity while driving toward a unified vision.

This is a true greenfield opportunity where you will define what good looks like for product security at Velotic. Youll establish the secure SDLC framework select and implement security tooling build a security champions network and create the processes that will scale with the companys growth. The challenge and opportunity lie in harmonizing security practices across two different engineering cultures while maintaining development velocity and building something better than either organization had before.

The successful candidate will work at the intersection of security engineering and product management. Youll need to be technical enough to earn the respect of senior engineers strategic enough to influence product roadmaps and pragmatic enough to balance security ideals with business realities. This role requires coordination with external partnersSystem Integrators who are helping stand up development infrastructure and MSSP providers who deliver security monitoring servicesrequiring strong vendor management skills alongside technical expertise.

Day-to-day youll lead threat modeling sessions review security architectures triage vulnerabilities guide remediation efforts implement security automation and work hands-on with development teams to embed security throughout the development process. Youll also be responsible for managing security assessments from customers responding to security questionnaires coordinating penetration tests and ensuring Velotics products meet compliance requirements for key certifications like SOC 2 and ISO 27001.

A key aspect of this role is building security in a developer-friendly way. Youll need to shift security left without slowing teams down automate security checks within CI/CD pipelines provide clear and actionable security guidance and celebrate security wins to build momentum. Youll establish metrics that demonstrate both security improvements and the business value of the product security program.

This role reports to the Chief Product Officer and collaborates closely with the CISO VP/Directors of Engineering Product Management leaders Infrastructure/Cloud teams and external security partners. Youll regularly present product security metrics risk assessments and program updates to executive leadership particularly around critical vulnerabilities security incidents and program maturity progress.

The ideal candidate for this role is someone who thrives at the intersection of security and engineering loves building programs from scratch and is energized by the challenge of bringing together different organizations with a shared security vision. You should be comfortable with ambiguity excellent at influencing without authority and passionate about making security an enabler of innovation rather than a blocker. If you want to leave a lasting mark by building a world-class product security program during a critical formative period this is the opportunity for you.

This position offers significant autonomy direct impact on product strategy close collaboration with executive leadership and private equity stakeholders and the satisfaction of building something meaningful from the ground up in a well-funded growth-oriented environment.

Qualifications :

Qualifications:

• Bachelors degree in Computer Science Cybersecurity Software Engineering or related technical field; Masters preferred
• 8 years of experience in application security product security or secure software development with at least 3 years in a leadership role
• Proven experience building or scaling product security programs in SaaS B2B software B2C software or product-focused technology companies
• Preferred experience leading product security through organizational transitions such as carve-outs mergers acquisitions or multi-entity integrations 
• Deep technical expertise in application security including secure coding practices security architecture threat modeling and vulnerability management
• Strong knowledge of common vulnerabilities and attack patterns (OWASP Top 10 SANS Top 25 etc.) and modern application security testing methodologies
• Experience with application security testing tools and methodologies including SAST DAST IAST SCA container security scanning and penetration testing
• Hands-on experience with modern development practices including CI/CD pipelines DevSecOps cloud-native architecture microservices APIs and infrastructure-as-code
• Strong understanding of cloud security across major platforms (AWS Azure GCP) and containerization technologies (Docker Kubernetes)
• Experience with security automation security tooling integration and shifting security left in the development process
• Knowledge of secure software development frameworks (NIST SSDF OWASP SAMM BSIMM ISO/IEC 27034) and ability to implement them in practical developer-friendly ways
• Maintains a deep understanding of the compliance requirements relevant to software products (SOC 2 ISO 27001 PCI DSS GDPR CCPA etc.)
• Proven ability to work effectively with engineering teams influence without direct authority and build security champions programs
• Strong communication skills with ability to translate technical security concepts for both technical and non-technical audiences
• Relevant certifications such as CSSLP CEH OSCP GWAPT AWS/Azure/GCP Security certifications or similar credentials preferred
• Experience harmonizing security tools processes and practices across a large development organization with different tech stacks and maturity levels
• Proven ability to balance prioritize and roadmap security initiatives with business velocity and developer capacity

Responsibilities:

Program strategy and operating model:

• Build and lead Velotics product security program from the ground up establishing security practices tools processes and culture across engineering teams
• Build and maintain a security champions program to embed security expertise within engineering teams and foster a culture of security ownership
• Develop and deliver security training tailored to developers covering secure coding practices common vulnerabilities and security tooling

Secure SDLC and engineering enablement:

• Develop and implement a unified secure SDLC framework that harmonizes security practices across both carved-out entities while respecting existing development workflows and gradually elevating security maturity
• Oversee the selection implementation and management of application security testing tools (SAST DAST SCA container scanning etc.) across multiple development environments and tech stacks
• Work with infrastructure and cloud teams to ensure secure deployment practices container security Kubernetes security and cloud security best practices
• Lead software supply chain security initiatives including open-source security management dependency scanning and software bill of materials (SBOM) generation

Security testing and vulnerability management:

• Coordinate product security initiatives across internal engineering teams System Integrators and MSSP providers to ensure consistent security controls and effective vulnerability management
• Establish and lead threat modeling practices for new features products and architectural changes working closely with engineering and product teams
• Manage vulnerability disclosure programs coordinate security issue triage and remediation and establish SLAs for vulnerability resolution based on risk
• Establish incident response procedures for product security vulnerabilities coordinating with engineering teams on remediation and customer communication
• Partner with product management to incorporate security requirements into product roadmaps and ensure security enhances rather than impedes product innovation

Governance compliance and customer assurance:

• Define and implement security requirements for all stages of the software development lifecycle from design through deployment and maintenance
• Ensure compliance for products with regulatory and certification requirements (SOC 2 ISO 27001 etc.)

Leadership and influencing:

• Lead security architecture reviews for new products features and infrastructure changes providing actionable guidance to engineering teams
• Lead security testing initiatives including penetration testing coordination bug bounty program management and red team exercises
• Establish metrics and KPIs to measure product security posture track vulnerability trends and demonstrate program effectiveness to leadership
• Manage third-party security assessments of Velotics products including customer security reviews vendor questionnaires and independent audits
• Serve as the primary product security liaison with SI partners implementing development infrastructure and MSSP providers delivering security monitoring services
• Build and manage the product security budget including tooling investments third-party testing services and team resources
• Stay current with emerging threats vulnerabilities and security technologies relevant to the product software industry

Additional Information :

All your information will be kept confidential according to EEO guidelines.

Remote Work :

No

Employment Type :

Full-time