Senior Lead Product Security Engineer
Technology, Data & Digital · IT Infrastructure & Security · Cybersecurity · Software Engineering
In short
HID Global is seeking a Senior Lead Product Security Engineer for their Chennai, India office. This hybrid role involves managing the product vulnerability lifecycle, from triage to disclosure, and collaborating with various teams to ensure security standards are met across a diverse product portfolio.
Responsibilities
- Run vulnerability intake, triage, prioritization, remediation tracking, escalation, and closure processes across assigned product areas.
- Collaborate closely with Information Security, Development, Product Security, Legal, Privacy, and Compliance teams to coordinate vulnerability response activities.
- Assess, triage, prioritize, and coordinate remediation of vulnerabilities identified through SAST, SCA, secret scanning, penetration testing, security assessments, and external researchers.
- Track remediation commitments, validate progress with development teams, monitor SLA compliance, and escalate overdue or at-risk vulnerabilities.
- Lead emergency response or “fire-fighting” calls for urgent and critical vulnerabilities, bringing together the required stakeholders to define containment, remediation, validation, communication, and closure actions.
- Manage coordinated vulnerability disclosure activities, including external intake, researcher communications, vulnerability validation coordination, and disclosure timelines.
- Maintain vulnerability-management playbooks, operating procedures, exception workflows, risk-acceptance records, and evidence required for audits or customer inquiries.
- Support SBOM-driven response activities for third-party and open-source component vulnerabilities.
- Develop practical guidance and training that enable product teams to independently execute their vulnerability-management responsibilities.
- Produce clear operational and executive reporting on risk posture, remediation performance, disclosure activity, and program improvements.
- Identify gaps in adoption or process effectiveness and recommend scalable improvements.
Requirements
- 10–12 years of experience in product security, application security, PSIRT, vulnerability management, or a related security discipline.
- Demonstrated experience managing the end-to-end vulnerability lifecycle in a software or connected-product environment.
- Experience with application security capabilities and vulnerability sources, including SAST, SCA, secret scanning, penetration testing, and secure handling of credentials and secrets in development and CI/CD environments.
- Experience coordinating or participating in penetration testing, including reviewing findings, validating impact, and driving remediation.
- Strong understanding of vulnerability severity, CVSS, remediation prioritization, common application-security vulnerabilities, and secure software development practices.
- Experience coordinating response for urgent or critical security vulnerabilities under tight timelines.
- Experience with coordinated vulnerability disclosure or PSIRT operations.
- Ability to work effectively with distributed engineering teams and influence action without direct authority.
- Strong written and verbal communication skills, including the ability to communicate technical risk clearly to non-technical stakeholders.
Desired Qualifications
- Familiarity with SBOMs, software supply-chain vulnerabilities, and open-source component governance.
- Experience in a large, multi-product or regulated environment.
- Relevant certifications such as CISSP, CSSLP, GIAC, or comparable credentials.
Benefits
- You’ll work as part of a global team in a flexible work environment, learning and enhancing your expertise.
- We welcome an opportunity to meet you and learn about your unique talents, skills, and experiences.
- If you have most of the skills and experience, we want you to apply.
- You embrace challenges and want to drive change.
- We are open to ideas, including flexible work arrangements, job sharing or part-time job seekers.
- You are results-orientated, reliable, and straightforward and value being treated accordingly.
- We want all our employees to be themselves to feel appreciated and accepted.
- This opportunity may be open to flexible working arrangements.
- Part of the ASSA ABLOY Group.
- 63,000 colleagues in over 70 different countries.
- Empowerment to build career around aspirations and ambitions.
- Support with regular feedback, training, and development opportunities.
- Encouragement to grow role locally, regionally, or internationally.
- Diverse, inclusive teams.
- Value different perspectives and experiences.
Skills
SASTSCApenetration testingCI/CDCVSS
#Product Security#Vulnerability Management#Cloud Engineer#Security#IT
About ASSA ABLOY Group
Let’s create a safer and more open world – together! ASSA ABLOY is the global leader in access solutions with sales of SEK 121 billion and 52,000 employees. The Group has operations in over 70 countries and sales worldwide. ASSA ABLOY’s innovations enable safe, secure and convenient access to physical and digital places. Every day, we help billions of people experience a more open world. We have a feeling of discovery and urge to innovate by working together and telling it like it is, enabling us to be always growing, never boring and leading right. Do you want to be encouraged to act, have…
Company
ASSA ABLOY GroupJob Posted
5 days ago
Expires
in 1 month
Employment Type
Full Time
Work mode
Hybrid
Experience Level
Associate
Locations
Chennai, India
Applicants
Be an early applicant