Vice President, Product Security

Qualifications

Leadership & Executive Management

• 12+ years of progressive experience in cybersecurity, application security, product security, cloud security, or security architecture, including 7+ years in senior leadership roles managing globally distributed security, engineering, and architecture teams.

• Proven experience building, scaling, and leading high-performing Product Security organizations supporting large-scale SaaS, cloud-native, and enterprise software platforms.

• Demonstrated success leading directors, senior managers, architects, and security engineering teams across multiple geographies and product portfolios.

• Experience owning multi-million-dollar security budgets, strategic planning processes, headcount forecasting, vendor relationships, and security program execution.

• Strong executive presence with the ability to communicate technical risk, business impact, and security strategy to Boards of Directors, Executive Leadership Teams, auditors, regulators, and customer executives.

• Proven ability to influence security and product roadmaps across Engineering, Product Management, Cloud Operations, Legal, Compliance, Customer Success, Sales Engineering, and Corporate Security organizations.

• Experience participating in M&A due diligence, product security assessments, and post-acquisition security integration activities is highly desirable.

Product Security & Secure Engineering

• Deep expertise in product security, application security, cloud security, DevSecOps, software supply chain security, and secure software development lifecycle (SSDLC) practices.

• Demonstrated experience implementing and scaling:

• Security-by-design principles

• Threat modeling frameworks

• Secure coding standards

• Vulnerability management programs

• Red teaming exercises

• Bug bounty and responsible disclosure programs

• Software supply chain security controls

• SBOM management

• Secure CI/CD pipelines

• Container and Kubernetes security

• Extensive knowledge of modern authentication and identity architectures including:

• Zero Trust

• OAuth2

• OpenID Connect

• SAML

• PKI

• Hardware-backed cryptography

• Secrets management

• PAM solutions

• Deep understanding of modern security frameworks including:

• NIST Cybersecurity Framework

• NIST SP 800-53

• NIST SP 800-171

• NIST SP 800-218 (SSDF)

• CIS Controls

• OWASP Top 10

• OWASP ASVS

• SOC 2

• ISO 27001

Federal Compliance & Government Security Experience

FedRAMP

• 10+ years of experience supporting U.S. federal cybersecurity programs and regulatory frameworks.

• Proven experience leading, achieving, and sustaining multiple FedRAMP Moderate and FedRAMP High Authorizations to Operate (ATO) for cloud-native SaaS products.

• Extensive experience working directly with:

• Federal Agencies

• Joint Authorization Board (JAB) stakeholders

• Third Party Assessment Organizations (3PAOs)

• Authorizing Officials

• Government security assessors

• Deep knowledge of:

• NIST SP 800-53 Rev. 5

• FedRAMP Continuous Monitoring

• POA&M management

• Significant Change Requests

• Annual Assessments

• Vulnerability remediation requirements

• Configuration management controls

• Demonstrated ownership of security strategy and product architecture supporting regulated government cloud environments.

CMMC & DoD Cloud Requirements

• Hands-on experience implementing and managing environments aligned to:

• CMMC Level 2 requirements

• NIST SP 800-171

• DFARS 252.204-7012

• DFARS 252.204-7019

• DFARS 252.204-7020

• DFARS 252.204-7021

• Experience designing and securing solutions deployed within Department of Defense environments requiring Impact Level (IL) authorization.

• Demonstrated knowledge and practical experience supporting:

• DoD Impact Level 4 (IL4)

• DoD Impact Level 5 (IL5)

• DoD Impact Level 6 (IL6)

• Experience working with government customers handling Controlled Unclassified Information (CUI), National Security Systems (NSS), and classified or highly regulated workloads.

• Familiarity with DISA STIGs, SRGs, DoD Cloud Computing Security Requirements Guide (CC SRG), and associated authorization processes.

NIAP & Common Criteria

• Experience leading or supporting NIAP Common Criteria certification efforts for enterprise software, networking products, endpoint security solutions, or cybersecurity technologies.

• Strong understanding of:

• Common Criteria Evaluation and Validation Scheme (CCEVS)

• Protection Profiles

• Security Targets

• Evaluation Assurance Levels (EAL)

• NIAP product certification lifecycle

• Experience working with accredited testing laboratories and certification authorities to achieve and maintain product certifications.

Multi-Cloud Security & Hyperscaler Expertise

• 15+ years of experience designing and securing cloud-native SaaS platforms operating at enterprise scale.

• Demonstrated architecture and operational expertise across multiple hyperscale cloud service providers including:

Amazon Web Services (AWS)

• Experience securing AWS environments leveraging:

• Organizations

• IAM

• KMS

• CloudTrail

• GuardDuty

• Security Hub

• Control Tower

• ECS/EKS

• Native compliance controls

Microsoft Azure

• Experience securing Azure environments utilizing:

• Entra ID

• Azure Policy

• Defender for Cloud

• Key Vault

• Azure Monitor

• Microsoft Sentinel

• AKS

• Landing Zone architectures

Google Cloud Platform (GCP)

• Experience designing secure GCP architectures leveraging:

• Cloud IAM

• Security Command Center

• Cloud KMS

• Anthos

• Chronicle

• Organization Policies

• GKE security controls

Oracle Cloud Infrastructure (OCI)

• Experience securing OCI environments including:

• OCI IAM

• OCI Vault

• Cloud Guard

• Security Zones

• OCI Logging

• OCI Container Engine for Kubernetes (OKE)

• Experience developing governance models and security architectures across multi-cloud and hybrid-cloud environments.

• Demonstrated track record implementing consistent security controls, monitoring, identity governance, and compliance frameworks across AWS, Azure, GCP, and OCI.

Preferred Qualifications

• CISSP, CCSP, GIAC, SABSA, or equivalent advanced security certifications.

• Prior experience serving as:

• VP Product Security

• Head of Product Security

• Chief Product Security Officer

• Distinguished Security Architect

• Senior Security Executive within a cybersecurity or cloud technology company.

• Experience working in publicly traded technology organizations and interacting with Audit Committees and Board-level Cybersecurity Committees.