Lead Product Security Engineer
ASSA ABLOY24 hours ago
Chennai, IndiaSenior / Staff+
Responsibilities
- Review and triage vulnerabilities identified through security scanning tools, penetration tests, external reports, and internal security assessments.
- Coordinate with Information Security, Development, DevOps, and Product Security teams to validate findings, assign ownership, and drive remediation.
- Track vulnerabilities from intake through closure, including status, due dates, validation evidence, and exceptions.
- Prioritize vulnerabilities using CVSS and risk factors such as criticality, exposure, data sensitivity, exploitability, and customer impact.
- Escalate overdue, blocked, urgent, and critical vulnerabilities and participate in emergency response calls.
- Support coordinated vulnerability disclosure, penetration-test finding remediation, and SBOM-related vulnerability monitoring.
- Maintain vulnerability records, ticketing and reporting systems, metrics, dashboards, playbooks, procedures, knowledge articles, and training materials.
- Identify recurring issues, process gaps, and tooling problems and recommend improvements.
Requirements
- 8–10 years of experience in application security, product security, vulnerability management, security engineering, or a related discipline.
- Practical experience with vulnerability triage, remediation tracking, and closure validation.
- Working knowledge of common application-security vulnerabilities and OWASP principles.
- Familiarity with SAST, DAST, SCA, container scanning, and infrastructure vulnerability scanners.
- Hands-on experience reviewing SAST, SCA, secret-scanning, secret-management, and penetration-test findings.
- Understanding of CVSS and risk-based vulnerability prioritization.
- Experience working with development or DevOps teams in an Agile software-development environment.
- Strong attention to detail, organization, follow-through, and written communication skills.
- Preferred qualifications include PSIRT or coordinated vulnerability disclosure exposure, SBOM and software supply-chain security familiarity, basic Python, SQL, or PowerShell skills, and experience in regulated, enterprise, cloud, IoT, or connected-product environments.
- Security+, CEH, GIAC, or comparable certifications are preferred.
Benefits
- Hybrid work arrangement in Chennai, India, with potential flexible working arrangements, job sharing, or part-time options.
- Global team environment with opportunities for learning, training, development, regular feedback, and career growth.
- Inclusive equal-opportunity workplace supporting diverse teams and perspectives.
About ASSA ABLOY
ASSA ABLOY builds physical and digital access solutions, including locks, door closers and automatics, access control systems, mobile keys, and secure identity products. It sells hardware, software, and services to commercial, institutional, and residential customers through distributors, integrators, and OEM partners. Founded in 1994 and headquartered in Stockholm, the public company (Nasdaq Stockholm) operates in 70+ countries and owns brands such as Yale and HID Global.