Senior Lead Product Security Engineer
ASSA ABLOY8 days ago
Chennai, IndiaStaff+
Responsibilities
- Run vulnerability intake, triage, prioritization, remediation tracking, escalation, and closure across assigned product areas.
- Coordinate vulnerability response with Information Security, Development, Product Security, Legal, Privacy, and Compliance teams.
- Assess and coordinate remediation for vulnerabilities identified through SAST, SCA, secret scanning, penetration testing, security assessments, and external researchers.
- Track remediation commitments, validate progress, monitor SLA compliance, and escalate overdue or at-risk vulnerabilities.
- Lead emergency response calls for urgent and critical vulnerabilities, coordinating containment, remediation, validation, communication, and closure.
- Manage coordinated vulnerability disclosure activities, including researcher communications, validation coordination, and disclosure timelines.
- Maintain vulnerability-management playbooks, procedures, exception workflows, risk-acceptance records, and audit evidence.
- Support SBOM-driven responses involving third-party and open-source component vulnerabilities.
- Develop guidance and training to help product teams execute vulnerability-management responsibilities independently.
- Produce risk, remediation, disclosure, and program-improvement reporting for operational and executive audiences.
Requirements
- 10–12 years of experience in product security, application security, PSIRT, vulnerability management, or a related security discipline.
- Demonstrated experience managing the end-to-end vulnerability lifecycle in a software or connected-product environment.
- Experience with SAST, SCA, secret scanning, penetration testing, and secure handling of credentials and secrets in development and CI/CD environments.
- Experience coordinating or participating in penetration testing, reviewing findings, validating impact, and driving remediation.
- Strong understanding of vulnerability severity, CVSS, remediation prioritization, common application-security vulnerabilities, and secure software development practices.
- Experience coordinating responses to urgent or critical security vulnerabilities under tight timelines.
- Experience with coordinated vulnerability disclosure or PSIRT operations.
- Ability to work effectively with distributed engineering teams and influence action without direct authority.
- Strong written and verbal communication skills, including communicating technical risk to non-technical stakeholders.
- Preferred qualifications include familiarity with SBOMs, software supply-chain vulnerabilities, open-source component governance, and large multi-product or regulated environments.
- Relevant certifications such as CISSP, CSSLP, GIAC, or comparable credentials are preferred.
Benefits
- Hybrid location in Chennai, India.
- Flexible work environment and potential flexible working arrangements, including job sharing or part-time work.
- Global-team collaboration with learning, training, development, and career-growth opportunities.
- Equal Opportunity/Affirmative Action employer with a focus on diverse and inclusive teams.
Categories
About ASSA ABLOY
ASSA ABLOY builds physical and digital access solutions, including locks, door closers and automatics, access control systems, mobile keys, and secure identity products. It sells hardware, software, and services to commercial, institutional, and residential customers through distributors, integrators, and OEM partners. Founded in 1994 and headquartered in Stockholm, the public company (Nasdaq Stockholm) operates in 70+ countries and owns brands such as Yale and HID Global.