Lead Product Security

About Black Duck and Role Overview

Black Duck Software, Inc. specializes in assisting organizations to develop secure and high-quality software, reducing risks while boosting development speed and efficiency. As an innovator in application security, Black Duck provides solutions including SAST, SCA, and DAST to help teams rapidly identify and address vulnerabilities in proprietary code, open source components, and software behavior. Their blend of leading tools, services, and expertise enables organizations to enhance security and quality throughout the software development lifecycle and DevSecOps processes.

The Lead Product Security position is a senior technical role accountable for integrating security into Black Duck's products. Working with considerable autonomy under general supervision, this position leads secure architectural and design reviews, advances threat modeling practices, defines security standards and design checkpoints to embed secure-by-default principles in engineering workflows. A major responsibility involves scaling security capabilities by evolving the Security Champions program and mentoring engineering and security personnel. Additionally, the role encompasses conducting deep secure code reviews in critical areas, managing external security evaluations, collaborating with PSIRT on vulnerability handling, and assessing product security maturity to guide strategic enhancements.

Key Responsibilities

• Lead architectural and design security reviews across Black Duck's SCA, Coverity, and related products, providing actionable recommendations prior to implementation.
• Enhance and promote threat modeling processes by coaching engineers to independently perform and evaluate threat models.
• Establish security requirements, design gates, and baselines defining secure-by-default engineering practices.
• Develop and monitor the secure development lifecycle encompassing SCA, SAST, secret scanning, dependency management, and build pipeline security.
• Conduct detailed secure code reviews on high-risk components such as authentication, authorization, cryptography, secrets management, and input validation.
• Secure product supply chains and release mechanisms including SBOM generation and ensuring the integrity of build and distribution artifacts.
• Advance the Security Champions program by recruiting participants across teams, expanding training initiatives, hosting office hours, and tracking engagement and outcomes.
• Mentor engineers and junior security staff in secure design, code review, and threat modeling to build organizational security capability.
• Coordinate penetration testing and third-party security assessments, managing remediation efforts in collaboration with engineering.
• Collaborate with PSIRT to triage and remediate product vulnerabilities, incorporating root cause analysis into design and process controls.
• Evaluate product security maturity via BSIMM or SAMM frameworks and develop prioritized roadmaps for improvement.
• Support compliance with EU Cyber Resilience Act requirements for secure-by-design and vulnerability management by providing technical evidence and process updates.
• Serve as a technical expert responding to customer security questionnaires, audits, and escalations, compiling accurate answers, gathering evidence, and maintaining a knowledge base.
• Assist incident response related to product code, build systems, or infrastructure by contributing product-specific insights and remediation guidance.
• Lead focused workstreams within broader product security projects, track progress in Jira, and provide expertise in application security tooling evaluations and proofs of concept.

Qualifications and Skills

• Understanding of AI and Large Language Model security threats including prompt injection, sensitive data risks, and OWASP Top 10 for LLM applications.
• Bachelor’s degree in Computer Science, Information Security, IT, or equivalent hands-on experience.
• Over 8 years in product, application, or software security engineering with deep expertise in secure design reviews, threat modeling, and secure code analysis.
• Proven success establishing or managing security champions or developer enablement programs to scale security knowledge in engineering teams.
• Familiarity with application security tools such as SCA, SAST, DAST, and secret scanning, including their detection capabilities and common false positive scenarios.
• Practical secure coding and review experience in at least one commercial software language, with the capacity to analyze unfamiliar code for security implications.
• Experience defining and implementing security requirements, standards, and design gates successfully adopted by engineering.
• Knowledge of at least one major cloud provider (AWS, Azure, or GCP) from a product security standpoint, including container and infrastructure-as-code security.
• Experience managing penetration tests or third-party security assessments, ensuring findings are addressed thoroughly.
• Strong mentoring skills and ability to lead technical initiatives without direct reporting lines.
• Competence in using AI and LLM tools to assist security activities such as code review, investigations, and documentation, with careful judgment regarding AI output validation.
• Excellent written and oral communication skills, capable of explaining complex security topics to technical and non-technical audiences.
• Experience contributing to Product Security Incident Response Teams and vulnerability management, including CVSS scoring and coordinated disclosure, is advantageous.
• Familiarity with product security maturity models (BSIMM, SAMM) or secure-by-design regulations like the EU Cyber Resilience Act is a plus.
• Certifications such as CSSLP, CISSP, GWAPT, OSWE, or cloud security credentials are beneficial.
• Experience supporting responses to customer security questionnaires, RFPs, or third-party risk assessments is a desirable asset.

Additional Information

This role operates in a typical office environment requiring extensive computer use, frequent phone communication, and occasional lifting of items up to 20 pounds. Some travel may be required.

Salary Range: 117000 to 150000 CAD annually

Black Duck is an equal opportunity employer committed to providing workplace inclusivity and accommodations in compliance with all applicable laws.