SDLC Security and Compliance Lead

Role overview

This lead defines and maintains the processes and evidence needed to demonstrate that software development meets security standards and regulatory obligations. The role serves as a working subject matter expert for industrial cybersecurity certification, coordinates audit and certification readiness, and owns engineering’s contribution to vulnerability disclosure and incident management. Its focus is process, documentation, training, and compliance assurance rather than implementing technical controls.

Responsibilities - Lead alignment between IEC 62443-4-1 requirements and engineering practices, identify gaps, and support corrective actions when development or quality processes drift. - Maintain software engineering process documents and map committed standards to quality management documentation. - Track emerging security obligations, including product requirements associated with the EU Cyber Resilience Act, and support additional external compliance needs. - Represent software engineering in audits and conformity assessments; prepare and maintain evidence such as tickets, code reviews, and QA records. - Maintain traceability from code changes through reviews, tests, requirements, and customer tickets; verify release checklist evidence for production releases and hotfixes. - Coordinate third-party penetration testing and ensure results enter the development tracking process. - Own engineering’s coordinated vulnerability disclosure and incident management processes, including playbooks, role qualifications, training, disclosure coordination, and lessons learned. - Run readiness checks, identify training gaps, coordinate training, and consult on threat modeling.

Requirements - Technical bachelor’s degree in computer science, engineering, software development, cybersecurity, or a related field, plus a relevant master’s degree or equivalent demonstrated experience. - At least eight years of relevant experience; 15 or more years is preferred. - Cybersecurity certification or equivalent experience, such as CISSP, GICSP, or ISA/IEC 62443 Cybersecurity Expert. - Extensive experience with security or compliance audits and policy and process documentation; lead auditor or equivalent experience is required. - Experience with software development processes, such as design, testing, assurance, or management; agile experience is preferred. - Background delivering software in a controlled or regulated environment, and experience with incident management or coordinated vulnerability disclosure. - Ability to communicate with and present to executive leadership.

Nice to have

Experience achieving IEC 62443-4-1 or 62443-4-2 certification, working with the EU Cyber Resilience Act, or participating in threat modeling is preferred.

Benefits and work setup

Full-time, with hybrid and remote options available. Listed benefits include employer-covered medical, dental, and vision insurance, paid holidays and leave, and a 401(k) match. Employment is limited to people located in the United States who do not require visa sponsorship.