Technical Manager – Product Security, Vulnerability Management & Software Assurance

Lumentum; Ottawa; On-site; CAD 120,000 - 150,000; Full time

Job summary

Lumentum Canada is seeking a Technical Manager to lead a team focused on software security, vulnerability management, secure manufacturing processes, and cloud-based security applications. You will oversee vulnerability identification, remediation, and reporting across embedded and network products, and drive secure cloud app development with customer-facing APIs.

The role collaborates with software engineering, product security, cloud engineering, manufacturing, and customer-facing teams to

Qualifications

• Bachelor’s degree in Computer Science, Engineering, Cybersecurity, or a related field.
• Experience leading software security, product security, vulnerability management, application security, or cloud security teams.
• Strong understanding of vulnerability management, CVE analysis.

Responsibilities

• Lead, mentor, and develop a team responsible for software security, vulnerability management, and cloud security applications.
• Establish processes for identifying, analyzing, prioritizing, remediating, and tracking software vulnerabilities.
• Oversee SBOM and VEX report creation, validation, and distribution.
• Define vulnerability triage criteria using severity, exploitability, product exposure, reachability, and customer impact.
• Coordinate vulnerability remediation with development and release teams; promote secure software development practices.

Skills

Software security

Product security

Vulnerability management

Application security

Cloud security

Education

Bachelor’s degree in CS/Engineering/Cybersecurity or related field

Tools

Black Duck

Job description

It's fun to work in a company where people truly BELIEVE in what they're doing!

We're committed to bringing passion and customer focus to the business.

If you like wild growth and working with happy, enthusiastic over-achievers, you'll enjoy your career with us!

Lumentum Canada was awarded the 2022 National Capital Region's Top Employers for the 6th consecutive year and the 2022 Career Directory Canada's Best Employers for Recent Graduates for the 5th consecutive year.

About Lumentum

At Lumentum, we're building the tech behind the world's fastest networks and most advanced systems. Our optical and photonic solutions power everything from AI and cloud computing to data centers, telecom, and advanced manufacturing.

We're a global team of innovators working where light meets technology, solving big challenges that keep the world connected and moving forward. If shaping the future of connectivity excites you, you'll fit right in.

Why You'll Love This Role

We are seeking a Technical Manager to lead a team responsible for product vulnerability management, software assurance, secure manufacturing processes, and cloud-based security applications. This role will oversee the identification, assessment, remediation, and reporting of software vulnerabilities across embedded and network products.

The manager will also lead the development of a secure cloud application and supporting APIs for exchanging device information with customers. This may include certificates, device identity, software versions, security status, SBOMs, vulnerability data, VEX reports, attestation results, and lifecycle information.

The role will work closely with software engineering, product security, cloud engineering, manufacturing, and customer-facing teams.

What You'll Be Doing

• Lead, mentor, and develop a team responsible for software security, vulnerability management, and cloud security applications.
• Establish processes for identifying, analyzing, prioritizing, remediating, and tracking software vulnerabilities.
• Manage Black Duck and related Software Composition Analysis tools, including project configuration, scanning, policy review, reporting, and issue resolution.
• Oversee the creation, validation, and distribution of SBOM and VEX reports.
• Define vulnerability triage criteria using severity, exploitability, product exposure, reachability, and customer impact.
• Lead the use of AI-assisted code scanning and security analysis while ensuring findings are validated by qualified engineers.
• Develop secure software-signing processes, including key management, signing workflows, access control, auditability, and protection against unauthorized signing.
• Secure and review software manufacturing procedures, including build integrity, artifact provenance, release controls, and production access.
• Manage the development of a secure cloud application for exchanging device and product-security information with customers.
• Establish mechanisms for securely ingesting and sharing device information, including device identity, software versions, SBOMs, vulnerabilities, VEX status, attestation results, and security events.
• Coordinate vulnerability remediation with development and release teams.Promote secure software development practices, threat modeling, code review, and security testing.

Education

What We’re Looking For

Bachelor’s degree in Computer Science, Engineering, Cybersecurity, or a related field.

Experience

• Experience leading software security, product security, vulnerability management, application security, or cloud security teams.
• Strong understanding of vulnerability management, CVE analysis