Head of Product Security (m/w/d)

DE40 L+F Apothekenservice GmbH; Koblenz; Hybrid; EUR 90,000 - 130,000; Full time

Benefits offered by this job

Mobile work

On-site work three days a week

In-house academy

Health & fitness center

Kindergarten on campus

Company pension

Job bike

Corporate benefits

Job summary

CGM, a leading health IT company, is seeking a seasoned product security leader to define and own the security strategy across a global software portfolio. You will lead the secure development lifecycle, drive governance and tooling, and collaborate with FIRE teams.

Fluent in German and English with deep knowledge of EU cyber resilience acts and data protection, you will mentor Security Champions and build a Security Guild, while enabling secure AI-enabled development.

Qualifications

• Several years of experience in product security or application security within a multi-product software organisation.
• Expertise in EU Cyber Resilience Act, with knowledge of NIS2 and GDPR.
• Hands-on experience with SAST, DAST, SCA, and SonarQube tooling.
• Experience with SBOM generation and governance, and managing supply chain risk.
• Strong communication and stakeholder management; CISSP or equivalent is advantageous.

Responsibilities

• Define and own the product security strategy for a global portfolio.
• Establish policy framework for secure development and release criteria.
• Drive CRA readiness across the portfolio and SBOM evidence processes.
• Set security tooling baselines and quality gates in the delivery pipeline.
• Shape governance for AI-driven security remediation and guardrails.
• Build Security Guild and foster security practices through training.

Skills

Product security

Application security

CISO experience

Security tooling

SBOM governance

Security governance

Communication skills

Education

CISSP or equivalent certification

Tools

SAST

DAST

SCA

SonarQube

SBOM tooling

Job description

As the leading company in the field of software solutions for healthcare, we operate in 19 countries and employ over 9,000 dedicated staff members. You will work in a dynamic and innovative environment full of opportunities. With your commitment and passion, you have the chance to make a sustainable difference. CGM Leverages AI: We’re looking for people who feel the power of AI in the e-health environment, who want to help shape change, and who are driven by a curious passion to see how technology can make healthcare smarter, simpler, and better. Together, we are shaping the healthcare system of the future. Become part of our mission and make a difference – for a world where knowledge saves lives! Are you passionate about groundbreaking products? Do you have the talent to turn ideas into real, valuable solutions—while always keeping the bigger picture in mind? Then we’d love to meet you!

Your Responsibilities:

• You define and own the product security strategy for our global portfolio and establish the policy framework for secure development, security baselines, and release criteria.
• You drive CRA readiness across the entire portfolio – from product classification to conformity assessment, and the build-out of SBOM and evidence processes.
• You set the mandatory security tooling baseline (SAST, DAST, SCA, secrets scanning) and define security quality gates within the delivery pipeline.
• You shape the governance for our AI-driven security remediation (agentic OpenCode pipeline) – including guardrails, approval criteria, and quality assurance.
• You build the Security Guild and a network of Security Champions embedded in the FIRE teams, and foster lived security practice through training and coaching

Your Profile:

• Several years of experience in product security, application security, or as a deputy CISO within a complex, multi-product software organisation.
• Demonstrable, current expertise in the EU Cyber Resilience Act – requirements, classification logic, and conformity assessment – along with working knowledge of NIS2 and GDPR.
• Strong, practical knowledge of the secure development lifecycle, threat modelling, and application security testing, together with hands‑on experience with SAST, DAST, SCA, and SonarQube tooling.
• Experience with SBOM generation and governance, as well as with managing supply chain risk; understanding of AI‑assisted and agentic development workflows.
• Strong communication and stakeholder management skillsto enforce standards without direct line authority; CISSP or an equivalent certification is an advantage.
• Fluent in German and English, with excellent written and verbal communication skills.

What you can expect from us:

• Mobile work: Work flexibly on the move two days a week and on site three days a week.
• Attractive locations: In addition to fully equipped workplaces, regular events such as summer parties and Christmas parties await you at our locations.
• Development: Our in‑house academy and our portfolio of external cooperation partners will support you in your further development.
• Health: Health is a valuable asset for us. Our in‑house canteen offers a selection of tasty and healthy dishes every day, and we welcome you to our fully equipped fitness center for weekly courses (online & offline).
• More is always possible: The kindergarten on our CGM campus in Koblenz helps our employees to organize their working day even more flexibly.
• We also offer corporate benefits, the option of a job bike, a company pension scheme, and much more.

Diversity is part of CGM!

We look forward to receiving your application regardless of disability, gender, nationality, ethnic and social background, religion, age, sexual orientation, and identity.

We create the future of e-health. CGM is one of the leading e-health companies in the world with more than 8.700 highly qualified employees. Sustainable solutions for constantly growing demands in healthcare Locations in 19 countries and products in 60 countries worldwide.