Global Director of Product Security - Saas

Chronos Systems Inc.; España; A distancia; EUR 120.000 - 180.000; Jornada completa

Descripción de la vacante

Chronos Systems Inc. is seeking a security leader to establish and head a global team for product and infrastructure security. The role demands 7+ years in product and application security with hands-on design and deployment of controls across access, data protection, vulnerability management, and cloud security.

You will lead security programs, mentor engineers, and collaborate with executives to embed security across development and operations, pursuing SOC2, HIPAA, PCI, and ISO certifications.

Formación

• Minimum of 7 years in product and application security.
• Hands-on in deploying security controls across domains.
• Familiarity with ISO 27001, SOC 2, GDPR, CCPA.
• CISSP/OSCP/CEH certifications are a plus.

Responsabilidades

• Lead development and execution of a comprehensive product security strategy.
• Mentor security engineers and analysts; guide professional growth.
• Develop and maintain security programs across product and production environments.
• Define direction, objectives, and organizational structure for security teams.
• Oversee incident response, disaster recovery, monitoring, and governance.
• Lead security operations to protect against threats and respond to incidents.
• Grow and elevate product security programs to industry-leading levels.
• Collaborate with product, engineering, and operations for appropriate controls.
• Enforce security policies and procedures aligned with best practices.
• Partner with executives to ensure security is embedded in development.
• Stay informed of changes impacting information security and risk.
• Support SOC 2, HIPAA, PCI, NIST, ISO, and FedRAMP certifications; provide audit evidence.
• Lead post-mortem analyses for security breaches; drive root-cause fixes.
• Perform hands-on security assessments, code reviews, and pen tests as needed.

Conocimientos

Security leadership

Application security

Cloud security

Security governance

incident response

Educación

Bachelor's or Master's in Computer Science or Information Security

Herramientas

SIEM

Firewalls

IDS/IPS

Data Loss Prevention

Identity and access management

BCP / DR

Descripción del empleo

Our client, a leading Enterprise SaaS company, is looking for an exceptional security leader to establish and lead a global security team responsible for product and infrastructure security.

Experience

• Minimum of 7 years of experience in product security and application security.
• Hands-on experience designing and deploying security controls across all security domains, such as access management, data protection, vulnerability management, incident response and management, application security, network security, and preventive, detective, and offensive security solutions.
• Deep understanding of security principles, techniques, and technologies such as OWASP Top 10, SANS Top 25, encryption, identity and access management, network security, and cloud security.
• Familiarity with compliance frameworks and standards, such as ISO 27001, SOC 2, GDPR, and CCPA.
• An understanding of Application Security threats and countermeasures
• Practical knowledge of security technologies, especially those applying to SaaS Web applications and wider business solutions, including Firewalls, IDS/IPS, Identity and access management, SIEM, Data Loss Protection, BCP, and Cloud Security
• Bachelor's or Master's in Computer Science, Information Security, or a related field.
• Relevant security certifications (e.g., CISSP, OSCP, CEH) are a plus.

Role responsibilities

• Lead the company's development and implementation of a comprehensive product security strategy.
• As a hands-on leader, manage and mentor a team of security engineers and analysts, providing guidance and direction for their professional growth.
• Identify, develop, implement, and maintain security programs and processes across product development and production environments.
• Define strategic direction, set objectives, and structure and resource the organization and the work in a way that improves the team's impact and provides a paved path to a leadership position among SaaS providers, including application security, infrastructure security, and data security.
• Oversee critical cybersecurity areas, including incident response, disaster recovery, awareness, monitoring, remediation, information governance, and digital security.
• Lead all product security operations that protect against immediate threats and respond when something goes wrong.
• Grow the product security programs and capabilities to an industry-leading position, finding opportunities to improve our existing approach and helping to guide the team to unlock that potential.
• Build strong relationships within the product, engineering, and operations teams to implement the appropriate security controls to protect applications, infrastructure, and data.
• Develop and oversee the development and enforcement of security policies and procedures based on industry-standard best practices.
• Partner closely with executive leadership to ensure that all applications and platforms are developed with security in mind and that appropriate security controls have been implemented while driving continuous investment into cybersecurity.
• Work closely with internal stakeholders and business units to keep abreast of planned changes to technologies, working practices, and business activities that could impact the organization’s Information Security or risk profile.
• Support continued compliance with SOC2, HIPAA and other currently required standards and act as Product and Engineering technical lead within product security to expand certifications to include PCI, NIST800-171, ISO27001/277001, and FedRAMP. Ensure operation of related controls. Coordinate the provision of required evidence for audit.
• Lead incident response activities and post-mortem analysis for any security breaches or incidents, liaising with the Legal, Security, and Privacy teams on data protection, ensuring root causes of such breaches are understood and addressed.
• Conduct hands-on security assessments, code reviews, and penetration testing to identify product vulnerabilities and security gaps as needed.