Lead Product Security Engineer

Assa Abloy Entrance Systems; Chennai; Hybrid; INR 1,600,000 - 2,200,000; Full time

Job summary

Assa Abloy Entrance Systems in Chennai (Hybrid) is seeking a Lead Product Security Engineer to support the enterprise vulnerability-management program. You will work with development, information security, and product security teams to identify, triage, track, and remediate product vulnerabilities in line with processes, risk frameworks, and SLAs.

The role reports to the Senior Product Vulnerability Manager and requires hands-on experience with SAST, SCA, secret scanning, and vulnerability

Qualifications

• Minimum 8–10 years in security roles (application/product security or vulnerability management).
• Experience with vulnerability-management processes: triage, remediation tracking, closure validation.

Responsibilities

• Review and triage vulnerabilities from scans and tests.
• Coordinate remediation with development, security, DevOps, and product teams.
• Track vulnerabilities from intake to closure with due dates and evidence.
• Apply CVSS, criticality, exposure, data sensitivity, and customer impact prioritization.
• Escalate overdue or critical items to stakeholders.
• Participate in emergency response calls and document actions and owners.
• Integrate SAST, SCA, and secret scanning into CI/CD pipelines.
• Review findings from SAST/SCA and pentests; support remediation.
• Assist with coordinated vulnerability disclosure activities.
• Maintain vulnerability records and reporting dashboards.

Skills

PSIRT exposure

SBOM familiarity

Scripting (Python/SQL/PowerShell)

Regulated environment experience

Security certifications

Job description

Lead Product Security Engineer

Location: Chennai, India (Hybrid)

Job Summary

Profile Summary

The Product Vulnerability Management Engineer supports the execution of the enterprise product vulnerability management program. Reporting to the Senior Product Vulnerability Manager, this role works with development, Information Security, and product security teams to identify, triage, track, and remediate product vulnerabilities in line with established processes, risk frameworks, and service-level expectations.

Responsibilities

• Review and triage vulnerabilities identified through security scanning tools, penetration tests, external reports, and internal security assessments.


• Work with Information Security, Development, DevOps, and Product Security teams to validate findings, determine ownership, and coordinate remediation.


• Track vulnerabilities from intake through closure, including remediation status, due dates, validation evidence, and exceptions.


• Apply established vulnerability‑severity and prioritization frameworks, considering CVSS, application criticality, exposure, data sensitivity, exploitability, and customer impact.


• Follow up with development teams on remediation progress and **escalate** overdue, blocked, urgent, or critical items to the appropriate stakeholders.


• Participate in emergency response calls for urgent and critical vulnerabilities; document actions, owners, deadlines, and closure evidence.


• Familiarity with application‑security tooling and workflows, including integration of SAST, SCA, and secret scanning into CI/CD pipelines.


• Hands‑on experience reviewing and triaging findings from SAST, SCA, secret scanning/secret‑management tools, and penetration tests.


• Understanding of dependency vulnerabilities, exposed secrets, common application vulnerabilities, and remediation best practices.


• Experience supporting penetration‑test finding validation, tracking, and remediation with development teams.


• Assist with coordinated vulnerability disclosure activities, including intake tracking, communications support, vulnerability validation, and documentation.


• Maintain accurate records in vulnerability‑management, ticketing, and reporting systems.


• Support vulnerability metrics and dashboards, including SLA compliance, backlog, remediation aging, and finding trends.


• Help maintain playbooks, standard operating procedures, knowledge articles, and training materials.


• Support SBOM‑related vulnerability monitoring and response for third‑party and open‑source components.


• Identify recurring issues, process gaps, or tooling problems and recommend improvements to the team.

Preferred Qualifications

• Exposure to PSIRT or coordinated vulnerability disclosure processes.


• Familiarity with SBOMs, open‑source dependency risks, and software supply‑chain security.


• Basic scripting or data‑analysis skills using Python, SQL, PowerShell, or similar tools.


• Experience in a regulated, enterprise, cloud, IoT, or connected‑product environment.


• Certifications such as Security+, CEH, GIAC, or comparable credentials.

Education And/Or Qualification

• 8-10 years of experience in application security, product security, vulnerability management, security engineering, or a related discipline.


• Practical experience with vulnerability‑management processes, including triage, remediation tracking, and closure validation.


• Working knowledge of common application‑security vulnerabilities and OWASP principles.

Disclaimer: This job posting has been aggregated from external source. Role details, content, and availability are subject to change. Applicants are advised to confirm the latest information directly on the company website before applying.