Product Security Program Lead

Haumaru Whānau; Auckland; On-site; NZD 140,000 - 190,000; Full time

Job summary

Haumaru Technologies Limited in Auckland seeks a Senior Security Program Owner (Product Security) to lead planning, prioritization, and delivery of security across the product ecosystem, including Tāne and enterprise solutions. You will own the security program lifecycle, embed requirements into Agile delivery, and translate standards into actionable tasks.

You will bridge security, engineering, and business, driving execution through Scrum, DevSecOps, and governance, while ensuring compliance

Qualifications

• 8+ years of experience in product security or security program management.
• Proven experience in program ownership, delivery management, or product ownership.
• Strong experience in Agile/Scrum environments.
• Solid understanding of DevSecOps and CI/CD security integration.
• Strong knowledge of web, API, and cloud security (Azure/GCP preferred).
• Experience translating security requirements into delivery artifacts.
• Familiarity with threat modeling methodologies (STRIDE, attack trees).
• Understanding of IAM and modern authentication protocols (OAuth2, JWT, OpenID Connect).
• Familiarity with ISO 27001, NIST, PDPL, GDPR.
• Strong stakeholder management and communication skills.

Responsibilities

• Act as the Security Program Owner, defining and prioritizing security initiatives across all products and platforms
• Own and manage the security backlog, ensuring alignment with product roadmaps, business priorities, and regulatory requirements
• Translate security standards, risks, and compliance requirements into user stories, acceptance criteria, and deliverables
• Lead and participate in Agile/Scrum ceremonies (sprint planning, backlog grooming, reviews) to ensure security requirements are delivered
• Drive end-to-end delivery of security programs, ensuring timelines, scope, and quality objectives are met
• Ensure engineering and DevOps teams implement security requirements effectively and consistently
• Define and track security KPIs, delivery metrics, and risk indicators
• Ensure DevSecOps practices are embedded, with security controls integrated into CI/CD pipelines
• Oversee threat modeling and architecture review outputs, ensuring findings are converted into actionable tasks
• Validate that key security controls (authentication, authorization, data protection, API security) are properly implemented by delivery teams
• Act as the primary liaison between security, engineering, and business stakeholders
• Ensure compliance requirements (ISO 27001, NIST, PDPL, GDPR) are translated into implementable controls and delivered
• Support release governance, ensuring security requirements are met prior to production deployment
• Drive vulnerability remediation programs, ensuring findings are tracked, prioritized, and resolved
• Continuously improve secure delivery processes, Agile maturity, and DevSecOps integration

Skills

Program ownership

Agile/Scrum

DevSecOps

CI/CD security

Threat modeling

Web security

API security

Cloud security (Azure/GCP)

Stakeholder management

Security governance

Job description

Haumaru Technologies Limited in Auckland seeks a Senior Security Program Owner (Product Security) to lead planning, prioritization, and delivery of security across the product ecosystem, including Tāne and enterprise solutions. You will own the security program lifecycle, embed requirements into Agile delivery, and translate standards into actionable tasks.

You will bridge security, engineering, and business, driving execution through Scrum, DevSecOps, and governance, while ensuring compliance