Cyber Resilience Act (CRA) Compliance Lead

191 Altera Corporation; San Jose (CA); On-site; USD 149,000 - 216,000; Full time

Job summary

Altera Corporation in San Jose, CA seeks a CRA Compliance Lead to establish and govern the company-wide compliance framework for the EU Cyber Resilience Act and related product cybersecurity regulations.

Reporting to Quality & Reliability, you will translate regulatory obligations into scalable lifecycle processes, drive governance, evidence, and conformity documentation, and partner with cybersecurity, product, and engineering teams.

Qualifications

• Minimum Qualifications: Bachelor's degree in Engineering, Computer Science, Information Systems, Cybersecurity, Quality, or a related technical field.
• 10+ years of experience in product compliance, cybersecurity, quality systems, regulatory compliance, or related disciplines.
• 8+ years interpreting EU CRA and global product security requirements.
• 8+ years leading enterprise or product compliance programs across cross-functional teams and geographies.
• 8+ years implementing secure SDLC, risk management, SBOM governance, and post-market security compliance.
• 8+ years governance of product lifecycle, change control, and audit readiness.

Responsibilities

• Maintain enterprise CRA compliance framework, governance, policies, and decision authorities.
• Coordinate CRA requirements with product design controls, verification, and conformity evidence.
• Align with ISO/IEC standards, vulnerability management, and security frameworks.
• Lead cross-functional collaboration on product classification, conformity pathways, and obligations.
• Integrate CRA requirements into product lifecycle management and release processes.
• Define CRA conformity evidence for all lifecycle stages and manage CRA documentation.

Skills

Regulatory compliance leadership

Cross-functional program leadership

Secure SDLC

SBOM / open-source governance

Product lifecycle governance

Executive stakeholder communication

Education

Bachelor's degree in Engineering, Computer Science, Information Systems, Cybersecurity, Quality, or related technical field

Tools

ISO 27001

ISO/SAE 21434

ISO 26262

IEC 62443

NIST cybersecurity framework

CE marking documentation

Job description

Job Details: Job Description: About Altera At Altera, our independence as the world’s largest pure‑play FPGA solutions provider gives us the focus, speed, and agility to innovate without compromise. With more than four decades of industry‑leading FPGA expertise, our singular mission is to deliver the programmable technologies that help customers differentiate, innovate, and scale across rapidly evolving markets like AI, cloud, networking, and edge. As an independent company, we move faster, invest deeper, and partner more closely—empowering our teams to drive breakthrough innovation and shape the future of the FPGA industry.

About the Role

We are seeking for a Cyber Resilience Act (CRA) Compliance Lead who will establish, govern, and drive the company‑wide compliance framework for the European Union Cyber Resilience Act and related product cybersecurity regulatory requirements. Reporting within the Quality & Reliability organization, this role will serve as the enterprise CRA compliance lead and will coordinate cross‑functional activities. The role is responsible for translating regulatory obligations into scalable product lifecycle processes, compliance requirements, governance mechanisms, objective evidence, and conformity documentation. The CRA Compliance Lead will provide independent oversight of compliance while partnering with technical organizations responsible for cybersecurity architecture, product, software and firmware development, vulnerability management, security testing, incident response, vendor management and implementation of cybersecurity controls. This is a senior role requiring strong knowledge of product cybersecurity regulations, semiconductor and embedded‑product lifecycles, quality management systems, risk management, regulatory conformity, and cross‑functional program execution.

Key Responsibilities

• Maintain the enterprise CRA compliance framework, governance model, policies, procedures, roles, responsibilities, and decision authorities.
• Establish traceability model between CRA requirements, cybersecurity risks, product requirements, design controls, verification activities, technical documentation, and conformity evidence.
• Coordinate alignment with applicable standards and frameworks, including ISO/IEC 27001, IEC 62443, ISO/SAE 21434, ISO 26262, vulnerability management standards, emerging CRA harmonized standards and Altera security requirements.
• Monitor regulatory developments, delegated acts, implementing guidance, harmonized standards, and industry interpretations that may affect company products or compliance obligations.
• Partner with cross functional organization to determine product classification, critical-product applicability, conformity assessment pathways and regulatory obligations.
• Support integration of CRA requirements into product requirement management, product lifecycle management, configuration management, change control, and release‑management systems.
• Establish governance requirements for Software Bill of Materials management and CRA‑related software‑component traceability.
• Coordinate assessment of third‑party software, intellectual property, software components, and external dependencies that may affect product compliance.
• Lead development and governance of the CRA conformity‑assessment framework, and maintenance of required CRA technical documentation and conformity evidence.
• Define and drive CRA compliance check and evidence requirements for product concept, architecture, design, implementation, verification, validation, release, production, maintenance, and end‑of‑support stages.
• CRA Compliance Operations & Enablement: Partner with product security on vulnerability escalation, product non‑conformity management and external communication
• Establish CRA compliance metrics, dashboards, risk indicators, and management‑reporting mechanisms.
• Integrate CRA compliance monitoring into applicable QMS audit, management‑review, risk‑management, and corrective‑action processes.
• Develop CRA training, awareness, role‑based competency requirements, and implementation guidance to promote a sustainable compliance culture.
• Facilitate resolution of complex regulatory, technical, process, and organizational compliance issues.

Salary Range

The pay range below is for Bay Area California only. Actual salary may vary based on a number of factors including job location, job‑related knowledge, skills, experiences, trainings, etc. We also offer incentive opportunities that reward employees based on individual and company performance. $149,100 - $215,925 USD We use artificial intelligence to screen, assess, or select applicants for the position. Applicants must be eligible for any required U.S. export authorizations. #LI-MD1

Qualifications

• Minimum Qualifications Bachelor's degree in Engineering, Computer Science, Information Systems, Cybersecurity, Quality, or a related technical field.
• 10+ years of experience in product compliance, product cybersecurity, quality systems, regulatory compliance, engineering governance, semiconductor product development, or related technical disciplines.
• 8+ years of experience interpreting and applying product cybersecurity regulations, including the EU Cyber Resilience Act (CRA) and other applicable global product security regulatory requirements.
• 8+ years of experience leading enterprise or product compliance programs across multiple cross‑functional organizations and global geographic locations.
• 8+ years of experience implementing secure product development lifecycle (Secure SDLC) processes, product cybersecurity risk management, vulnerability management, software component governance (SBOM/open‑source governance), and post‑market product security compliance.
• 8+ years of experience managing product lifecycle governance processes, including New Product Introduction (NPI), requirements management, configuration management, engineering change management, product release governance, audit readiness, and compliance evidence management.
• 8+ years of experience partnering with executive leadership, engineering, legal, quality, security, and product management teams to drive compliance initiatives and influence technical decisions without direct management authority.
• 8+ years of experience leading complex cross‑functional programs requiring executive‑level communication, data‑driven decision making, stakeholder management, facilitation, and presentation of compliance strategies, risks, and program status to senior leadership.

Preferred Qualifications

• Experience within the FPGA, semiconductor, embedded systems, electronics, automotive, aerospace, defense, industrial, or technology industries.
• Experience with semiconductor hardware, embedded firmware, software development tools, intellectual property, reference designs, or complex product ecosystems.
• Working knowledge of applicable standards and frameworks, such as: IEC 62443, ISO/SAE 21434, ISO/IEC 27001, ISO 9001, AS9100, ISO 26262,IEC 61508 NIST Cybersecurity and secure software development Framework, Common Criteria or related product‑security assurance frameworks
• Experience with Software Bill of Materials, 3rd party and open‑source software governance, vulnerability‑disclosure programs, product security incident response, or cybersecurity conformity assessment.
• Experience supporting CE marking, EU product regulations, technical‑file development, declarations of conformity, or market‑surveillance activities.

Job Type

Regular

Shift

Shift 1 (United States of America)

Primary Location

San Jose, California, United States

Posting Statement

All qualified applicants will receive consideration for employment without regard to race, color, religion, religious creed, sex, national origin, ancestry, age, physical or mental disability, medical condition, genetic information