Head of Product Security & Secure SDLC

Velotic Software; Boston (MA); On-site; USD 180,000 - 260,000; Full time

Job summary

Velotic Software seeks a Product Security Leader to build a world‑class program from the ground up as two organizations harmonize. You will embed security across the SDLC, define secure development practices, and partner with engineering, product, and external MSPs to maintain velocity and strong security postures.

You will lead threat modeling, security architectures reviews, and remediation efforts while aligning with SOC 2 and ISO 27001 compliance requirements in a fast‑growing, well‑funded

Qualifications

• Bachelor's degree in Computer Science, Cybersecurity, Software Engineering, or related technical field; Master's preferred
• 8+ years of experience in application security, product security, or secure software development, with leadership experience
• Proven experience building or scaling product security programs in SaaS/B2B/B2C
• Leading security through organizational transitions such as carve-outs, mergers, or multi-entity integrations
• Deep technical expertise in secure coding practices, threat modeling, and vulnerability management
• Knowledge of OWASP Top 10, SANS Top 25, and modern testing methodologies
• Experience with SAST/DAST/IAST/SCA, container security, and pentesting
• CI/CD, DevSecOps, cloud-native, microservices, APIs, IaC
• Cloud security across AWS/Azure/GCP and containerization (Docker/Kubernetes)
• Security automation, tooling integration, and shifting left in development pipelines
• Knowledge of NIST SSDF, OWASP SAMM, BSIMM, ISO/IEC 27034
• Familiarity with SOC 2, ISO 27001, PCI DSS, GDPR, CCPA compliance
• Ability to influence engineering teams and build security champions
• Strong written/spoken communication for technical/non-technical audiences
• CSSLP/CEH/OSCP/GWAPT or similar preferred
• Experience harmonizing security tools across large orgs with different stacks

Responsibilities

• Build and lead Velotic's product security program from the ground up across engineering teams
• Establish secure SDLC framework, select and implement tooling, build security champions
• Collaborate with product management to integrate security into roadmaps and features
• Coordinate with System Integrators and MSSP providers for security controls
• Lead threat modeling, vulnerability triage, remediation guidance, and security automation
• Embed security checks in CI/CD and promote developer-friendly security practices
• Produce security metrics, risk assessments, and program updates for leadership
• Manage security assessments, questionnaires, penetration tests, and regulatory compliance

Skills

Application security

Secure SDLC

Threat modeling

DevSecOps

Cloud security (AWS/Azure/GCP)

Security communications

Education

Bachelor's degree in CS/Cybersecurity/Software Engineering

Master's degree (preferred)

Tools

SAST

DAST

IAST

SCA

Container security scanning

Penetration testing

Job description

Velotic Software seeks a Product Security Leader to build a world‑class program from the ground up as two organizations harmonize. You will embed security across the SDLC, define secure development practices, and partner with engineering, product, and external MSPs to maintain velocity and strong security postures.

You will lead threat modeling, security architectures reviews, and remediation efforts while aligning with SOC 2 and ISO 27001 compliance requirements in a fast‑growing, well‑funded