Manager, Product Security Engineering

Johnson Controls; USA; Hybrid; USD 116.000 - 170.000; Vollzeit

Benefits dieser Stelle

Bonus plan

Benefits package

Zusammenfassung

Johnson Controls Fire Solutions seeks a strategic and technical Manager, Product Security Engineering to lead security ownership across a global portfolio of fire detection and suppression systems, including embedded firmware, connected devices, cloud platforms, and mobile apps.

You will define security strategy, build scalable processes, drive risk management, and ensure compliance with cybersecurity standards while fostering security ownership across engineering teams and the product lifecycle.

Qualifikationen

• Bachelor’s degree in computer science, cybersecurity, engineering, information technology, or a related technical discipline.
• 10+ years in software engineering, cloud engineering, DevSecOps, product security, or cybersecurity leadership with hands-on expertise.
• Proven ability to develop and execute product security strategies within complex tech organizations.
• Strong knowledge of product security, secure development practices, cloud/IoT security, and vulnerability management.
• Experience partnering with enterprise cybersecurity teams to implement governance and risk-management frameworks.
• Ability to drive cross-functional initiatives across engineering, product management, quality, and regulatory teams.
• Excellent leadership, communication, and executive presentation skills.
• Hybrid role based out of the JCI Westford office, in-office 3 days a week.

Aufgaben

• Lead security governance, policies, standards, and risk management across the product portfolio.
• Act as senior engineering leader for product cybersecurity within Fire Solutions and collaborate with Global Cybersecurity.
• Define engineering adoption of DevSecOps, automated security testing, software supply chain security, and secure tooling.
• Translate regulatory cybersecurity requirements into scalable engineering processes and evidence for audits.
• Drive SSDLC adoption, threat modeling, risk assessments, and security design reviews across hardware, firmware, software, cloud, mobile, and IoT.
• Oversee vulnerability management, incident response, remediation prioritization, and external communications.
• Design scalable security processes, automation, and AI-assisted workflows; define KPIs for security program success.

Kenntnisse

Security leadership

Strategic planning

Engineering execution

Cybersecurity risk management

Cross-functional collaboration

Ausbildung

Bachelor’s degree in CS/Engineering/Cybersecurity/IT

Jobbeschreibung

Johnson Controls Fire Solutions is seeking a strategic and technical Manager, Product Security Engineering to lead the implementation and execution of engineering ownership and execution of product security across a global portfolio of fire detection and suppression across life safety product domains including embedded firmware, connected devices, cloud platforms, mobile applications, and digital services. Responsible for defining and advancing the Fire Solutions product security execution strategy and roadmap in alignment with Global Cybersecurity standards and enterprise security objectives. The Manager will establish scalable security processes, lead cybersecurity risk and vulnerability management programs, drive application cyber regulation and corporate initiatives compliance, and develop an AI security threat response and governance capability. The successful candidate will provide leadership across a complex global ecosystem of hardware, firmware, software, cloud, and IoT solutions, ensuring security is effectively integrated throughout the product lifecycle. This individual will translate cybersecurity requirements into practical engineering processes, improve security operational efficiency, and promote a culture of security ownership across the Fire Solution Engineering organization. This position is critical to maintaining customer trust, meeting evolving cybersecurity expectations, supporting regulatory compliance initiatives, and ensuring the long-term success and resilience of the Fire Solutions business.

Key Responsibilities

• Product Security Leadership Partner with Johnson Controls Enterprise Security to establish security governance, policies, standards, and risk management frameworks across the product portfolio. Serve as the senior engineering leader for product cybersecurity within Fire Solutions, partnering closely with Global Cybersecurity to operationalize security strategy, standards, governance, and risk management practices. Drive a culture of security-by-design, accountability, and continuous improvement throughout the organization. Serve as the lead security architect for Fire Solutions Engineering, providing guidance on secure architecture decisions across firmware, cloud, mobile, IoT, and enterprise-connected systems. Define and drive the engineering adoption of DevSecOps practices including automated security testing, software supply chain security, CI/CD security controls, secrets management, and approved developer security tooling in partnership with Global Cybersecurity. Develop reusable security patterns, reference architectures, training materials, and engineering guidance that enable teams to independently build secure products.
• Security Governance & Compliance Execution Lead engineering adoption and execution of cybersecurity governance processes across the product development lifecycle. Partner with Regulatory Affairs, Quality, Legal, and Engineering teams to operationalize cybersecurity requirements associated with emerging regulations and industry standards. Translate regulatory cybersecurity requirements into scalable engineering processes, controls, documentation, and compliance evidence. Support audit readiness activities, security assessments, certifications, and regulatory reviews. Ensure cybersecurity requirements are integrated into product development, release, maintenance, and end-of-life processes. Monitor industry trends, emerging threats, and evolving cybersecurity requirements to continuously improve security capabilities.
• Product Security Program Management Drive adoption of secure development lifecycle (SSDLC) practices across hardware, firmware, software, cloud, mobile, and IoT product teams. Lead threat modeling, security architecture reviews, risk assessments, and security design reviews. Establish consistent security requirements for new product introductions and major platform enhancements. Oversee security testing programs, penetration testing activities, and security validation processes. Ensure security requirements are embedded throughout all phases of the product lifecycle.
• Vulnerability Management & Incident Response Establish and oversee global product vulnerability management processes. Lead coordinated vulnerability disclosure and external vulnerability response activities. Lead engineering coordination and remediation activities for product cybersecurity incidents in partnership with Global Cybersecurity incident response teams. Develop remediation prioritization frameworks and risk-based decision-making processes. Support customer communications and executive briefings related to cybersecurity issues and product security events. Drive continual improvements in vulnerability response timelines and remediation effectiveness. Act as the engineering security lead during critical vulnerability investigations and product cybersecurity incidents, coordinating root cause analysis, containment, remediation, and executive communications.
• Security Process Excellence & Operational Efficiency Design and implement scalable security processes that can be consistently adopted across global engineering organizations. Identify opportunities to improve efficiency through process optimization, automation, and AI-assisted workflows. Establish repeatable methods for security reviews, compliance evidence generation, risk assessments, and vulnerability tracking. Define and measure operational performance indicators that demonstrate security program effectiveness and business impact. Reduce friction in engineering processes while improving security outcomes and compliance readiness. Define and maintain product security KPIs including vulnerability remediation performance, threat modeling coverage, SSDLC adoption, penetration testing completion, software supply chain risk posture, and security defect escape rates.

Required Qualifications

• Bachelor’s degree in computer science, Cybersecurity, Engineering, Information Technology, or a related technical discipline.
• 10+ years of combined experience in software engineering, cloud engineering, DevSecOps, product security, application security, or cybersecurity leadership roles with demonstrated hands‑on technical expertise.
• Demonstrated success developing and executing product security strategies within complex technology organizations.
• Strong knowledge of product security, secure development practices, cloud security, IoT security, and vulnerability management.
• Experience working closely with enterprise cybersecurity teams to implement governance, standards, and risk management frameworks.
• Proven ability to drive cross-functional initiatives across engineering, product management, quality, and regulatory organizations.
• Excellent leadership, communication, stakeholder management, and executive presentation skills.
• Hybrid position out of JCI Westford office, expected to be in the office 3 days a week.

Preferred Qualifications

• Master’s degree in Cybersecurity, Computer Science, Engineering, Business, or a related field.
• Industry certifications such as CISSP, CISM, CRISC, CSSLP, GIAC, or equivalent.
• Experience supporting products subject to cybersecurity regulations and compliance frameworks.
• Knowledge of cybersecurity standards and frameworks including NIST, IEC 62443, ISO 27001, UL cybersecurity standards, and related industry practices.
• Experience with SBOM and software supply chain security.
• Experience with threat modeling methodologies such as STRIDE.
• Experience leading remediation of critical vulnerabilities and security incidents.

HIRING SALARY RANGE

Hir ing Salary Range: $116,000 - $170,000 (Salary to be determined by the education, experience, knowledge, skills, and abilities of the applicant, internal equity, and alignment with market data.)

Benefits

This role offers a competitive Bonus plan that will take into account individual, group, and corporate performance. This position includes a competitive benefits package.

The posted salary range reflects the target compensation for this role. However, we recognize that exceptional candidates may bring unique skills and experiences that exceed the typical profile. To support an efficient and fair hiring process, we may use technology assisted tools, including artificial intelligence (AI), to help identify and evaluate candidates. All hiring decisions are ultimately made by human reviewers. For details, please visit the About Us tab on the Johnson Controls Careers site at https://jobs.johnsoncontrols.com/about-us

Johnson Controls International plc. is an equal employment opportunity and affirmative action employer and all qualified applicants will receive consideration for employment without regard to race, color, religion, sex, national origin, age, protected veteran status, genetic information, sexual orientation, gender identity, status as a qualified individual with a disability or any other characteristic protected by law. To view more information about your equal opportunity and non-discrimination rights as a candidate, visit EEO is the Law. If you are an individual with a disability and you require an accommodation during the application process, please visit here.

Johnson Controls: Enhancing the Intelligence of Buildings Your buildings have a purpose. They are places for people to live or work. Facilities for learning or healing. Venues for entertainment and shopping. Sites for the specialized storage of tangible goods or mission‑critical data. Your buildings have a huge variety of functions; they are central to your mission. This is where Johnson Controls comes in, helping drive the outcomes that matter most. Through a full range of systems and digital solutions, we make your buildings smarter. A smarter building is safer, more comfortable, more efficient, and, ultimately, more sustainable. Most important, smarter buildings let you focus more intensely on your unique mission. Better for your people. Better for your bottom line. Better for the planet. At Johnson Controls, we’ve been making buildings smarter since 1885, and our capabilities, depth of innovation experience, and global reach have been growing ever since. Today, we offer the world’s largest portfolio of building products, technologies, software, and services; we put that portfolio to work to transform the environments where people live, work, learn and play.