Product Security Lead

Forterra; Arlington (VA); On-site; USD 175,000 - 200,000; Full time

Benefits offered by this job

Premium Healthcare Benefits

20 days PTO per year

7 weeks parental leave

$9k tuition reimbursement

Job summary

Forterra seeks a seasoned Product Security Lead to own security for all Forterra platforms end-to-end. This hands-on leadership role combines governance, strategy, and execution across software, hardware, and DevOps.

You will lead a small security team while guiding a large cross-functional group and serve as the security SME in pre-sales and customer evaluations. You will have built security programs, earned DoD authorizations from start to finish, and operate with credibility from engineering

Qualifications

• 7+ years in product or cybersecurity with proven program leadership.
• Experience owning an ATO end-to-end as the responsible authority.
• Practical command of NIST 800-37/800-53/800-171; DISA STIGS/SRG; eMASS artifacts.
• Experience securing embedded, autonomous, or operationally deployed systems.
• Led security programs, teams, and cross-functional security execution.
• Ability to operate at strategic and tactical levels with executives.

Responsibilities

• Own enterprise product security program across multiple autonomous platforms and lines.
• Lead full ATO lifecycle, control selection, evidence generation, and POAM management.
• Participate in software release boards as security go/no-go authority.
• Set 12- and 24-month security roadmaps, maturity plans, and resource forecasting.
• Brief senior leadership and government/commercial partners on risk and status.
• Develop cyber security requirements for networks including air-gapped environments.
• Lead threat modelling across autonomous and C2 systems; drive risk assessments.
• Own DISA STIG compliance strategy and implement guidance for engineering teams.
• Own SBOM generation pipeline and vulnerability management including CVE triage.
• Lead product security incident response and cross-group remediation.
• Support pre-sales security SME for RFP/RFQ responses.
• Build, mentor, and grow the product security team and culture.

Skills

Product security leadership

ATO program end-to-end

NIST 800-37/53/171

DISA STIGs and SRG

SBOM and vulnerability management

Security exemption handling

Executive briefing & stakeholder comms

DoD security clearance

Tools

eMASS

Job description

About Forterra

At Forterra, we are unleashing autonomy at scale to transform the battlefield. Our mission is to build the foundational platforms that enable an intelligent ecosystem to coordinate, adapt, and execute with speed and precision even in the uncertainty and disruption of modern conflict. In an era marked by rapid technological change and evolving threats, we design for flexibility, survivability, and operational dominance.

Forterra delivers weapons, sensors, and battlefield effects through integrated autonomous networks reaching operational areas faster, safer, and without placing human lives at risk. Our systems operate with distributed control, dynamic routing, and real-time responsiveness, enabling sustained advantage across complex mission environments.

About the role

Forterra is unleashing autonomy at scale to transform the battlefield, and the systems we field have to be trusted in the most contested, disconnected environments on earth. We're seeking a Product Security Lead to own security for all Forterra platforms end-to-end: someone who can own and advance the program.

This is a hands-on, leadership role, not a paper-compliance seat. You will set the security strategy, own the governance and compliance posture, and drive security execution across software, hardware, and devops. You will lead a small team of product security engineers while coordinating a significantly larger cross functional group of indirect contributors and server as the company's security SME in pre sales, bids/RFPs, and customer evaluations. Additionally you will serve as Forterra's product security voice to government customers, commercial partners, and executive leadership.

This is a senior security role. It requires someone who has built security programs before, earned DoD authorizations from beginning to end, and an operate with equal credibility in the weeds at the engineering level as well as at an executive briefing.

What you'll do

• Own the enterprise product security program across multiple autonomous vehicle platforms and business lines- governance, policies, and roadmap
• Lead the full ATO and IATT lifecycle across concurrent DoD programs, from control selection and tailoring through evidence generation. POAM management, and government stakeholder coordination. You are Forterra's ATO authority
• Participate in software release boards as the go/no go authority for security
• Set and own the 12 and 24 month security roadmap, capability maturity planning, and resource forecasting
• Brief senior leadership, government stakeholders, and commercial partners on program status, risk posture, and readiness activities
• Develop cyber security requirements for platforms operating in a multitude of networks, including air gapped, intermittently connections, and operationally constrained environments
• Lead threat modelling across autonomous, embedded, and command and control systems, driving risk assessments that weigh mitigations against mission requirements
• Own DISA STIG compliance strategy. Evaluate and tailor applicable checklists, translating required controls into implementable guidance for engineering teams
• Own the SBOM generation pipeline and vulnerability management program, including CVE triage, remediation prioritization, and POAM closure
• Lead the product level security incident response and coordinate cross organization remediation with the corporate cybersecurity team
• Support the contract and sales teams as the pre sales security SME, contributing to RFP and RFQ responses
• Build, lead, and develop the product security team. Hire, onboard, mentor, and grow direct reports and foster a security first engineering culture across the organization

Minimum Qualifications

• 7+ years in product or cybersecurity with demonstrated depth in program leadership
• Proven experience owning an ATO end to end as the responsible authority
• Practical command of NIST 800-37, 800-53, 800-171; DISA STIGS and SRG; eMASS artifact requirements, formats, and review cycles
• Demonstrated experience securing embedded, autonomous, or operationally deployed systems including air gapped and disconnected environments
• Experience building and leading security programs, teams, and functions
• Ability to operate at both the strategic and tactical levels simultaneously
• Strong executive communication skills. Ability to brief senior leadership and stakeholders and defend decision making
• Demonstrated experience with SBOM and vulnerability management in a product engineering environment
• Experience driving compliance validation against multiple concurrent frameworks, ex NIST, ISO/SAE, CMMC, etc
• Active US Security Clearance or eligibility. Must be a US Person as defined under ITAR

Preferred Qualifications

• Active CISSP or equivalent senior security certification
• ISO/SAE 21434 automotive cybersecurity experience
• Experience with multiple ATOs across multiple DoD programs or branches
• Familiarity with IEC 62443 commercial cybersecurity engineering standard
• Experience managing indirect contributors and cross functional security execution across large
• engineering organizations

US Salary Range
$175,000 - $200,000

The salary range for this role is an estimate and is based on a wide variety of compensation factors. The salary offered to candidates will vary based on a variety of factors including (but not limited to) relevant work experience, education, specialized training, critical expertise, training, and more. Equity in Forterra is included in most of our full-time, high-demand roles and is therefore considered part of Forterra's overall compensation package. In addition to base salary and equity, Forterra offers competitive benefits for full-time employees including:

• Premium Healthcare Benefits: Three plan options, including an HSA-eligible plan, with Forterra covering 80% of the plan premium for you and your dependents.
• Basic Life/AD&D, short and long-term disability insurance plans 100% covered by Forterra, plus the option to purchase additional life insurance for you and your dependents.
• Extremely generous company holiday calendar including a winter break in December.
• Competitive paid time off (PTO) offering 20 days accrued per year.
• A minimum of 7 weeks fully paid parental leave for birth/adoption.
• A $9k annual tuition reimbursement or professional development stipend.
• Fully stocked beverage refrigerators with all the Celsius your little heart desires.
• 401(k) retirement savings plan, including traditional, Roth 401(k), and after-tax deferral with company match up to 4%.

Your recruiter will be able to share more information about our salary and benefits offering during the hiring process.

CLEARANCE ELIGIBILITY - This position may require eligibility to obtain and maintain a U.S. security clearance.