Product Security Lead

Acronis, Inc.; Burlington (MA); On-site; USD 200,000 - 300,000; Full time

Benefits offered by this job

Comprehensive benefits package

Career development programs

Job summary

Acronis, Inc. is seeking an experienced Product Security Lead to drive our global product security strategy and assurance program across SaaS and on-premises products.

You will oversee governance, SDL, tooling, vulnerability management, and remediation, partnering with R&D, Product, and Security leadership to embed security throughout the software development lifecycle. You will build scalable security programs, lead IV&V, PSIRT, and SBOM initiatives, manage tooling and vendors, and ensure

Qualifications

• 10–15 years in information security, with at least 6–8 years in product security or secure SDLC.
• Hands-on experience selecting, deploying, and tuning SAST/DAST/SCA tooling at scale.
• Experience building or maturing an application security program (OWASP SAMM, BSIMM, or NIST SSDF).
• Proven experience with vulnerability management, SLA governance, and remediation verification.
• Proven experience leading PSIRT or incident response for critical product vulnerabilities.
• Proven experience managing a bug bounty program and researcher engagement.
• Working knowledge of GDPR, HIPAA, ISO/IEC 27001 and related compliance requirements.
• Ability to explain complex security concepts to non-technical stakeholders and influence engineering teams.
• Ability to develop long-term product security strategies aligned with business goals.
• Familiarity with cloud-native architectures, containers, microservices, and infrastructure as code.

Responsibilities

• Lead the product assurance program governance across SaaS and on-premises lines.
• Define SDL requirements aligned with product roadmaps and business goals.
• Establish risk acceptance, escalation processes, and clear ownership in Engineering and Product.
• Report security posture, risk trends, and KPIs to senior leadership.
• Oversee CI/CD security controls, tool tuning, and false-positive management.
• Drive software supply chain security, SBOM management, and provenance.
• Oversee IV&V code reviews, threat modeling, and security design reviews.
• Lead PSIRT, vulnerability disclosures, and customer communications for critical vulnerabilities.
• Ensure regulatory and customer assurance through audits and certifications.

Skills

Security leadership

Security strategy

SDL

Threat modeling

Vulnerability management

PSIRT

CI/CD security

SBOM governance

Regulatory compliance

Vendor management

Tools

SAST tools

DAST tools

SCA tools

SBOM tooling

Job description

Acronis is a global leader in cyber protection, delivering AI-powered protection for productive MSPs in a single, natively integrated platform that unifies operations management, cybersecurity, and data protection. Driven by our mission to protect, manage and automate every workload that businesses and lives depend on, we’ve built the industry’s only all-in-one solution. We are seeking an experienced Product Security Lead to drive Acronis’ global product security strategy and assurance program across our SaaS and on-premises portfolio. This role will oversee product security governance, secure development practices, security tooling and automation, vulnerability management, and remediation assurance. Working closely with R&D, Product, and Security leadership, you will embed security throughout the software development lifecycle, strengthen our security posture, and ensure compliance with industry standards and customer expectations. The ideal candidate combines deep technical expertise with strong leadership skills and a proven ability to build scalable security programs in a global software environment.

WHAT YOU’LL DO

Product Assurance Leadership and Governance

• Lead and provide oversight of the product assurance program, including governance, accountability, and metrics across all product lines (SaaS and on-premises).
• Define and maintain the product security strategy, policies, standards, and secure development lifecycle (SDL) requirements, aligned with business goals and product roadmaps.
• Establish risk acceptance, exception, and escalation processes with clear ownership in Engineering and Product.
• Report product security posture, risk trends, and program KPIs to senior leadership.

Toolchain Strategy and Procurement

• Conduct gap analysis of the Product Security toolchain, identify coverage and maturity gaps, and build the business case for tooling investments.
• Evaluate, select, and recommend appropriate tools, and manage vendor relationships.

Secure CI/CD and Automated Security Controls

• Select, configure, and set enforcement modes (audit, warn, block) for SAST, DAST, SCA, secrets scanning, and SBOM generation in CI/CD pipelines.
• Define quality gates, severity thresholds, and break-the-build criteria that balance risk reduction with developer velocity.
• Oversee tuning of rules and false-positive management to maintain developer trust and adoption.
• Drive software supply chain security, including dependency governance, SBOM management and distribution, build integrity, artifact signing, and provenance.

Independent Verification and Validation

• Define the independent verification and validation (IV&V) code review process, including scope, triggers, reviewer qualifications, and approval thresholds for high-risk changes.
• Oversee security design reviews and threat modeling for new features, architectures, and third-party integrations.
• Direct penetration testing, red team engagements, and external security assessments of products.

Vulnerability Management and Remediation Assurance

• Define and oversee the end-to-end vulnerability management process: intake, triage, risk scoring (e.g., CVSS, EPSS, exploitability context), SLAs, and remediation.
• Provide remediation assurance by verifying that fixes are effective, complete, and free of regressions, and by tracking SLA adherence and escalating overdue items.
• Manage the bug bounty and coordinated vulnerability disclosure programs, including researcher engagement, platform management, and incentive structuring.
• Lead the Product Security Incident Response Team (PSIRT) function, including security advisories, CVE publication, and customer communication for critical vulnerabilities.

Compliance and Customer Assurance

• Ensure compliance with relevant regulations, industry standards, and best practices, including GDPR, HIPAA, and ISO/IEC 27001.
• Align products with additional product-relevant frameworks as applicable (e.g., SOC 2, NIST SSDF, OWASP ASVS/SAMM, SLSA, EU Cyber Resilience Act, NIS2).
• Support customer security questionnaires, audits, and certification efforts (e.g., Common Criteria, FedRAMP, or other market-specific requirements).

Engineering Enablement and Culture

• Advise Product Management and R&D on security requirements, customer expectations, and product roadmaps.
• Build a security champions program and deliver secure coding training to developers.
• Embed security guidance, reusable patterns, and paved‑road tooling into developer workflows.
• Work closely with R&D, Product, IT/Corporate Security, Legal, and other teams within the Acronis Group.

Team Collaboration and Industry Awareness

• Coordinate and collaborate with an international team of security professionals across multiple time zones.
• Stay current on emerging threats, attack techniques, supply chain risks, AI/ML security, and security technologies relevant to the product portfolio.

WHO WE’RE LOOKING FOR

• 10-15 years of experience in information security, with at least 6-8 years in product security, application security, or secure SDLC. Additional leadership experience preferred.
• Hands-on experience selecting, deploying, and tuning SAST, DAST, SCA, secrets scanning, and SBOM tooling in CI/CD environments, including setting enforcement policies at scale.
• Experience building or maturing an application security program using frameworks such as OWASP SAMM, BSIMM, or NIST SSDF.
• Proven experience with vulnerability management programs, including risk-based prioritization, SLA governance, and remediation verification.
• Proven experience leading PSIRT or incident response efforts for critical product vulnerabilities, including coordinated disclosure.
• Proven experience managing a bug bounty program, including platform familiarity, researcher engagement, and incentive structuring.
• Working knowledge of regulatory and compliance requirements for products, including GDPR, HIPAA, and ISO/IEC 27001.
• Strong understanding of technical and compliance issues for SaaS and on-premises security product companies.
• Ability to analyze complex security data and trends, build actionable plans with key stakeholders, and communicate rationale and progress to senior leadership.
• Strong verbal and written communication skills, including the ability to explain complex security concepts to non-technical stakeholders and influence engineering teams without direct authority.
• Ability to develop long-term product security strategies aligned with business goals.
• Familiarity with modern software architectures, such as cloud-native, containers, microservices, and infrastructure as code.
• High integrity and ethical standards in handling sensitive and confidential information.
• Strong internal and external customer focus, with a desire to learn all aspects of the business.
• Disciplined, detail-oriented, and able to meet deadlines in a fast-paced environment while maintaining accuracy.
• Outstanding organizational, problem‑solving, and multitasking skills.
• Collaborative team player, self‑motivated and proactive, able to work with minimal supervision.
• Nice to have:CSSLP, CISSP, CISM, or OSCP/OSWE; experience with AI/ML security; experience with regulated or certified product environments.

WHO WE ARE

A Swiss company founded in Singapore in 2003, Acronis offers over twenty years of innovation with 15 offices worldwide and employees in 50+ countries. Acronis Cyber Protect is available in 26 languages in 150 countries and is used by over 21,000 service providers to protect more than 750,000 businesses. Our corporate culture centers on innovation, accountability, and impact. We encourage our people to think boldly, challenge conventional approaches, and take ownership of outcomes. As a member of our global “A-Team,” you’ll operate in a high-growth, fast-paced environment where resilience, adaptability, and a commitment to continuous improvement drive success.

Acronis is a global cyber protection company that provides natively integrated cybersecurity, data protection, and endpoint management for managed service providers (MSPs), small and medium businesses (SMBs), enterprise IT departments and home users. Our all-in-one solutions are highly efficient and designed to identify, prevent, detect, respond, remediate, and recover from modern cyberthreats with minimal downtime, ensuring data integrity and business continuity. We offer the most comprehensive security solution on the market for MSPs with our unique ability to meet the needs of diverse and distributed IT environments. A Swiss company founded in Singapore in 2003, Acronis offers over twenty years of innovation with 15 offices worldwide and more than 1800 employees in 50+ countries. Acronis Cyber Protect is available in 26 languages in 150 countries and is used by over 20,000 service providers to protect over 750,000 businesses. Our corporate culture is focused on making a positive impact on the lives of each employee and the communities we serve. Mutual trust, respect and belief that we can contribute to the world everyday are the cornerstones of our team. Each member of our “A-Team” plays an instrumental role in driving the success of our innovative and expanding business. We seek individuals who excel in dynamic, global environments and have a never give up attitude, contributing to our collective growth and impact.

OUR INTERVIEW PRACTICES

To maintain a fair and genuine hiring process, we kindly ask that all candidates participate in interviews without the assistance of AI tools or external prompts. Our interview process is designed to assess your individual skills, experiences, and communication style. We value authenticity and want to ensure we’re getting to know you—not a digital assistant. To help maintain this integrity, we ask to remove virtual backgrounds and include in-person interviews in our hiring process. Use of AI-generated responses or third-party support during live interviews may be grounds for disqualification from the recruitment process and a full criminal, education and identification background check is required for all new hires.

Acronis is an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to age, ancestry, color, marital status, national origin, physical or mental disability, medical condition, protected veteran status, race, religion, sex (including pregnancy), sexual orientation, gender identity or expression, or any other characteristic protected by applicable laws, regulations and ordinances.

The US pay range for this position is $200,000–$300,000. This range reflects the minimum and maximum total target annual compensation for this role across all U.S. locations. The actual compensation offered at the start of employment is determined based on factors including, but not limited to, experience level, knowledge, skills, and geographic location.

• In addition to competitive compensation, this role includes a comprehensive benefits package featuring medical, dental, and vision coverage, flexible spending accounts (FSA), disability and life insurance, a 401(k) retirement plan with company match, and a generous vacation policy.