Product Security Manager

CNH Industrial Group; Oak Brook (IL); Hybrid; USD 120,000 - 184,000; Full time

Job summary

CNH Industrial Group in Oak Brook, IL seeks a hands-on Product Security Leader to build and guide a team securing embedded software on tractors and devices, and the cloud platform powering digital services.

You will own the security strategy, budget, and compliance posture across markets, aligning with regulators, dealers, and customers while driving secure SDLC practices across multiple product lines.

Qualifications

• Bachelor's degree in Engineering, Computer Science, Cybersecurity, or related technical field (or equivalent experience).
• 8+ years of experience as a security practitioner, with experience in application, product, or embedded security.
• 3+ years of direct people leadership experience managing engineers, including hiring, coaching, performance management, and career development.
• Experience owning or co-owning an operating budget. Including annual planning, headcount forecasting, and tooling or vendor spend.
• Prior experience as a software engineer writing and shipping production code.
• Working understanding of both embedded software development and cloud software development, and the ability to reason about security across that full stack.
• Experience building and running compliance programs across multiple countries or regions, including translating differing regulatory requirements into a single maintainable process.
• Familiarity with common web and cloud security frameworks and practices, including the OWASP Top 10 and secure API design.
• Experience with build systems and CI/CD platforms (Jenkins, GitLab CI, GitHub Actions, Azure DevOps, or equivalent) and with integrating security tooling into automated pipelines.
• Experience with vulnerability management at scale: intake, triage, risk scoring (CVSS or similar), prioritization, and driving remediation across teams that do not report to you.

Responsibilities

• Lead, grow, and develop a product security team spanning both cloud security and embedded/vehicle security; hire, coach, set objectives, and manage performance and career development
• Oversee regional or functional security posture, maturity, and performance
• Actively grow and manage security education and enablement within product teams. Secure coding training, secure design guidance, security champions programs, and self-service tooling that makes the secure path the easy path
• Drive security incident response preparedness and lead major investigations
• Own the product security operating budget: annual planning, headcount forecasting, tooling and licensing spend, external services (penetration testing, assessments, certification), and training
• Manage security vendors, contracts, and service delivery expectations
• Collaborate with IT, operations, and risk teams to ensure alignment of controls
• Support internal/external audits and regulatory readiness (NIST, ISO, etc.)
• Own the product security strategy and roadmap for connected vehicle and cloud platforms
• Manage multiple concurrent projects and programs across several product lines and release cadences; balance security commitments against engineering delivery timelines and elevate trade-offs clearly
• Define and drive security requirements into the SDLC and CI/CD toolchain: SAST, SCA and dependency scanning, secrets detection, container and image scanning, SBOM generation and artifact signing
• Establish security requirements for the embedded platform, including secure boot, secure and OTA update, key and certificate management, hardware root of trust, debug port and diagnostic access control, and in-vehicle network segmentation.

Skills

Team leadership

Cloud security

Embedded security

Budget management

Regulatory compliance

Secure SDLC

CI/CD tooling

Vulnerability management

Education

Bachelor's degree in Engineering or related field

Tools

Jenkins

GitHub Actions

Azure DevOps

Yocto

Job description

Category: Engineering and Technical

Job Type: Full Time

Working Mode: Fully On-Site

About Us

Innovation. Sustainability. Productivity. This is how we are Breaking New Ground in our mission to sustainably advance the noble work of farmers and builders everywhere. With a growing global population and increased demands on resources, our products are instrumental to feeding and sheltering the world.

From developing products that run on alternative power to productivity-enhancing precision tech, we are delivering solutions that benefit people - and they are possible thanks to people like you. If the opportunity to build your skills as part of a collaborative, global team excites you, you’re in the right place.

Grow a Career. Build a Future!

Be part of this company at the forefront of agriculture and construction, that passionately innovates to drive customer efficiency and success. And we know innovation can’t happen without collaboration. So, everything we do at CNH Industrial is about reaching new heights as one team, always delivering for the good of our customers.

Job Purpose

You will lead CNH's product security team, with responsibility for securing the embedded software running on connected tractors, sprayers, combines and harvesters as well as the cloud platform and digital services those machines depend on. This is a hands-on technical leadership role with full ownership of the function: you will build and grow a team of cloud and embedded security engineers, own the product security budget and investment roadmap, set security strategy for the product portfolio, and own the global compliance posture that allows CNH products to ship into every market we serve.

Agricultural and construction equipment is now software-defined, connected, and increasingly autonomous - and regulators, dealers, and customers all expect it to be secure. You will be the person accountable for making that true, from the secure boot chain on an ECU through to the APIs and data pipelines that make up CNH's next generation digital platform.

Key Responsibilities

• Lead, grow, and develop a product security team spanning both cloud security and embedded/vehicle security; hire, coach, set objectives, and manage performance and career development
• Oversee regional or functional security posture, maturity, and performance
• Actively grow and manage security education and enablement within product teams. Secure coding training, secure design guidance, security champions programs, and self-service tooling that makes the secure path the easy path
• Drive security incident response preparedness and lead major investigations
• Own the product security operating budget: annual planning, headcount forecasting, tooling and licensing spend, external services (penetration testing, assessments, certification), and training
• Manage security vendors, contracts, and service delivery expectations
• Collaborate with IT, operations, and risk teams to ensure alignment of controls
• Support internal/external audits and regulatory readiness (NIST, ISO, etc.)
• Own the product security strategy and roadmap for connected vehicle and cloud platforms
• Manage multiple concurrent projects and programs across several product lines and release cadences; balance security commitments against engineering delivery timelines and elevate trade-offs clearly
• Define and drive security requirements into the SDLC and CI/CD toolchain: SAST, SCA and dependency scanning, secrets detection, container and image scanning, SBOM generation and artifact signing
• Establish security requirements for the embedded platform, including secure boot, secure and OTA update, key and certificate management, hardware root of trust, debug port and diagnostic access control, and in-vehicle network segmentation.

Experience Required

• Bachelor's degree in Engineering, Computer Science, Cybersecurity, or related technical field (or equivalent experience)
• 8+ years of experience as a security practitioner, with experience in application, product, or embedded security
• 3+ years of direct people leadership experience managing engineers, including hiring, coaching, performance management, and career development
• Experience owning or co-owning an operating budget. Including annual planning, headcount forecasting, and tooling or vendor spend
• Prior experience as a software engineer writing and shipping production code
• Working understanding of both embedded software development and cloud software development, and the ability to reason about security across that full stack
• Experience building and running compliance programs across multiple countries or regions, including translating differing regulatory requirements into a single maintainable process
• Familiarity with common web and cloud security frameworks and practices, including the OWASP Top 10 and secure API design
• Experience with build systems and CI/CD platforms (Jenkins, GitLab CI, GitHub Actions, Azure DevOps, or equivalent) and with integrating security tooling into automated pipelines
• Experience with vulnerability management at scale: intake, triage, risk scoring (CVSS or similar), prioritization, and driving remediation across teams that do not report to you

Preferred Qualifications

• Experience securing connected vehicles, off-highway equipment, automotive, or other safety-relevant cyber-physical systems
• Familiarity with automotive and machinery cybersecurity standards and regulations, such as RED, EU Cyber Resilience Act, NIS2, and relevant regional data protection requirements
• Experience with functional safety concepts (ISO 25119, ISO 26262) and the interaction between safety and security
• Familiarity with cloud and information security frameworks such as ISO 27001, SOC 2, NIST CSF, NIST SSDF, or CIS Benchmarks
• Hands-on background in one or more of: embedded C/C++, Linux/Yocto or RTOS platforms, CAN/ISOBUS or automotive Ethernet, hardware security modules, or firmware reverse engineering
• Experience with penetration testing or red teaming systems
• Experience managing a globally distributed team or working across multiple time zones
• Prior experience in agriculture, construction, telematics, or precision farming domains

Pay Transparency

The annual salary for this role is USD $120,225.00 - $184,345.00 plus any