PSIRT Commander

Insight Global; Colorado Springs (CO); Remote; USD 83,000 - 103,000; Full time

Job summary

Insight Global seeks a PSIRT Commander to lead the organization’s response to product cybersecurity vulnerabilities and incidents. You will coordinate with R&D, Product Security, Compliance, Legal, Customer Communications, and executives to ensure timely assessment, remediation, and communication.

The role supports regulatory readiness activities (CRA, CVD, attestations) and governance, with a fully remote arrangement and a compensation range of $60-75/hour based on experience.

Qualifications

• Bachelor's degree in computer science, cybersecurity, information technology, or equivalent experience.
• 4-5 years of experience in security incident response, product security, software/hardware development, or related fields.
• Familiarity with security concepts including CVEs, CVSS, and secure development practices.
• Experience working with technical engineering teams and effective communication skills.

Responsibilities

• Lead end-to-end response to security vulnerabilities and incidents.
• Perform intake, triage, and severity assessments of reports.
• Coordinate incident response meetings with stakeholders and executives.
• Guide escalation, remediation priorities, and regulatory reporting.
• Maintain incident timelines, evidence, and closure documentation.

Skills

Incident response

Product security

SSDLC

Vulnerability management

Security engineering

Cross-functional collaboration

Education

Bachelor's degree in CS/Cybersecurity/IT

Job description

Job Description

The PSIRT Commander is responsible for coordinating and leading the organization’s response to product cybersecurity vulnerabilities, security incidents, and regulatory reporting obligations. This role serves as the central point of coordination between R&D, Product Security, Compliance, Legal, Customer Communications, and Executive Leadership to ensure the timely assessment, remediation, communication, and closure of product security issues.

In addition to incident management responsibilities, the PSIRT Commander supports product security compliance initiatives, including regulatory readiness activities such as the EU Cyber Resilience Act (CRA), CISA Secure Software Development Attestation, product security assessments, audit preparation, and cybersecurity governance activities. This will be a fully remote position, offering between $60-75/hour depending on experience.

Key Responsibilities

• Drive and coordinate the end-to-end response to reported product security vulnerabilities and cybersecurity incidents.
• Perform initial intake, triage, and severity assessment of security reports.
• Organize and facilitate incident response meetings with technical and business stakeholders.
• Drive decision-making regarding escalation paths, remediation priorities, customer communications, and regulatory reporting obligations.
• Track incident timelines, actions, evidence, and closure activities.
• Coordinate vulnerability disclosures, security advisories, and stakeholder communications.
• Support crisis-level response activities, provide coverage and executive reporting when required.

Secondary Responsibilities:

• Perform regulatory assessments
• Audit support and preparation
• Assessment reporting/tracking
• User documentation
• Confluence updates
• Mailbox monitoring

Cross-Functional Collaboration

• Coordinate activities across Product Security, Governance & Compliance, Legal, Customer Support, Quality, and Engineering organizations.
• Facilitate alignment between technical teams and business stakeholders during security events.
• Present incident status, risk assessments, and compliance updates to leadership.
• Drive continuous improvement of PSIRT processes, workflows, and reporting capabilities.
• Partner with R&D, Product Management, Security Champions, and Security teams to assess vulnerabilities and remediation plans.
• Provide guidance on risk evaluation, exploitability, customer impact, and remediation strategies.

Regulatory Compliance and Governance

• Support implementation and operationalization of product security regulations and frameworks, including:
• EU Cyber Resilience Act (CRA)
• CISA Secure Software Development Attestation
• Vulnerability Disclosure and Coordinated Vulnerability Disclosure (CVD) requirements
• Assist with product security compliance assessments and audit readiness activities.
• Support crisis-level response activities, including on-call coverage and executive reporting during major incidents.
• Contribute to compliance dashboards, metrics, and process improvement initiatives.

We are a company committed to creating diverse and inclusive environments where people can bring their full, authentic selves to work every day. We are an equal opportunity/affirmative action employer that believes everyone matters. Qualified candidates will receive consideration for employment regardless of their race, color, ethnicity, religion, sex (including pregnancy), sexual orientation, gender identity and expression, marital status, national origin, ancestry, genetic factors, age, disability, protected veteran status, military or uniformed service member status, or any other status or characteristic protected by applicable laws, regulations, and ordinances. If you need assistance and/or a reasonable accommodation due to a disability during the application or recruiting process, please send a request to [e-mail] learn more about how we collect, keep, and process your private information, please review Insight Global’s Workforce Privacy Policy: https://insightglobal.com/workforce-privacy-policy/.

Skills and Requirements

• Bachelor’s degree in computer science, Cybersecurity, Information Technology, or equivalent experience.
• 4-5 years of experience in one or more of the following:
  • Security incident response
  • Product security
  • Software or hardware development
  • Secure software development lifecycle (SSDLC)
  • Vulnerability management
  • Security engineering
• Experience working directly with technical engineering teams.
• Understanding of common security concepts including:
  • Security testing methodologies
  • CVEs and CVSS scoring
  • Secure development practices
• Self-motivated and proactive, with a positive attitude and willingness to take ownership of problems through resolution.
• Flexible and adaptable, with the ability to support a variety of product security activities beyond incident response, including compliance assessments, audit readiness activities, regulatory initiatives, and policy development.
• Ability to prioritize competing demands and remain effective in fast-paced or time-sensitive situations.
• Excellent written and presentation communication skills, including the ability to communicate effectively with both technical and non-technical audiences.
• Strong documentation skills, including development of reports, incident records, compliance evidence, and executive summaries.
• Experience participating in or leading a PSIRT, CSIRT, SOC, Security Engineering, Product Security, or Incident Response team.
• Familiarity with product security regulations and standards such as CRA, NIST SSDF, IEC 62443, ISO 27001, or CISA guidance.
• Experience supporting compliance assessments, audits, attestations, or cybersecurity governance programs.
• Knowledge of software development, DevSecOps, cloud platforms, embedded systems, or hardware development environments.
• Experience with vulnerability disclosure programs and external security researchers.