SDLC Security & Compliance Lead | IEC 62443 Expert

Inductive Automation LLC; Oregon; Hybrid; USD 140,000 - 190,000; Full time

Benefits offered by this job

Health care covered

401k with match

Paid time off

Job summary

Inductive Automation LLC seeks an SDLC Security and Compliance Lead to define, refine, and document standards ensuring our software development lifecycle meets IEC 62443 and EU CRA regulatory obligations. This role aligns practices, owns policy documents, and supports audits and certifications, while coordinating vulnerability disclosure and incident management with IT/Cyber teams.

Hybrid/remote, full-time.

Qualifications

• Technical Bachelor's Degree required (computer science, engineering, software development, or cybersecurity)
• Relevant Master's Degree or demonstrated equivalent experience required
• Cybersecurity certification or equivalent demonstrated experience required (CISSP, GICSP, or ISA/IEC 62443 Cybersecurity Expert)
• Experience (8 years required; 15+ years preferred)
• Software development experience (not necessarily writing code; design, testing, assurance, management, etc); agile preferred
• Extensive security or compliance audit experience (required); ISO Lead Auditor or equivalent with experience
• Extensive experience with policy and process documentation (required)
• Delivering software in controlled or regulated environment
• Incident management or coordinated vulnerability disclosure program experience
• Communicating with and presenting to executive leadership

Responsibilities

• Serving as subject matter expert and working lead for IEC 62443 certifications; owning the gap between the standard's requirements and Inductive Automation practice
• Monitoring practice changes in Development and Quality Assurance that could create compliance drift; supporting corrective actions and nonconformance activities
• Tracking security roadmap and EU Cyber Resilience Act product-level requirements
• Supporting external security and compliance requirements as needed / requested (e.g. Life Sciences, automotive, aerospace, Dept of Defense, US/EU law or regulation, etc)
• Participating in ISO and CRA conformity audits as the Software Engineering representative; prepare and maintain auditable evidence (tickets, code reviews, QA records)
• Coordinating on third party penetration testing; incorporating results into the SDLC ticket process
• Owning day-to-day currency of process documents. Maintains the mapping between committed standards (e.g. 62443, ISO 27001) practices and QMS documentation
• Maintaining SDLC traceability from code change through reviews, tests, requirements, and customer tickets
• Verifying Release Checklist completion as compliance evidence for all production software, including hotfixes
• Responsible for the Software Engineering portion of the Coordinated Vulnerability Disclosure and incident management program, in coordination with other stakeholders; keeps the playbook and process documentation current, with awareness of reporting requirements
• Maintaining Incident Manager qualification and training for Software Engineering personnel with defined CVD roles; drive post-incident lessons learned into process and training
• Supporting Ignition Coordinated Vulnerability Disclosure. Coordinating with CISA/NVD, communicating with external researchers and stakeholders, and managing disclosure and release timing; supporting ENISA reporting requirements per compliance with the EU CRA
• Running internal readiness checks and pre-audit gap assessments; tracks personnel qualification
• Identifying training gaps and coordinate delivery with engineering managers and leadership
• Consulting on Threat Modeling and participating in related activities

Skills

IEC 62443

ISO 27001

CISSP

GICSP

ISA/IEC 62443 Cybersecurity Expert

Audit experience

Policy documentation

Executive briefing

Education

Bachelor's degree in CS/Engineering/Cybersecurity

Master's degree preferred

Job description

Inductive Automation LLC seeks an SDLC Security and Compliance Lead to define, refine, and document standards ensuring our software development lifecycle meets IEC 62443 and EU CRA regulatory obligations. This role aligns practices, owns policy documents, and supports audits and certifications, while coordinating vulnerability disclosure and incident management with IT/Cyber teams.

Hybrid/remote, full-time.