Senior Engineer, Application and Product Security

Vernovis, Ltd.; Westerville (OH); On-site; USD 130,000 - 155,000; Full time

Job summary

Vernovis, Ltd. in Westerville, OH is seeking a Senior Engineer, Application and Product Security to lead certification efforts and secure software development initiatives across products.

You will collaborate with engineering, security, and business teams to map requirements to frameworks and drive secure design and implementation. The role emphasizes hands-on security control catalogs, cross-functional communication, and alignment with NIST OSCAL and industry standards to support customer

Qualifications

• Bachelor's degree in IT, CS, Engineering, or related field.
• 7+ years in IT, Engineering, or Security including 3+ years in Product Security.
• Experience with security frameworks and certification efforts (IEC 62443, NIST, ISO 27001, FedRAMP, SOC 2).

Responsibilities

• Support product security certification activities across IEC 62443, ISO 27001, SOC 2, FedRAMP, NIST, and related standards.
• Maintain SSDF alignment with evolving standards, regulations, and best practices.
• Map regulatory obligations into security requirements with traceability.
• Manage security requirement changes via Git/GitLab, including branching and MR reviews.
• Collaborate with Engineering, IT, GRC, Procurement, and Supply Chain to implement security requirements.
• Support customer security questionnaires and certification documentation.

Skills

Security requirements mapping

Cross-functional collaboration

Stakeholder management

Technical communication

Education

Bachelor's degree in IT / Computer Science / Engineering

Tools

Git

NIST OSCAL

JSON

YAML

Job description

Job Title: Senior Engineer, Application and Product Security

Location/ Work Structure: Westerville, OH | On-site 5 days per week

Compensation: Salary or Hourly: $130,000–$155,000 annually

Who we are:

Vernovis is a Total Talent Solutions company that specializes in Technology, Cybersecurity, Finance & Accounting functions. At Vernovis, we help these professionals achieve their career goals, matching them with innovative projects and dynamic direct hire opportunities in Ohio and across the Midwest.

Client Overview:

Vernovis partnering with a global technology organization seeking a Senior Engineer, Application and Product Security to support product security certifications, regulatory compliance, and secure software development initiatives. This role will work cross-functionally with engineering, security, and business teams to ensure products and applications meet evolving industry standards and security requirements.

What You'll Do:

Support product and application security certification activities across industry frameworks, including IEC 62443, UL 2900, ISO 27001, SOC 2, FedRAMP, and NIST 800-171.

Maintain, enhance, and align organizational security requirements and the Secure Software Development Framework (SSDF) with evolving industry standards, regulations, and best practices.

Author, review, and maintain security requirements, control catalogs, profiles, crosswalks, and mappings using NIST OSCAL in structured JSON formats.

Map regulatory obligations, including the EU Cyber Resilience Act (CRA), into security requirements with documented traceability to assessment objectives and supporting evidence.

Manage security requirement changes through Git/GitLab, including branching, merge requests, collaborative reviews, and stakeholder approvals.

Partner with Engineering, Application, IT, GRC, Procurement, and Supply Chain teams to implement security requirements, support vendor compliance, and guide product certification efforts.

Support engineering and development teams in understanding security requirements, improving secure development practices, and achieving higher security maturity levels.

Collaborate with internal stakeholders to support customer security questionnaires, certification documentation, reporting, and continuous improvement initiatives.

What Experience You'll Have:

Bachelor's degree in Information Technology, Computer Science, Engineering, or a related field, with 7+ years of experience in IT, Engineering, or Security, including at least 3 years specifically in Product Security.

Experience supporting product security frameworks, industry standards, and certification efforts, including IEC 62443, NIST, ISO 27001, FedRAMP, SOC 2, or comparable standards.

Hands-on experience with Git, including branching, merge requests, version control, and collaborative review of structured documentation.

Experience with NIST OSCAL or equivalent machine-readable security control catalogs, profiles, and mappings using JSON or YAML.

Demonstrated experience mapping regulatory and industry frameworks into organizational security requirements, along with strong communication, stakeholder management, and cross-functional collaboration skills.

What Experience is Nice to Have:

Experience with IEC 62443, embedded device security, and product security certification processes.

Experience performing or supporting penetration testing of embedded devices and connected products.

Experience leveraging AI tools, including coding assistants and document-analysis tools, to accelerate security requirement mapping, documentation, drafting, and review.