Senior Product Security Architect & Engagement Lead

Zappsec Inc.; Tewksbury (MA); On-site; USD 130,000 - 170,000; Full time

Job summary

Zappsec Inc. is seeking a Principal Product Security Architect & Engagement Lead to drive end-to-end product cybersecurity assessments for customer products, including CRA-aligned evaluations, architecture reviews, threat modelling, and executive reporting.

You will guide the engagement from scoping through deliverables while ensuring export-control compliance. The role requires leadership of multidisciplinary teams, strong communication with executives, and deep knowledge of standards such as

Qualifications

• Strong experience in product cybersecurity and secure-by-design principles.
• Expertise in threat modelling, architecture review, and trust boundary analysis.
• Understanding of product lifecycle security and operational resilience concepts.
• Familiarity with secure SDLC, SBOM governance, and vulnerability management practices.
• Strong executive communication and stakeholder management capability.
• Control traceability, evidence management, release readiness, and risk calibration.
• CRA product scope, applicability and classification analysis; compliance-evidence readiness.
• PSIRT and vulnerability handling processes and coordinated disclosure.
• Experience across offensive security and security architecture domains.
• US Citizen or Green Card holder (US Person).

Responsibilities

• Lead overall engagement delivery, governance, and customer coordination.
• Conduct product security architecture assessments and threat modelling activities.
• Perform trust boundary analysis and review data flows across components.
• Oversee CRA-aligned assessment methodology, evidence readiness, and traceability.
• Evaluate operational resilience and lifecycle security controls across environments.
• Review secure-by-design implementation and product-security governance practices.
• Guide technical testing activities and validate risk prioritization and exploitability.
• Review findings and ensure consistency across outputs.
• Lead executive reporting, release readiness, and remediation discussions.
• Ensure evidence mapping aligns to CRA requirements and traceability.
• Review lifecycle security including decommissioning and data disposal.
• Assess security support-period commitments and vulnerability disclosure readiness.
• Evaluate data minimization and secure handling across ecosystems.
• Enforce export-control compliant handling of personnel, systems, and data.

Skills

Product security architecture

Threat modelling

Executive communication

Regulatory/compliance (CRA/NIST/IEC)

Export-control compliance

PSIRT & vulnerability handling

Job description

Zappsec Inc. is seeking a Principal Product Security Architect & Engagement Lead to drive end-to-end product cybersecurity assessments for customer products, including CRA-aligned evaluations, architecture reviews, threat modelling, and executive reporting.

You will guide the engagement from scoping through deliverables while ensuring export-control compliance. The role requires leadership of multidisciplinary teams, strong communication with executives, and deep knowledge of standards such as