{"id":3814789,"url":"https://alion.io/job/acronis-product-security-lead","title":"Product Security Lead","company":{"id":54327,"name":"Acronis","domain":"acronis.com","url":"https://alion.io/company/acronis","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":null},"role":"Security","role_family":"Security","seniority":"lead","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Burlington, United States","United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":200000,"max":300000,"currency":"USD","period":"year","gross":null,"usd_annual":300000},"salary_estimate":null,"experience_years_min":10,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"CI/CD","optional":false},{"name":"CVE","optional":false},{"name":"CVSS","optional":false},{"name":"EPSS","optional":false},{"name":"FedRAMP","optional":false},{"name":"GDPR","optional":false},{"name":"HIPAA","optional":false},{"name":"OWASP","optional":false},{"name":"OWASP ASVS","optional":false},{"name":"OWASP SAMM","optional":false},{"name":"Red Teaming","optional":false},{"name":"SBOM","optional":false},{"name":"SDL","optional":false},{"name":"SLSA","optional":false},{"name":"SOC 2","optional":false},{"name":"Threat Modeling","optional":false},{"name":"Verification & Validation","optional":false},{"name":"C","optional":true}],"status":"live","first_seen_at":"2026-11-05T15:37:58Z","employer_posted_date":"2026-11-05","last_verified_at":"2026-11-08T09:39:21Z","board_verified":true,"closed_at":null,"days_open":2,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":2},"description":"Acronis is a global leader in cyber protection, delivering AI-powered protection for productive MSPs in a single, natively integrated platform that unifies operations management, cybersecurity, and data protection. Driven by our mission to protect, manage and automate every workload that businesses and lives depend on, we’ve built the industry’s only all-in-one solution.We are seeking an experienced Product Security Lead to drive Acronis’ global product security strategy and assurance program across our SaaS and on-premises portfolio. This role will oversee product security governance, secure development practices, security tooling and automation, vulnerability management, and remediation assurance. Working closely with R&D, Product, and Security leadership, you will embed security throughout the software development lifecycle, strengthen our security posture, and ensure compliance with industry standards and customer expectations. The ideal candidate combines deep technical expertise with strong leadership skills and a proven ability to build scalable security programs in a global software environment.\nWHAT YOU’LL DO\nProduct Assurance Leadership and Governance\nLead and provide oversight of the product assurance program, including governance, accountability, and metrics across all product lines (SaaS and on-premises). \nDefine and maintain the product security strategy, policies, standards, and secure development lifecycle (SDL) requirements, aligned with business goals and product roadmaps. \nEstablish risk acceptance, exception, and escalation processes with clear ownership in Engineering and Product. \nReport product security posture, risk trends, and program KPIs to senior leadership. \nToolchain Strategy and Procurement\nConduct gap analysis of the Product Security toolchain, identify coverage and maturity gaps, and build the business case for tooling investments. \nEvaluate, select, and recommend appropriate tools, and manage vendor relationships. \nSecure CI/CD and Automated Security Controls\nSelect, configure, and set enforcement modes (audit, warn, block) for SAST, DAST, SCA, secrets scanning, and SBOM generation in CI/CD pipelines. \nDefine quality gates, severity thresholds, and break-the-build criteria that balance risk reduction with developer velocity. \nOversee tuning of rules and false-positive management to maintain developer trust and adoption. \nDrive software supply chain security, including dependency governance, SBOM management and distribution, build integrity, artifact signing, and provenance. \nIndependent Verification and Validation\nDefine the independent verification and validation (IV&V) code review process, including scope, triggers, reviewer qualifications, and approval thresholds for high-risk changes. \nOversee security design reviews and threat modeling for new features, architectures, and third-party integrations. \nDirect penetration testing, red team engagements, and external security assessments of products. \nVulnerability Management and Remediation Assurance\nDefine and oversee the end-to-end vulnerability management process: intake, triage, risk scoring (e.g., CVSS, EPSS, exploitability context), SLAs, and remediation. \nProvide remediation assurance by verifying that fixes are effective, complete, and free of regressions, and by tracking SLA adherence and escalating overdue items. \nManage the bug bounty and coordinated vulnerability disclosure programs, including researcher engagement, platform management, and incentive structuring. \nLead the Product Security Incident Response Team (PSIRT) function, including security advisories, CVE publication, and customer communication for critical vulnerabilities. \nCompliance and Customer Assurance\nEnsure compliance with relevant regulations, industry standards, and best practices, including GDPR, HIPAA, and ISO/IEC 27001. \nAlign products with additional product-relevant frameworks as applicable (e.g., SOC 2, NIST SSDF, OWASP ASVS/SAMM, SLSA, EU Cyber Resilience Act, NIS2). \nSupport customer security questionnaires, audits, and certification efforts (e.g., Common Criteria, FedRAMP, or other market-specific requirements). \nEngineering Enablement and Culture\nAdvise Product Management and R&D on security requirements, customer expectations, and product roadmaps. \nBuild a security champions program and deliver secure coding training to developers. \nEmbed security guidance, reusable patterns, and paved-road tooling into developer workflows. \nWork closely with R&D, Product, IT/Corporate Security, Legal, and other teams within the Acronis Group. \nTeam Collaboration and Industry Awareness\nCoordinate and collaborate with an international team of security professionals across multiple time zones. \nStay current on emerging threats, attack techniques, supply chain risks, AI/ML security, and security technologies relevant to the product portfolio. \nWHO WE’RE LOOKING FOR\n10-15 years of experience in information security, with at least 6-8 years in product security, application security, or secure SDLC. Additional leadership experience preferred. \nHands-on experience selecting, deploying, and tuning SAST, DAST, SCA, secrets scanning, and SBOM tooling in CI/CD environments, including setting enforcement policies at scale. \nExperience building or maturing an application security program using frameworks such as OWASP SAMM, BSIMM, or NIST SSDF. \nProven experience with vulnerability management programs, including risk-based prioritization, SLA governance, and remediation verification. \nProven experience leading PSIRT or incident response efforts for critical product vulnerabilities, including coordinated disclosure. \nProven experience managing a bug bounty program, including platform familiarity, researcher engagement, and incentive structuring. \nWorking knowledge of regulatory and compliance requirements for products, including GDPR, HIPAA, and ISO/IEC 27001. \nStrong understanding of technical and compliance issues for SaaS and on-premises security product companies. \nAbility to analyze complex security data and trends, build actionable plans with key stakeholders, and communicate rationale and progress to senior leadership. \nStrong verbal and written communication skills, including the ability to explain complex security concepts to non-technical stakeholders and influence engineering teams without direct authority. \nAbility to develop long-term product security strategies aligned with business goals. \nFamiliarity with modern software architectures, such as cloud-native, containers, microservices, and infrastructure as code. \nHigh integrity and ethical standards in handling sensitive and confidential information. \nStrong internal and external customer focus, with a desire to learn all aspects of the business. \nDisciplined, detail-oriented, and able to meet deadlines in a fast-paced environment while maintaining accuracy. \nOutstanding organizational, problem-solving, and multitasking skills. \nCollaborative team player, self-motivated and proactive, able to work with minimal supervision. \nNice to have: CSSLP, CISSP, CISM, or OSCP/OSWE; experience with AI/ML security; experience with regulated or certified product environments \nWHO WE ARE\nA Swiss company founded in Singapore in 2003, Acronis offers over twenty years of innovation with 15 offices worldwide and employees in 50+ countries. Acronis Cyber Protect is available in 26 languages in 150 countries and is used by over 21,000 service providers to protect more than 750,000 businesses.\nOur corporate culture centers on innovation, accountability, and impact. We encourage our people to think boldly, challenge conventional approaches, and take ownership of outcomes. As a member of our global “A-Team,” you’ll operate in a high-growth, fast-paced environment where resilience, adaptability, and a commitment to continuous improvement drive success.\nOUR INTERVIEW PRACTICES\nTo maintain a fair and genuine hiring process, we kindly ask that all candidates participate in interviews without the assistance of AI tools or external prompts. Our interview process is designed to assess your individual skills, experiences, and communication style. We value authenticity and want to ensure we’re getting to know you-not a digital assistant. To help maintain this integrity, we ask to remove virtual backgrounds and include in-person interviews in our hiring process.\nUse of AI-generated responses or third-party support during live interviews may be grounds for disqualification from the recruitment process and a full criminal, education and identification background check is required for all new hires.\nAcronis is an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to age, ancestry, color, marital status, national origin, physical or mental disability, medical condition, protected veteran status, race, religion, sex (including pregnancy), sexual orientation, gender identity or expression, or any other characteristic protected by applicable laws, regulations and ordinances.\nThe US pay range for this position is $200,000-$300,000. This range reflects the minimum and maximum total target annual compensation for this role across all U.S. locations. The actual compensation offered at the start of employment is determined based on factors including, but not limited to, experience level, knowledge, skills, and geographic location.\nIn addition to competitive compensation, this role includes a comprehensive benefits package featuring medical, dental, and vision coverage, flexible spending accounts (FSA), disability and life insurance, a 401(k) retirement plan with company match, and a generous vacation policy.","description_format":"text","description_chars":9715,"description_truncated":false,"requirements":{"experience_years_min":10,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Generous vacation","Life insurance","Retirement plans"],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Cybersecurity","Managed IT Services (MSP)","Cloud Cost & Multi-Cloud Management","Custom Software Development"],"lifecycle":[{"event":"open","at":"2026-11-05T15:37:58Z"}],"visa":[],"liveness":{"score":90,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.903,"p_room":1,"age_days":2,"expected_fill_days":27,"reasons":["conf:8","velocity","win:early"],"computed_at":"2026-11-08T05:47:12Z"},"pay":{"stated_usd_annual":300000,"is_top_pay":true},"html_url":"https://alion.io/job/acronis-product-security-lead","json_url":"https://alion.io/job/acronis-product-security-lead.json","meta":{"generated_at":"2026-11-08T12:35:35Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":26791,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-09T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":54327},"rest":"https://alion.io/mcp/rest/get_company?id=54327"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Facronis-product-security-lead"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Facronis-product-security-lead"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Facronis-product-security-lead"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/acronis-product-security-lead\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Facronis-product-security-lead"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3814789}},{"tool":"search_jobs","arguments":{"company":"acronis.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3814789},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}