Product Security Lead

Donaldson is committed to solving the world’s most complex filtration challenges. Together, we make cool things. As an established technology and innovation leader, we are continuously evolving to meet the filtration needs of our changing world. Join a culture of collaboration and innovation that matters and a chance to learn, effect change, and make meaningful contributions at work and in communities.

We are looking for a Product Security Lead who will be responsible for establishing and operating Donaldson’s global product security incident management and vulnerability lifecycle capabilities across all product lines.

This role serves as the single point of contact for product security incidents and vulnerability management, ensuring timely identification, remediation, disclosure, and reporting in alignment with regulatory requirements, including the EU Cyber Resilience Act (CRA).

The position partners closely with Business Operations, Product Engineering, IT, Legal, Privacy, and regional stakeholders to enable secure product development, transparency of software components, and effective responses to vulnerabilities.

The Product Security Lead serves as a trusted advisor to leadership on product security posture, vulnerability risk, and regulatory readiness.

Key Responsibilities

1. Product Security Incident Management (PSIM) & Leadership

• Serve as the designated PSIM for all product-related vulnerabilities and security incidents
• Lead the end-to-end lifecycle of product security vulnerabilities, including identification, triage, remediation, and communication
• Coordinate cross-functional response efforts across Product, Corporate Engineering, Legal, and Communications teams

2. Vulnerability Management & Remediation

• Establish and operate continuous vulnerability monitoring processes for digital products and associated electronic components
• Ensure vulnerabilities are assessed, prioritized, and remediated without delay in alignment with regulatory expectations
• Oversee the development and secure distribution of patches and security updates to customers

3. Software Quality Assurance & SBOM Management

• Maintain and govern a machine-readable Software Bill of Materials (SBOM) for products
• Collaborate with the Application Security specialist in providing services for product teams
• Ensure SBOM accuracy and completeness to support vulnerability tracking and regulatory transparency

4. Coordinated Vulnerability Disclosure (CVD)

• Establish and manage external vulnerability disclosure channels
• Ensure timely publication of vulnerability disclosures following remediation
• Align disclosure practices with industry standards and regulatory requirements. Regulatory Reporting & Compliance
• Initially focused on compliance with the EU CRA, executing regulatory reporting obligations, including mandated timelines for vulnerability and incident reporting
• Serve as the primary liaison with external authorities (e.g., EU ENISA and other regulators)
• Maintain required technical documentation and compliance artifacts to support regulatory review

5. Monitoring Lifecycle Security & Support Obligations

• Ensure products are supported with security updates throughout their defined lifecycle
• Partner with Product and Corporate Engineering teams to integrate security maintenance into product roadmaps

5. Enterprise Product Security Architecture Alignment

• Translate product security strategy and regulatory requirements into scalable processes, standards, and operating models
• Partner with Product, Engineering, and Architecture teams to embed secure-by-design principles across the development lifecycle
• Contribute to the definition and adoption of enterprise capabilities, including SBOM standards, vulnerability management processes, and PSIRT operating procedures
• Ensure alignment of product security practices with internal policies, ISMS requirements, and global regulatory frameworks
• Identify gaps in product security capabilities and drive implementation of improvements to enhance consistency and scalability

6. Documentation, Metrics & Continuous Improvement

• Develop and maintain metrics and reporting to track vulnerability management effectiveness and regulatory readiness
• Improve processes for vulnerability management, disclosure, and reporting
• Ensure documentation is maintained in support of auditability and compliance

Minimum Qualifications

• Bachelor’s degree in Cybersecurity, Computer Science, Engineering, or related field (or equivalent experience)
• Minimum 5+ years of experience in application security, product security, or quality assurance
• Experience managing vulnerability lifecycles, including triage, remediation, and disclosure
• Strong understanding of secure software development and software supply chain risks (including SBOM)
• Ability to coordinate cross-functional teams and communicate risk to technical and non-technical stakeholders

Preferred Qualifications

• Master’s degree in Cybersecurity, Computer Science, Engineering, or related field (or equivalent experience)
• Experience with EU CRA or similar regulatory requirements
• Experience in vulnerability and incident response, or equivalent function
• Understanding of secure-by-design concepts and best practices
• Familiarity with vulnerability disclosure frameworks and practices
• Experience supporting regulatory reporting and audits
• Relevant security professional certifications (CISSP, CISSP, CSSLP, CISM, or equivalent)

Employment opportunities for positions in the United States may require use of information which is subject to the export control regulations of the United States. Hiring decisions for such positions are required by law to be made in compliance with these regulations. Applicants for employment opportunities in other countries must be able to meet the comparable export control requirements of that country and of the United States.

Donaldson Company has been made aware that there are several recruiting scams that are targeting job seekers. These scams have attempted to solicit money for job applications and/or collect confidential information, Donaldson will never solicit money during the application or recruiting process. Donaldson only accepts online applications through our Careers | Donaldson Company, Inc. website and any communication from a Donaldson recruiter would be sent using a donaldson.com email address. If you have any questions about the legitimacy of an employment opportunity, please reach out to [email protected] to verify that the communication is from Donaldson.

Our policy is to provide equal employment opportunities to all qualified persons without regard to race, gender, color, disability, national origin, age, religion, union affiliation, sexual orientation, veteran status, citizenship, gender identity and/or expression, or other status protected by law.