{"id":1493231,"url":"https://alion.io/job/donaldson-product-security-lead","title":"Product Security Lead","company":{"id":1918236,"name":"Donaldson","domain":"donaldson.com","url":"https://alion.io/company/donaldson-com","size_band":"5000+","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":{"grade":"A","score":87,"open_postings":15,"ghost_share":0,"stale_share":0.733,"repost_share":0,"time_to_fill_p50_days":20,"computed_at":"2026-10-14T06:34:16Z"}},"role":"Security","role_family":"Security","seniority":"lead","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Terrassa, Spain"],"countries":["ES"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":52000,"max_usd":135000,"period":"year","method":"global_role_cell_scaled_by_country","sample_n":588},"experience_years_min":5,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Incident Management","optional":false},{"name":"SBOM","optional":false}],"status":"live","first_seen_at":"2026-08-12T00:00:00Z","employer_posted_date":"2026-08-12","last_verified_at":"2026-10-15T00:08:22Z","board_verified":true,"closed_at":null,"days_open":64,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":64},"description":"Donaldson is committed to solving the world’s most complex filtration challenges. Together, we make cool things. As an established technology and innovation leader, we are continuously evolving to meet the filtration needs of our changing world. Join a culture of collaboration and innovation that matters and a chance to learn, effect change, and make meaningful contributions at work and in communities.\nWe are looking for a Product Security Lead who will be responsible for establishing and operating Donaldson’s global product security incident management and vulnerability lifecycle capabilities across all product lines.\nThis role serves as the single point of contact for product security incidents and vulnerability management, ensuring timely identification, remediation, disclosure, and reporting in alignment with regulatory requirements, including the EU Cyber Resilience Act (CRA).\nThe position partners closely with Business Operations, Product Engineering, IT, Legal, Privacy, and regional stakeholders to enable secure product development, transparency of software components, and effective responses to vulnerabilities.\nThe Product Security Lead serves as a trusted advisor to leadership on product security posture, vulnerability risk, and regulatory readiness.\nKey Responsibilities\n1. Product Security Incident Management (PSIM) & Leadership\nServe as the designated PSIM for all product-related vulnerabilities and security incidents\nLead the end-to-end lifecycle of product security vulnerabilities, including identification, triage, remediation, and communication\nCoordinate cross-functional response efforts across Product, Corporate Engineering, Legal, and Communications teams\n2. Vulnerability Management & Remediation\nEstablish and operate continuous vulnerability monitoring processes for digital products and associated electronic components\nEnsure vulnerabilities are assessed, prioritized, and remediated without delay in alignment with regulatory expectations\nOversee the development and secure distribution of patches and security updates to customers\n 3. Software Quality Assurance & SBOM Management\nMaintain and govern a machine-readable Software Bill of Materials (SBOM) for products\nCollaborate with the Application Security specialist in providing services for product teams\nEnsure SBOM accuracy and completeness to support vulnerability tracking and regulatory transparency\n 4. Coordinated Vulnerability Disclosure (CVD)\nEstablish and manage external vulnerability disclosure channels\nEnsure timely publication of vulnerability disclosures following remediation\nAlign disclosure practices with industry standards and regulatory requirements. Regulatory Reporting & Compliance\nInitially focused on compliance with the EU CRA, executing regulatory reporting obligations, including mandated timelines for vulnerability and incident reporting\nServe as the primary liaison with external authorities (e.g., EU ENISA and other regulators)\nMaintain required technical documentation and compliance artifacts to support regulatory review\n5. Monitoring Lifecycle Security & Support Obligations\nEnsure products are supported with security updates throughout their defined lifecycle\nPartner with Product and Corporate Engineering teams to integrate security maintenance into product roadmaps\n5. Enterprise Product Security Architecture Alignment\nTranslate product security strategy and regulatory requirements into scalable processes, standards, and operating models\nPartner with Product, Engineering, and Architecture teams to embed secure-by-design principles across the development lifecycle\nContribute to the definition and adoption of enterprise capabilities, including SBOM standards, vulnerability management processes, and PSIRT operating procedures\nEnsure alignment of product security practices with internal policies, ISMS requirements, and global regulatory frameworks\nIdentify gaps in product security capabilities and drive implementation of improvements to enhance consistency and scalability\n6. Documentation, Metrics & Continuous Improvement\nDevelop and maintain metrics and reporting to track vulnerability management effectiveness and regulatory readiness\nImprove processes for vulnerability management, disclosure, and reporting\nEnsure documentation is maintained in support of auditability and compliance\n Minimum Qualifications\nBachelor’s degree in Cybersecurity, Computer Science, Engineering, or related field (or equivalent experience)\nMinimum 5+ years of experience in application security, product security, or quality assurance\nExperience managing vulnerability lifecycles, including triage, remediation, and disclosure\nStrong understanding of secure software development and software supply chain risks (including SBOM)\nAbility to coordinate cross-functional teams and communicate risk to technical and non-technical stakeholders\n Preferred Qualifications\nMaster’s degree in Cybersecurity, Computer Science, Engineering, or related field (or equivalent experience)\nExperience with EU CRA or similar regulatory requirements\nExperience in vulnerability and incident response, or equivalent function\nUnderstanding of secure-by-design concepts and best practices\nFamiliarity with vulnerability disclosure frameworks and practices\nExperience supporting regulatory reporting and audits\nRelevant security professional certifications (CISSP, CISSP, CSSLP, CISM, or equivalent)\nEmployment opportunities for positions in the United States may require use of information which is subject to the export control regulations of the United States. Hiring decisions for such positions are required by law to be made in compliance with these regulations. Applicants for employment opportunities in other countries must be able to meet the comparable export control requirements of that country and of the United States.\nDonaldson Company has been made aware that there are several recruiting scams that are targeting job seekers. These scams have attempted to solicit money for job applications and/or collect confidential information, Donaldson will never solicit money during the application or recruiting process. Donaldson only accepts online applications through our Careers | Donaldson Company, Inc. website and any communication from a Donaldson recruiter would be sent using a donaldson.com email address. If you have any questions about the legitimacy of an employment opportunity, please reach out to  to verify that the communication is from Donaldson.\nOur policy is to provide equal employment opportunities to all qualified persons without regard to race, gender, color, disability, national origin, age, religion, union affiliation, sexual orientation, veteran status, citizenship, gender identity and/or expression, or other status protected by law.","description_format":"text","description_chars":6831,"description_truncated":false,"requirements":{"experience_years_min":5,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Biotechnology","Application Security","Supply Chain","Nonprofits & Foundations"],"lifecycle":[{"event":"open","at":"2026-09-30T01:15:16Z"}],"visa":[],"liveness":{"score":11,"band":"cold","label":"Long shot","p_open":1,"p_active":0.377,"p_room":0.28,"age_days":63,"expected_fill_days":20,"reasons":["conf:0","stale_co","velocity","win:tail","crowd:brand"],"computed_at":"2026-10-14T06:34:16Z"},"pay":null,"html_url":"https://alion.io/job/donaldson-product-security-lead","json_url":"https://alion.io/job/donaldson-product-security-lead.json","meta":{"generated_at":"2026-10-15T01:26:42Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":1880,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-16T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":1918236},"rest":"https://alion.io/mcp/rest/get_company?id=1918236"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fdonaldson-product-security-lead"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fdonaldson-product-security-lead"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fdonaldson-product-security-lead"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/donaldson-product-security-lead\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fdonaldson-product-security-lead"}]}