{"id":792398,"url":"https://alion.io/job/itron-principal-product-security","title":"Principal, Product Security","company":{"id":5951,"name":"Itron","domain":"itron.com","url":"https://alion.io/company/itron","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":{"grade":"B","score":83,"open_postings":11,"ghost_share":0.091,"stale_share":0.364,"repost_share":0.182,"time_to_fill_p50_days":39,"computed_at":"2026-11-03T05:54:40Z"}},"role":"Security","role_family":"Security","seniority":"lead","employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Austin, United States","Washington, United States","Chicago, United States","Raleigh, United States","United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":96000,"max":165000,"currency":"USD","period":"year","gross":null,"usd_annual":165000},"salary_estimate":null,"experience_years_min":7,"visa_sponsorship":false,"relocation_package":false,"has_equity":true,"technologies":[{"name":"Agile","optional":false},{"name":"Azure DevOps","optional":false},{"name":"CI/CD","optional":false},{"name":"GitHub","optional":false},{"name":"GitHub Actions","optional":false},{"name":"GitLab","optional":false},{"name":"Jenkins","optional":false},{"name":"Least Privilege","optional":false},{"name":"OWASP","optional":false},{"name":"OWASP Top 10","optional":false},{"name":"PowerShell","optional":false},{"name":"Python","optional":false},{"name":"SBOM","optional":false},{"name":"Terraform","optional":false},{"name":"Threat Modeling","optional":false},{"name":"AWS","optional":true},{"name":"Azure","optional":true},{"name":"Bitbucket","optional":true},{"name":"CloudFormation","optional":true},{"name":"CMMC","optional":true},{"name":"GitLab CI","optional":true},{"name":"ISO 27001","optional":true},{"name":"Open Policy Agent","optional":true},{"name":"OWASP SAMM","optional":true},{"name":"SLSA","optional":true},{"name":"SOC 2","optional":true}],"status":"live","first_seen_at":"2026-09-11T00:00:00Z","employer_posted_date":"2026-09-11","last_verified_at":"2026-11-03T09:56:11Z","board_verified":true,"closed_at":null,"days_open":53,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":53},"description":"Itron is innovating new ways for utilities and cities to manage energy and water. We create a more resourceful world to protect essential resources for today and tomorrow. Join us.\nItron, Inc. (NASDAQ: ITRI) is a global technology and services company dedicated to the resourceful use of energy and water. With more than 300 million deployed endpoints worldwide, Itron is a leader in IoT innovation, helping utilities and cities create a more sustainable, connected, and resourceful future.\nAs a member of the Information Security team, you will serve as the senior technical leader responsible for advancing Itron's product security program across software development, cloud, and engineering environments. This role focuses on securing source code, software supply chains, CI/CD pipelines, and product architectures while enabling agile, customer-centric development practices. You will collaborate closely with Product Development, DevOps, Cloud Engineering, Enterprise Architecture, and Cybersecurity teams to design and implement scalable security solutions that protect Itron products and services throughout the development lifecycle.\nDuties & Responsibilities\nLead the architecture and engineering of security controls that protect source code repositories, development environments, build systems, software supply chains, and release processes.\nDesign and implement secure CI/CD pipeline patterns, artifact management controls, signing services, and deployment workflows that ensure software integrity from code commit through product release.\nPartner with security-by-design and application security testing teams to operationalize security requirements, vulnerability management, threat modeling outcomes, and release controls.\nEstablish and promote secure application and API security standards, including authentication, authorization, secure coding practices, data protection, logging, and abuse prevention.\nCollaborate with engineering teams to reduce application, API, and cloud attack surfaces through secure architecture, identity management, and least-privilege access models.\nDrive modernization of development and engineering environments to mitigate risks associated with credential compromise, malicious code, dependency attacks, and unauthorized releases.\nIntegrate security capabilities across source control, CI/CD platforms, cloud services, artifact repositories, governance tools, and security monitoring solutions.\nAutomate security controls and operational processes using APIs, infrastructure-as-code, and scripting technologies such as Python, PowerShell, Terraform, GitHub Actions, Azure DevOps, Jenkins, and GitLab.\nEstablish security logging, monitoring, and detection requirements for software development and release environments in partnership with security operations teams.\nDevelop secure architecture guardrails, reference standards, operational procedures, and technical documentation that support scalable and innovative product delivery.\nEnsure auditable evidence exists for software supply chain controls, artifact integrity, release approvals, SBOM generation, and regulatory or customer assurance requirements.\nMentor engineers and influence cross-functional teams to adopt secure, customer-focused, collaborative, and accountable engineering practices across global product environments.\nRequired Skills & Experience\nBachelor's degree in Computer Science, Information Systems, Cybersecurity, or a related field; or an equivalent combination of education and experience.\n\n7+ years of experience in cybersecurity, product security, application security, software engineering, DevSecOps, cloud security, or a related technical discipline.\n\n5+ years of hands-on experience securing software development environments, source code platforms, CI/CD pipelines, or software supply chains.\nExpert-level experience designing and operating security controls across cloud, SaaS, enterprise, and product engineering environments.\nStrong knowledge of software supply chain security, source code protection, secrets management, privileged access management, artifact integrity, dependency governance, and secure release practices.\nDeep understanding of application and API security principles, including OWASP Top 10, OWASP API Security Top 10, secure coding practices, and modern authentication and authorization models.\nExperience troubleshooting complex issues involving source control systems, build platforms, deployment pipelines, artifact repositories, and release management processes.\nExperience implementing path-to-production controls including policy enforcement, release gates, exception management, evidence collection, and deployment readiness criteria.\nDemonstrated ability to communicate technical risk and recommendations effectively to engineering leadership and executive stakeholders.\nProven ability to influence diverse teams and drive adoption of secure, innovative, and agile engineering practices.\nStrong written, verbal, and stakeholder-management skills.\nPreferred Skills & Experience\nProfessional certifications such as CISSP, CSSLP, CCSP, GIAC GWEB, GWAPT, GCSA, AWS Security Specialty, Microsoft Certified: Cybersecurity Architect Expert, or equivalent security certifications.\n\nHands-on experience with GitHub, GitLab, Azure DevOps, Bitbucket, or similar platforms, including branch protection, code review workflows, signed commits, repository permissions, and secret scanning.\nExperience securing CI/CD platforms such as Jenkins, GitHub Actions, Azure DevOps, and GitLab CI, along with artifact repositories, package registries, and deployment automation solutions.\nKnowledge of secure product architecture, deployment security, artifact signing, provenance, SBOM practices, and release integrity controls.\nFamiliarity with software supply chain security frameworks and practices including SLSA, NIST SSDF, OWASP SAMM, and OWASP Top 10.\nExperience applying application and API security principles across web, cloud, mobile, embedded, and service-based architectures.\nExperience using Terraform, AWS CloudFormation, Open Policy Agent, Python, PowerShell, and policy-as-code approaches to automate security controls.\nUnderstanding of modern product security threats including dependency confusion, malicious packages, source code tampering, credential theft, build pipeline compromise, and release artifact manipulation.\nExperience supporting regulated environments aligned with ISO 27001, SOC 2, NIST, CMMC, IEC 62443, or comparable frameworks.\nTravel: Less than 25%.\nBenefits Info:\nThis position also includes a competitive benefit package including; financial, social, health and wellbeing programs, paid vacation, 401k matching, employee stock purchase program, hybrid work schedule, and more!\nThe successful candidate’s starting salary will be determined based on permissible, non-discriminatory factors such as skills and experience and may vary by location. The base salary is $96,000-165,000 annually. This position is eligible for our annual bonus program.\nItron is committed to building an inclusive and diverse workforce and providing an authentic workplace experience for all employees. If you are excited about this role but your past experiences don't perfectly align with every requirement, we encourage you to apply anyway. In the end, you may be just who we are looking for!\nThe successful candidate's starting wage will be determined based on permissible, non-discriminatory factors such as skills and experience.\nItron is proud to be an Equal Opportunity Employer. If you require an accommodation to apply, please contact a recruiting representative at 1-800-635-5461 or email .\nItron is transforming how the world manages energy, water and city services. Our trusted intelligent infrastructure solutions help utilities and cities improve efficiency, build resilience and deliver safe, reliable and affordable service. With edge intelligence, we connect people, data insights and devices so communities can better manage the essential resources they rely on to live. Join us as we create a more resourceful world: www.itron.com","description_format":"text","description_chars":8132,"description_truncated":false,"requirements":{"experience_years_min":7,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[]},"benefits":["401k plan","Hybrid work"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["IoT Platforms & Solutions","Smart Grid","Application Security"],"lifecycle":[{"event":"open","at":"2026-09-12T03:53:53Z"}],"visa":[{"country":"US","licensed_sponsor":true,"evidence":"H-1B filings in 12 months: 41 · green card filings: 9","filings_12m":41,"filings_prev_12m":58,"green_card_filings_12m":9,"median_offered_wage_usd":128900,"route":null,"cap_exempt":false,"checked_at":"2026-10-29T16:27:21+00:00","sources":["US Department of Labor: LCA disclosure data (H-1B, H-1B1, E-3)","US Department of Labor: PERM disclosure data (green cards)"],"filings_for_role_12m":2}],"liveness":{"score":42,"band":"fade","label":"Fading","p_open":1,"p_active":0.756,"p_room":0.55,"age_days":53,"expected_fill_days":39,"reasons":["conf:1","velocity","win:tail"],"computed_at":"2026-11-03T05:54:40Z"},"pay":{"stated_usd_annual":165000,"is_top_pay":false},"html_url":"https://alion.io/job/itron-principal-product-security","json_url":"https://alion.io/job/itron-principal-product-security.json","meta":{"generated_at":"2026-11-03T19:35:13Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":1836,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-04T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":5951},"rest":"https://alion.io/mcp/rest/get_company?id=5951"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fitron-principal-product-security"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fitron-principal-product-security"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fitron-principal-product-security"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/itron-principal-product-security\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fitron-principal-product-security"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":792398}},{"tool":"search_jobs","arguments":{"company":"itron.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":792398},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}