{"id":3045225,"url":"https://alion.io/job/johnson-controls-manager-product-security-engineering","title":"Manager, Product Security Engineering","company":{"id":448321,"name":"Johnson Controls","domain":"johnsoncontrols.com","url":"https://alion.io/company/johnsoncontrols-3","size_band":"5000+","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":{"grade":"B","score":84,"open_postings":757,"ghost_share":0.001,"stale_share":0.62,"repost_share":0.013,"time_to_fill_p50_days":22,"computed_at":"2026-10-22T06:10:10Z"}},"role":"Security","role_family":"Security","seniority":null,"employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Westford, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":116000,"max":170000,"currency":"USD","period":"year","gross":null,"usd_annual":170000},"salary_estimate":null,"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"CI/CD","optional":false},{"name":"Threat Modeling","optional":false},{"name":"ISO 27001","optional":true},{"name":"SBOM","optional":true},{"name":"STRIDE","optional":true}],"status":"live","first_seen_at":"2026-10-21T00:00:00Z","employer_posted_date":"2026-10-21","last_verified_at":"2026-10-23T02:02:19Z","board_verified":true,"closed_at":null,"days_open":2,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":2},"description":"Johnson Controls Fire Solutions is seeking a strategic and technical Manager, Product Security Engineering to lead the implementation and execution of engineering ownership and execution of product security across a global portfolio of fire detection and suppression across life safety product domains including embedded firmware, connected devices, cloud platforms, mobile applications, and digital services.\nResponsible for defining and advancing the Fire Solutions product security execution strategy and roadmap in alignment with Global Cybersecurity standards and enterprise security objectives. The Manager will establish scalable security processes, lead cybersecurity risk and vulnerability management programs, drive application cyber regulation and corporate initiatives compliance, and develop an AI security threat response and governance capability.\nThe successful candidate will provide leadership across a complex global ecosystem of hardware, firmware, software, cloud, and IoT solutions, ensuring security is effectively integrated throughout the product lifecycle. This individual will translate cybersecurity requirements into practical engineering processes, improve security operational efficiency, and promote a culture of security ownership across the Fire Solution Engineering organization.\nThis position is critical to maintaining customer trust, meeting evolving cybersecurity expectations, supporting regulatory compliance initiatives, and ensuring the long-term success and resilience of the Fire Solutions business.\nKey Responsibilities\nProduct Security Leadership\nPartner with Johnson Controls Enterprise Security to establish security governance, policies, standards, and risk management frameworks across the product portfolio.\nServe as the senior engineering leader for product cybersecurity within Fire Solutions, partnering closely with Global Cybersecurity to operationalize security strategy, standards, governance, and risk management practices.\nDrive a culture of security-by-design, accountability, and continuous improvement throughout the organization.\nServe as the lead security architect for Fire Solutions Engineering, providing guidance on secure architecture decisions across firmware, cloud, mobile, IoT, and enterprise-connected systems.\nDefine and drive the engineering adoption of DevSecOps practices including automated security testing, software supply chain security, CI/CD security controls, secrets management, and approved developer security tooling in partnership with Global Cybersecurity.\nDevelop reusable security patterns, reference architectures, training materials, and engineering guidance that enable teams to independently build secure products.\nSecurity Governance & Compliance Execution\nLead engineering adoption and execution of cybersecurity governance processes across the product development lifecycle.\nPartner with Regulatory Affairs, Quality, Legal, and Engineering teams to operationalize cybersecurity requirements associated with emerging regulations and industry standards.\nTranslate regulatory cybersecurity requirements into scalable engineering processes, controls, documentation, and compliance evidence.\nSupport audit readiness activities, security assessments, certifications, and regulatory reviews.\nEnsure cybersecurity requirements are integrated into product development, release, maintenance, and end-of-life processes.\nMonitor industry trends, emerging threats, and evolving cybersecurity requirements to continuously improve security capabilities.\nProduct Security Program Management\nDrive adoption of secure development lifecycle (SSDLC) practices across hardware, firmware, software, cloud, mobile, and IoT product teams.\nLead threat modeling, security architecture reviews, risk assessments, and security design reviews.\nEstablish consistent security requirements for new product introductions and major platform enhancements.\nOversee security testing programs, penetration testing activities, and security validation processes.\nEnsure security requirements are embedded throughout all phases of the product lifecycle.\nVulnerability Management & Incident Response\nEstablish and oversee global product vulnerability management processes.\nLead coordinated vulnerability disclosure and external vulnerability response activities.\nLead engineering coordination and remediation activities for product cybersecurity incidents in partnership with Global Cybersecurity incident response teams.\nDevelop remediation prioritization frameworks and risk-based decision-making processes.\nSupport customer communications and executive briefings related to cybersecurity issues and product security events.\nDrive continual improvements in vulnerability response timelines and remediation effectiveness.\nAct as the engineering security lead during critical vulnerability investigations and product cybersecurity incidents, coordinating root cause analysis, containment, remediation, and executive communications.\nSecurity Process Excellence & Operational Efficiency\nDesign and implement scalable security processes that can be consistently adopted across global engineering organizations.\nIdentify opportunities to improve efficiency through process optimization, automation, and AI-assisted workflows.\nEstablish repeatable methods for security reviews, compliance evidence generation, risk assessments, and vulnerability tracking.\nDefine and measure operational performance indicators that demonstrate security program effectiveness and business impact.\nReduce friction in engineering processes while improving security outcomes and compliance readiness.\nDefine and maintain product security KPIs including vulnerability remediation performance, threat modeling coverage, SSDLC adoption, penetration testing completion, software supply chain risk posture, and security defect escape rates.\nRequired Qualifications\nBachelor’s degree in computer science, Cybersecurity, Engineering, Information Technology, or a related technical discipline.\n10+ years of combined experience in software engineering, cloud engineering, DevSecOps, product security, application security, or cybersecurity leadership roles with demonstrated hands-on technical expertise.\nDemonstrated success developing and executing product security strategies within complex technology organizations.\nStrong knowledge of product security, secure development practices, cloud security, IoT security, and vulnerability management.\nExperience working closely with enterprise cybersecurity teams to implement governance, standards, and risk management frameworks.\nProven ability to drive cross-functional initiatives across engineering, product management, quality, and regulatory organizations.\nExcellent leadership, communication, stakeholder management, and executive presentation skills.\nHybrid position out of JCI Westford office, expected to be in the office 3 days a week.\nPreferred Qualifications\nMaster's degree in Cybersecurity, Computer Science, Engineering, Business, or a related field.\nIndustry certifications such as CISSP, CISM, CRISC, CSSLP, GIAC, or equivalent.\nExperience supporting products subject to cybersecurity regulations and compliance frameworks.\nKnowledge of cybersecurity standards and frameworks including NIST, IEC 62443, ISO 27001, UL cybersecurity standards, and related industry practices.\nExperience with SBOM and software supply chain security\nExperience with threat modeling methodologies such as STRIDE\nExperience leading remediation of critical vulnerabilities and security incidents\nHIRING SALARY RANGE: $116,000 - $170,000 (Salary to be determined by the education, experience, knowledge, skills, and abilities of the applicant, internal equity, and alignment with market data.) This role offers a competitive Bonus plan that will take into account individual, group, and corporate performance. This position includes a competitive benefits package. The posted salary range reflects the target compensation for this role. However, we recognize that exceptional candidates may bring unique skills and experiences that exceed the typical profile. If you believe your background warrants consideration beyond the stated range, we encourage you to apply. To support an efficient and fair hiring process, we may use technology assisted tools, including artificial intelligence (AI), to help identify and evaluate candidates. All hiring decisions are ultimately made by human reviewers. For details, please visit the About Us tab on the Johnson Controls Careers site at https://jobs.johnsoncontrols.com/about-us\nJohnson Controls International plc. is an equal employment opportunity and affirmative action employer and all qualified applicants will receive consideration for employment without regard to race, color, religion, sex, national origin, age, protected veteran status, genetic information, sexual orientation, gender identity, status as a qualified individual with a disability or any other characteristic protected by law. To view more information about your equal opportunity and non-discrimination rights as a candidate, visitEEO is the Law. If you are an individual with a disability and you require an accommodation during the application process, please visit here.","description_format":"text","description_chars":9257,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[]},"benefits":["Equity"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Information Security","HVAC & Refrigeration","Access Control & Alarm Systems","Building Automation & Controls"],"lifecycle":[{"event":"open","at":"2026-10-22T00:07:53Z"}],"visa":[{"country":"US","licensed_sponsor":true,"evidence":"H-1B filings in 12 months: 61 · green card filings: 15","filings_12m":61,"filings_prev_12m":53,"green_card_filings_12m":15,"median_offered_wage_usd":109474,"route":null,"cap_exempt":false,"checked_at":"2026-10-15T11:24:14+00:00","sources":["US Department of Labor: LCA disclosure data (H-1B, H-1B1, E-3)","US Department of Labor: PERM disclosure data (green cards)"],"filings_for_role_12m":4}],"liveness":{"score":63,"band":"ok","label":"Likely open","p_open":1,"p_active":0.632,"p_room":1,"age_days":1,"expected_fill_days":22,"reasons":["conf:2","stale_co","velocity","win:early","comp:brand"],"computed_at":"2026-10-22T06:10:10Z"},"pay":{"stated_usd_annual":170000,"is_top_pay":true},"html_url":"https://alion.io/job/johnson-controls-manager-product-security-engineering","json_url":"https://alion.io/job/johnson-controls-manager-product-security-engineering.json","meta":{"generated_at":"2026-10-23T05:43:40Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":9333,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-24T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":448321},"rest":"https://alion.io/mcp/rest/get_company?id=448321"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fjohnson-controls-manager-product-security-engineering"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fjohnson-controls-manager-product-security-engineering"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fjohnson-controls-manager-product-security-engineering"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/johnson-controls-manager-product-security-engineering\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fjohnson-controls-manager-product-security-engineering"}]}