Lead Product Security

This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for a Lead Product Security based in Canada. This is a senior technical leadership role responsible for embedding security throughout the product development lifecycle. You will shape secure architecture, design reviews, threat modeling, and secure-by-default standards across product engineering. The role combines hands-on security expertise with developer enablement, mentoring, and organizational security maturity. You will work across application security tooling, secure code review, product supply chain security, and vulnerability response. A key focus is scaling security capabilities through Security Champions, training, reusable guidance, and measurable improvement programs. You will collaborate closely with engineering, security operations, PSIRT, and other stakeholders on high-impact security initiatives. The position offers broad autonomy and the opportunity to influence how secure software is designed, built, assessed, and maintained. \n Accountabilities: - Lead security architecture and design reviews across core product lines, providing actionable guidance before implementation begins. - Contribute to and scale threat modeling practices by coaching engineers to conduct their own models and reviewing results. - Define security requirements, design gates, product security baselines, and standards that establish a practical definition of secure-by-default. - Build and measure secure development lifecycle practices across SCA, SAST, DAST, secret scanning, dependency management, and build pipeline integrity. - Conduct deep secure code reviews in high-risk areas such as authentication, authorization, cryptography, secrets management, and input validation.

- Strengthen product supply chain and release security, including SBOM generation and the integrity of build and distribution artifacts. - Develop and expand the Security Champions program through recruitment, training, enablement content, office hours, and outcome tracking. - Mentor engineers and security professionals on secure design, threat modeling, and secure code review to scale security expertise across teams. - Coordinate penetration tests and third-party security assessments, triaging findings and driving remediation through completion. - Partner with PSIRT on product vulnerability triage, remediation, and coordinated response, using root-cause insights to improve engineering and SDLC controls. - Assess product security maturity using frameworks such as BSIMM or SAMM and drive a prioritized improvement roadmap. - Support secure-by-design regulatory requirements, including the EU Cyber Resilience Act, through technical evidence and process improvements. - Provide subject matter expertise for customer security questionnaires, audits, RFPs, and security escalations, while building reusable, vetted response documentation. - Support incident response involving product code, build systems, or product infrastructure with product-specific security expertise and remediation guidance. - Lead discrete technical workstreams, track milestones, and contribute to application security tooling evaluations and proof-of-concepts. Requirements - Bachelor’s degree in Computer Science, Information Security, Information Technology, or equivalent practical experience. - 8+ years of experience in product security, application security, or software security engineering, with strong hands-on experience in secure design reviews, threat modeling, and secure code review. - Experience building or operating a Security Champions program, developer security training initiative, or comparable security enablement program. - Strong knowledge of application security tooling, including SCA, SAST, DAST, and secret scanning, along with an understanding of their detection capabilities and limitations.