Principal Product Security Architect & Engagement Lead Role Summary • Lead and govern the end-to-end product lifecycle cybersecurity assessment engagement for the customer product including: • CRA-aligned security evaluation, architecture assessment, threat modelling, technical oversight, evidence traceability, and executive reporting. • Accountable for leading all the discussions during the assessment including product applicability, intended use analysis, classification, Risk-based decisions, test-plan quality, change control, customer workshops, executive reporting, and escalation of material risks. • Serve as the primary customer interface and ensure all assessment activities are executed in compliance with export-control requirements. Key Responsibilities • Lead overall engagement delivery, governance, and customer coordination, including multidisciplinary team leadership, workstream ownership, estimation, change control, customer workshops, executive reporting, and difficult-risk communication • Conduct product security architecture assessments and threat modelling activities, including attack-tree, abuse-case, misuse-case, secure-update, rollback, recovery and safe-state architecture analysis • Perform trust boundary analysis and review data flows across product components and external integrations • Oversee CRA-aligned assessment methodology, compliance traceability, and lifecycle security evaluation, including CRA product scope, applicability and classification analysis, essential-requirement interpretation, conformity-assessment strategy, technical-documentation readiness, and compliance-evidence readiness • Evaluate operational resilience, recovery considerations, and lifecycle security controls across deployed product environments • Review secure-by-design implementation and product security governance practices • Guide technical testing activities and validate risk prioritization and exploitability context • Review security findings and ensure consistency across technical and compliance outputs • Lead executive reporting, release readiness assessment, and remediation discussions • Ensure evidence collection and assessment outputs align to CRA requirements, with control traceability, findings calibration, residual-risk governance, release-readiness conclusions, and defensible evidence mapping • Review lifecycle security considerations including secure decommissioning and data disposal practices • Assess security support-period commitments, update strategy, coordinated vulnerability disclosure, post-market vulnerability handling, incident-reporting readiness, and product logging, monitoring and auditability architecture • Evaluate connected-system and ecosystem-impact considerations, data minimization, sensitive-data handling, security-control design, and control effectiveness across product environments • Enforce export-control compliant handling of personnel, systems, and data • Provide final quality assurance and assessment signoff oversight Required Skills & Experience Mandatory: • Strong experience in product cybersecurity and secure-by-design principles, including product security architecture, secure-by-design governance, security-control design and effectiveness evaluation • Expertise in threat modelling, architecture review, and trust boundary analysis, including attack-tree, abuse-case, misuse-case, data-flow, data-minimization and sensitive-data analysis • Strong understanding of product lifecycle security and operational resilience concepts • Familiarity with secure SDLC, SBOM governance, and vulnerability management practices • Strong executive communication and stakeholder management capability • Control traceability, evidence management, release readiness, residual-risk assessment, findings calibration, negotiation, executive escalation, and material-risk communication • CRA product scope, applicability and classification analysis; CRA essential-requirement interpretation; conformity-assessment strategy and readiness; technical-documentation and compliance-evidence readiness • PSIRT and vulnerability handling processes, coordinated vulnerability disclosure, security support-period and update-strategy assessment, post-market vulnerability and incident-reporting readiness • NIST SSDF OR IEC 62443-4-1/4-2 frameworks; compliance and regulatory security assessments; product cybersecurity risk assessment; connected-device, embedded, IoT or regulated-product environments • Experience across both offensive security and security architecture domains • US Citizen or Green Card holder (US Person) Good to have: • Experience leading CRA, regulated product security, or compliance-driven cybersecurity assessments • Experience leading engagement in export-controlled environments • FedRAMP or regulated environment experience preferred Preferred Certifications IEC 62443 (OT Security) or Certified DevSecOps Professional or any other relevant product-security credentials Years of Required Experience • 12+ years in Product Security Architecture • 5+ years in complex customer assessment and regulatory assessment engagements • Five years leading complex customer security and regulatory assessment engagements • Demonstrated leadership of multidisciplinary product-security teams; experience defining assessment scope, effort estimates, workstream ownership and experience approving security reports