About this opportunity
Zappsec Inc. lists this Principal Product Security Architect & Engagement Lead opportunity in tewksbury, Massachusetts. Review the employer’s description below for duties, qualifications and application requirements.
Job description
Principal Product Security Architect & Engagement Lead
Role Summary
Lead and govern the end-to-end product lifecycle cybersecurity assessment engagement for the customer product including:
CRA-aligned security evaluation, architecture assessment, threat modelling, technical oversight, evidence traceability, and executive reporting.
Accountable for leading all the discussions during the assessment including product applicability, intended use analysis, classification, Risk-based decisions, test-plan quality, change control, customer workshops, executive reporting, and escalation of material risks.
Serve as the primary customer interface and ensure all assessment activities are executed in compliance with export-control requirements.
Key Responsibilities
Lead overall engagement delivery, governance, and customer coordination, including multidisciplinary team leadership, workstream ownership, estimation, change control, customer workshops, executive reporting, and difficult-risk communication
Conduct product security architecture assessments and threat modelling activities, including attack-tree, abuse-case, misuse-case, secure-update, rollback, recovery and safe-state architecture analysis
Perform trust boundary analysis and review data flows across product components and external integrations
Oversee CRA-aligned assessment methodology, compliance traceability, and lifecycle security evaluation, including CRA product scope, applicability and classification analysis, essential-requirement interpretation, conformity-assessment strategy, technical-documentation readiness, and compliance-evidence readiness
Evaluate operational resilience, recovery considerations, and lifecycle security controls across deployed product environments
Review secure-by-design implementation and product security governance practices
Guide technical testing activities and validate risk prioritization and exploitability context
Review security findings and ensure consistency across technical and compliance outputs
Lead executive reporting, release readiness assessment, and remediation discussions
Ensure evidence collection and assessment outputs align to CRA requirements, with control traceability, findings calibration, residual-risk governance, release-readiness conclusions, and defensible evidence mapping
Review lifecycle security considerations including secure decommissioning and data disposal practices
Assess security support-period commitments, update strategy, coordinated vulnerability disclosure, post-market vulnerability handling, incident-reporting readiness, and product logging, monitoring and auditability architecture
Evaluate connected-system and ecosystem-impact considerations, data minimization, sensitive-data handling, security-control design, and control effectiveness across product environments
Enforce export-control compliant handling of personnel, systems, and data
Provide final quality assurance and assessment signoff oversight
Required Skills & Experience
Mandatory:
Strong experience in product cybersecurity and secure-by-design principles, including product security architecture, secure-by-design governance, security-control design and effectiveness evaluation
Expertise in threat modelling, architecture review, and trust boundary analysis, including attack-tree, abuse-case, misuse-case, data-flow, data-minimization and sensitive-data analysis
Strong understanding of product lifecycle security and operational resilience concepts
Familiarity with secure SDLC, SBOM governance, and vulnerability management practices
Strong executive communication and stakeholder management capability
Control traceability, evidence management, release readiness, residual-risk assessment, findings calibration, negotiation, executive escalation, and material-risk communication
CRA product scope, applicability and classification analysis; CRA essential-requirement interpretation; conformity-assessment strategy and readiness; technical-documentation and compliance-evidence readiness
PSIRT and vulnerability handling processes, coordinated vulnerability disclosure, security support-period and update-strategy assessment, post-market vulnerability and incident-reporting readiness
NIST SSDF OR IEC 62443-4-1/4-2 frameworks; compliance and regulatory security assessments; product cybersecurity risk assessment; connected-device, embedded, IoT or regulated-product environments
Experience across both offensive security and security architecture domains
US Citizen or Green Card holder (US Person)
Good to have:
Experience leading CRA, regulated product security, or compliance-driven cybersecurity assessments
Experience leading engagement in export-controlled environments
FedRAMP or regulated environment experience preferred
Preferred Certifications
IEC 62443 (OT Security) or Certified DevSecOps Professional or any other relevant product-security credentials
Years of Required Experience
12+ years in Product Security Architecture
5+ years in complex customer assessment and regulatory assessment engagements
Five years leading complex customer security and regulatory assessment engagements
Demonstrated leadership of multidisciplinary product-security teams; experience defining assessment scope, effort estimates, workstream ownership and experience approving security reports
#J-18808-Ljbffr
Worksite address
tewksbury, MA, 01876, US
Who can apply
Review the original listing for work authorization, qualifications and employer requirements.