inductive-automation-llc - SDLC Security and Compliance Lead
Requirements
• Technical Bachelor's Degree required (computer science, engineering, software development, or cybersecurity) • Relevant Master's Degree or demonstrated equivalent experience required • Cybersecurity certification or equivalent demonstrated experience required (CISSP, GICSP, or ISA/IEC 62443 Cybersecurity Expert) • Experience (8 years required; 15+ years preferred) • Software development experience (not necessarily writing code; design, testing, assurance, management, etc); agile preferred. • Extensive security or compliance audit experience (required); ISO Lead Auditor or equivalent with experience • Extensive experience with policy and process documentation (required) • Delivering software in controlled or regulated environment • Incident management or coordinated vulnerability disclosure program experience • Communicating with and presenting to executive leadership • Experience achieving IEC 62443-4-1 or 62443-4-2 certification, or equivalent • Experience with EU Cyber Resilience Act, or equivalent • Threat modeling experience is strongly preferred
Responsibilities
• Serving as subject matter expert and working lead for IEC 62443 certifications; owning the gap between the standard's requirements and Inductive Automation practice • Monitoring practice changes in Development and Quality Assurance that could create compliance drift; supporting corrective actions and nonconformance activities • Tracking security roadmap and EU Cyber Resilience Act product-level requirements • Supporting external security and compliance requirements as needed / requested (e.g. Life Sciences, automotive, aerospace, Dept of Defense, US/EU law or regulation, etc). • Participating in ISO and CRA conformity audits as the Software Engineering representative; prepare and maintain auditable evidence (tickets, code reviews, QA records) • Coordinating on third party penetration testing; incorporating results into the SDLC ticket process • Owning day-to-day currency of process documents. Maintains the mapping between committed standards (e.g. 62443, ISO 27001) practices and QMS documentation • Maintaining SDLC traceability from code change through reviews, tests, requirements, and customer tickets • Verifying Release Checklist completion as compliance evidence for all production software, including hotfixes • Responsible for the Software Engineering portion of the Coordinated Vulnerability Disclosure and incident management program, in coordination with other stakeholders; keeps the playbook and process documentation current, with awareness of reporting requirements. • Maintaining Incident Manager qualification and training for Software Engineering personnel with defined CVD roles; drive post-incident lessons learned into process and training • Supporting Ignition Coordinated Vulnerability Disclosure. Coordinating with CISA/National Vulnerability Database (NVD), communicating with external researchers and stakeholders, and managing disclosure and release timing; supporting ENISA reporting requirements per compliance with the EU Cyber Resilience Act • Running internal readiness checks and pre-audit gap assessments; tracks personnel qualification • Identifying training gaps and coordinate delivery with engineering managers and leadership • Consulting on Threat Modeling and participating in related activities
Benefits
• Our target salary for this role is $163k - $180k. • Inductive Automation’s ranges are market-driven and set to allow for flexibility. Although it is not typical for an individual to start at the top end of the range for the position, compensation decisions are dependent on: the facts and circumstances of each case, work location, job-related skills, experience, relevant education or training; and other business and organizational needs. • Upload your resume here to autofill key application fields. • Drop your resume here! • Parsing your resume. Autofilling key fields... • or drag and drop here • The address listed in this application should reflect the location where you will be working from. • The state listed in this application should reflect the location where you will be working from. This information helps us determine hiring eligibility based on locations where we are currently authorized to operate. • Please write the full, official name of the institution (no abbreviations). Enter N/A if not applicable. • Example: University of California, Berkeley (not "Cal" or "UCB") • Because many colleges share names or have multiple campuses, please provide the specific campus location (City, State, and Country) for verification purposes. Enter N/A if not applicable. • Example: Los Angeles, CA, USA • Please specify the level of degree obtained or currently being pursued. Enter N/A if you do not hold a degree. • Example: High School Diploma, B.S., B.A., M.S., Ph.D., Associate of Arts • If applicable, please state your major, minor, or primary concentration. • Example: Computer Science • Approximate start month/year and end month/year (or expected graduation). This field is completely optional and is used only to facilitate verification in the event of an offer. • Example: Sept 2018 - May 2022 • Completed studies / Degree conferred • Currently enrolled / Actively pursuing degree • Attended, did not complete degree • If you need to list multiple degrees, note transfers between schools, or clarify your enrollment timeline for future background verification, please do so here. • Inductive Automation requires all employees to live within the United States and be legally authorized to work during employment. • At this time, we are unable to offer employment for individuals located outside of the United States and/or those who require sponsorship for employment visa status (e.g., H-1B visa status, etc). • How did you hear about this job opportunity? Please specify the job site or source. • Recruiting Privacy Policy
Apply in one click
Upload My Resume
Drop here or click to browse · Tap to choose · PDF, DOCX, DOC, RTF, TXT