Product Security Lead

Acronis is a global leader in cyber protection, delivering AI-powered protection for productive MSPs in a single, natively integrated platform that unifies operations management, cybersecurity, and data protection. Driven by our mission to protect, manage and automate every workload that businesses and lives depend on, we’ve built the industry’s only all-in-one solution.

• Lead and provide oversight of the product assurance program, including governance, accountability, and metrics across all product lines (SaaS and on-premises).

• Define and maintain the product security strategy, policies, standards, and secure development lifecycle (SDL) requirements, aligned with business goals and product roadmaps.

• Establish risk acceptance, exception, and escalation processes with clear ownership in Engineering and Product.

• Report product security posture, risk trends, and program KPIs to senior leadership.

• Conduct gap analysis of the Product Security toolchain, identify coverage and maturity gaps, and build the business case for tooling investments.

• Evaluate, select, and recommend appropriate tools, and manage vendor relationships.

• Select, configure, and set enforcement modes (audit, warn, block) for SAST, DAST, SCA, secrets scanning, and SBOM generation in CI/CD pipelines.

• Define quality gates, severity thresholds, and break-the-build criteria that balance risk reduction with developer velocity.

• Oversee tuning of rules and false-positive management to maintain developer trust and adoption.

• Drive software supply chain security, including dependency governance, SBOM management and distribution, build integrity, artifact signing, and provenance.

• Define the independent verification and validation (IV&V) code review process, including scope, triggers, reviewer qualifications, and approval thresholds for high-risk changes.

• Oversee security design reviews and threat modeling for new features, architectures, and third-party integrations.

• Direct penetration testing, red team engagements, and external security assessments of products.

• Define and oversee the end-to-end vulnerability management process: intake, triage, risk scoring (e.g., CVSS, EPSS, exploitability context), SLAs, and remediation.

• Provide remediation assurance by verifying that fixes are effective, complete, and free of regressions, and by tracking SLA adherence and escalating overdue items.

• Manage the bug bounty and coordinated vulnerability disclosure programs, including researcher engagement, platform management, and incentive structuring.

• Lead the Product Security Incident Response Team (PSIRT) function, including security advisories, CVE publication, and customer communication for critical vulnerabilities.

• Ensure compliance with relevant regulations, industry standards, and best practices, including GDPR, HIPAA, and ISO/IEC 27001.

• Align products with additional product-relevant frameworks as applicable (e.g., SOC 2, NIST SSDF, OWASP ASVS/SAMM, SLSA, EU Cyber Resilience Act, NIS2).

• Support customer security questionnaires, audits, and certification efforts (e.g., Common Criteria, FedRAMP, or other market-specific requirements).

• Advise Product Management and R&D on security requirements, customer expectations, and product roadmaps.

• Build a security champions program and deliver secure coding training to developers.

• Embed security guidance, reusable patterns, and paved-road tooling into developer workflows.

• Work closely with R&D, Product, IT/Corporate Security, Legal, and…