Product Security Lead

About the role

Forterra is unleashing autonomy at scale to transform the battlefield, and the systems we field have to be trusted in the most contested, disconnected environments on earth. We're seeking a Product Security Lead to own security for all Forterra platforms end-to-end: someone who can own and advance the program.

This is a hands-on, leadership role, not a paper-compliance seat. You will set the security strategy, own the governance and compliance posture, and drive security execution across software, hardware, and devops. You will lead a small team of product security engineers while coordinating a significantly larger cross functional group of indirect contributors and server as the company's security SME in pre sales, bids/RFPs, and customer evaluations. Additionally you will serve as Forterra's product security voice to government customers, commercial partners, and executive leadership.

This is a senior security role. It requires someone who has built security programs before, earned DoD authorizations from beginning to end, and an operate with equal credibility in the weeds at the engineering level as well as at an executive briefing.

What you'll do

• Own the enterprise product security program across multiple autonomous vehicle platforms and business lines- governance, policies, and roadmap
• Lead the full ATO and IATT lifecycle across concurrent DoD programs, from control selection and tailoring through evidence generation. POAM management, and government stakeholder coordination. You are Forterra's ATO authority
• Participate in software release boards as the go/no go authority for security
• Set and own the 12 and 24 month security roadmap, capability maturity planning, and resource forecasting
• Brief senior leadership, government stakeholders, and commercial partners on program status, risk posture, and readiness activities
• Develop cyber security requirements for platforms operating in a multitude of networks, including air gapped, intermittently connections, and operationally constrained environments
• Lead threat modelling across autonomous, embedded, and command and control systems, driving risk assessments that weigh mitigations against mission requirements
• Own DISA STIG compliance strategy. Evaluate and tailor applicable checklists, translating required controls into implementable guidance for engineering teams
• Own the SBOM generation pipeline and vulnerability management program, including CVE triage, remediation prioritization, and POAM closure
• Lead the product level security incident response and coordinate cross organization remediation with the corporate cybersecurity team
• Support the contract and sales teams as the pre sales security SME, contributing to RFP and RFQ responses
• Build, lead, and develop the product security team. Hire, onboard, mentor, and grow direct reports and foster a security first engineering culture across the organization

Minimum Qualifications

• 7+ years in product or cybersecurity with demonstrated depth in program leadership
• Proven experience owning an ATO end to end as the responsible authority
• Practical command of NIST 800-37, 800-53, 800-171; DISA STIGS and SRG; eMASS artifact requirements, formats, and review cycles
• Demonstrated experience securing embedded, autonomous, or operationally deployed systems including air gapped and disconnected environments
• Experience building and leading security programs, teams, and functions
• Ability to operate at both the strategic and tactical levels simultaneously
• Strong executive communication skills. Ability to brief senior leadership and stakeholders and defend decision making
• Demonstrated experience with SBOM and vulnerability management in a product engineering environment
• Experience driving compliance validation against multiple concurrent frameworks, ex NIST, ISO/SAE, CMMC, etc
• Active US Security Clearance or eligibility. Must be a US Person as defined under ITAR

Preferred Qualifications

• Active CISSP or equivalent senior security certification
• ISO/SAE 21434 automotive cybersecurity experience
• Experience with multiple ATOs across multiple DoD programs or branches
• Familiarity with IEC 62443 commercial cybersecurity engineering standard
• Experience managing indirect contributors and cross functional security execution across large
• engineering organizations

US Salary Range
$175,000 - $200,000

The salary range for this role is an estimate and is based on a wide variety of compensation factors. The salary offered to candidates will vary based on a variety of factors including (but not limited to) relevant work experience, education, specialized training, critical expertise, training, and more. Equity in Forterra is included in most of our full-time, high-demand roles and is therefore considered part of Forterra’s overall compensation package. In addition to base salary and equity, Forterra offers competitive benefits for full-time employees including:

• Premium Healthcare Benefits: Three plan options, including an HSA-eligible plan, with Forterra covering 80% of the plan premium for you and your dependents.
• Basic Life/AD&D, short and long-term disability insurance plans 100% covered by Forterra, plus the option to purchase additional life insurance for you and your dependents.
• Extremely generous company holiday calendar including a winter break in December.
• Competitive paid time off (PTO) offering 20 days accrued per year.
• A minimum of 7 weeks fully paid parental leave for birth/adoption.
• A $9k annual tuition reimbursement or professional development stipend.
• Fully stocked beverage refrigerators with all the Celsius your little heart desires.
• 401(k) retirement savings plan, including traditional, Roth 401(k), and after-tax deferral with company match up to 4%.

Your recruiter will be able to share more information about our salary and benefits offering during the hiring process.

CLEARANCE ELIGIBILITY - This position may require eligibility to obtain and maintain a U.S. security clearance. For more information about U.S. Security Clearances: click here.

Forterra is an equal-opportunity employer, providing and promoting equal employment opportunity in all personnel practices. Forterrans are unique, talented individuals who are united through a shared passion to deliver autonomous systems that enable national resilience and a robust supply chain.

All qualified applicants will receive consideration for employment without regard to any factor, including veteran and disability status, and criminal history, in accordance with applicable local, state, and federal laws.

Forterra is also committed to working with and providing reasonable accommodations to individuals with disabilities. Please let your recruiter know if you need an accommodation at any point during the interview process.

To see Forterra’s candidate data privacy policy, please visit Forterra Legal | Job Applicant Privacy Notice.