Acronis is a global leader in cyber protection, delivering AI-powered protection for productive MSPs in a single, natively integrated platform that unifies operations management, cybersecurity, and data protection. Driven by our mission to protect, manage and automate every workload that businesses and lives depend on, we’ve built the industry’s only all-in-one solution.
We are seeking an experienced Product Security Lead to drive Acronis’ global product security strategy and assurance program across our SaaS and on-premises portfolio. This role will oversee product security governance, secure development practices, security tooling and automation, vulnerability management, and remediation assurance. Working closely with R&D, Product, and Security leadership, you will embed security throughout the software development lifecycle, strengthen our security posture, and ensure compliance with industry standards and customer expectations. The ideal candidate combines deep technical expertise with strong leadership skills and a proven ability to build scalable security programs in a global software environment.
WHAT YOU’LL DO
Product Assurance Leadership and Governance
Lead and provide oversight of the product assurance program, including governance, accountability, and metrics across all product lines (SaaS and on-premises).
Define and maintain the product security strategy, policies, standards, and secure development lifecycle (SDL) requirements, aligned with business goals and product roadmaps.
Establish risk acceptance, exception, and escalation processes with clear ownership in Engineering and Product.
Report product security posture, risk trends, and program KPIs to senior leadership.
Toolchain Strategy and Procurement
Conduct gap analysis of the Product Security toolchain, identify coverage and maturity gaps, and build the business case for tooling investments.
Evaluate, select, and recommend appropriate tools, and manage vendor relationships.
Secure CI/CD and Automated Security Controls
Select, configure, and set enforcement modes (audit, warn, block) for SAST, DAST, SCA, secrets scanning, and SBOM generation in CI/CD pipelines.
Define quality gates, severity thresholds, and break-the-build criteria that balance risk reduction with developer velocity.
Oversee tuning of rules and false-positive management to maintain developer trust and adoption.
Drive software supply chain security, including dependency governance, SBOM management and distribution, build integrity, artifact signing, and provenance.
Independent Verification and Validation
Define the independent verification and validation (IV&V) code review process, including scope, triggers, reviewer qualifications, and approval thresholds for high-risk changes.
Oversee security design reviews and threat modeling for new features, architectures, and third-party integrations.
Direct penetration testing, red team engagements, and external security assessments of products.
Vulnerability Management and Remediation Assurance
Define and oversee the end-to-end vulnerability management process: intake, triage, risk scoring (e.g., CVSS, EPSS, exploitability context), SLAs, and remediation.
Provide remediation assurance by verifying that fixes are effective, complete, and free of regressions, and by tracking SLA adherence and escalating overdue items.
Manage the bug bounty and coordinated vulnerability disclosure programs, including researcher engagement, platform management, and incentive structuring.
Lead the Product Security Incident Response Team (PSIRT) function, including security advisories, CVE publication, and customer communication for critical vulnerabilities.
Compliance and Customer Assurance
Ensure compliance with relevant regulations, industry standards, and best practices, including GDPR, HIPAA, and ISO/IEC 27001.
Align products with additional product-relevant frameworks as applicable (e.g., SOC 2, NIST SSDF, OWASP ASVS/SAMM, SLSA, EU Cyber Resilience Act,…