Black Duck Software, Inc.
Lead Product Security
Remote - Canada · Senior
Sponsorship not specified$117k-$150kDetected 3 days ago
Code ReviewAWSGCPAzureCloud PlatformsLLMsCybersecuritySOC OperationsIncident ResponseJiraSupply ChainHRISCommunicationCISSP
Stay score
odds of building a lasting career here
54Sponsors, lottery-bound
Cap-exempt (no lottery)0
Sponsors this role80
Entry-level history0
PERM / green-card track0
Lottery odds (Level III)83
Fits your clock70
Sponsors, but it's cap-subject — you still face the weighted lottery (~45% per draw at Level III). Good if you win; have a cap-exempt backup on your list.
Lottery odds assume a STEM candidate.
Personalize to your clock →Employer immigration record
from this employer's Department of Labor filings
Files H-1B transfers
1 transfer filing in the last year, covering 5 workers. Median labor-condition decision: 7 days. An employer that already files transfers is one that can take over an existing H-1B.
Sourced from Department of Labor LCA, PERM and prevailing-wage disclosure data. Employer matching is by name, so figures may be split across an employer's legal entities. Absence of a filing means none appears in our copy of the data, not that none exists.
Community outcomes
No reports yet — be the first to help the next applicant.
About the role
- Help mature and evolve the Security Champions program: recruit champions across product teams, grow the training and enablement curriculum, run office hours, and report on participation and outcomes.
Responsibilities
- Lead security architecture and design reviews for Black Duck SCA, Coverity, and adjacent product lines, delivering actionable feedback before implementation begins.
- Contribute to the threat modeling methodology and help scale its adoption: coach engineers to run their own models and review outputs, rather than serving as the sole modeler.
- Define security requirements, design gates, and product security baselines that give engineering a testable definition of secure-by-default.
- Build and measure the secure development lifecycle across SCA, SAST, secret scanning (GitGuardian), dependency hygiene, and build pipeline integrity.
- Secure the product supply chain and release process, including SBOM generation and the integrity of build and distribution artifacts.
- Mentor engineers and less experienced security staff on secure design, secure code review, and threat modeling, growing capability across the organization rather than absorbing the work.
- Assist with the scoping and coordination of penetration tests and third-party security assessments; triage findings and drive remediation to closure with engineering owners.
- Partner with PSIRT on triage and fix coordination for internally discovered and externally reported product vulnerabilities, feeding root causes back into design and SDLC controls.
- Measure product security maturity using BSIMM or SAMM style assessment and drive a prioritized improvement roadmap.
- Support EU Cyber Resilience Act secure-by-design and vulnerability handling obligations with the technical evidence and process changes engineering needs.
Nice to have
- Assist with the scoping and coordination of penetration tests and third-party security assessments
- Other tasks and activities as assigned.
- Awareness of AI and LLM security risks such as prompt injection, sensitive data exposure, and the OWASP Top 10 for LLM Applications.
- Bachelor's degree in Computer Science, Information Security, Information Technology, or equivalent practical experience.
- 8+ years of experience in product security, application security, or software security engineering, with hands-on depth in secure design review, threat modeling, and secure code review.
- Working knowledge of application security tooling (SCA, SAST, DAST, secret scanning), the vulnerability classes each detects, and where each produces false positives.
- Practical secure coding and review experience in at least one language used in commercial software products, with the ability to read unfamiliar code and reason about security impact.
- Familiarity with at least one major cloud platform (AWS, Azure, or GCP) from a product security perspective, including container and infrastructure-as-code security.
Compensation
- $117,000 - $150,000 CAD
Equal opportunity
- Black Duck is an equal opportunity employer.
Apply directly at Black Duck Software, Inc. →Create a free account for alerts like thisView Black Duck Software, Inc. immigration profile
This listing is sourced directly from Black Duck Software, Inc.'s careers page and normalized into a canonical job model.