Product Security Incident Response Program Manager

This is a fully remote position, open to applicants in Austria, +3 more countries.

📋 Description

• Lead the operational response to reported vulnerabilities impacting NXP hardware and software products.

• Own and manage security cases from the initial intake through assessment, remediation coordination, customer communication, and responsible disclosure.

• Develop response plans, milestones, ownership, dependencies, escalation paths, and communication cadence for designated cases.

• Coordinate impact assessments and remediation planning across engineering, product management, quality, legal, communications, and customer-facing organizations.

• Monitor decisions, evidence, approvals, outstanding actions, and delivery risks.

• Facilitate vulnerability review meetings and ensure actions are completed.

• Manage responsible and coordinated vulnerability disclosure with researchers, customers, partners, and relevant external organizations.

• Oversee CVE reservation and publication workflows with technical subject-matter experts.

• Coordinate the creation, review, approval, and publication of security advisories and customer communications.

• Enhance PSIRT procedures, templates, governance, and audit readiness.

• Support compliance with regulations such as the EU Cyber Resilience Act, future standards, and vulnerability-reporting obligations.

⛳️ Requirements

• Experience in Product Security, Embedded Security, Semiconductor Security, Cybersecurity, vulnerability management, or technical engineering programs.

• 3+ years of relevant work experience.

• Strong understanding of vulnerability management, coordinated disclosure, incident handling, or product risk management.

• Ability to influence cross-functional stakeholders across engineering, product management, quality, and customer-facing teams.

• Proven capability to coordinate complex investigations involving multiple technical and business organizations.

• Strong project or program management skills, including dependency management, risk tracking, escalation, prioritization, and reporting.

• Excellent communication skills and a passion for safeguarding innovative technology at scale.

• Familiarity with embedded products, semiconductor products, firmware, automotive, industrial, or IoT environments is advantageous.

• Fluent in English.

• PMP, PgMP, Scrum Master, SAFe, or other project/program management certifications are preferred, but not required.

• A conscientious and reliable working style is necessary as the role may involve security-related tasks and security certifications.

🏝️ Benefits

• Home office.

• Flexible working hours.

• Meal benefits.

• Market-competitive compensation aligned with the benchmarking of the electronic and semiconductor industry (for applications in Gratkorn).