Come work at a place where innovation and teamwork come together to support the most exciting missions in the world!
Vice President, Product Security
Overview
Executive leader responsible for defining and executing enterprise Product Security strategy across cloud-native SaaS platforms, secure software development, regulatory compliance, and multi-cloud environments. Leads global security engineering, architecture, and compliance teams while partnering with Product, Engineering, Cloud Operations, Legal, and executive leadership.
Required Qualifications
Executive Leadership
- 12+ years of cybersecurity, product security, application security, cloud security, or security architecture experience, including 7+ years in senior leadership roles.
- Proven success building and scaling global Product Security organizations.
- Experience leading directors, managers, architects, and security engineering teams.
- Strong executive communication skills with Boards, C-suite leaders, customers, auditors, and regulators.
- Experience managing security strategy, budgets, forecasting, vendors, and enterprise security programs.
- Ability to influence product and engineering roadmaps across cross-functional organizations.
Product Security & Secure Engineering
- Deep expertise in Product Security, Application Security, Cloud Security, DevSecOps, SSDLC, and software supply chain security.
- Experience implementing:
- Security-by-Design
- Threat Modeling
- Secure Coding Standards
- Vulnerability Management
- Red Team Programs
- Bug Bounty Programs
- SBOM and Supply Chain Security
- Secure CI/CD Pipelines
- Container and Kubernetes Security
- Strong knowledge of Zero Trust, OAuth2, OpenID Connect, SAML, PKI, Secrets Management, and PAM.
- Expertise with NIST, OWASP, CIS Controls, SOC 2, and ISO 27001 frameworks.
Federal & Regulated Environment Security
- 10+ years supporting U.S. Federal cybersecurity and compliance programs.
- Proven experience achieving and maintaining FedRAMP Moderate and High authorizations.
- Strong knowledge of NIST SP 800-53, FedRAMP Continuous Monitoring, POA&M management, and government assessment processes.
- Experience supporting CMMC 2.0, NIST 800-171, DFARS requirements, and DoD cloud environments (IL4/IL5/IL6).
- Familiarity with DISA STIGs, CC SRG, CUI, and regulated government workloads.
- Experience supporting NIAP/Common Criteria certification initiatives preferred.
Multi-Cloud Security
- 15+ years securing enterprise-scale cloud platforms.
- Hands-on expertise across AWS, Azure, GCP, and OCI.
- Experience with cloud identity, security monitoring, key management, container security, governance, and compliance frameworks.
- Track record implementing consistent security controls across multi-cloud and hybrid-cloud environments.
Preferred Qualifications
- CISSP, CCSP, GIAC, SABSA, or equivalent certifications.
- Prior experience as VP Product Security, Head of Product Security, Chief Product Security Officer, or comparable senior security executive.
- Experience in publicly traded technology companies and Board-level cybersecurity reporting.
- M&A security due diligence and post-acquisition integration experience.
- Background supporting cybersecurity, cloud security, vulnerability management, endpoint security, or SIEM platforms.
Qualys is an Equal Opportunity Employer, please see our EEO policy.
Skills Required
- 12+ years of progressive experience in cybersecurity, application security, product security, cloud security, or security architecture
- 7+ years in senior leadership roles managing globally distributed security, engineering, and architecture teams
- Experience building, scaling, and leading Product Security organizations for large-scale SaaS, cloud-native, and enterprise software platforms
- Experience leading directors, senior managers, architects, and security engineering teams across multiple geographies and product portfolios
- Experience owning multi-million-dollar security budgets, strategic planning, headcount forecasting, vendor relationships, and security program execution
- Executive communication experience with boards, executive leadership teams, auditors, regulators, and customer executives
- Experience influencing security and product roadmaps across engineering, product, cloud operations, legal, compliance, customer success, sales engineering, and corporate security
- Experience implementing product security, application security, cloud security, DevSecOps, software supply chain security, and SSDLC practices
- Experience with security-by-design, threat modeling, secure coding, vulnerability management, red teaming, bug bounty, responsible disclosure, SBOMs, secure CI/CD, container security, and Kubernetes security
- Knowledge of modern authentication and identity architectures, including Zero Trust, OAuth2, OpenID Connect, SAML, PKI, hardware-backed cryptography, secrets management, and PAM
- Knowledge of NIST, CIS Controls, OWASP, SOC 2, and ISO 27001 security frameworks
- 10+ years supporting U.S. federal cybersecurity programs and regulatory frameworks
- Experience leading multiple FedRAMP Moderate and FedRAMP High Authorizations to Operate for cloud-native SaaS products
- Experience working with federal agencies, JAB stakeholders, 3PAOs, authorizing officials, and government security assessors
- Experience with FedRAMP continuous monitoring, POA&M management, significant change requests, annual assessments, vulnerability remediation, and configuration management controls
- Experience implementing CMMC Level 2, NIST SP 800-171, DFARS requirements, and DoD Impact Level authorization environments
- Experience supporting DoD Impact Levels 4, 5, and 6 and workloads involving CUI, NSS, classified, or highly regulated data
- Knowledge of DISA STIGs, SRGs, DoD Cloud Computing Security Requirements Guide, and authorization processes
- Experience leading or supporting NIAP Common Criteria certification for enterprise software, networking, endpoint security, or cybersecurity products
- Understanding of CCEVS, Protection Profiles, Security Targets, EALs, and the NIAP certification lifecycle
- 15+ years designing and securing cloud-native SaaS platforms at enterprise scale
- Architecture and operational expertise across AWS, Azure, GCP, and OCI
- Experience developing governance models and security architectures across multi-cloud and hybrid-cloud environments
- CISSP, CCSP, GIAC, SABSA, or equivalent advanced security certification
- Prior experience as VP Product Security, Head of Product Security, Chief Product Security Officer, Distinguished Security Architect, or senior security executive
- Experience in publicly traded technology organizations and interaction with audit committees or board-level cybersecurity committees
- Experience supporting enterprise cybersecurity products, vulnerability management platforms, endpoint security solutions, cloud security tools, SIEMs, or security operations technologies
Qualys Compensation & Benefits Highlights
The following summarizes recurring compensation and benefits themes identified from responses generated by popular LLMs to common candidate questions about Qualys and has not been reviewed or approved by Qualys.
-
Affordable Benefits — Benefits costs are widely viewed as low for employees and dependents, with healthcare often described as almost fully paid for. Feedback suggests this affordability helps offset perceptions of lower base pay in some roles.
-
Healthcare Strength — Healthcare offerings are broad, including multiple medical plan options, dental and vision coverage, mental health support, and disability insurance. Benefits are described as “pretty amazing” or “great,” reinforcing perceived quality and coverage depth.
-
Equity Value & Accessibility — Equity participation is accessible through company stock plans and an employee stock purchase plan. Compensation packages commonly include equity alongside salary and bonus, which some consider a meaningful part of total rewards.
Qualys Insights
What We Do
Qualys, Inc. (NASDAQ: QLYS) is a pioneer and leading provider of disruptive cloud-based security, compliance and IT solutions with more than 10,000 subscription customers worldwide, including a majority of the Forbes Global 100 and Fortune 100. Qualys helps organizations streamline and automate their security and compliance solutions onto a single platform for greater agility, better business outcomes, and substantial cost savings. The Qualys Cloud Platform leverages a single agent to continuously deliver critical security intelligence while enabling enterprises to automate the full spectrum of vulnerability detection, compliance, and protection for IT systems, workloads and web applications across on premises, endpoints, servers, public and private clouds, containers, and mobile devices. Founded in 1999 as one of the first SaaS security companies, Qualys has strategic partnerships and seamlessly integrates its vulnerability management capabilities into security offerings from cloud service providers, including Amazon Web Services, the Google Cloud Platform and Microsoft Azure, along with a number of leading managed service providers and global consulting organizations. For more information, please visit http://www.qualys.com
.png)
