> Markdown version of [/jobs/ext/148406-cybersecurity-technical-program-manager](https://www.wearedevelopers.com/jobs/ext/148406-cybersecurity-technical-program-manager). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Cybersecurity Technical Program Manager - **Company:** Johnson Controls - **Location:** Westford, MA, United States (Remote available) - **Experience:** Expert - **Salary:** $118,000.0 - $177,000.0 - **Contract:** Permanent contract - **Skills:** Testing (Software), Agile Methodology, Software System Penetration Testing, JIRA, Microsoft Azure, Cloud Computing Security, Cyber Security, DevOps, Open Source Technology, Open Web Application Security, Secure Coding, Software Engineering, Software Vulnerability Management, Mttr, Information Technology, Devsecops, Static Application Security Testing, Vulnerability Analysis, Dynamic Application Security Testing - **Published:** May 15, 2026 - **Apply:** https://www.indeed.com/viewjob?jk=bdf1fda5bac5fc18 ## About the Role Do you have experience in Vulnerability management?, Do you have a Bachelor's degree?, * Bachelor's degree in Computer Science, Cybersecurity, Information Security, Software Engineering or related field. * 10+ years of professional experience in electronic product design and new product introduction within a manufacturing context (e.g., collaboration with Design Engineers, Software Engineers, Software QA, Manufacturing, Supply Chain, Supplier Quality, Product Management, etc.) * Proven experience managing product security or cybersecurity programs for connected devices or embedded systems. * Strong hands-on experience with: + Vulnerability management (identification, triage, prioritization, remediation tracking) + Security testing tools (SAST, DAST, dependency scanning, fuzzing) + Threat modeling and risk assessment methodologies * Experience driving compliance with Cyber Resilience Act (CRA) or similar global cybersecurity regulations. * Demonstrated success in driving cross-functional teams to resolve security vulnerabilities within defined SLAs. * Familiarity with secure coding practices and common vulnerabilities (OWASP Top 10, CVEs, CWEs). * Strong understanding of software development methodologies (Agile/DevSecOps). * Excellent communication, stakeholder management, and executive reporting skills. * Ability to operate effectively in complex, regulated environments and manage ambiguity. * Meticulous attention to detail and technical accuracy. * Outstanding organizational and technical competencies. * Effective interpersonal and multitasking skills. Preferred: * Project Management Professional (PMP) Certification. * Experience in IoT, embedded systems, or safety-critical industries (fire/life safety, medical, automotive). * Certifications such as CISSP, CISM, or CEH. * Experience with tools such as JIRA, Azure DevOps, or similar. * Knowledge of SBOM standards and open-source risk management. * Familiarity with cloud security and connected device ecosystems. ## Description We are actively seeking a results-driven Cybersecurity Technical Program Manager to join our Fire Detection New Product Introduction (NPI) Program Management Office. Based in one of our advanced R&D facilities located in Westford, MA, this role offers a hybrid work environment requiring three days per week onsite and allowing two days of remote work. What You Will Do: As a key leader, the Cybersecurity Technical Program Manager will drive the end-to-end cybersecurity strategy, execution, and compliance for NPI programs delivering connected fire detection products. This role focuses on integrating security into the product lifecycle, ensuring proactive vulnerability identification, risk mitigation, and regulatory compliance (including CRA) across software and embedded systems. How You Will Do It: * Lead and manage cybersecurity workstreams across multiple concurrent NPI programs from concept through product launch and sustaining phases. * Drive secure development lifecycle (SDL) practices and ensure alignment with enterprise and regulatory cybersecurity frameworks. * Partner with software engineering, hardware, QA, architecture, and DevOps teams to: + Identify, assess, and prioritize software and system vulnerabilities + Ensure timely remediation and closure of security findings + Track and report vulnerability metrics (MTTR, backlog, severity trends) * Establish and maintain cybersecurity program plans, including risk registers, threat models, compliance milestones, and mitigation strategies. * Oversee product security testing activities, including SAST, DAST, penetration testing, SBOM generation, and third-party vulnerability assessments. * Ensure compliance with Cyber Resilience Act (CRA) and other relevant regulations/standards (e.g., IEC 62443, NIST, ISO 27001, UL cybersecurity requirements). * Coordinate security incident response planning and vulnerability disclosure processes for products in the field. * Facilitate cross-functional alignment to drive timely resolution of security issues, including coordination with external vendors and suppliers. * Prepare and present cybersecurity posture, risks, and compliance status to senior leadership and stakeholders. * Promote a culture of security-first mindset and continuous improvement through lessons learned and best practices. ## Related Videos - [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers) - [Collaboration Quantified: Lessons from Open Source Developer Networks](https://www.wearedevelopers.com/videos/1422-collaboration-quantified-lessons-from-open-source-developer-networks) - [What Developers Get Wrong About Application Quality](https://www.wearedevelopers.com/videos/233-what-developers-get-wrong-about-application-quality) - [From DevOps to Scaled DevOps: How We’re Rebuilding Continuous Delivery as a Platform](https://www.wearedevelopers.com/videos/100018-from-devops-to-scaled-devops-how-we-re-rebuilding-continuous-delivery-as-a-platform) - [Integrate your Cognitive Assistant with 3rd-party DBs and software](https://www.wearedevelopers.com/videos/249-integrate-your-cognitive-assistant-with-3rd-party-dbs-and-software) - [DevOps Maturity Check – a way to balance autonomy and alignment](https://www.wearedevelopers.com/videos/58-devops-maturity-check-a-way-to-balance-autonomy-and-alignment) ## Related Articles - [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed) - [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking) - [Now is the time for industrialized software development](https://www.wearedevelopers.com/magazine/601-now-is-the-time-for-industrialized-software-development) - [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing) - [Walking Into The Era of Supply Chain Risks](https://www.wearedevelopers.com/magazine/106-walking-into-the-era-of-supply-chain-risks) - [Understanding and Mitigating Common Web Vulnerabilities](https://www.wearedevelopers.com/magazine/565-understanding-and-mitigating-common-web-vulnerabilities)