Director of Product Security, Bonterra

• 5–7 years of experience in software development or engineering roles, including 2–3 years in a leadership role
• Proficiency in at least one major language (C#, Java, Python, Ruby, etc.)
• 5–7 years of experience in application/product security with emphasis on secure software development, code
• Analysis, and vulnerability management
• Strong knowledge of secure design principles (e.g., threat modeling, least privilege, cryptography) and common software vulnerabilities (e.g., CWE Top 25, OWASP Top 10)
• Excellent written and verbal communication skills; able to translate complex technical topics for both engineers and executives
• Demonstrated ability to make pragmatic risk-based decisions and prioritize effectively in a fast-moving environment

Desirable

• We’re looking for a Director, Product Security to lead Bonterra’s product security program — ensuring the safety, resilience, and trustworthiness of our SaaS platforms
• Report directly to the CISO and own the Product Security program across Bonterra’s SaaS portfolio
• Champion secure-by-design practices across the entire software lifecycle — from architecture and design, to CI/CD
• Pipelines, to production monitoring
• Partner closely with R&D, Product, M&A, and IT leaders to embed security into product decisions, integrations, and
• Innovation initiatives
• Build and scale security programs through automation, tooling, and training — not just headcount
• Define and execute a multi-year roadmap for Product Security that addresses gaps in coverage, staffing, and
• Capabilities as Bonterra grows
• Oversee vulnerability management across applications: review findings (SAST, DAST, SCA, penetration tests, bug
• Bounty), assess risk, and drive remediation with engineering partners
• Lead activities such as:
• Threat modeling and design reviews
• Third-party / M&A product security assessments
• Secure code review and testing
• Secure open-source and third-party component lifecycle management
• Centralized tracking, prioritization, and metrics reporting
• Develop meaningful, quantitative metrics that demonstrate product security health, progress, and business value
• Identify systemic classes of vulnerabilities, design scalable defenses, and evangelize secure coding and product patterns across engineering