Vice President, Product Security at QLYS_US Qualys, Inc.

About The Role

Come work at a place where innovation and teamwork come together to support the most exciting missions in the world!

1 2 + years of progressive experience in cybersecurity, application security, product security, cloud security, or security architecture, including 7 + years in senior leadership roles managing globally distributed security, engineering, and architecture teams.
Proven experience building, scaling, and leading high-performing Product Security organizations supporting large-scale SaaS, cloud-native, and enterprise software platforms.
Demonstrated success leading directors, senior managers, architects, and security engineering teams across multiple geographies and product portfolios.
Experience owning multi-million-dollar security budgets, strategic planning processes, headcount forecasting, vendor relationships, and security program execution.
Strong executive presence with the ability to communicate technical risk, business impact, and security strategy to Boards of Directors, Executive Leadership Teams, auditors, regulators, and customer executives.
Proven ability to influence security and product roadmaps across Engineering, Product Management, Cloud Operations, Legal, Compliance, Customer Success, Sales Engineering, and Corporate Security organizations.
Experience participating in M&A due diligence, product security assessments, and post-acquisition security integration activities is highly desirable.

Deep expertise in product security, application security, cloud security, DevSecOps , software supply chain security, and secure software development lifecycle (SSDLC) practices.
Demonstrated experience implementing and scaling:
Security-by-design principles
Threat modeling frameworks
Secure coding standards
Vulnerability management programs
Red teaming exercises
Bug bounty and responsible disclosure programs
Software supply chain security controls
SBOM management
Secure CI/CD pipelines
Container and Kubernetes security
Extensive knowledge of modern authentication and identity architectures including:
Zero Trust
OAuth2
OpenID Connect
SAML
PKI
Hardware-backed cryptography
Secrets management
PAM solutions
Deep understanding of modern security frameworks including:
NIST Cybersecurity Framework
NIST SP 800-53
NIST SP 800-171
NIST SP 800-218 (SSDF)
CIS Controls
OWASP Top 10
OWASP ASVS
SOC 2
ISO 27001

10+ years of experience supporting U.S. federal cybersecurity programs and regulatory frameworks.
Proven experience leading, achieving, and sustaining multiple FedRAMP Moderate and FedRAMP High Authorizations to Operate (ATO) for cloud-native SaaS products.
Extensive experience working directly with:
Federal Agencies
Joint Authorization Board (JAB) stakeholders
Third Party Assessment Organizations (3PAOs)
Authorizing Officials
Government security assessors
Deep knowledge of:
NIST SP 800-53 Rev. 5
FedRAMP Continuous Monitoring
POA&M management
Significant Change Requests
Annual Assessments
Vulnerability remediation requirements
Configuration management controls
Demonstrated ownership of security strategy and product architecture supporting regulated government cloud environments.

Hands-on experience implementing and managing environments aligned to:
CMMC Level 2 requirements
NIST SP 800-171
DFARS 252.204-7012
DFARS 252.204-7019
DFARS 252.204-7020
DFARS 252.204-7021
Experience designing and securing solutions deployed within Department of Defense environments requiring Impact Level (IL) authorization.
Demonstrated knowledge and practical experience supporting:
DoD Impact Level 4 (IL4)
DoD Impact Level 5 (IL5)
DoD Impact Level 6 (IL6)
Experience working with government customers handling Controlled Unclassified Information (CUI), National Security Systems (NSS), and classified or highly regulated workloads.
Familiarity with DISA STIGs, SRGs, DoD Cloud Computing Security Requirements Guide (CC SRG), and associated authorization processes.

Experience leading or supporting NIAP Common Criteria certification efforts for enterprise software, networking products, endpoint security solutions, or cybersecurity technologies.
Strong understanding of:
Common Criteria Evaluation and Validation Scheme (CCEVS)
Protection Profiles
Security Targets
Evaluation Assurance Levels (EAL)
NIAP product certification lifecycle
Experience working with accredited testing laboratories and certification authorities to achieve and maintain product certifications.

15+ years of experience designing and securing cloud-native SaaS platforms operating at enterprise scale.
Demonstrated architecture and operational expertise across multiple hyperscale cloud service providers including:

Experience securing OCI environments including:
OCI IAM
OCI Vault
Cloud Guard
Security Zones
OCI Logging
OCI Container Engine for Kubernetes (OKE)
Experience developing governance models and security architectures across multi-cloud and hybrid-cloud environments.
Demonstrated track record implementing consistent security controls, monitoring, identity governance, and compliance frameworks across AWS, Azure, GCP, and OCI.

CISSP, CCSP, GIAC, SABSA, or equivalent advanced security certifications.
Prior experience serving as:
VP Product Security
Head of Product Security
Chief Product Security Officer
Distinguished Security Architect
Senior Security Executive within a cybersecurity or cloud technology company.
Experience working in publicly traded technology organizations and interacting with Audit Committees and Board-level Cybersecurity Committees.
Experience supporting enterprise cybersecurity products, vulnerability management platforms, endpoint security solutions, cloud security tools, SIEMs, or security operations technologies.

Qualys is an Equal Opportunity Employer, please see our EEO policy .