Donaldson is committed to solving the world’s most complex filtration challenges. Together, we make cool things. As an established technology and innovation leader, we are continuously evolving to meet the filtration needs of our changing world. Join a culture of collaboration and innovation that matters and a chance to learn, effect change, and make meaningful contributions at work and in communities. We are looking for a Product Security Lead who will be responsible for establishing and operating Donaldson’s integral product security incident management and vulnerability lifecycle capabilities across all product lines. This role serves as the single point of contact for product security incidents and vulnerability management, ensuring timely identification, remediation, disclosure, and reporting in alignment with regulatory requirements, including the EU Cyber Resilience Act (CRA). The position partners closely with Business Operations, Product Engineering, IT, Legal, Privacy, and regional stakeholders to enable secure product development, transparency of software components, and effective responses to vulnerabilities. The Product Security Lead serves as a trusted advisor to leadership on product security posture, vulnerability risk, and regulatory readiness.Key Responsibilities- 1. Product Security Incident Management (PSIM) & Leadership Serve as the designated PSIM for all product-related vulnerabilities and security incidents Lead the end-to-end lifecycle of product security vulnerabilities, including identification, triage, remediation, and communication Coordinate cross-functional response efforts across Product, Corporate Engineering, Legal, and Communications teams- 2. Vulnerability Management & Remediation Establish and operate continuous vulnerability monitoring processes for digital products and associated electronic components Ensure vulnerabilities are assessed, prioritized, and remediated without delay in alignment with regulatory expectations Oversee the development and secure distribution of patches and security updates to customers- 3. Software Quality Assurance & SBOM Management Maintain and govern a machine-readable Software Bill of Materials (SBOM) for products Collaborate with the Application Security specialist in providing services for product teams Ensure SBOM accuracy and completeness to support vulnerability tracking and regulatory transparency- 4. Coordinated Vulnerability Disclosure (CVD)



Establish and manage external vulnerability disclosure channels Ensure timely publication of vulnerability disclosures following remediation Align disclosure practices with industry standards and regulatory requirements. Regulatory Reporting & Compliance Initially focused on compliance with the EU CRA, executing regulatory reporting obligations, including mandated timelines for vulnerability and incident reporting Serve as the primary liaison with external authorities (e.G., EU ENISA and other regulators) Maintain required technical documentation and compliance artifacts to support regulatory review- 5. Monitoring Lifecycle Security & Support Obligations Ensure products are supported with security updates throughout their defined lifecycle Partner with Product and Corporate Engineering teams to integrate security maintenance into product roadmaps 5. Enterprise Product Security Architecture Alignment Translate product security strategy and regulatory requirements into scalable processes, standards, and operating models Partner with Product, Engineering, and Architecture teams to embed secure-by-design principles across the development lifecycle Contribute to the definition and adoption of enterprise capabilities, including SBOM standards, vulnerability management processes, and PSIRT operating procedures Ensure alignment of product security practices with internal policies, ISMS requirements, and global regulatory frameworks Identify gaps in product security capabilities and drive implementation of improvements to enhance consistency and scalability- 6. Documentation, Metrics & Continuous Improvement Develop and maintain metrics and reporting to track vulnerability management effectiveness and regulatory readiness Improve processes for vulnerability management, disclosure, and reporting Ensure documentation is maintained in support of auditability and complianceMinimum Qualifications- Bachelor’s degree in Cybersecurity, Computer Science, Engineering, or related field (or equivalent experience)- Minimum 5+ years of experience in application security, product security,



or quality assurance- Experience managing vulnerability lifecycles, including triage, remediation, and disclosure- Strong understanding of secure software development and software supply chain risks (including SBOM)- Ability to coordinate cross-functional teams and communicate risk to technical and non-technical stakeholdersPreferred Qualifications- Master’s degree in Cybersecurity, Computer Science, Engineering, or related field (or equivalent experience)- Experience with EU CRA or similar regulatory requirements- Experience in vulnerability and incident response, or equivalent function- Understanding of secure-by-design concepts and best practices- Familiarity with vulnerability disclosure frameworks and practices- Experience supporting regulatory reporting and audits- Relevant security professional certifications (CISSP, CISSP, CSSLP, CISM, or equivalent)Employment opportunities for positions in the United States may require use of information which is subject to the export control regulations of the United States. Hiring decisions for such positions are required by law to be made in compliance with these regulations. Applicants for employment opportunities in other countries must be able to meet the comparable export control requirements of that country and of the United States.Our policy is to provide equal employment opportunities to all qualified persons without regard to race, gender, color, disability, national origin, age, religion, union affiliation, sexual orientation, veteran status, citizenship, gender identity and/or expression, or other status protected by law.Donaldson Company helps solve some of the world's most complex filtration and contamination control challenges, and is one of the largest global providers of unique filtration technologies and high-quality filters and parts. Our filtration technologies and products are used every day, in a variety of industries and environments, including aerospace, agriculture, construction, food and beverage, manufacturing, mining, power generation, transportation and many more. Key to our success, our 14,000 employees support customers at sales, manufacturing and distribution centers from over 140 locations on six continents. The filtration market continues to grow. Customers' needs for filtration solutions continue to evolve. And the opportunities for our products and our people continue to expand.Learn more at www.Donaldson.Com.#J-18808-Ljbffr

📌 Product Security Lead (Terrassa)
🏢 Barcelona, Spain Donaldson Ibèrica Soluciones
📍 Terrassa