We are looking for a Product Security Lead who will be responsible for establishing and operating Donaldson’s global product security incident management and vulnerability lifecycle capabilities across all product lines. This role serves as the single point of contact for product security incidents and vulnerability management, ensuring timely identification, remediation, disclosure, and reporting in alignment with regulatory requirements, including the EU Cyber Resilience Act (CRA). The position partners closely with Business Operations, Product Engineering, IT, Legal, Privacy, and regional stakeholders to enable secure product development, transparency of software components, and effective responses to vulnerabilities.

The Product Security

Lead serves as a trusted advisor to leadership on product security posture, vulnerability risk, and regulatory readiness.

Key Responsibilities

1. Product Security Incident Management (PSIM) & Leadership Serve as the designated PSIM for all product-related vulnerabilities and security incidents Lead the end-to-end lifecycle of product security vulnerabilities, including identification, triage, remediation, and communication Coordinate cross-functional response efforts across Product, Corporate Engineering, Legal, and Communications teams
2. Vulnerability Management & Remediation Establish and operate continuous vulnerability monitoring processes for digital products and associated electronic components Ensure vulnerabilities are assessed, prioritized, and remediated without delay in alignment with regulatory expectations Oversee the development and secure distribution of patches and security updates to customers
3. Software Quality Assurance & SBOM Management Maintain and govern a machine-readable Software Bill of Materials (SBOM)



for products Collaborate with the Application Security specialist in providing services for product teams Ensure SBOM accuracy and completeness to support vulnerability tracking and regulatory transparency
4. Coordinated Vulnerability Disclosure (CVD) Establish and manage external vulnerability disclosure channels Ensure timely publication of vulnerability disclosures following remediation Align disclosure practices with industry standards and regulatory requirements.

Regulatory

Reporting & Compliance Initially focused on compliance with the EU CRA, executing regulatory reporting obligations, including mandated timelines for vulnerability and incident reporting Serve as the primary liaison with external authorities (e.g., EU ENISA and other regulators) Maintain required technical documentation and compliance artifacts to support regulatory review

5. Monitoring Lifecycle Security & Support Obligations Ensure products are supported with security updates throughout their defined lifecycle Partner with Product and Corporate Engineering teams to integrate security maintenance into product roadmaps

6. Enterprise Product Security Architecture Alignment Translate product security strategy and regulatory requirements into scalable processes, standards, and operating models Partner with Product, Engineering, and Architecture teams to embed secure-by-design principles across the development lifecycle Contribute to the definition and adoption of enterprise capabilities, including SBOM standards, vulnerability management processes, and PSIRT operating procedures Ensure alignment of product security practices with internal policies, ISMS requirements, and general regulatory frameworks Identify gaps in product security capabilities and drive implementation of improvements to enhance consistency and scalability

7. Documentation, Metrics & Continuous Improvement Develop and maintain metrics and reporting to track vulnerability management effectiveness and regulatory readiness Improve processes for vulnerability management, disclosure, and reporting Ensure documentation is maintained in support of auditability and compliance

Minimum Qualifications Bachelor’s degree in Cybe

📌 Product Security Lead - EMEA (Barcelona)
🏢 Donaldson
📍 Barcelona