Product Security Principal

About Us Ever wondered what powers the products people rely on every day? Chances are, we've helped build it. Our software and development tools help build products for cars, hospitals, factories, homes, and industries worldwide. We help engineers solve complex challenges and create technology people can depend on. Rooted in Nordic values and trusted by innovators worldwide, we combine deep technical expertise with a culture of curiosity, craftsmanship, and collaboration. With decades of engineering experience and a shared passion for technical excellence, we're helping shape the future of software and embedded development. We take pride in building tools for people who build the world around us. About the Role Qt Group’s software development tools are used to build the systems people rely on every day — in-car interfaces, medical devices, industrial machinery and embedded products of every kind. That means the security of our products shapes the security of our customers’ products. Our product security team sets the standards, processes and practices that keep the Qt Group portfolio secure, spanning Qt, IAR, Axivion, Squish, Coco and Test Center, and our design tools. As Product Security Principal you are the hands-on technical expert and senior leader at the center of that work. You bring deep security expertise across the Group—embedding secure development practices in R&D, running vulnerability handling and incident response, and making sure our products meet the regulatory requirements our customers depend on, including the EU Cyber Resilience Act (CRA). This is a senior individual contributor role with genuine ownership and visibility across the Group — you will shape how security works here, not just report on it. Possible locations for this position are Espoo or Oulu, Finland. What You’ll Do Help evolve and operationalize our SSDLC across R&D — coaching engineers on secure development practices, working with product security leadership to mature our approach, and embedding security as part of how we build rather than a check at the end Provide technical leadership for our product security regulatory work across the Group, including the EU CRA: ensure conformity evidence and technical documentation are sound, assess products against applicable standards, and support compliance decisions across all Business Units Run vulnerability management end to end, from CVE tracking and Software Bill of Materials (SBOM) processes to coordinated disclosure across the Qt Group portfolio, working with product teams and BUs to ensure consistent processes and technical rigor Provide technical depth and leadership to our PSIRT program — working with the PSIRT coordinator to handle complex vulnerability analysis, incident triage, and customer communication, ensuring technical rigor in incident response Support customers directly — answering security questionnaires, contributing to assessments and audits, and helping sales and account teams with security evidence Work across all Business Units and functions — R&D, Product Management, Legal — as a technical resource, bringing security expertise to architecture decisions, standards assessments, and regulatory compliance work What You Bring to the Table Strong hands-on experience with product security — vulnerability analysis, secure code review, threat modelling in real products, secure software development lifecycle implementation. Experience working across multiple products or teams within a complex organization. Solid understanding of product security regulations and standards (EU CRA, IEC 62443, ISO/IEC 27001, domain-specific standards); experience translating regulatory requirements into technical assessments and conformity decisions Experience with vulnerability management and incident response in a product context The ability to influence without authority — you will work closely with engineers, lawyers and product managers who do not report to you Strong communication skills in English, including writing clearly for both technical and non-technical readers Bonus Points For... A security certification such as CISSP or CISM Experience in a regulated or safety-critical domain — automotive, medical or industrial Familiarity with additional compliance frameworks such as CMMC, or with ASPICE assessments Hands-on experience with threat modelling (STRIDE, attack trees, data flow analysis) Experience with security testing tools and frameworks (static analysis, dynamic testing, code review automation) Experience leveraging AI/ML for security improvement or vulnerability analysis Familiarity with software supply chain security practices and SBOM tooling Build What Matters. Grow Where It Matters. We believe work should support your life, not the other way around. That's why our benefits are designed to be flexible, inclusive, and meaningful across every stage of your journey. From wellbeing and growth to celebrating life's big (and small) moments, we invest in what matters to you, wherever you are. <li data-leveltext="" data-font="Symbol" data-listid="1" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"hybridMultilevel"}" data-aria-posinset="1" data-aria-level="