Principal Product Security Program Leader

Job Title

Principal Product Security Program Leader

Role Summary

Lead product security for the Adaptive & Embedded Computing (AECG) business unit, owning vulnerability response, secure development lifecycle (SDL) governance, and regulatory alignment across hardware, firmware, and software tooling teams.

Act as the primary interface to the Product Security Office, Legal, and corporate compliance teams to ensure timely remediation, coordinated disclosure, and compliance with obligations such as the EU Cyber Resilience Act and GDPR.

Experience Level

Senior — the role requires expert-level product security and PSIRT leadership. The posting specifies senior, high-visibility responsibilities but does not state a numeric years-of-experience requirement.

Responsibilities

Core responsibilities include end-to-end product-security program leadership and incident coordination.

• Own product security governance for the AECG business unit and report program health to the Product Security Office and executive leadership.
• Coordinate triage and remediation of vulnerability reports across silicon, firmware, and tooling teams.
• Lead incident response for high-severity vulnerabilities and active exploit reports, including coordinated disclosure with customers and partners.
• Maintain and evolve security threat models for adaptive-computing design tools and related products.
• Manage SDL health tracking and remediation progress across product teams.
• Partner with Legal and Compliance to translate regulatory requirements (e.g., CRA, GDPR) into engineering and process requirements, including SBOM and disclosure obligations.
• Facilitate customer-facing security assessments and due-diligence requests.

Requirements

Must-have skills and experience are listed first; preferred items are marked.

• Must-have: Proven product security, PSIRT, or Security Design Lifecycle leadership in semiconductor, EDA, embedded systems, or a comparable industry.
• Must-have: Hands-on experience running coordinated vulnerability disclosure (CVD) or PSIRT programs: triage, CVSS scoring, CVE assignment, advisory/bulletin authoring, and coordinated disclosure with hyperscalers, OEMs, and external researchers.
• Must-have: Working expertise with SAST tools (e.g., Coverity, CodeQL), SCA/SBOM tooling (e.g., Black Duck, SPDX, CycloneDX), threat modeling methodologies, and secure SDLC frameworks such as NIST SSDF or ISO/SAE standards.
• Must-have: Practical familiarity with the EU Cyber Resilience Act and GDPR and the ability to translate regulatory obligations into engineering requirements and processes.
• Must-have: Experience partnering with Legal, Corporate Communications, and Compliance on regulated disclosures and customer communications.
• Must-have: Strong executive communication: concise status reporting and ability to translate technical findings into business impact.
• Must-have: Authorized to work in the United States; the role is not eligible for visa sponsorship.
• Nice-to-have: Experience with FPGA design tool flows (Vivado, Vitis) and embedded software stacks (PetaLinux, Yocto).
• Nice-to-have: Familiarity with ISO/IEC 27001, industry security groups (FIRST PSIRT SIG, OpenSSF, OCP Security), bug-bounty operations, and contributions to regulator guidance or standards bodies.

Education Requirements

No formal academic degree is specified in the posting. The posting calls out relevant industry certifications as beneficial: CISSP, CISM, CSSLP. The role expects senior-level practical experience in product security/PSIRT leadership.

About the Company

Company: Advanced Micro Devices

Headquarters: Sunnyvale, California, USA

Advanced Micro Devices, or AMD, is a global semiconductor company that designs and manufactures microprocessors, graphics processors, and related technologies for a variety of computing devices. Known for pushing the boundaries of innovation, AMD's mission is to deliver high-performance computing solutions for AI, data centers, gaming, and embedded applications. They foster a collaborative, inclusive culture focused on creativity and problem-solving, aiming to drive progress and excellence in technology.