[Hiring] Lead Incident Security Responder @Black Duck Software

Role Description

The Lead Incident Security Responder drives applied product security work across Black Duck’s portfolio, protecting our products and supporting the customer security inquiries that come into our Security Operations team. Operating with broad autonomy under general guidance, you lead portions of complex security projects, partner with the Director of Security Operations and the broader engineering organization, and serve as an informal technical resource for less experienced team members. The role requires hands-on product security depth combined with program coordination.

• Deliver architecture reviews, threat models, vulnerability triage, and customer-facing security work.
• Maintain detection content, contribute to SOAR automations, and track projects through to measurable outcomes.

Qualifications

• At least 7 – 8 years of applicable experience in product security, application security, or security engineering.
• Hands-on depth in at least two of the following: secure SDLC, threat modeling, secure code review, vulnerability management, product incident response, or customer-facing product security work.
• Working knowledge of application security tooling (SCA, SAST, DAST, secret scanning) and the vulnerabilities they catch.
• Familiarity with at least one major cloud platform (AWS, Azure, or GCP) from a security perspective.
• Awareness of AI and LLM security risks such as prompt injection, sensitive data exposure, and the OWASP Top 10 for LLM Applications.
• Demonstrated ability to work independently under general guidance and to lead workstreams or small project teams without formal direct-report authority.
• Practical use of AI and LLM tools to accelerate day-to-day security work.
• Strong written and verbal communication skills.
• Bachelor’s degree in Computer Science, Information Security, Information Technology, or equivalent practical experience.
• Experience contributing to a Product Security Incident Response Team (PSIRT) or equivalent product vulnerability response process.
• Familiarity with vulnerability scoring (CVSS), embargo handling, and coordinated disclosure.
• Industry certifications such as CISSP, CSSLP, GWAPT, GPEN, OSCP, OSWE, or cloud security equivalents are a plus.
• Experience supporting customer security questionnaires, RFPs, or third-party risk assessments.

Requirements

• Extensive use of the computer which involves viewing a monitor and keyboarding for most of the workday.
• Placing and receiving phone calls.
• Occasionally moving and lifting objects up to 20 pounds.
• May require some travel as needed.

Benefits

• Pay Range: $100,000 - $150,000 CAD

Company Description

Black Duck Software, Inc. helps organizations build secure, high-quality software, minimizing risks while maximizing speed and productivity. Black Duck, a recognized pioneer in application security, provides SAST, SCA, and DAST solutions that enable teams to quickly find and fix vulnerabilities and defects in proprietary code, open source components, and application behavior.