Senior Engineer, Application and Product Security

Job Title: Senior Engineer, Application and Product Security

Location/ Work Structure: Westerville, OH | On-site 5 days per week

Compensation: Salary or Hourly: $130,000–$155,000 annually 

Who we are:

Vernovis is a Total Talent Solutions company that specializes in Technology, Cybersecurity, Finance & Accounting functions. At Vernovis, we help these professionals achieve their career goals, matching them with innovative projects and dynamic direct hire opportunities in Ohio and across the Midwest.

Client Overview:

Vernovis partnering with a global technology organization seeking a Senior Engineer, Application and Product Security to support product security certifications, regulatory compliance, and secure software development initiatives. This role will work cross-functionally with engineering, security, and business teams to ensure products and applications meet evolving industry standards and security requirements.

What You'll Do:

• Support product and application security certification activities across industry frameworks, including IEC 62443, UL 2900, ISO 27001, SOC 2, FedRAMP, and NIST 800-171.

• Maintain, enhance, and align organizational security requirements and the Secure Software Development Framework (SSDF) with evolving industry standards, regulations, and best practices.

• Author, review, and maintain security requirements, control catalogs, profiles, crosswalks, and mappings using NIST OSCAL in structured JSON formats.

• Map regulatory obligations, including the EU Cyber Resilience Act (CRA), into security requirements with documented traceability to assessment objectives and supporting evidence.

• Manage security requirement changes through Git/GitLab, including branching, merge requests, collaborative reviews, and stakeholder approvals.

• Partner with Engineering, Application, IT, GRC, Procurement, and Supply Chain teams to implement security requirements, support vendor compliance, and guide product certification efforts.

• Support engineering and development teams in understanding security requirements, improving secure development practices, and achieving higher security maturity levels.

• Collaborate with internal stakeholders to support customer security questionnaires, certification documentation, reporting, and continuous improvement initiatives.

What Experience You'll Have:

• Bachelor's degree in Information Technology, Computer Science, Engineering, or a related field, with 7 years of experience in IT, Engineering, or Security, including at least 3 years specifically in Product Security.

• Experience supporting product security frameworks, industry standards, and certification efforts, including IEC 62443, NIST, ISO 27001, FedRAMP, SOC 2, or comparable standards.

• Hands-on experience with Git, including branching, merge requests, version control, and collaborative review of structured documentation.

• Experience with NIST OSCAL or equivalent machine-readable security control catalogs, profiles, and mappings using JSON or YAML.

• Demonstrated experience mapping regulatory and industry frameworks into organizational security requirements, along with strong communication, stakeholder management, and cross-functional collaboration skills.

What Experience is Nice to Have:

• Experience with IEC 62443, embedded device security, and product security certification processes.

• Experience performing or supporting penetration testing of embedded devices and connected products.

• Experience leveraging AI tools, including coding assistants and document-analysis tools, to accelerate security requirement mapping, documentation, drafting, and review.

By applying for this job, you agree to receive calls, AI-generated calls, text messages, or emails from and its affiliates, and contracted partners. Frequency varies for text messages. Message and data rates may apply. Carriers are not liable for delayed or undelivered messages. You can reply STOP to cancel and HELP for help. You can access our privacy policy at https://vernovis.com/privacy-policy-2/.