The posting
At Gigamon, our purpose is to protect the hybrid networks and data of the largest, most complex organizations on the planet. Certified as a Great Place to Work, we offer a deep observability pipeline that efficiently delivers network-derived intelligence to cloud, security, and observability tools. This helps our customers to eliminate security blind spots, optimize network traffic, and dramatically reduce tool cost and complexity, enabling them to better secure and manage their hybrid cloud infrastructure. Gigamon has served more than 4,000 customers worldwide, including over 80 percent of Fortune 100 enterprises, 9 of the 10 largest mobile network providers, and hundreds of governments and educational organizations.
The Senior Director, Product Security & PSIRT, will lead large-enterprise product security programs across Gigamon’s hardware and software portfolio. This role will set the strategic direction for the PSIRT team, chair the PSIRT Steering Committee, and partner with VP and executive leadership to drive timely, risk-based decisions. Serving as the PSIRT technical advisor to the COO and CISO, the leader will establish consistent, repeatable practices for vulnerability research, testing, customer engagement, communications, knowledge base content, and coordinated disclosure. They will also develop Gigamon’s product red-team framework, evaluate appropriate security tools, and advise the CISO on the evolving product security tool landscape.
What you’ll do
- Set the strategic direction, priorities, and operating model for Gigamon’s Product Security and PSIRT programs.
- Lead and develop the PSIRT team, including mentoring junior PSIRT engineers and establishing clear expectations for performance, technical growth, and delivery.
- Chair the PSIRT Steering Committee and partner with VP and executive leadership to assess material vulnerabilities, prioritize response activities, and drive accountability.
- Serve as the PSIRT technical advisor to the COO and CISO, providing clear assessments of product security risks, response options, remediation progress, and business impact.
- Establish consistent, repeatable processes for vulnerability intake, research, testing, triage, remediation tracking, customer engagement, communications, knowledge base articles, and coordinated disclosure.
- Lead vulnerability research and testing across Gigamon’s hardware and software products, including attack-surface analysis, product behavior analysis, exploitability assessment, and validation of remediation.
- Develop a product red-team framework covering engagement models, testing methodologies, objectives, reporting standards, risk prioritization, and remediation follow-through.
- Coordinate product red-team and adversarial testing activities with internal teams and qualified external providers, as appropriate.
- Evaluate the product security and red-team tool landscape and advise the CISO on tool selection, adoption, integration, and investment priorities.
- Translate vulnerability research and adversarial testing results into practical security improvements and risk-based remediation plans.
- Guide product and engineering teams in applying secure development practices, including threat modeling, static and dynamic application security testing, fuzzing, penetration testing, and secure release processes.
- Oversee security advisories, customer notifications, frequently asked questions, remediation guidance, and other communications related to product vulnerabilities.
- Establish release security governance, including security reviews, risk acceptance, exception management, and criteria for product security readiness.
- Partner with product, engineering, threat research, detection, support, customer success, legal, and communications teams to coordinate vulnerability response and improve product security outcomes.
- Identify appropriate opportunities to use automation and artificial intelligence in vulnerability research, testing, PSIRT operations, and security communications while maintaining oversight, quality, and accountability.
- Communicate product security posture, material risks, response status, and remediation progress clearly to executive and cross-functional stakeholders.
What you’ve done
- Bring at least 10 years of progressive PSIRT experience, including leadership of large-enterprise product security programs.
- Led or scaled PSIRT, product security, vulnerability research, security engineering, or closely related programs across hardware, software, networking, or security products.
- Established strategic direction, operating models, priorities, and measurable delivery expectations for product security teams.
- Developed and mentored junior PSIRT engineers while building technical capability and supporting career growth.
- Led vulnerability intake, triage, research, testing, remediation tracking, customer engagement, security advisories, and coordinated disclosure.
- Developed or operated red-team, adversarial testing, penetration testing, or vulnerability research programs.
- Created frameworks, methodologies, or operating models for product red-team activities where a formal capability was not previously established.
- Evaluated security testing and product security tools and advised senior security leaders on technology selection, adoption, and investment.
- Chaired or operated an executive-level security steering committee and partnered effectively with COO, CISO, VP, and executive leadership on risk decisions.
- Served as a trusted technical advisor to senior executives on product security posture, material vulnerabilities, remediation strategies, and business risk.
- Applied secure development practices, including threat modeling, static and dynamic application security testing, fuzzing, penetration testing, and secure release governance.
- Translated complex vulnerabilities and adversarial findings into practical engineering actions, risk-based priorities, and clear executive decisions.
- Set priorities and delivered measurable results through organizational change and competing business demands.
- Worked effectively across distributed product and engineering organizations without relying solely on direct authority.
- Applied knowledge of Linux, operating-system security, embedded systems, networking, cloud platforms, or platform engineering.
- Applied automation or artificial intelligence to software security, vulnerability research, red teaming, PSIRT operations, or engineering workflows.
- Earned a bachelor’s degree in computer science, engineering, cybersecurity, or a related field, or demonstrated equivalent professional experience.
Who you are
- A strategic and technically credible product security leader who can set direction while engaging deeply with complex hardware and software security challenges.
- An experienced PSIRT operator who establishes durable processes and delivers consistent, high-quality outcomes.
- A builder who can develop practical red-team frameworks and mature emerging product security capabilities.
- A pragmatic technology strategist who evaluates tools based on effectiveness, scalability, integration, operational fit, and cost.
- A trusted technical advisor who provides clear, balanced guidance to the COO, CISO, and executive leadership.
- A decisive executive partner who can chair a steering committee, establish accountability, and drive timely action.
- A practical problem solver who helps product and engineering teams balance security, delivery, reliability, customer impact, and business requirements.
- A clear communicator who explains technical vulnerabilities, remediation priorities, response decisions, and business implications without alarmism.
- A customer-focused leader who values accurate, consistent, and actionable security communications.
- A collaborative partner who builds trust across product, engineering, threat research, detection, support, customer success, legal, communications, and executive teams.
- A people-focused leader who develops junior engineers, grows technical capability, and creates a high-performing, inclusive organization.
- An accountable operator who sets priorities, follows through on commitments, and makes sound risk-based decisions.
- A global-minded leader who works effectively across distributed teams and makes product security a shared responsibility.
