SalariesSign in
AboutPrivacyTerms
Lead Incident Security Responder
Black Duck Software, Inc.

Lead Incident Security Responder

CanadaRemoteFull-time
Pay Range: CAD 100k - CAD 150k / annual
Posted Sep 27
Apply

Job Description

Black Duck Software, Inc. helps organizations build secure, high-quality software, minimizing risks while maximizing speed and productivity. Black Duck, a recognized pioneer in application security, provides SAST, SCA, and DAST solutions that enable teams to quickly find and fix vulnerabilities and defects in proprietary code, open source components, and application behavior. With a combination of industry-leading tools, services, and expertise, only Black Duck helps organizations maximize security and quality in DevSecOps and throughout the software development life cycle.

Lead Incident Security Responder

Position Summary

The Lead Incident Security Responder drives applied product security work across Black Duck’s portfolio, protecting our products and supporting the customer security inquiries that come into our Security Operations team. Operating with broad autonomy under general guidance, you lead portions of complex security projects, partner with the Director of Security Operations and the broader engineering organization, and serve as an informal technical resource for less experienced team members. The role requires hands-on product security depth combined with program coordination: delivering architecture reviews, threat models, vulnerability triage, and customer-facing security work, while also maintaining detection content, contributing to SOAR automations, and tracking projects through to measurable outcomes.

Essential Functions/Responsibilities

  • Partner with engineering teams building Black Duck SCA, Coverity, and adjacent products on architecture reviews, threat models, and security design feedback.
  • Contribute to a measurable secure development lifecycle covering SCA, SAST, secret scanning (GitGuardian), dependency hygiene, and build pipeline security.
  • Recommend systematic improvements when patterns emerge across the portfolio rather than relying on one-off fixes.
  • Triage internally discovered and externally reported product vulnerabilities and help drive resolution with engineering teams.
  • Coordinate vulnerability fixes with engineering and support customer-facing communications when needed.
  • Help triage customer security questionnaires, audit requests, and ad hoc product security questions in close partnership with the Director of Security Operations.
  • Draft technically accurate answers to customer security inquiries; gather evidence from engineering when needed.
  • Join customer security calls as a subject matter expert when called upon and contribute to a growing knowledge base of reusable responses.
  • Support detection engineering and incident response activities across the corporate environment, with a focus on issues that intersect with our products.
  • Maintain and tune detection content in CrowdStrike NG-SIEM and Sumo Logic related to product security risks; help work escalations from our MDR provider (ReliaQuest).
  • Contribute to SOAR automations and runbooks that reduce manual toil.
  • Lead discrete workstreams within larger security initiatives or coordinate small project teams where appropriate.
  • Track projects through Jira with clear milestones and concise status updates; provide technical input into vendor evaluations and POCs across the SecOps and AppSec stack.
  • Act as an informal resource and mentor for less experienced team members on product security, secure development, and threat modeling.
  • Explain difficult or sensitive technical information clearly to engineers, security peers, and non-technical stakeholders.
  • Document tribal knowledge into runbooks, SOPs, and onboarding materials.
  • Other tasks and activities as assigned.

Required Education/Experience & Skills

  • At least 7 – 8 years of applicable experience in product security, application security, or security engineering, with hands-on depth in at least two of the following: secure SDLC, threat modeling, secure code review, vulnerability management, product incident response, or customer-facing product security work.
  • Working knowledge of application security tooling (SCA, SAST, DAST, secret scanning) and the vulnerabilities they catch.
  • Familiarity with at least one major cloud platform (AWS, Azure, or GCP) from a security perspective.
  • Awareness of AI and LLM security risks such as prompt injection, sensitive data exposure, and the OWASP Top 10 for LLM Applications.
  • Demonstrated ability to work independently under general guidance and to lead workstreams or small project teams without formal direct-report authority.
  • Practical use of AI and LLM tools to accelerate day-to-day security work (investigation, query drafting, secure code review, documentation), with sound judgment about when AI-generated output requires human validation before it is shared, shipped, or acted on.
  • Strong written and verbal communication skills, including the ability to explain technical security topics to engineers, security peers, and non-technical stakeholders; calm and steady under incident, audit, or customer-escalation pressure.
  • Bachelor’s degree in Computer Science, Information Security, Information Technology, or equivalent practical experience.
  • Experience contributing to a Product Security Incident Response Team (PSIRT) or equivalent product vulnerability response process.
  • Familiarity with vulnerability scoring (CVSS), embargo handling, and coordinated disclosure.
  • Industry certifications such as CISSP, CSSLP, GWAPT, GPEN, OSCP, OSWE, or cloud security equivalents are a plus.
  • Experience supporting customer security questionnaires, RFPs, or third-party risk assessments.

Physical Requirements

General office environment and responsibilities requiring:

  • Extensive use of the computer which involves viewing a monitor and keyboarding for most of the workday
  • Placing and receiving phone calls
  • Occasionally moving and lifting objects up to 20 pounds
  • May require some travel as needed.

Pay Range

$100,000—$150,000 CAD

Black Duck is an equal opportunity employer. We consider all applicants for employment without regard to race, color, national origin, religion, sex, gender identity or expression, age, disability, sexual orientation, veteran or military service status, or any other characteristic protected by applicable law. Black Duck complies with all applicable laws prohibiting employment discrimination in every jurisdiction where it operates and provides reasonable accommodations to individuals with disabilities in accordance with applicable law.

Originally posted on Himalayas

View job

Red Team Security Engineer

Backblaze

  • Colombia
  • Remote
  • Full-time
Apply
22 hrs ago
View job

Information Security Analyst (Product Assurance)

Lacuna Talent

  • United States
  • Remote
  • Full-time
Apply
22 hrs ago
View job
S

Senior Cyber Security Specialist

Softtest pays pty ltd

  • Australia
  • Remote
  • Full-time
Apply
23 hrs ago
View job

OT-Security Consultant / Penetration Tester (m/w/d)

Yekta IT GmbH

  • Germany
  • Remote
  • Full-time
Apply
23 hrs ago
View job
S

Client Assurance- InfoSec GRC - Remote US

SAMC SitusAMC Holdings Corp

  • United States
  • Remote
  • Full-time
Apply
1 day ago
View job

Network Security Engineer - Vulnerability & Compliance Focus

Support Tech LLC

  • United States
  • Remote
  • Full-time
Apply
1 day ago
View job

Principal AI Research Cybersecurity Scientist (Bay Area)

Alice

  • United States
  • Remote
  • Full-time
Apply
1 day ago
View job

Senior Risk Analyst

Apogee Global RMS

  • United States
  • Remote
  • Contract
Apply
1 day ago
View job

Security Compliance Engineer

Yuno

  • Argentina
  • Remote
  • Full-time
Apply
1 day ago
View job

Chief Information Security Officer (CISO) — Insurance & Investments

TheHiveCareers

  • Dominican Republic
  • Remote
  • Full-time
Apply
1 day ago
View job

Senior Incident Response Analyst

HealthEdge

  • United States
  • Remote
  • Full-time
Apply
1 day ago
View job
I

SME Security Control Assessor

IMAGINEEER LLC

  • United States
  • Remote
  • Full-time
Apply
1 day ago
View job

Cybersecurity Analyst Intermediate w/Splunk

General Dynamics Information Technology

  • United States
  • Remote
  • Full-time
Apply
1 day ago
View job

Information Security Risk Specialist

Booz Allen Hamilton

  • United States
  • Remote
  • Full-time
Apply
1 day ago
View job

Incident Response Analyst

Check Point Software

  • Australia
  • Remote
  • Full-time
Apply
1 day ago
View job

Mid-Level Security Automation Engineer

DecisionPoint Corporation

  • United States
  • Remote
  • Full-time
Apply
1 day ago
View job

Principal Security Compliance Analyst (FedRAMP) - Remote, U.S.

Entrust

  • United States
  • Remote
  • Full-time
Apply
1 day ago
View job
F

Cybersecurity Analyst II

Frontgrade Technologies

  • United States
  • Remote
  • Full-time
Apply
1 day ago
View job

Security Operations Engineer

Collectors

  • United States
  • Remote
  • Full-time
Apply
1 day ago
View job

IT Security Specialist (Microsoft Azure & 365 Focus)

Support Tech LLC

  • United States
  • Remote
  • Contract
Apply
1 day ago
View job

Cybersecurity Program Manager

Apogee Global RMS

  • United States
  • Remote
  • Contract
Apply
1 day ago
View job

Director, IT & Security

Illuminate Literacy

  • United States
  • Remote
  • Full-time
Apply
1 day ago
View job

Senior Security Operations Engineer

Sword Health

  • United States
  • Remote
  • Full-time
Apply
1 day ago
View job
S

Security Software Developer

Softtest pays pty ltd

  • Australia
  • Remote
  • Full-time
Apply
1 day ago
View job

National Security Manager

Fujifilm

  • United States
  • Remote
Apply
1 day ago
View job

Manager Identity & Trust Engineering

BlueCross BlueShield of Tennessee

  • United States
  • Remote
  • Full-time
Apply
1 day ago
View job

Senior Product Owner DevSecOps

Humana

  • United States
  • Remote
  • Full-time
Apply
1 day ago
View job

Sr. Engineer, Product Cyber Security

BD

  • United States
  • Remote
  • Full-time
Apply
1 day ago
View job

Sr. Security/ Technology Engineer

NV5

  • United States
  • Remote
  • Full-time
Apply
1 day ago
View job

Cyber Security Cloud Engineer

National Carwash Solutions

  • United States
  • Remote
  • Full-time
Apply
1 day ago
Page 1 of 127Next
Black Duck Software, Inc.

Lead Incident Security Responder

CanadaRemoteFull-time
Pay Range: CAD 100k - CAD 150k / annual
Posted Sep 27
Apply

Job Description

Black Duck Software, Inc. helps organizations build secure, high-quality software, minimizing risks while maximizing speed and productivity. Black Duck, a recognized pioneer in application security, provides SAST, SCA, and DAST solutions that enable teams to quickly find and fix vulnerabilities and defects in proprietary code, open source components, and application behavior. With a combination of industry-leading tools, services, and expertise, only Black Duck helps organizations maximize security and quality in DevSecOps and throughout the software development life cycle.

Lead Incident Security Responder

Position Summary

The Lead Incident Security Responder drives applied product security work across Black Duck’s portfolio, protecting our products and supporting the customer security inquiries that come into our Security Operations team. Operating with broad autonomy under general guidance, you lead portions of complex security projects, partner with the Director of Security Operations and the broader engineering organization, and serve as an informal technical resource for less experienced team members. The role requires hands-on product security depth combined with program coordination: delivering architecture reviews, threat models, vulnerability triage, and customer-facing security work, while also maintaining detection content, contributing to SOAR automations, and tracking projects through to measurable outcomes.

Essential Functions/Responsibilities

  • Partner with engineering teams building Black Duck SCA, Coverity, and adjacent products on architecture reviews, threat models, and security design feedback.
  • Contribute to a measurable secure development lifecycle covering SCA, SAST, secret scanning (GitGuardian), dependency hygiene, and build pipeline security.
  • Recommend systematic improvements when patterns emerge across the portfolio rather than relying on one-off fixes.
  • Triage internally discovered and externally reported product vulnerabilities and help drive resolution with engineering teams.
  • Coordinate vulnerability fixes with engineering and support customer-facing communications when needed.
  • Help triage customer security questionnaires, audit requests, and ad hoc product security questions in close partnership with the Director of Security Operations.
  • Draft technically accurate answers to customer security inquiries; gather evidence from engineering when needed.
  • Join customer security calls as a subject matter expert when called upon and contribute to a growing knowledge base of reusable responses.
  • Support detection engineering and incident response activities across the corporate environment, with a focus on issues that intersect with our products.
  • Maintain and tune detection content in CrowdStrike NG-SIEM and Sumo Logic related to product security risks; help work escalations from our MDR provider (ReliaQuest).
  • Contribute to SOAR automations and runbooks that reduce manual toil.
  • Lead discrete workstreams within larger security initiatives or coordinate small project teams where appropriate.
  • Track projects through Jira with clear milestones and concise status updates; provide technical input into vendor evaluations and POCs across the SecOps and AppSec stack.
  • Act as an informal resource and mentor for less experienced team members on product security, secure development, and threat modeling.
  • Explain difficult or sensitive technical information clearly to engineers, security peers, and non-technical stakeholders.
  • Document tribal knowledge into runbooks, SOPs, and onboarding materials.
  • Other tasks and activities as assigned.

Required Education/Experience & Skills

  • At least 7 – 8 years of applicable experience in product security, application security, or security engineering, with hands-on depth in at least two of the following: secure SDLC, threat modeling, secure code review, vulnerability management, product incident response, or customer-facing product security work.
  • Working knowledge of application security tooling (SCA, SAST, DAST, secret scanning) and the vulnerabilities they catch.
  • Familiarity with at least one major cloud platform (AWS, Azure, or GCP) from a security perspective.
  • Awareness of AI and LLM security risks such as prompt injection, sensitive data exposure, and the OWASP Top 10 for LLM Applications.
  • Demonstrated ability to work independently under general guidance and to lead workstreams or small project teams without formal direct-report authority.
  • Practical use of AI and LLM tools to accelerate day-to-day security work (investigation, query drafting, secure code review, documentation), with sound judgment about when AI-generated output requires human validation before it is shared, shipped, or acted on.
  • Strong written and verbal communication skills, including the ability to explain technical security topics to engineers, security peers, and non-technical stakeholders; calm and steady under incident, audit, or customer-escalation pressure.
  • Bachelor’s degree in Computer Science, Information Security, Information Technology, or equivalent practical experience.
  • Experience contributing to a Product Security Incident Response Team (PSIRT) or equivalent product vulnerability response process.
  • Familiarity with vulnerability scoring (CVSS), embargo handling, and coordinated disclosure.
  • Industry certifications such as CISSP, CSSLP, GWAPT, GPEN, OSCP, OSWE, or cloud security equivalents are a plus.
  • Experience supporting customer security questionnaires, RFPs, or third-party risk assessments.

Physical Requirements

General office environment and responsibilities requiring:

  • Extensive use of the computer which involves viewing a monitor and keyboarding for most of the workday
  • Placing and receiving phone calls
  • Occasionally moving and lifting objects up to 20 pounds
  • May require some travel as needed.

Pay Range

$100,000—$150,000 CAD

Black Duck is an equal opportunity employer. We consider all applicants for employment without regard to race, color, national origin, religion, sex, gender identity or expression, age, disability, sexual orientation, veteran or military service status, or any other characteristic protected by applicable law. Black Duck complies with all applicable laws prohibiting employment discrimination in every jurisdiction where it operates and provides reasonable accommodations to individuals with disabilities in accordance with applicable law.

Originally posted on Himalayas