Principal, Product Security

We need to output HTML fragment with sections: About the role? The posting includes description paragraphs. We need to use

for section headings: About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. We should include only sections that have real specific content. The posting includes: description (intro), duties & responsibilities, required skills & experience, preferred skills & experience, benefits info, pay range, travel less than 25% (maybe schedule?), but schedule not given. Travel is not schedule. So we can include Benefits, Pay. Possibly also "About the role" from intro paragraphs. Responsibilities from Duties & Responsibilities. Requirements from Required Skills & Experience. Qualifications maybe from Preferred Skills & Experience? Or we could combine. But we need to avoid thin sections. Let's decide sections: - About the role: intro paragraphs describing Itron and role overview. - Responsibilities: the list of duties. - Requirements: Required Skills & Experience (maybe also include education etc.) - Qualifications: Preferred Skills & Experience (maybe call it Preferred Qualifications) - Benefits: Benefits Info paragraph. - Pay: base salary range and bonus eligibility. - Schedule: Not provided; we should not include Schedule section if no specific content. Travel less than 25% could be considered schedule? Not exactly schedule. Better omit Schedule. We must not repeat job title as heading. No Job ID. We must use

• for any list of duties/requirements/benefits. So we need to convert the duties list into
  • . Also required skills list maybe bullet list? It's paragraphs but we can still list each bullet? The required skills are sentences; we could keep as

    . But rule: Use

    • for any list of duties/requirements/benefits. So we need to identify lists. The duties are a series of sentences each starting with a verb; we can treat as list. Similarly required skills maybe list? It's a paragraph with semicolons; but we could still make list? Safer: treat duties as list; required skills as

      maybe but rule says any list of duties/requirements/benefits must be

      • . The required skills is a list of requirements; we could bullet them. Let's extract each requirement as bullet. Similarly benefits: list of items: financial, social, health and wellbeing programs, paid vacation, 401k matching, employee stock purchase program, hybrid work schedule, and more! We'll bullet. Pay: we have base salary range and bonus eligibility; not a list, so

        . Now we need to preserve all substantive information, not invent or summarize away detail. So we must keep all details from the posting. We'll need to include the intro paragraphs exactly (or close). Must not add extra info. Let's extract content. Intro: "Itron is innovating new ways for utilities and cities to manage energy and water. We create a more resourceful world to protect essential resources for today and tomorrow. Join us. Itron, Inc. (NASDAQ: ITRI) is a global technology and services company dedicated to the resourceful use of energy and water. With more than 300 million deployed endpoints worldwide, Itron is a leader in IoT innovation, helping utilities and cities create a more sustainable, connected, and resourceful future. As a member of the Information Security team, you will serve as the senior technical leader responsible for advancing Itron's product security program across software development, cloud, and engineering environments. This role focuses on securing source code, software supply chains, CI/CD pipelines, and product architectures while enabling agile, customer-centric development practices. You will collaborate closely with Product Development, DevOps, Cloud Engineering, Enterprise Architecture, and Cybersecurity teams to design and implement scalable security solutions that protect Itron products and services throughout the development lifecycle." That's the About the role. Now Duties & Responsibilities list: each sentence after "Duties & Responsibilities". Let's extract: - Lead the architecture and engineering of security controls that protect source code repositories, development environments, build systems, software supply chains, and release processes. - Design and implement secure CI/CD pipeline patterns, artifact management controls, signing services, and deployment workflows that ensure software integrity from code commit through product release. - Partner with security-by-design and application security testing teams to operationalize security requirements, vulnerability management, threat modeling outcomes, and release controls. - Establish and promote secure application and API security standards, including authentication, authorization, secure coding practices, data protection, logging, and abuse prevention. - Collaborate with engineering teams to reduce application, API, and cloud attack surfaces through secure architecture, identity management, and least-privilege access models. - Drive modernization of development and engineering environments to mitigate risks associated with credential compromise, malicious code, dependency attacks, and unauthorized releases. - Integrate security capabilities across source control, CI/CD platforms, cloud services, artifact repositories, governance tools, and security monitoring solutions. - Automate security controls and operational processes using APIs, infrastructure-as-code, and scripting technologies such as Python, PowerShell, Terraform, GitHub Actions, Azure DevOps, Jenkins, and GitLab. - Establish security logging, monitoring, and detection requirements for software development and release environments in partnership with security operations teams. - Develop secure architecture guardrails, reference standards, operational procedures, and technical documentation that support scalable and innovative product delivery. - Ensure auditable evidence exists for software supply chain controls, artifact integrity, release approvals, SBOM generation, and regulatory or customer assurance requirements. - Mentor engineers and influence cross-functional teams to adopt secure, customer-focused, collaborative, and accountable engineering practices across global product environments. Now Required Skills & Experience: Let's extract bullet points: - Bachelor's degree in Computer Science, Information Systems, Cybersecurity, or a related field; or an equivalent combination of education and experience. - 7+ years of experience in cybersecurity, product security, application security, software engineering, DevSecOps, cloud security, or a related technical discipline. - 5+ years of hands-on experience securing software development environments, source code platforms, CI/CD pipelines, or software supply chains. - Expert-level experience designing and operating security controls across cloud, SaaS, enterprise, and product engineering environments. - Strong knowledge of software supply chain security, source code protection, secrets management, privileged access management, artifact integrity, dependency governance, and secure release practices. - Deep understanding of application and API security principles, including OWASP Top 10, OWASP API Security Top 10, secure coding practices, and modern authentication and authorization models. - Experience troubleshooting complex issues involving source control systems, build platforms, deployment pipelines, artifact repositories, and release management processes. - Experience implementing path-to-production controls including policy enforcement, release gates, exception management, evidence collection, and deployment readiness criteria. - Demonstrated ability to communicate technical risk and recommendations effectively to engineering leadership and executive stakeholders. - Proven ability to influence diverse teams and drive adoption of secure, innovative, and agile engineering practices. - Strong written, verbal, and stakeholder-management skills. Now Preferred Skills & Experience: bullet list: - Professional certifications such as CISSP, CSSLP, CCSP, GIAC GWEB, GWAPT, GCSA, AWS Security Specialty, Microsoft Certified: Cybersecurity Architect Expert, or equivalent security certifications. - Hands-on experience with GitHub, GitLab, Azure DevOps, Bitbucket, or similar platforms, including branch protection, code review workflows, signed commits, repository permissions, and secret scanning. - Experience securing CI/CD platforms such as Jenkins, GitHub Actions, Azure DevOps, and GitLab CI, along with artifact repositories, package registries, and deployment automation solutions. - Knowledge of secure product architecture, deployment security, artifact signing, provenance, SBOM practices, and release integrity controls. - Familiarity with software supply chain security frameworks and practices including SLSA, NIST SSDF, OWASP SAMM, and OWASP Top 10. - Experience applying application and API security principles across web, cloud, mobile, embedded, and service-based architectures. - Experience using Terraform, AWS CloudFormation, Open Policy Agent, Python, PowerShell, and policy-as-code approaches to automate security controls. - Understanding of modern product security threats including dependency confusion, malicious packages, source code tampering, credential theft, build pipeline compromise, and release artifact manipulation. - Experience supporting regulated environments aligned with ISO 27001, SOC 2, NIST, CMMC, IEC 62443, or comparable frameworks. - Travel: Less than 25%. (This is not a skill but we could include under Preferred maybe as note; but we might treat as separate? Travel is not a skill; but we could include as a note under Preferred or maybe under About? The rule: include section only when posting has real specific content. Travel is specific content; but we don't have a Travel section heading; we could incorporate into Preferred or maybe a separate "Travel" but not in allowed headings. Since allowed headings are limited, we could put travel info in Benefits? Not appropriate. Could put in About? Might be okay to include as a

        under Preferred or maybe under About? The instruction: Use headings only from list; we can't add Travel heading. So we need to fold travel info into a short

        or drop it. It says: "Do NOT put Job ID / requisition numbers as headings — fold minor metadata into a short

        or drop it." Travel is minor metadata; we can fold into a short

        maybe under Preferred or About. Let's include a

        under Preferred Skills & Experience (or after) stating "Travel: Less than 25%." But we need to preserve all substantive information; we can include it as a paragraph. Now Benefits Info: "This position also includes a competitive benefit package including; financial, social, health and wellbeing programs, paid vacation, 401k matching, employee stock purchase program, hybrid work schedule, and more!" We'll bullet each item. Pay: "The successful candidate’s starting salary will be determined based on permissible, non-discriminatory factors such as skills and experience and may vary by location. The base salary is $96,000-165,000 annually. This position is eligible for our annual bonus program." Also later: "The successful candidate's starting wage will be determined based on permissible, non-discriminatory factors such as skills and experience." That's repetitive; we should preserve but not duplicate? We need to preserve ALL substantive information; but we can combine duplicates? The instruction: "Preserve ALL substantive information; do NOT invent or summarize away detail." Duplicates lines: we should not repeat duplicated lines. So we need to avoid repeating same sentence. There's duplicate about starting wage determined based on permissible factors. We'll include once. Now we need to output HTML fragment only, no markdown fences. Let's craft:

        About the role

        Itron is innovating new ways for utilities and cities to manage energy and water. We create a more resourceful world to protect essential resources for today and tomorrow. Join us. Itron, Inc. (NASDAQ: ITRI) is a global technology and services company dedicated to the resourceful use of energy and water. With more than 300 million deployed endpoints worldwide, Itron is a leader in IoT innovation, helping utilities and cities create a more sustainable, connected, and resourceful future. As a member of the Information Security team, you will serve as the senior technical leader responsible for advancing Itron's product security program across software development, cloud, and engineering environments. This role focuses on securing source code, software supply chains, CI/CD pipelines, and product architectures while enabling agile, customer-centric development practices. You will collaborate closely with Product Development, DevOps, Cloud Engineering, Enterprise Architecture, and Cybersecurity teams to design and implement scalable security solutions that protect Itron products and services throughout the development lifecycle.

        Responsibilities

        • Lead the architecture and engineering of security controls that protect source code repositories, development environments, build systems, software supply chains, and release processes.
        • Design and implement secure CI/CD pipeline patterns, artifact