Principal, Product Security

We need to produce HTML fragment with sections: About the role? The posting includes description paragraphs. We need to use

for section headings: About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. Only include sections where there is real specific content. We must not repeat job title as heading. Remove boilerplate, navigation, legal, EEO, etc. Also remove duplicated lines, application instructions. We need to preserve all substantive information. Let's parse the posting: First paragraph: "Itron is innovating new ways for utilities and cities to manage energy and water. We create a more resourceful world to protect essential resources for today and tomorrow. Join us. Itron, Inc. (NASDAQ: ITRI) is a global technology and services company dedicated to the resourceful use of energy and water. With more than 300 million deployed endpoints worldwide, Itron is a leader in IoT innovation, helping utilities and cities create a more sustainable, connected, and resourceful future." That's about the company. Could be "About the role"? Actually "About the role" is for role description. But we have a description of the role: "As a member of the Information Security team, you will serve as the senior technical leader responsible for advancing Itron's product security program across software development, cloud, and engineering environments. This role focuses on securing source code, software supply chains, CI/CD pipelines, and product architectures while enabling agile, customer-centric development practices. You will collaborate closely with Product Development, DevOps, Cloud Engineering, Enterprise Architecture, and Cybersecurity teams to design and implement scalable security solutions that protect Itron products and services throughout the development lifecycle." That's role description. Could be under "About the role". We'll put that as prose in

. Then "Duties & Responsibilities" list: many bullet points. We'll put under

Responsibilities

with

• each. Then "Required Skills & Experience": list of requirements. Could be under

  Requirements

  or

  Qualifications

  . The instruction says use headings: About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. We need to decide which to use. We have both required skills and preferred skills. Could map required to Requirements, preferred to Skills? Or we could combine. But we should not create thin sections. We have substantive content for both required and preferred. Could put Requirements for required, Skills for preferred (or Qualifications). The instruction says we can use those headings; we should include only when posting has real specific content. So we can include Requirements (required), Skills (preferred), Benefits, Pay. Possibly also Qualifications? Might be redundant. We'll include Requirements and Skills. We also have "Travel: Less than 25%." That's maybe under Schedule? Not exactly schedule. Could be under Schedule? But schedule usually refers to work schedule (hybrid, remote). There's mention of hybrid work schedule in Benefits Info. So Schedule could be hybrid work schedule? Actually they say "hybrid work schedule" under Benefits Info. So we could put Schedule section with that detail. But they said only include Schedule if posting actually states them. It does mention hybrid work schedule. So we can include Schedule. Pay: they give base salary range $96,000-165,000 annually, plus bonus program. So we include Pay. Benefits: they list competitive benefit package including financial, social, health and wellbeing programs, paid vacation, 401k matching, employee stock purchase program, hybrid work schedule, and more! Also mention annual bonus program. So Benefits section. We need to avoid repeating info. Ensure we don't duplicate hybrid work schedule in both Benefits and Schedule? Might be okay but we could place hybrid work schedule under Benefits (as part of benefits) and Schedule maybe just mention hybrid work schedule? Actually they said hybrid work schedule is a benefit. So we could put Schedule maybe not needed. But they said include Schedule only if posting actually states them. It does state hybrid work schedule, but that's more a benefit. However we could still include Schedule with that detail. But to avoid duplication, maybe we put hybrid work schedule under Benefits and not Schedule. But then Schedule section would be empty or we would omit it. The instruction: "never create Pay/Schedule/Benefits sections unless the posting actually states them." So we can include Schedule only if there is explicit schedule info. The posting says "hybrid work schedule" under Benefits Info. That is schedule info. So we can include Schedule with that detail. However we might also mention it in Benefits; duplication is okay? Might be considered repeating. Better to keep Schedule separate with that detail, and Benefits without hybrid work schedule (or keep both but mention it's part of benefits). To avoid duplication, we can put hybrid work schedule under Schedule, and Benefits list other items (financial, social, health and wellbeing programs, paid vacation, 401k matching, employee stock purchase program, and more!). Also mention annual bonus program maybe under Benefits or Pay? It's part of compensation; could be under Pay. We'll include annual bonus program under Pay. Now we need to strip boilerplate: EEO statements, accommodation contact, etc. Also remove duplicated lines like "The successful candidate's starting wage will be determined based on permissible, non-discriminatory factors such as skills and experience." appears twice; we keep once. Also remove navigation/footer like "Join us as we create a more resourceful world: www.itron.com" maybe keep as part of About the role? It's marketing; but it's substantive? Might be considered boilerplate? It's a call to action; maybe we can keep as part of About the role? The instruction: remove cookie/navigation/legal/EEO/equal-opportunity/scam-warning boilerplate, duplicated lines, and application instructions. The website link is not necessarily boilerplate; it's a call to action. Might keep. But we should also remove "Itron is transforming how the world manages energy, water and city services..." paragraph at end; that's also marketing but maybe keep as part of About the role? It's somewhat repetitive of earlier. Could be considered boilerplate? It's describing company again. Might be okay to keep but we already have company description earlier. Might be duplicate. Safer to remove that final paragraph as it's repetitive. Also remove "If you are excited about this role but your past experiences don't perfectly align with every requirement, we encourage you to apply anyway. In the end, you may be just who we are looking for!" That's application encouragement; maybe considered application instructions? It's not exactly instructions to apply, but it's encouraging. Might be considered boilerplate? Not sure. Safer to remove. Also remove "Itron is committed to building an inclusive and diverse workforce and providing an authentic workplace experience for all employees." That's EEO boilerplate; remove. Also remove "If you require an accommodation to apply, please contact a recruiting representative at 1-800-635-5461 or email Accessibility@itron.com." Remove. Also remove "Itron is proud to be an Equal Opportunity Employer." Remove. Now we need to format. Let's extract sections: About the role: combine first paragraph about company and role description? Actually About the role should focus on role. We'll include the role description paragraph(s). Could also include brief company context but not necessary. We'll include:

  As a member of the Information Security team, you will serve as the senior technical leader responsible for advancing Itron's product security program across software development, cloud, and engineering environments. This role focuses on securing source code, software supply chains, CI/CD pipelines, and product architectures while enabling agile, customer-centric development practices. You will collaborate closely with Product Development, DevOps, Cloud Engineering, Enterprise Architecture, and Cybersecurity teams to design and implement scalable security solutions that protect Itron products and services throughout the development lifecycle.

  That's enough. Responsibilities: list each duty. Let's list them: - Lead the architecture and engineering of security controls that protect source code repositories, development environments, build systems, software supply chains, and release processes. - Design and implement secure CI/CD pipeline patterns, artifact management controls, signing services, and deployment workflows that ensure software integrity from code commit through product release. - Partner with security-by-design and application security testing teams to operationalize security requirements, vulnerability management, threat modeling outcomes, and release controls. - Establish and promote secure application and API security standards, including authentication, authorization, secure coding practices, data protection, logging, and abuse prevention. - Collaborate with engineering teams to reduce application, API, and cloud attack surfaces through secure architecture, identity management, and least-privilege access models. - Drive modernization of development and engineering environments to mitigate risks associated with credential compromise, malicious code, dependency attacks, and unauthorized releases. - Integrate security capabilities across source control, CI/CD platforms, cloud services, artifact repositories, governance tools, and security monitoring solutions. - Automate security controls and operational processes using APIs, infrastructure-as-code, and scripting technologies such as Python, PowerShell, Terraform, GitHub Actions, Azure DevOps, Jenkins, and GitLab. - Establish security logging, monitoring, and detection requirements for software development and release environments in partnership with security operations teams. - Develop secure architecture guardrails, reference standards, operational procedures, and technical documentation that support scalable and innovative product delivery. - Ensure auditable evidence exists for software supply chain controls, artifact integrity, release approvals, SBOM generation, and regulatory or customer assurance requirements. - Mentor engineers and influence cross-functional teams to adopt secure, customer-focused, collaborative, and accountable engineering practices across global product environments. Now Requirements (required skills & experience): - Bachelor's degree in Computer Science, Information Systems, Cybersecurity, or a related field; or an equivalent combination of education and experience. - 7+ years of experience in cybersecurity, product security, application security, software engineering, DevSecOps, cloud security, or a related technical discipline. - 5+ years of hands-on experience securing software development environments, source code platforms, CI/CD pipelines, or software supply chains. - Expert-level experience designing and operating security controls across cloud, SaaS, enterprise, and product engineering environments. - Strong knowledge of software supply chain security, source code protection, secrets management, privileged access management, artifact integrity, dependency governance, and secure release practices. - Deep understanding of application and API security principles, including OWASP Top 10, OWASP API Security Top 10, secure coding practices, and modern authentication and authorization models. - Experience troubleshooting complex issues involving source control systems, build platforms, deployment pipelines, artifact repositories, and release management processes. - Experience implementing path-to-production controls including policy enforcement, release gates, exception management, evidence collection, and deployment readiness criteria. - Demonstrated ability to communicate technical risk and recommendations effectively to engineering leadership and executive stakeholders. - Proven ability to influence diverse teams and drive adoption of secure, innovative, and agile engineering practices. - Strong written, verbal, and stakeholder-management skills. Now Skills (preferred skills & experience): - Professional certifications such as CISSP, CSSLP, CCSP, GIAC GWEB, GWAPT, GCSA, AWS Security Specialty, Microsoft Certified: Cybersecurity Architect Expert, or equivalent security certifications. - Hands-on experience with GitHub, GitLab, Azure DevOps, Bitbucket, or similar platforms, including branch protection, code review workflows, signed commits, repository permissions, and secret scanning. - Experience securing CI/CD platforms such as Jenkins, GitHub Actions, Azure DevOps, and GitLab CI, along with artifact repositories, package registries, and deployment automation solutions. - Knowledge of secure product architecture, deployment security, artifact signing, provenance, SBOM practices, and release integrity controls. - Familiarity with software supply chain security frameworks and practices including SLSA, NIST SSDF, OWASP SAMM, and OWASP Top 10. - Experience applying application and API security principles across web, cloud, mobile, embedded, and service-based architectures. - Experience using Terraform, AWS CloudFormation, Open Policy Agent, Python, PowerShell, and policy-as-code approaches