R&D Security Manager

About the role

The Nemetschek Group is a pioneer in the digital transformation of the AEC/O industry, with a strong focus on open standards such as OPEN BIM. As one of the world’s leading groups in this industry, Nemetschek improves the construction process through intelligent software solutions that help customers plan, build, and operate buildings more efficiently, sustainably, and with fewer demands on resources. HCSS, part of the Nemetschek Group, provides innovative software solutions that help heavy civil construction companies streamline their operations and improve productivity. While this position sits within Nemetschek, the R&D Security Manager will provide dedicated security support to HCSS and collaborate closely with its product development and engineering teams. The R&D Security Manager will integrate security seamlessly into HCSS’s product development lifecycle, partnering with Agile teams to embed security into sprint planning and prioritize relevant risks. This person will establish initiatives such as a security champions program and “train-the-trainer” efforts to strengthen security awareness across R&D. The role will also support secure source code management, regulatory compliance, and the development of security documentation frameworks. By monitoring emerging threats and managing vulnerabilities, the R&D Security Manager will help protect intellectual property and sensitive data while serving as a key liaison among HCSS R&D, Nemetschek Shared Services, and the appropriate security leadership teams.

Responsibilities

• Implement comprehensive security strategies for the R&D department as part of the product development process (Agile Sprint Planning) and Reporting to Brand CISOs
• Establish a train the trainer initiative for awareness and knowledge exchange throughout the R&D personnel
• Review and Implement source code repository hardening and change management according to guideline
• Prioritize security issues in Sprint backlog
• Act as interface to Shared Services
• Establish Security Documentation (Setup and Maintenance of the Framework)
• Identify and document vulnerability remediation information (based on CVSS 4) to R&D engineers
• Identify and assess security risks related to R&D activities, including intellectual property, confidential data, and emerging technologies
• Ensure compliance with relevant security regulations like GDPR, industry standards, and company policies in software development through workshops

Requirements

• Bachelor’s or Master’s degree in Information Security, Computer Science