Senior Director Product Security

About the role

Generac is seeking a forward‑thinking Senior Director, Product Security to lead and advance our enterprise‑wide product security strategy across a rapidly expanding portfolio of connected products, energy technologies, software, and digital services. This highly visible leadership role is responsible for ensuring security is embedded into every stage of the product lifecycle, enabling our teams to deliver innovative solutions that are secure by design and trusted by customers around the world.

As the company’s foremost product security leader, you will define the frameworks, governance, and security standards that shape how we design, develop, deploy, and support connected technologies. Leveraging IEC 62443 as the foundation of our product security program, you will lead the evolution of our secure development lifecycle, drive enterprise‑wide adoption of secure engineering practices, and establish best‑in‑class Product Security Incident Response capabilities that safeguard customers and products in the field.

This role will play a pivotal part in navigating an increasingly complex global regulatory environment, including the EU Cyber Resilience Act, UK Product Security requirements, and emerging international standards. You will translate evolving cybersecurity regulations into practical engineering processes that position Generac ahead of compliance requirements while strengthening customer trust and market differentiation.

Why Join Generac? At Generac, you'll have the opportunity to shape the security strategy for a growing portfolio of connected energy solutions that power homes, businesses, and communities worldwide. Your leadership will directly influence product innovation, customer trust, regulatory readiness, and the future of secure energy technology.

Major Responsibilities

• Product Security Strategy
  • Set the enterprise product security strategy and multi‑year roadmap, embedding “secure by design” as the standard across the product portfolio and related energy technology solutions.
  • Establish IEC 62443 as the primary product security framework and define its application across industrial, commercial, and consumer connected products.
  • Make product security a visible driver of customer trust and competitive differentiation; represent it to customers, partners, auditors, and regulators.
  • Partner with engineering and product leadership so security requirements, threat models, and risk decisions are built into product design, development, and release.
• Secure Development Lifecycle
  • Define and operationalize a secure development lifecycle that includes threat modeling, secure coding, security testing, and security gates.
  • Lead the company toward formal certification of its secure development lifecycle against IEC 62443‑4‑1, advancing process maturity and preparing for assessment by an accredited body.
  • Establish foundations for downstream certification, including IEC 62443‑4‑2 for components and IEC 62443‑3‑3 for systems.
  • Drive software bill of materials, secure software supply chain, and vulnerability management practices into the development lifecycle.
• Product Security Incident Response
  • Build and lead the Product Security Incident Response capability to receive, triage, investigate, and resolve field vulnerabilities and incidents.
  • Establish coordinated vulnerability disclosure and handling practices aligned to ISO/IEC 29147 and ISO/IEC 30111, including a public intake channel and clear security advisories for customers.
  • Stand up processes and reporting to meet regulatory timelines, such as the EU Cyber Resilience Act’s 24‑hour, 72‑hour, and final‑report cadences for actively exploited vulnerabilities.
  • Partner with enterprise security operations and incident response to ensure coordinated handling of product and enterprise incidents.
• Global Regulatory and Compliance Leadership
  • Lead the company’s response to a fast‑moving global regulatory landscape, including the EU Cyber Resilience Act, the UK product security regime, and emerging regulations in other markets.
  • Translate new obligations into engineering requirements, evidence, and documentation (e.g., conformity assessment, CE marking support, declarations of conformity).
  • Maintain product security policies, standards, and control narratives; own the evidence that demonstrates compliance to auditors, customers, and market‑surveillance authorities.
  • Track the regulatory horizon and advise executive leadership on cost, risk, and timing of new requirements.
• Organization and Talent
  • Build, staff, and develop a high‑performing product security organization, including managers and senior engineers.
  • Set clear direction, develop talent, and create a culture of ownership, engineering rigor, and customer focus.
  • Influence teams beyond direct reports, embedding product security champions within each business‑unit engineering organization.
  • Manage product security tooling, services, and external partners; steer investment toward the highest risk‑reduction opportunities.

Minimum Qualifications

• Bachelor’s degree in Engineering, Computer Science, Cybersecurity, or a related field (or equivalent experience).
• One or more of the following certifications is strongly preferred: CISSP, CSSLP, GICSP, ISA or IEC 62443 certifications, or equivalent product and application security credentials.
• 12 + years of experience in cybersecurity, product security, or secure engineering with progressive leadership responsibility.
• 7 + years leading teams, including managing other managers or senior engineers, ideally across multiple regions.
• Proven record of building or substantially maturing a product security program for connected, embedded, or industrial products.
• Hands‑on leadership of a secure development lifecycle and a product security incident response capability.
• Working experience applying IEC 62443 to real products, including familiarity with the path to IEC 62443‑4‑1 certification.
• Experience navigating global product security regulations such as the EU Cyber Resilience Act or comparable regimes.

Preferred Qualifications

• Advanced degree in Engineering, Cybersecurity, or Computer Science.
• Additional ISA or IEC 62443, cloud, or product security certifications.
• Experience achieving or maintaining IEC 62443‑4‑1 certification of a secure development lifecycle.
• Background in energy, power, industrial, or connected consumer product environments.
• Experience securing products that span operational technology, embedded systems, cloud‑connected services, and mobile applications.
• Experience aligning product security with enterprise security, including shared incident response and governance.

Knowledge, Skills, and Abilities

• Deep knowledge of secure‑by‑design principles, secure development lifecycle, threat modeling, and product vulnerability management.
• Strong command of IEC 62443, including the secure development lifecycle requirements of 62443‑4‑1 and the component and system requirements of 62443‑4‑2 and 62443‑3‑3.
• Working knowledge of the global product security regulatory landscape, including the EU Cyber Resilience Act, the UK product security regime, and emerging regimes in other markets.
• Practical understanding of product security incident response and coordinated vulnerability disclosure aligned to ISO/IEC 29147 and ISO/IEC 30111.
• Ability to set enterprise strategy and translate it into engineering practice, evidence, and certification outcomes.
• Excellent executive communication and influence; capable of representing product security to the board, customers, auditors, and regulators.
• Demonstrated ability to build, develop, and retain a world‑class technical organization.