Software Development Life Cycle (SDLC) Security and Compliance Lead

The Software Development Life Cycle (SDLC) Security and Compliance Lead defines, refines processes, and documents standards to ensure Inductive Automation's software development lifecycle meets certification and regulatory obligations. As the working lead for International Electrotechnical Commission (IEC 62443-4-1), this role aligns the standards with Inductive Automation’s practice, owns the Software Engineering process document family, tracks emerging and upcoming security requirements (e.g., IEC 62443-4-2, European Union (EU) Cyber Resilience Act (CRA)), and represents Software Engineering in compliance audits, company certifications, and compliance efforts (International Organization for Standardization (ISO) 9001, ISO 27001, CRA conformity assessment). This role helps define and sets standards within Software Engineering and ensures processes are documented; it does not implement technical measures. It is responsible for demonstrating compliance, including readiness checks, evidence preparation, and audit and certification support.

Additionally, this role owns Software Engineering's portion of the Coordinated Vulnerability Disclosure (CVD) and incident management program alongside the IT/Cyber divisions. Responsibilities include maintaining playbooks, maintaining Incident Management qualification and training, and coordinating the Common Vulnerabilities and Exposures (CVE) lifecycle through disclosure, including Cybersecurity and Infrastructure Security Agency (CISA) and European Union Agency for Cybersecurity (ENISA) reporting readiness. Across all duties, the lead ensures engineering personnel are trained and compliant with defined processes.

Responsibilities

• Serving as subject matter expert and working lead for IEC 62443 certifications; owning the gap between the standard's requirements and Inductive Automation practice
• Monitoring practice changes in Development and Quality Assurance that could create compliance drift; supporting corrective actions and nonconformance activities
• Tracking security roadmap and EU Cyber Resilience Act product-level requirements
• Supporting external security and compliance requirements as needed (e.g., Life Sciences, automotive, aerospace, Dept of Defense, US/EU law or regulation, etc.)
• Participating in ISO and CRA conformity audits as the Software Engineering representative; prepare and maintain auditable evidence (tickets, code reviews, QA records)
• Coordinating on third-party penetration testing; incorporating results into the SDLC ticket process
• Owning day-to-day currency of process documents. Maintains the mapping between committed standards (e.g., 62443, ISO 27001) practices and QMS documentation
• Maintaining SDLC traceability from code change through reviews, tests, requirements, and customer tickets
• Verifying Release Checklist completion as compliance evidence for all production software, including hotfixes
• Responsible for the Software Engineering portion of the Coordinated Vulnerability Disclosure and incident management program, in coordination with other stakeholders; keeps the playbook and process documentation current, with awareness of reporting requirements.
• Maintaining Incident Manager qualification and training for Software Engineering personnel with defined CVD roles; drive post-incident lessons learned into process and training
• Supporting Ignition Coordinated Vulnerability Disclosure. Coordinating with CISA/National Vulnerability Database (NVD), communicating with external researchers and stakeholders, and managing disclosure and release timing; supporting ENISA reporting requirements per compliance with the EU Cyber Resilience Act
• Running internal readiness checks and pre-audit gap assessments; tracks personnel qualification
• Identifying training gaps and coordinating delivery with engineering managers and leadership
• Consulting on Threat Modeling and participating in related activities