Job Details:

Job Description:

About the role

Altera is looking for a Director to lead AI and Software Security (Head of AI & Product Security). The Director is accountable for the company wide AI Security Lab and the Software Security program for product, application, and engineering software. Software Security is a core responsibility, not a service limited to product reviews or release gates. It covers architecture and design, development, build, release, operation, vulnerability response, and retirement.

The AI Security Lab serves Corporate, Software, Hardware, and the other security teams. The Director owns Software Security for Altera software that is built, acquired, integrated, or substantially customized. This includes products, applications, APIs, SDKs, developer tools, engineering systems, cloud services, AI software, source repositories, build systems, and delivery pipelines. The Software Security Architect / App/SW Security Tech Lead reports to this Director and leads secure architecture and threat modeling. The Director sets the program direction, standards, coverage, and assurance. Engineering and application owners implement and operate their systems and fix findings. The security team sets requirements, advises, checks results, and escalates unresolved risk.

The Director sets priorities and standards and works directly with engineering leaders to address software and AI risks. The role partners with Product, Software, Hardware, Corporate Technology, Legal, Privacy, and Information Security.

What You'll Do

Set the AI and Product Security strategy

·      Define and maintain Altera’s AI, product, application, and secure development security strategy, roadmap, operating model, and control objectives.

·      Translate business goals, product risks, customer expectations, and applicable obligations into pragmatic security requirements and measurable plans.

·      Establish clear ownership, decision rights, risk acceptance paths, escalation criteria, and interfaces with other security and engineering functions.

·      Advise the CISO and business leaders on material AI and product risks, investment priorities, exceptions, and residual risk.

·      Establish service priorities and intake for the AI Security Lab, balancing demand from Corporate, Software, Hardware, and the security verticals.

Lead the AI Security Lab

·      Run the AI Security Lab for Corporate, Software, Hardware, and the security teams. Set priorities for its reviews, testing, and guidance.

·      Set security requirements for AI systems, models, agents, copilots, and AI features with AI owners, Engineering, Privacy, and Legal.

·      Oversee adversarial testing of AI features and agents. Test for prompt injection, unsafe tool use, data exposure, misuse, and related weaknesses.

·      Oversee secure AI adoption practices, including data protection, access controls, model and vendor risk review, secure integration, monitoring, and lifecycle change management.

·      Guide AI security automation and testing. Require human review for actions that could materially affect systems or data.

·      Coordinate AI security work across software and hardware products, including security testing of AI accelerator IP and FPGA workloads, in partnership with the relevant product and Hardware Security teams.

Own Software Security end to end

·      Set and own the Software Security strategy, standards, architecture oversight, assurance model, roadmap, and measures across the agreed Altera software portfolio. Make this an explicit program with named owners, adoption plans, risk decisions, and measurable coverage.

·      Cover the full software lifecycle: intake and classification; security requirements; architecture and threat modeling; implementation and code review; dependencies and build; security verification; release approval and evidence; production vulnerability management; and end of life or retirement.

·      Define the in scope portfolio with Engineering and IT, including customer facing and shipped software, applications and APIs, SDKs and developer tools, engineering platforms and systems, cloud native services, AI enabled software, and the source repositories, CI/CD, build, signing, and artifact delivery systems used to create or distribute software.

·      Lead the Software Security Architect / App/SW Security Tech Lead as a direct report technical lead. Set expectations for secure architecture, design reviews, threat modeling, and technical guidance; coach the role while retaining Director level accountability for program outcomes.

·      Establish security by design requirements and reusable architecture patterns covering trust boundaries, authentication and authorization, data protection, cryptography, secure configuration, logging, tenant isolation, and other relevant software risks.

·      Define and govern risk based application and software security testing, including SAST, DAST, software composition analysis, API testing, fuzzing, manual security reviews, and penetration testing. Set standards for coverage, triage, severity, remediation, exceptions, and validation of fixes.

·      Lead software supply chain security, including dependency and open source risk, SBOM expectations, secrets protection, repository and branch controls, build system security, CI/CD pipeline controls, artifact integrity, signing, and provenance.

·      Ensure release processes include proportionate security criteria, documented findings and exceptions, accountable risk decisions, and retrievable evidence; avoid treating a one time review or release gate as a substitute for lifecycle security.

·      Establish a risk based software vulnerability management program: identify and validate findings, set remediation expectations, track aging and exceptions, verify fixes, and escalate unresolved material risk. Coordinate product vulnerability handling and disclosure with PSIRT and product owners; PSIRT retains its established ownership.

·      Partner with Engineering, IT, and application owners to make controls practical and adopted. The Software Security team defines requirements, provides architecture and engineering support, validates outcomes, and escalates risk; system owners retain responsibility for implementation, operation, and remediation.

·      Build developer enablement through security champions, secure coding guidance, reusable libraries and patterns, training, and automation that improves security without creating unnecessary delivery friction.

·      Coordinate security assessments for software products, APIs, developer tools, SDKs, engineering platforms, firmware/software boundaries, and other in scope systems, using internal capability and specialist providers as appropriate.

·      Partner with PSIRT, Legal, Privacy, Product, Hardware Security, and customer facing teams on software vulnerabilities, security commitments, disclosure, customer impact, and lessons learned.

·      Report portfolio coverage, design review and testing coverage, critical findings, remediation performance, exception aging, release evidence, and risk trends to the CISO and engineering leadership.

Director level team leadership

·      Set team objectives, responsibilities, operating rhythms, technical quality expectations, and performance measures.

·      Hire, develop, and retain a high performing, appropriately distributed team across AI security, product security, application security, and DevSecOps.

·      Coach managers and senior individual contributors, including the software security architect / App/SW Security Tech Lead, on technical judgment, influence, execution, and career growth.

·      Allocate capacity across strategic programs, engineering engagements, AI Lab requests, and time sensitive product risks.

·      Build a culture of collaboration, accountability, constructive challenge, continuous learning, and measurable risk reduction.

·      Manage budgets, tools, service providers, and specialist testing partners in line with approved plans.

Establish assurance, metrics, and continuous improvement

·      Define and report meaningful indicators of coverage, risk, remediation, exception aging, review quality, and adoption of secure development practices.

·      Ensure critical product and AI security decisions, reviews, testing, exceptions, and remediation evidence are documented and retrievable.

·      Use findings from incidents, product vulnerabilities, testing, audits, and engineering feedback to improve standards and controls.

·      Provide clear, concise reporting for the CISO and stakeholders that connects technical findings to business, customer, product, and intellectual property impact.

·      Support audits, customer due diligence, and regulatory or contractual assessments by providing accurate evidence for the programs this team owns.

Key partnerships

·      Product and Software Engineering: Secure architecture, threat modeling, SSDLC adoption, release readiness, remediation, and developer enablement.

·      Hardware Security and Hardware Engineering: Product specific security requirements and testing for hardware, firmware, FPGA, and AI accelerator use cases.

·      PSIRT: Vulnerability intake, severity and response coordination, disclosure, and remediation communications; PSIRT retains its established ownership.

·      AI, Corporate Technology, and business teams: Secure AI adoption, use case risk reviews, data controls, and safe integration of models and agents.

·      CISO organization and security verticals: Shared AI Lab services, automation, risk escalation, incident coordination, and alignment of control responsibilities.

·      Legal, Privacy, Compliance, and customer facing teams: Product vulnerability and AI risk decisions, privacy implications, assurance evidence, and customer commitments.

What Success Looks Like

·      The Director sets a clear plan for AI and Software Security, and teams know their responsibilities.

·      The AI Security Lab has a defined intake process, agreed priorities, and clear owners for its work.

·      The software security architect / App/SW Security Tech Lead and broader team have clear goals, decision rights, and effective engagement with engineering.

·      Security reviews and threat modeling happen early enough to influence product and software design, with findings tracked through remediation or explicit risk decisions.

·      Software Security has clear end to end ownership and measurable coverage across the agreed software portfolio, not only products approaching release.

·      Security requirements and threat modeling are integrated into design; code, dependencies, repositories, builds, APIs, and pipelines receive risk based controls and testing; releases have documented security decisions and evidence.

·      Software vulnerabilities are triaged, assigned, remediated, validated, or explicitly risk accepted within defined processes, with material exposure escalated.

·      AI enabled systems receive proportionate security review and testing before production use and when material changes occur.

·      Product vulnerabilities are coordinated with PSIRT and product owners using clear severity, remediation, escalation, and communication processes.

·      Engineering teams use the security guidance and tools in their development work, and raise risks early.

·      Leadership receives concise reporting on material risks, coverage, remediation, exceptions, and progress against the roadmap.

Salary Range 

The pay range below is for Bay Area California only. Actual salary may vary based on a number of factors including job location, job-related knowledge, skills, experiences, trainings, etc. We also offer incentive opportunities that reward employees based on individual and company performance.  

 

$209,500 - $303,250 USD

 

We use artificial intelligence to screen, assess, or select applicants for the position. Applicants must be eligible for any required U.S. export authorizations.

 #LI-MD1

Qualifications:

Minimum Qualifications

·      Bachelor’s degree in Computer Science, Cybersecurity, Engineering, Information Systems, or a related discipline, or equivalent practical experience.

·      10+ years of experience in product security, application security, software security, secure development, AI security, or a closely related discipline;

·      Demonstrated experience leading a security function or multidisciplinary technical team at director or equivalent scope, including setting priorities, developing talent, and delivering measurable outcomes.

·      Deep, hands on understanding of end to end Software Security, including secure architecture and design, threat modeling, secure coding, application and API security, software supply chain and build security, security testing, release assurance, and vulnerability management.

·      Experience establishing and operating a Software Security program across multiple development teams and software types, with risk based standards, measurable coverage, remediation governance, and clear ownership boundaries.

·      Experience embedding security into software development and release workflows, including CI/CD, repositories, build systems, dependencies, artifact integrity, and software supply chain controls.

·      Working knowledge of AI/ML security risks and practical approaches to securing models, agents, copilots, data flows, and AI integrations.

·     Experience in evaluating technical risk and explain trade offs, remediation options, and residual risk to both engineering teams and executives.

·      Experience influencing senior stakeholders and building effective partnerships across Engineering, Product, IT, Legal, Privacy, and Security.

Preferred Qualifications

·      Good to have experience in semiconductor, FPGA, silicon, hardware, firmware, developer tools, or other complex product development environments.

·      Experience establishing or scaling a secure software development lifecycle and product security program across multiple engineering teams.

·      Experience with AI red teaming, agent security, model security, AI governance, or security testing of AI enabled products.

·      Familiarity with relevant practices and standards such as NIST SSDF, NIST Cybersecurity Framework, OWASP ASVS/SAMM, OWASP Top 10, ISO/IEC 27001, and software supply chain security guidance.

·      Experience with application security tooling and processes, including SAST, DAST, software composition analysis, API testing, fuzzing, CI/CD security, SBOMs, and secrets management.

·      Experience coordinating with PSIRT, vulnerability disclosure programs, penetration testing providers, or other specialist security vendors.

·      Relevant certifications such as CISSP, CSSLP, CISM, or equivalent are a plus; equivalent experience may be considered.

Job Type:

Regular

Shift:

Shift 1 (United States of America)

Primary Location:

San Jose, California, United States

Additional Locations:

Posting Statement:

All qualified applicants will receive consideration for employment without regard to race, color, religion, religious creed, sex, national origin, ancestry, age, physical or mental disability, medical condition, genetic information, military and veteran status, marital status, pregnancy, gender, gender expression, gender identity, sexual orientation, or any other characteristic protected by local law, regulation, or ordinance.