Product Security Manager

Are you an experienced cybersecurity professional who thrives on complex technical challenges and making technology future-proof? Do you want to have a direct impact on how our machines and digital products are developed and secured? If so, we’d love to invite you for an introductory meeting!

For nearly 80 years, Moba has been creating comprehensive solutions for sorting, packaging, and processing eggs sold all over the world. Over the years, Moba has grown to become the global market leader, with high-tech systems in 111 different countries that process more than 1 billion eggs every day. From design, development, production, and installation to service, it all happens in Barneveld.

As Product Security Manager, you are responsible for the cybersecurity of our machines, software solutions, and digital services throughout the entire product lifecycle. You define the product security strategy in alignment with our business objectives and risk appetite, ensure “security-by-design” is embedded in our development processes, and ensure that Moba complies with European regulations on product cybersecurity, particularly the Cyber Resilience Act (CRA). The CRA sets requirements for the entire product, from design to support, and the initial reporting obligations are already in effect. You will establish the approach that will enable Moba to comply with these requirements in a sustainable manner.

You will work closely with R&D, Engineering, IT, Product Management, Marketing, Sales, and other departments. In doing so, you will serve as the link between technical security requirements, legislation, and the day-to-day realities of product development.

What kinds of tasks can you specifically expect?

Product Security & Governance

• You will develop the product security policy, standards, and secure-by-design principles for our products and digital solutions, aligned with the CRA’s essential requirements, and guide R&D and other departments through their implementation.
• You will define the requirements for secure software development (coding standards, review gates, and security testing criteria) and ensure they are integrated into the development process.
• You will determine the requirements for SBOMs (Software Bills of Materials) and technical documentation, and support the engineering team in keeping them up to date so that they support CE marking and conformity assessment under the CRA.
• You establish standards for secure architecture and IT/OT integration of our products and evaluate technical designs against these standards.
• You provide awareness sessions and training for R&D and engineering on secure-by-design, secure coding, and the obligations under the CRA.

Risk, Vulnerability, and Incident Management

• You will develop the framework for product risk and vulnerability management, determine the criteria and frequency of risk analyses and penetration tests, and coordinate their implementation with engineering and QA.
• You will set up the coordinated vulnerability disclosure (CVD) process and the reporting channel, assess incoming reports, and ensure that the responsible engineering teams resolve them.
• You will manage the handling of product vulnerabilities and incidents through the Product Security Incident Response Team (PSIRT) and ensure that mandatory CRA reports to the CSIRT and ENISA are submitted within the legal deadlines.
• You determine the policy for security updates and patches for products in the field, including the CRA support period, and coordinate with the teams that build and roll out updates.

Compliance & Regulations

• You are responsible for compliance and audit management related to the Cyber Resilience Act, the Machinery Regulation, NIS2, and IEC 62443.
• You prepare the necessary documentation, oversee audits and assessments by notified bodies, and follow up on nonconformities.
Collaboration with Suppliers, Customers, and Marketing
• You establish cybersecurity requirements for suppliers—such as the submission of SBOMs and the handling of vulnerabilities—and support their implementation.
• You will advise on terms of sale and contracts to ensure it is clear who is responsible for what (such as infrastructure, network segmentation, patching, and password management) and that risks beyond Moba’s control are identified and mitigated in advance.
• You coordinate with Product Management and product marketing regarding the risks and opportunities of cybersecurity within our portfolio.
• You advise clients’ IT departments and support our internal OT security specialists with production-related issues.