This position is critical to maintaining customer trust, meeting evolving cybersecurity expectations, supporting regulatory compliance initiatives, and ensuring the long-term success and resilience of the Fire Solutions business.

Key Responsibilities

Product Security Strategy & Leadership

• Define and execute the Fire Solutions Product Security Strategy aligned with business objectives, customer expectations, and enterprise cybersecurity standards.
• Partner with Johnson Controls Enterprise Security to establish security governance, policies, standards, and risk management frameworks across the product portfolio.
• Serve as the senior product security leader for Fire Solutions and provide strategic cybersecurity guidance to business and engineering leadership.
• Develop multi-year security roadmaps focused on improving product security maturity, resilience, and operational effectiveness.
• Establish security metrics, KPIs, and executive reporting mechanisms to measure program effectiveness and risk reduction.
• Drive a culture of security-by-design, accountability, and continuous improvement throughout the organization.

Security Governance & Compliance Execution

• Lead the implementation of cybersecurity governance processes across the product development lifecycle.
• Partner with Regulatory Affairs, Quality, Legal, and Engineering teams to operationalize cybersecurity requirements associated with emerging regulations and industry standards.
• Translate regulatory cybersecurity requirements into scalable engineering processes, controls, documentation, and compliance evidence.
• Support audit readiness activities, security assessments, certifications, and regulatory reviews.
• Ensure cybersecurity requirements are integrated into product development, release, maintenance, and end-of-life processes.
• Monitor industry trends, emerging threats, and evolving cybersecurity requirements to continuously improve security capabilities.

Cyber Resilience Act (CRA) Leadership

• Lead the cybersecurity execution framework required to support CRA compliance across the Fire Solutions portfolio.
• Work closely with Regulatory Affairs, which owns regulatory strategy and interpretation, to ensure cybersecurity obligations are effectively implemented within engineering and product development processes.
• Establish and maintain processes supporting:
• Secure development practices
• Vulnerability management
• Coordinated vulnerability disclosure
• Software Bill of Materials (SBOM) management
• Security documentation
• Post-release monitoring and response
• Coordinate cross-functional efforts to ensure sustainable compliance execution across global product teams.
• Develop metrics and reporting to track cybersecurity compliance readiness and risk posture.

AI Security Governance & Threat Response

• Define and lead the organization's AI security governance and threat response strategy.
• Establish processes for identifying, assessing, mitigating, and responding to AI-related cybersecurity risks.
• Partner with Enterprise Security and engineering teams to implement secure AI adoption practices and governance controls.
• Evaluate AI-enabled product capabilities for cybersecurity risk and resilience.
• Develop playbooks and response processes for AI-specific threats and vulnerabilities.
• Leverage AI-driven security tools and automation to improve security effectiveness and operational efficiency.

Product Security Program Management

• Drive adoption of secure development lifecycle (SSDLC) practices across hardware, firmware, software, cloud, mobile, and IoT product teams.
• Lead threat modeling, security architecture reviews, risk assessments, and security design reviews.
• Establish consistent security requirements for new product introductions and major platform enhancements.
• Oversee security testing programs, penetration testing activities, and security validation processes.
• Ensure security requirements are embedded throughout all phases of the product lifecycle.

Vulnerability Management & Incident Response

• Establish and oversee global product vulnerability management processes.
• Lead coordinated vulnerability disclosure and external vulnerability response activities.
• Manage security incident response processes affecting products and connected services.
• Develop remediation prioritization frameworks and risk-based decision-making processes.
• Support customer communications and executive briefings related to cybersecurity issues and product security events.
• Drive continual improvements in vulnerability response timelines and remediation effectiveness.

Security Process Excellence & Operational Efficiency

• Design and implement scalable security processes that can be consistently adopted across global engineering organizations.
• Identify opportunities to improve efficiency through process optimization, automation, and AI-assisted workflows.
• Establish repeatable methods for security reviews, compliance evidence generation, risk assessments, and vulnerability tracking.
• Define and measure operational performance indicators that demonstrate security program effectiveness and business impact.
• Reduce friction in engineering processes while improving security outcomes and compliance readiness.

Global Leadership & Collaboration

• Lead and influence geographically distributed teams and cross-functional stakeholders across multiple business functions.
• Build strong partnerships with Enterprise Security, Regulatory Affairs, Quality, Product Management, Engineering, Operations, Legal, and Customer Support organizations.
• Develop organizational capabilities, talent strategies, and succession plans within the product security function.
• Drive alignment and decision-making across diverse technical and business stakeholders.
• Serve as a trusted advisor to executive leadership on cybersecurity risks, investments, and priorities.

Customer & Industry Engagement

• Represent Johnson Controls in customer discussions regarding product cybersecurity capabilities and security practices.
• Support strategic customer engagements, audits, assessments, and security reviews.
• Participate in industry working groups, standards organizations, and cybersecurity forums.
• Maintain awareness of emerging technologies, threat landscapes, and industry best practices relevant to fire and life safety products.

Required Qualifications

• Bachelor’s degree in computer science, Cybersecurity, Engineering, Information Technology, or a related technical discipline.
• 12+ years of experience in cybersecurity, product security, software engineering, systems engineering, or related technical leadership roles.
• 5+ years of experience leading large-scale security programs and influencing global organizations.
• Demonstrated success developing and executing product security strategies within complex technology organizations.
• Strong knowledge of product security, secure development practices, cloud security, IoT security, and vulnerability management.
• Experience working closely with enterprise cybersecurity teams to implement governance, standards, and risk management frameworks.
• Proven ability to drive cross-functional initiatives across engineering, product management, quality, and regulatory organizations.
• Excellent leadership, communication, stakeholder management, and executive presentation skills.

Preferred Qualifications

• Master's degree in Cybersecurity, Computer Science, Engineering, Business, or a related field.
• Industry certifications such as CISSP, CISM, CRISC, CSSLP, GIAC, or equivalent.
• Experience supporting products subject to cybersecurity regulations and compliance frameworks.
• Knowledge of cybersecurity standards and frameworks including NIST, IEC 62443, ISO 27001, UL cybersecurity standards, and related industry practices.
• Experience building and scaling product security organizations.
• Experience implementing DevSecOps and security automation initiatives.
• Knowledge of AI governance, AI security controls, and emerging AI threat landscapes.

Experience Required

The ideal candidate has successfully led cybersecurity and product security initiatives within global organizations that develop complex hardware and software products operating in highly regulated environments.

Global Product Experience

• Experience supporting global product portfolios spanning:
• Embedded systems
• Hardware devices
• Firmware platforms
• Cloud services
• Mobile applications
• SaaS platforms
• IoT and connected device ecosystems
• Proven success integrating cybersecurity requirements across multiple product lines and technology stacks.
• Experience balancing business objectives, customer needs, compliance requirements, and cybersecurity risk management.

Global Team Leadership & Communication

• Demonstrated success leading globally distributed teams and influencing cross-functional organizations across multiple regions.
• Ability to build alignment among engineering, product management, quality, regulatory, and cybersecurity stakeholders.
• Strong executive presence with the ability to communicate complex technical concepts to both technical and non-technical audiences.
• Experience driving organizational change and establishing company-wide security practices.

Highly Regulated Industry Experience

• Experience within highly regulated industries such as:
• Fire and life safety, Industrial automation, Building technologies, medical devices, Aerospace and defense, Critical infrastructure, Transportation systems, Energy or utility sectors
• Experience supporting regulatory, audit, and compliance initiatives where cybersecurity requirements are critical to product development and market access.
• Demonstrated ability to operationalize cybersecurity requirements within engineering organizations.

Hardware & Software Ecosystem Expertise

• Deep understanding of securing products across an end-to-end technology ecosystem, including:
• Hardware platforms
• Embedded firmware
• Edge devices
• IoT architecture
• Cloud infrastructure
• Web applications
• Mobile applications
• APIs and connected services
• Experience managing cybersecurity risks throughout the product lifecycle from concept and architecture through deployment, maintenance, and end-of-life support.
• Knowledge of modern threat landscapes impacting connected devices, industrial systems, cloud platforms, and customer-facing applications.

Success Measures

Within the first 18-24 months, the Director will:

• Establish and execute a comprehensive Fire Solutions Product Security Strategy.
• Strengthen collaboration and operating models between Fire Solutions and Enterprise Security teams.
• Implement scalable cybersecurity processes across the global product development organization.
• Achieve sustainable CRA execution readiness across applicable product portfolios.
• Establish a robust AI security governance and threat response framework.
• Improve vulnerability management effectiveness and security response performance.
• Increase security maturity through adoption of security-by-design and SSDLC practices.
• Enhance security operational efficiency through automation, metrics, and process optimization.
• Build strong partnerships across Engineering, Regulatory Affairs, Quality, Product Management, Program Management and Enterprise Security organizations.

SALARY RANGE: $142,000 - $200,000(Salary to be determined by the education, experience, knowledge, skills, and abilities of the applicant, internal equity, and alignment with market data.) This role offers a competitive Bonus plan that will take into account individual, group, and corporate performance. This position includes a competitive benefits package. The posted salary range reflects the target compensation for this role. However, we recognize that exceptional candidates may bring unique skills and experiences that exceed the typical profile. If you believe your background warrants consideration beyond the stated range, we encourage you to apply. To support an efficient and fair hiring process, we may use technology assisted tools, including artificial intelligence (AI), to help identify and evaluate candidates. All hiring decisions are ultimately made by human reviewers. For details, please visit the About Us tab on the Johnson Controls Careers site at https://jobs.johnsoncontrols.com/about-us

Johnson Controls International plc. is an equal employment opportunity and affirmative action employer and all qualified applicants will receive consideration for employment without regard to race, color, religion, sex, national origin, age, protected veteran status, genetic information, sexual orientation, gender identity, status as a qualified individual with a disability or any other characteristic protected by law. To view more information about your equal opportunity and non-discrimination rights as a candidate, visit EEO is the Law . If you are an individual with a disability and you require an accommodation during the application process, please visit here .