Cyber Resilience Act (CRA) Compliance Lead
$149,100–$215,925 year
On-siteSan Jose, California, United States
Job Summary
Establish and govern the enterprise Cyber Resilience Act (CRA) compliance framework, translating regulatory obligations into scalable product lifecycle processes and conformity documentation. Maintain the traceability model between CRA requirements, cybersecurity risks, and design controls while monitoring regulatory developments and industry interpretations. Partner with cross-functional teams to determine product classification, integrate CRA requirements into product and release management systems, and lead the development of the conformity-assessment framework. Manage third-party software assessment, establish Software Bill of Materials governance, and define compliance check requirements across all product stages. Establish CRA metrics, dashboards, and reporting mechanisms to support QMS audits and risk management processes. Facilitate resolution of complex regulatory and technical compliance issues while driving training and competency requirements to promote a sustainable compliance culture.
Required Qualifications
- Bachelor's degree in Engineering, Computer Science, Information Systems, Cybersecurity, Quality, or a related technical field
- 10+ years of experience in product compliance, product cybersecurity, quality systems, regulatory compliance, engineering governance, semiconductor product development, or related technical disciplines
- 8+ years of experience interpreting and applying product cybersecurity regulations, including the EU Cyber Resilience Act (CRA) and other applicable global product security regulatory requirements
- 8+ years of experience leading enterprise or product compliance programs across multiple cross-functional organizations and global geographic locations
- 8+ years of experience implementing secure product development lifecycle (Secure SDLC) processes, product cybersecurity risk management, vulnerability management, software component governance (SBOM/open-source governance), and post-market product security compliance
- 8+ years of experience managing product lifecycle governance processes, including New Product Introduction (NPI), requirements management, configuration management, engineering change management, product release governance, audit readiness, and compliance evidence management
- 8+ years of experience partnering with executive leadership, engineering, legal, quality, security, and product management teams to drive compliance initiatives and influence technical decisions without direct management authority
- 8+ years of experience leading complex cross-functional programs requiring executive-level communication, data-driven decision making, stakeholder management, facilitation, and presentation of compliance strategies, risks, and program status to senior leadership
Desired Qualifications
- Experience within the FPGA, semiconductor, embedded systems, electronics, automotive, aerospace, defense, industrial, or technology industries
- Experience with semiconductor hardware, embedded firmware, software development tools, intellectual property, reference designs, or complex product ecosystems
- Working knowledge of applicable standards and frameworks, such as: IEC 62443, ISO/SAE 21434, ISO/IEC 27001, ISO 9001, AS9100, ISO 26262,IEC 61508 NIST Cybersecurity and secure software development Framework, Common Criteria or related product-security assurance frameworks
- Experience with Software Bill of Materials, 3rd party and open-source software governance, vulnerability-disclosure programs, product security incident response, or cybersecurity conformity assessment
- Experience supporting CE marking, EU product regulations, technical-file development, declarations of conformity, or market-surveillance activities
Hiring someone like this?
Get your role in front of qualified candidates on Sorce.