VP, Product Security Greater San Francisco, CA Area

Your Role

The Commercial Product Security organization is responsible for ensuring that security is embedded throughout the lifecycle of Stellarus commercial products, platforms, and technology services. The Vice President, Product Security will establish and lead the enterprise product security strategy, governance framework, and operating model to protect Stellarus commercial products, customer data, and digital ecosystems while enabling innovation and business growth.

This executive leader will partner closely with Product, Engineering, Risk Management, Privacy, Compliance, and Legal business leaders to build secure-by-design capabilities that scale across Stellarus' portfolio of healthcare technology solutions. The role will oversee product security engineering, application security, cloud security, DevSecOps, vulnerability management, security architecture, and product security governance programs.

Our leadership model is about developing great leaders at all levels and creating opportunities for our people to grow – personally, professionally, and financially. We are looking for leaders that are energized by creative and critical thinking, building and sustaining high-performing teams, getting results the right way, and fostering continuous learning.

RESPONSIBILITIES

Your Work

In this role, you will:

• Establish and execute the enterprise commercial Product Security vision, strategy, and multi-year roadmap aligned with Stellarus business objectives, technology priorities, customer commitments, and product growth strategy.
• Build and lead a high-performing Product Security organization focused on security engineering excellence, scalable product security practices, operational rigor, and measurable risk reduction.
• Partner with Product Management, Engineering, Architecture, Compliance and Platform teams to embed security requirements into the product development lifecycle.
• Drive adoption of secure-by-design and secure-by-default principles across all products, platforms, APIs, cloud services, and technology solutions.
• Define and govern technical product security requirements across authentication, authorization, identity, API security, encryption, key management, secrets management, tenant isolation, secure configuration, logging, abuse prevention, and data protection.
• Oversee application security, cloud security, DevSecOps, software supply chain security, threat modeling, penetration testing, and vulnerability management programs.
• Establish cloud-native product security standards for infrastructure-as-code, containers, Kubernetes, serverless architectures, CI/CD pipelines, cloud identity, network segmentation, workload protection, runtime security, and continuous control monitoring.
• Drive security automation across the software delivery lifecycle, including SAST, DAST, SCA, IaC scanning, container image scanning, secrets detection, SBOM generation, artifact signing, policy-as-code, CI/CD security gates, and automated vulnerability triage.
• Lead security assessments and reviews for new products, strategic initiatives, acquisitions, partnerships, and technology implementations.
• Develop enterprise-wide product security metrics, reporting, and executive dashboards that provide visibility into risk posture, security maturity, and program effectiveness.
• Partner with Legal, Privacy, Compliance, Internal Audit, and Risk Management teams to ensure alignment with applicable regulatory requirements and industry standards.
• Champion security automation and continuous monitoring capabilities that improve efficiency and reduce organizational risk.
• Represent Product Security in executive leadership forums, customer engagements, regulatory discussions, and industry events as needed.
• Foster a culture of security awareness, accountability, and continuous improvement across the technology organization.
• Manage product security budgets, investments, vendor relationships, and strategic initiatives to maximize business value and risk reduction.

QUALIFICATIONS

Required Knowledge and Experience

• (Bachelor’s degree in Computer Science, Engineering, or a related technical field) or (18+ years of relevant experience (as shown below) in lieu of a degree).
• 12+ years of relevant experience in information security, cybersecurity, product security, application security, cloud security, software engineering security, or related disciplines, with a proven track record of leading enterprise-scale security programs and technical organizations.
• 7+ years of leadership experience leading managers and/or large-scale security organizations, with a proven track record of building high-performing teams and developing talent.
• At least one industry standard certification e.g., CISSP, CISM or CCSP
• Proven executive leadership experience developing and scaling enterprise Product Security programs in complex, highly regulated environments.
• Deep expertise in secure software development lifecycle (SSDLC), application security, DevSecOps, cloud security, API security, and software supply chain security.
• Strong understanding of modern cloud platforms, microservices architectures, containerized environments, and platform engineering practices.
• Experience implementing and operationalizing security frameworks and standards such as NIST CSF, NIST SSDF, ISO 27001, CIS Controls, SOC 2, and OWASP.
• Demonstrated success integrating security into agile and product-centric operating models.
• Strong knowledge of threat modeling, vulnerability management, penetration testing, code analysis, and secure architecture review methodologies.
• Experience managing security risks associated with customer-facing products, digital platforms, APIs, and cloud-native applications.
• Proven ability to translate business strategy into actionable security roadmaps, investment plans, and measurable outcomes.
• Strong financial and operational acumen, including experience managing budgets, prioritizing investments, and optimizing organizational performance.
• Excellent communication, stakeholder management, and executive presentation skills with the ability to influence technical and non-technical audiences.
• Experience collaborating with executive leadership, boards, customers, regulators, and external auditors. *

Preferred Knowledge and Experience

• Experience in healthcare, health plans, healthcare technology, payer/provider ecosystems, or other highly regulated industries.
• Experience securing SaaS platforms, healthcare data products, AI/ML solutions, and cloud-native digital services.
• Familiarity with healthcare regulatory requirements including HIPAA, HITRUST, CMS regulations, and emerging healthcare cybersecurity guidance.
• Experience leading product security programs supporting commercial software products and enterprise platforms.
• Professional certifications such as CISSP, CISM, CCSP, CSSLP, GIAC, or equivalent.
• Advanced degree in Cybersecurity, Computer Science, Engineering, Information Systems, or a related field.
• Experience serving as a security executive, security officer, or equivalent leadership role in a technology-driven organization.

About Stellarus and the Ascendiun Family of Companies

Stellarus, launched in January 2025, is designed to scale innovative healthcare solutions that support customers in creating a health care experience deserving of their family, friends, and neighbors.

Stellarus is part of a family of organizations that is overseen by a nonprofit corporate entity named Ascendiun. The Ascendiun Family of Companies also includes Blue Shield of California and its subsidiary, Blue Shield of California Promise Health Plan and Altais, a clinical services company.

Stellarus’ vision is to empower its customers to create a healthcare experience that is worthy of their family, friends, and neighbors. Stellarus’ objective is to offer innovative, modern, scalable solutions that challenge the health care status quo. This very closely aligns with Blue Shield of California’s vision by using innovation to improve quality, affordability, and experience for members.

To achieve our mission, we foster an environment where all employees can thrive and contribute fully to address the needs of the various communities we serve. We are committed to creating and maintaining a supportive workplace that upholds our values and advances our goals.

Our Values:

At Stellarus, our core values of agility, trust, drive, courage and service shape our approach to developing innovative product offerings.

Our Workplace Model:

We believe in fostering a workplace environment that balances purposeful in-person collaboration with flexibility - providing clear expectations while respecting the diverse needs of our workforce. Our workplace model is designed around intentional in-person interaction, collaboration, connection, creativity and flexibility:

• For most teams, this means coming into the office two days per week.

• Employees living more than 50 miles from an office location, out of state employees, and employees in certain member-facing roles should work with their manager to determine in-office time based on business need.

• For employees with medical conditions that may impact their ability to work in-office, we are committed to engaging in an interactive process and providing reasonable accommodations to ensure their work environment is conducive to their success and well-being.

The Company reserves the right to require more presence in the office based on business needs, and requirements are subject to change with periodic reviews.

Physical Requirements:

Office Environment - roles involving part to full time schedule in Office Environment. Based in our physical offices and work from home office/deskwork - Activity level: Sedentary, frequency most of work day.

Please click here for further physical requirement detail.

Equal Employment Opportunity:

External hires must pass a background check/drug screen. Qualified applicants with arrest records and/or conviction records will be considered for employment in a manner consistent with Federal, State and local laws, including but not limited to the San Francisco Fair Chance Ordinance. All qualified applicants will receive consideration for employment without regards to race, color, religion, sex, national origin, sexual orientation, gender identity, protected veteran status or disability status and any other classification protected by Federal, State and local laws.