Cyber Resilience Act (CRA) Compliance Lead

Reporting within the Quality & Reliability organization, this role will serve as the enterprise CRA compliance lead and will coordinate cross-functional activities. The role is responsible for translating regulatory obligations into scalable product lifecycle processes, compliance requirements, governance mechanisms, objective evidence, and conformity documentation. The CRA Compliance Lead will provide independent oversight of compliance while partnering with technical organizations responsible for cybersecurity architecture, product, software and firmware development, vulnerability management, security testing, incident response, vendor management and implementation of cybersecurity controls.

This is a senior role requiring strong knowledge of product cybersecurity regulations, semiconductor and embedded-product lifecycles, quality management systems, risk management, regulatory conformity, and cross-functional program execution.

Key Responsibilities:

CRA Compliance Strategy & Governance

Maintain the enterprise CRA compliance framework, governance model, policies, procedures, roles, responsibilities, and decision authorities.

Establish traceability model between CRA requirements, cybersecurity risks, product requirements, design controls, verification activities, technical documentation, and conformity evidence.

Coordinate alignment with applicable standards and frameworks, including ISO/IEC 27001, IEC 62443, ISO/SAE 21434, ISO 26262, vulnerability management standards, emerging CRA harmonized standards and Altera security requirements.

Monitor regulatory developments, delegated acts, implementing guidance, harmonized standards, and industry interpretations that may affect company products or compliance obligations.

Partner with cross functional organization to determine product classification, critical-product applicability, conformity assessment pathways and regulatory obligations.

Support integration of CRA requirements into product requirement management, product lifecycle management, configuration management, change control, and release-management systems.

Establish governance requirements for Software Bill of Materials management and CRA-related software-component traceability.

Coordinate assessment of third-party software, intellectual property, software components, and external dependencies that may affect product compliance.

Lead development and governance of the CRA conformity-assessment framework, and maintenance of required CRA technical documentation and conformity evidence.

Define and drive CRA compliance check and evidence requirements for product concept, architecture, design, implementation, verification, validation, release, production, maintenance, and end-of-support stages.

CRA Compliance Operations & Enablement:

Partner with product security on vulnerability escalation, product non-conformity management and external communication

Establish CRA compliance metrics, dashboards, risk indicators, and management-reporting mechanisms.

Integrate CRA compliance monitoring into applicable QMS audit, management-review, risk-management, and corrective-action processes.

Develop CRA training, awareness, role-based competency requirements, and implementation guidance to promote a sustainable compliance culture.

Facilitate resolution of complex regulatory, technical, process, and organizational compliance issues.

Salary Range

The pay range below is for Bay Area California only. Actual salary may vary based on a number of factors including job location, job-related knowledge, skills, experiences, trainings, etc. We also offer incentive opportunities that reward employees based on individual and company performance.

$149,100 - $215,925 USD

We use artificial intelligence to screen, assess, or select applicants for the position. Applicants must be eligible for any required U.S. export authorizations.

#LI-MD1

Qualifications:

Minimum Qualifications

Bachelor's degree in Engineering, Computer Science, Information Systems, Cybersecurity, Quality, or a related technical field.

10+ years of experience in product compliance, product cybersecurity, quality systems, regulatory compliance, engineering governance, semiconductor product development, or related technical disciplines.

2+ years of experience interpreting and applying product cybersecurity regulations, including the EU Cyber Resilience Act (CRA) and other applicable global product security regulatory requirements.

8+ years of experience leading enterprise or product compliance programs across multiple cross-functional organizations and global geographic locations.

8+ years of experience implementing secure product development lifecycle (Secure SDLC) processes, product cybersecurity risk management, vulnerability management, software component governance (SBOM/open-source governance), and post-market product security compliance.

8+ years of experience managing product lifecycle governance processes, including New Product Introduction (NPI), requirements management, configuration management, engineering change management, product release governance, audit readiness, and compliance evidence management.

8+ years of experience partnering with executive leadership, engineering, legal, quality, security, and product management teams to drive compliance initiatives and influence technical decisions without direct management authority.

8+ years of experience leading complex cross-functional programs requiring executive-level communication, data-driven decision making, stakeholder management, facilitation, and presentation of compliance strategies, risks, and program status to senior leadership.

Preferred Qualifications

Experience within the FPGA, semiconductor, embedded systems, electronics, automotive, aerospace, defense, industrial, or technology industries.

Experience with semiconductor hardware, embedded firmware, software development tools, intellectual property, reference designs, or complex product ecosystems.

Working knowledge of applicable standards and frameworks, such as:

IEC 62443, ISO/SAE 21434, ISO/IEC 27001, ISO 9001, AS9100, ISO 26262,IEC 61508

NIST Cybersecurity and secure software development Framework, Common Criteria or related product-security assurance frameworks

Experience with Software Bill of Materials, 3rd party and open-source software governance, vulnerability-disclosure programs, product security incident response, or cybersecurity conformity assessment.

Experience supporting CE marking, EU product regulations, technical-file development, declarations of conformity, or market-surveillance activities.

Job Type:

Regular

Shift:

Shift 1 (United States of America)

Primary Location:

San Jose, California, United States

Additional Locations:

Posting Statement:

All qualified applicants will receive consideration for employment without regard to race, color, religion, religious creed, sex, national origin, ancestry, age, physical or mental disability, medical condition, genetic information, military and veteran status, marital status, pregnancy, gender, gender expression, gender identity, sexual orientation, or any other characteristic protected by local law, regulation, or ordinance.