Principal Product Security Manager - Regulations and Standards

Arm; Cambridge; Hybrid; GBP 70,000 - 90,000; Full time

Job summary

A leading technology company in Cambridge seeks a Product Security Manager to oversee compliance with evolving global security regulations. The role involves coordinating across engineering, legal, and product teams to embed regulatory requirements into product design. Ideal candidates will have a strong background in product security standards and experience in regulatory advocacy. This position supports innovation and customer trust while ensuring Arm's products meet compliance standards.

Benefits

Flexible hybrid working model

Support for accommodations during recruitment

Commitment to equal opportunities

Qualifications

• Strong knowledge of product security regulations including EU CRA, NIS2, etc.
• Experience with Security Development Lifecycles and product security assurance.
• Proven ability to translate regulatory requirements into technical actions.

Responsibilities

• Track and analyze upcoming product security regulations.
• Support the product security team in compliance program development.
• Develop training programs for staff on compliance practices.

Skills

Product security regulations knowledge

Security Development Lifecycles experience

Regulatory advocacy experience

Project management skills

Ability to interpret legal/regulatory text

Job description

Job Overview:

The Product Security Manager for regulations and standards will lead Arm’s efforts to meet and maintain compliance with evolving global product security regulations, including the EU Cyber Resilience Act (CRA). This role will work multi-functionally with engineering, legal, product management, and security teams to ensure Arm’s products and processes align with regulatory requirements while supporting innovation and customer trust. It also consists on actively representing Arm in key international standards and regulatory working groups helping build the industry landscape.

Responsibilities:

Regulatory Monitoring & Strategy

• Track, analyse, and interpret upcoming product security regulations (e.g., EU CRA, NIS2, U.S. cybersecurity labelling).
• Develop and communicate a regulatory compliance roadmap tailored to Arm’s product portfolio.
• Serve as the internal subject matter expert on security-related regulatory obligations.

Compliance Program Development

• Support the product security team in implementing policies, frameworks, and processes to ensure product compliance with security regulations.
• Lead risk assessments and gap analyses against regulatory requirements.

Cross-functional Coordination

• Partner with engineering and product teams to embed compliance requirements into product design and development.
• Work closely with Legal and Corporate Security to align regulatory, contractual, and certification requirements.
• Support incident response planning and regulatory reporting obligations.

Training & Awareness

• Develop training and awareness programs to ensure staff understand and implement security compliance practices.
• Provide guidance to product teams on practical application of CRA and other regulations.

Required Skills and Experience:

• Strong knowledge of product security regulations and standards, and their associated communities, including but not limited to the: EU CRA, ENISA, UK PSTI, BSI, NIS2, OpenSSF
• Experience with Security Development Lifecycles and product security assurance, including requirement management, threat modelling, security testing, and incident response
• Previous involvement in regulatory advocacy, industry working groups, or standards development.
• Proven ability to interpret legal/regulatory text and translate into actionable technical requirements.
• Project management and program coordination skills across multiple collaborators.

“Nice To Have” Skills and Experience:

• Familiarity with the security of embedded systems, semiconductors, software supply chain security
• A history of low-level software or hardware development/architecture
• Knowledge of ISO 21434, IEC 62443, SESIP, PSA Certified

In Return:

You will develop the roadmap for Arm’s core interconnect and control subsystems, ensuring they are strategically aligned and technically validated across markets. While the initial focus is infrastructure, you will work across line of business and customers to ensure these foundational technologies are robust, driven, and reusable across Arm’s diverse product portfolio. Your ownership of requirement specs and roadmap rigor will ensure subsystem coherence across product generations — enabling Arm to scale from IP to complete system solutions.

Our 10x mindset guides how we engineer, collaborate, and grow. Understand what it means and how to reflect 10x in your work: https://careers.arm.com/en/10x-mindset

Accommodations at Arm:

At Arm, we want our people to Do Great Things. If you need support or an accommodation to Be Your Brilliant Self during the recruitment process, please email [e-mail]. To note, by sending us the requested information, you consent to its use by Arm to arrange for appropriate accommodations. All accommodation requests will be treated with confidentiality, and information concerning these requests will only be disclosed as necessary to provide the accommodation. Although this is not an exhaustive list, examples of support include breaks between interviews, having documents read aloud or office accessibility. Please email us about anything we can do to accommodate you during the recruitment process.

Equal Opportunities at Arm:

Arm is an equal opportunity employer, committed to providing an environment of mutual respect where equal opportunities are available to all applicants and colleagues. We are a diverse organization of dedicated and innovative individuals, and don’t discriminate on the basis of race, color, religion, sex, sexual orientation, gender identity, national origin, disability, or status as a protected veteran.

Hybrid Working at Arm:

Arm’s hybrid approach to working is centred around flexibility, where we split our time between the office and other locations to get our work done. Within that framework, we empower groups and teams to determine their own particular hybrid working pattern, depending on the work and the team’s needs. Details of what this means for each role will be shared upon application. In some cases, the flexibility we can offer is limited by local legal, regulatory, tax, or other considerations, and where this is the case, we will collaborate with you to find the best solution. Please talk to us to find out more about what this could look like for you.