Cyber Resilience Act (CRA) Compliance Lead

About this role

Job Details:

Job Description: About Altera At Altera™, our independence as the world’s largest pure ‑ play FPGA solutions provider gives us the focus, speed, and agility to innovate without compromise. With more than four decades of industry ‑ leading FPGA expertise, our singular mission is to deliver the programmable technologies that help customers differentiate, innovate, and scale across rapidly evolving markets like AI, cloud, networking, and edge. As an independent company, we move faster, invest deeper, and partner more closely—empowering our teams to drive breakthrough innovation and shape the future of the FPGA industry.

About the Role We are seeking for a Cyber Resilience Act (CRA) Compliance Lead who will establish, govern, and drive the company-wide compliance framework for the European Union Cyber Resilience Act and related product cybersecurity regulatory requirements.

Reporting within the Quality & Reliability organization, this role will serve as the enterprise CRA compliance lead and will coordinate cross-functional activities. The role is responsible for translating regulatory obligations into scalable product lifecycle processes, compliance requirements, governance mechanisms, objective evidence, and conformity documentation. The CRA Compliance Lead will provide independent oversight of compliance while partnering with technical organizations responsible for cybersecurity architecture, product, software and firmware development, vulnerability management, security testing, incident response, vendor management and implementation of cybersecurity controls.

This is a senior role requiring strong knowledge of product cybersecurity regulations, semiconductor and embedded-product lifecycles, quality management systems, risk management, regulatory conformity, and cross-functional program execution.

Key Responsibilities:

CRA Compliance Strategy & Governance • Maintain the enterprise CRA compliance framework, governance model, policies, procedures, roles, responsibilities, and decision authorities.

• Establish traceability model between CRA requirements, cybersecurity risks, product requirements, design controls, verification activities, technical documentation, and conformity evidence.

• Coordinate alignment with applicable standards and frameworks, including ISO/IEC 27001, IEC 62443, ISO/SAE 21434, ISO 26262, vulnerability management standards, emerging CRA harmonized standards and Altera security requirements.

• Monitor regulatory developments, delegated acts, implementing guidance, harmonized standards, and industry interpretations that may affect company products or compliance obligations.

• Partner with cross functional organization to determine product classification, critical-product applicability, conformity assessment pathways and regulatory obligations.

• Support integration of CRA requirements into product requirement management, product lifecycle management, configuration management, change control, and release-management systems.

• Establish governance requirements for Software Bill of Materials management and CRA-related software-component traceability.

• Coordinate assessment of third-party software, intellectual property, software components, and external dependencies that may affect product compliance.

• Lead development and governance of the CRA conformity-assessment framework, and maintenance of required CRA technical documentation and conformity evidence.

• Define and drive CRA compliance check and evidence requirements for product concept, architecture, design, implementation, verification, validation, release, production, maintenance, and end-of-support stages.

CRA Compliance Operations & Enablement: • Partner with product security on vulnerability escalation, product non-conformity management and external communication

• Establish CRA compliance metrics, dashboards, risk indicators, and management-reporting mechanisms.

• Integrate CRA compliance monitoring into applicable QMS audit, management-review, risk-management, and corrective-action processes.

• Develop CRA training, awareness, role-based competency requirements, and implementation guidance to promote a sustainable compliance culture.

• Facilitate resolution of complex regulatory, technical, process, and organizational compliance issues.

Salary Range The pay range below is for Bay Area California only. Actual salary may vary based on a number of factors including job location, job-related knowledge, skills, experiences, trainings, etc. We also offer incentive opportunities that reward employees based on individual and company performance.

$149,100 - $215,925 USD

We use artificial intelligence to screen, assess, or select applicants for the position. Applicants must be eligible for any required U.S. export authorizations.

#LI-MD1

Qualifications: Minimum Qualifications • Bachelor's degree in Engineering, Computer Science, Information Systems, Cybersecurity, Quality, or a related technical field.

• 10+ years of experience in product compliance, product cybersecurity, quality systems, regulatory compliance, engineering governance, semiconductor product development, or related technical disciplines.

• 2+ years of experience interpreting and applying product cybersecurity regulations, including the EU Cyber Resilience Act (CRA) and other applicable global product security regulatory requirements.

• 8+ years of experience leading enterprise or product compliance programs across multiple cross-functional organizations and global geographic locations.

• 8+ years of experience implementing secure product development lifecycle (Secure SDLC) processes, product cybersecurity risk management, vulnerability management, software component governance (SBOM/open-source governance), and post-market product security compliance.

• 8+ years of experience managing product lifecycle governance processes, including New Product Introduction (NPI), requirements management, configuration manageme

Similar jobs

• Cyber Resilience Advisor — Immersivelabs · Remote
• Cyber Operations Lead — Accenturefederalservices · Arlington, VA
• Cyber Security Coordinator — Equipmentsharecom · Columbia, MO (Headquarters)
• Risk and Compliance Lead — Replit · Remote
• Cybersecurity Counsel — Waymo · Mountain View, CA, USA
• Staff Cyber Resilience Engineer — Xometry · North Bethesda, MD
• Staff Cyber Resilience Engineer — Xometry · Lexington, KY
• Staff Cyber Resilience Engineer — Xometry · Denver, CO