Job Description
The Company:Hexagon is a global leader in digital reality solutions, combining sensor, software, and autonomous technologies. We are putting data to work to boost efficiency, productivity, quality, and safety across industrial, manufacturing, infrastructure, public sector, and mobility applications.
Our technologies are shaping the production and people-related ecosystems to become increasingly connected and autonomous - ensuring a scalable, sustainable future.
Hexagon's Mining division solves surface and underground mine challenges with proven technologies for planning, operations, and safety.
Hexagon (Nasdaq Stockholm: HEXA B) has approximately 24,000 employees in 50 countries and net sales of approximately 5.5bn USD. Learn more at hexagon.com and follow us @HexagonAB.
Purpose of Position:The Product Cybersecurity Specialist helps define the internal cybersecurity processes, performs product cybersecurity analysis, and works with cross functional teams to ensure that Hexagon Mining products and services meet compliance requirements as set by ISO 27001 and the Cyber Resilience Act (CRA). The role supports product cybersecurity compliance across the Mining Division.
Working within the governance framework and processes, the Specialist conducts product cybersecurity audits and assessments, collaborates with Product Development teams in the planning and development of cybersecurity plans for product development, reviews and approves work products/services from a product cybersecurity perspective, prepares audit reports, contributes to Engineering and Support & Services process development, and delivers internal training. The role provides technical guidance and leadership to Service & Support, Product, and Engineering teams and works cooperatively across Product Management, Engineering, Quality, Support & Service, Legal, and Information Security.
Major Areas of Responsibility:Performs service and product cybersecurity analysis and activities as per internal processes to ensure our products meet all compliance requirements.
Specific Accountabilities 1. Audits and Assessments - Supports third party audits for product cybersecurity.
- May conduct product cybersecurity internal audits and assessments.
- Reviews and approves Work Products from a product cybersecurity perspective.
2. Compliance Evidence & Documentation - Develops cybersecurity plans for Product Management and Service & Support teams.
- Applies and maintains product cybersecurity processes within a quality management system.
- Establishes and maintains compliance documentation required for regulatory audits.
- Supports technical file creation and evidence management.
- Coordinates cybersecurity compliance reviews and readiness activities.
- Develops product cybersecurity metrics, dashboards, and reporting.
3. Reporting - Prepares product cybersecurity audit reports.
- Compiles and evaluates data to determine conformance to appropriate cybersecurity assurance levels.
4. Engineering Process Development - Contributes to engineering process development.
- Supports and conducts product cybersecurity internal assessments.
5. Regulatory Compliance Support (ISO 27001 & EU CRA) - Applies ISO 27001 and EU Cyber Resilience Act requirements to assigned Mining products, software, cloud services, and connected systems.
- Conducts product-level ISO 27001 and CRA applicability and gap assessments and documents the results.
- Supports vulnerability intake, assessment, prioritization, and remediation tracking.
- Compiles compliance evidence and supports technical file creation and evidence management for regulatory audits.
- Contributes to the Mining Division's input to the ISO 27001 and Hexagon CRA initiative and cross-functional working groups.
6. Vulnerability Management & Incident Response - Establishes product vulnerability management processes aligned with CRA requirements.
- Coordinates vulnerability intake, assessment, prioritization, and remediation activities.
- Leads exploitation impact assessments and cross-functional response efforts.
- Coordinates reporting of exploited vulnerabilities and severe incidents to applicable authorities where required.
- Defines customer communication, disclosure, and notification processes.
7. Training - May conduct product cybersecurity training internally as required.
8. Cross-Functionality Leadership - Serves as the Mining Division lead and subject matter expert for cybersecurity compliance.
- Provides technical guidance and leadership to others.
- Facilitates innovation through collaboration.
- May lead and facilitate technical discussions.
- Identifies key issues and patterns in complex situations; takes a broad perspective to problems and spots new, less obvious solutions.
- Tailors communication of complex technical content and reasoning for the audience.
- May set cybersecurity objectives, conduct performance evaluations, and assess employee development requirements.
Knowledge and Experience - Required:- -Bachelor Degree in Engineering, Computer Science or a similar discipline.
- -3+ or more years of experience in product development with involvement in cybersecurity activities.
- -Strong understanding of cybersecurity risk management.
- -Experience leading and/or working with cross-functional teams/programs.
- -Training record in internal product cybersecurity processes.
- -Working towards a Certified Cybersecurity Engineer qualification per relevant product cybersecurity standards.
Knowledge and Experience - Desired:- EU Cyber Resilience Act (CRA)
- NIS2
- ISO 27001
- IEC 62443
- Secure Software Development Lifecycle (SSDLC)
- Vulnerability Disclosure Programs
- SBOM initiatives
- Mining technology, SaaS, cloud platforms, or connected products.
Travel:- Domestic and international travel up to 10% of time.
Additional Information:Critical Performance Factors for Success Strong analytical and problem-solving skills. Excellent communication and writing skills with a professional and positive attitude. Technically competent to articulate facts and/or findings and make design and process recommendations. Ability to work cooperatively and productively with colleagues and cross functional teams. Ability to influence without authority and lead technical activities. Resourceful in knowing how to research problems and find information on related topics. Ability to lead.
Development Opportunities - Gain experience with product cybersecurity analysis.
- Build regulatory compliance expertise through EU CRA readiness activities across the Mining portfolio.
- Progress towards a Certified Cybersecurity Engineer qualification and, where business requirements support it, a team lead role.
Success Measures (First 12-18 Months) - Complete CRA applicability and gap assessments for assigned priority products.
- Develop cybersecurity plans for assigned product development programmes.
- Apply vulnerability monitoring and reporting processes to assigned products.
- Produce product cybersecurity audit reports demonstrating conformance to the appropriate cybersecurity assurance levels.
- Support SBOM and supplier security review activities.
- Complete the internal product cybersecurity process training record and progress towards Certified Cybersecurity Engineer qualification.
- Contribute to engineering process development and deliver internal cybersecurity training as required.
Hexagon is an Equal Opportunity Employer. We prohibit discrimination against any job applicant based on protected characteristics.
