CRA Lead – Secure Software Development

CRA Lead – Secure Software Development Reports To: CRA Practice Lead Department: Cyber Resilience & Compliance Engineering About Us At Codvo, we are committed to building scalable, future-ready data platforms that power business impact. We believe in a culture of innovation, collaboration, and growth, where engineers can experiment, learn, and thrive. Join us to be part of a team that solves complex data challenges with creativity and cutting-edge technology.

About the Role We are seeking a CRA Lead to establish and scale a cross-platform, cross-technology development and testing practices aligned with the EU Cyber Resilience Act (CRA). This role will focus on enabling secure-by-design software development, continuous compliance testing, and codebase certification across a wide range of technologies, platforms, and deployment models (cloud, edge, embedded, on-prem). Key Responsibilities Practice Leadership - Execute the vision, strategy, and operating model for a CRA-aligned secure development and certification practice. - Build and lead a high-performing team across secure development, compliance testing, and DevSecOps. - Collaborate with product, legal, and security teams to interpret CRA requirements and embed them into engineering workflows.

Secure Development & Architecture - Establish secure-by-design principles across diverse technology stacks (e.g., web, mobile, embedded, cloud-native, edge). - Drive adoption of secure SDLC practices including threat modeling, secure architecture reviews, and secure coding standards. - Ensure integration of security controls across heterogeneous environments and third-party components. Compliance & Certification - Operationalize CRA-aligned testing and documentation processes across all software delivery pipelines. - Lead the implementation of automated compliance checks, SBOM generation, and vulnerability management. - Ensure traceability, audit readiness, and conformity assessment support for CRA and related regulations (e.g., NIS2, ISO 27001). Tooling & Automation - Implement a technology-agnostic toolchain for secure development, testing, and compliance automation. - Integrate security and compliance tooling into CI/CD pipelines across multiple platforms and languages. - Promote reuse of security patterns, templates, and automation assets across teams.

Stakeholder Engagement - Act as the technical authority on CRA compliance for internal teams, partners, and clients. - Support pre-sales, solutioning, and proposal development for CRA-related services. - Represent the practice in regulatory, industry, and standards forums. Required Skills & Experience - 7-10 years of experience in software engineering, cybersecurity, or compliance, with at least 2 years in a lead/senior role. - Proven experience in secure software development across multiple platforms (e.g., cloud, mobile, embedded, edge). - Good understanding of cybersecurity regulations including CRA, NIS2, and global standards - Hands-on experience with secure SDLC, DevSecOps, and software composition analysis (SCA) tools. - Familiarity with SBOM standards (e.g., SPDX, CycloneDX) and vulnerability disclosure processes. - Excellent communication, leadership, and stakeholder management skills. Preferred Qualifications - Bachelor’s or Master’s degree in Computer Science, Cybersecurity, or related field. - Experience working in regulated industries (e.g., MedTech, Industrial, Automotive, Fintech). - Exposure to open-source governance, third-party risk management, and secure supply chain practices.

Why Join Us? - Lead a pioneering practice at the intersection of cybersecurity, compliance, and software engineering. - Work on high-impact projects across industries and platforms. - Collaborate with a world-class team across AI, Edge, Cloud, and IoT domains. - Be part of a mission to build resilient, compliant, and trustworthy digital systems.