Lead Cybersecurity Test Engineer

About the role

Distech Controls’ success and reputation are fueled by our world-class team of employees. We look for qualified individuals who are striving to succeed and that wish to actively contribute to our continued growth. Distech Controls values its team members and offers them a modern, motivating work environment, and competitive salaries and benefits.

Distech Controls is a Canadian-based company located in Brossard, on the South Shore of Montreal (QC), with a European headquarter in Brignais (Lyon), France. We are proud to be part of the

Acuity Inc.

family since 2015. Our mission is to connect people with intelligent building solutions for better health, better space, and better efficiencies through our forward-thinking technologies and services.

Acuity Inc. (NYSE: AYI) is a market-leading industrial technology company. We use technology to solve problems in spaces, light and more things to come. Through our two business segments, Acuity Brands Lighting (ABL) and Acuity Intelligent Spaces (AIS), we design, manufacture, and bring to market products and services that make a valuable difference in people’s lives.

We achieve growth through the development of innovative new products and services, including lighting, lighting controls, building management solutions, and an audio, video and control platform. We focus on customer outcomes and drive growth and productivity to increase market share and deliver superior returns. We look to aggressively deploy capital to grow the business and to enter attractive new verticals.

Acuity Inc. is based in Atlanta, Georgia, with operations across North America, Europe and Asia. The Company is powered by approximately 13,000 dedicated and talented associates. Visit us at

Job Summary

The Cybersecurity Test Engineer is responsible for supporting product security testing, vulnerability management, compliance coordination, and security validation across software, firmware, cloud, and system components. This role performs or coordinates penetration testing activities, reviews findings from tools such as Aqua, Snyk, and related security scanners, supports vulnerability triage, and serves as a technical liaison between R&D, Legal, Compliance, Product, and Quality.

This position helps ensure that security findings are understood, prioritized, tracked, remediated, verified, and reported according to organizational policies, quality expectations, and applicable regulatory or contractual requirements. The role contributes directly to Software Quality / System Quality Engineering by strengthening defect prevention, release readiness, customer trust, and secure product delivery.

Key Tasks & Responsibilities (Essential Functions)

Security Testing

• Perform targeted product security testing and vulnerability validation.
• Support penetration testing activities for software, firmware, APIs, cloud services, and connected systems.
• Review security test results from internal and external assessments.
• Validate security fixes and support regression testing.
• Identify gaps in security test coverage.

Vulnerability Management

• Review findings from tools such as Aqua, Snyk, and other security scanning platforms.
• Triage vulnerabilities by severity, exploitability, product impact, and customer risk.
• Partner with engineering teams to ensure findings are properly documented and assigned.
• Track vulnerability remediation against defined SLAs.
• Verify remediation and closure evidence.

Compliance and Legal Liaison

• Serve as a technical liaison between R&D, Legal, Compliance, Product, and Quality for product security matters.
• Support compliance evidence collection and security documentation.
• Assist with customer security questionnaires, audit responses, and regulatory inquiries.
• Help translate legal or compliance expectations into actionable engineering requirements.

Secure Development Support

• Advise engineering teams on secure design and secure coding practices.
• Participate in design reviews for security-sensitive features.
• Support threat modeling and risk assessments.
• Help define security acceptance criteria and quality gates.

Reporting and Governance

• Maintain vulnerability dashboards and security quality metrics.
• Support executive reporting on vulnerability backlog, aging, SLA performance, and risk posture.
• Ensure alignment between security policies and operational workflows.
• Partner with Quality Operations on security SLA reporting.

Skills and Minimum Experience Required

• Experience in cybersecurity, product security, application security, DevSecOps, or security testing.
• Familiarity with vulnerability scanners and security testing tools.
• Understanding of vulnerability severity, CVEs, CVSS, exploitability, and remediation workflows.
• Experience working with development teams to resolve security findings.
• Strong communication skills with both technical and non-technical stakeholders.

Preferred Skills and Experience

• Experience with Snyk, Aqua, or similar security tools.
• Experience with penetration testing or ethical hacking.
• Knowledge of embedded systems, firmware security, cloud security, or connected device security.
• Familiarity with compliance frameworks, secure SDLC, SBOM, or product security programs.
• Security certifications such as Security+, CEH, GIAC, CISSP, or equivalent experience.

Travel Requirements

• 1-20%
• Distech Controls Inc. is owned by Acuity Inc., which is located in the United States. These companies share a global recruitment system on which the data you provide will be stored, and which will be subject to the laws of the United States of America.

Pay and benefits

The range for this position is $150,000 to $270,000. Placement within this range may vary, depending on the applicant’s experience and geographic location. Acuity offers generous benefits including health care, dental coverage, vision plans, 401K benefits, and commissions/incentive compensation depending on role. For a list of our benefits,

Please click here and here for more information.

Any unsolicited resumes sent to Acuity Inc. from a third party, such as an Agency recruiter, including unsolicited resumes sent to an Acuity Inc. mailing address, fax machine or email address, directly to Acuity Inc. employees, or to Acuity Inc. resume database will be considered Acuity Inc. property. Acuity Inc. will NOT pay a fee for any placement resulting from the receipt of an unsolicited resume.

Acuity Inc. will consider any candidate for whom an Agency has submitted an unsolicited resume to have been referred by the Agency free of any charges or fees. This includes any Agency that is an approved/engaged vendor, but does not have the appropriate approvals to be engaged on a search.

E-Verify Participation Poster e-verify.gov eeoc.gov