Rockwell Automation Security Team

Security at Rockwell Automation

Compiled from public job postings, careers pages, and company materials. Data may not reflect current state — verify during interviews.

3 Intel Signals

How they approach application security

“Rockwell Automation's Application Security (AppSec) approach is deeply integrated into its product development lifecycle, emphasizing a "security by design"philosophy. The company aligns its cybersecurity program with industry standards like the NIST Cybersecurity Framework and IEC 62443-4-1, focusing on identifying, protecting, detecting, responding to, and recovering from cyber threats across its infrastructure, products, and customer environments. Their stated AppSec mission is a holistic strategy to ensure safety, security, and resilience across infrastructure, products, and customers. They adopt an embedded, enabling approach to security, evidenced by an industry-certified secure software development lifecycle process. Their risk philosophy is based on a risk-based approach aligned with NIST CSF principles (Identify, Protect, Detect, Respond, Recover) and includes risk assessments in new product development. No public information was available regarding specific pain points or goals, and no significant contradictions were found.”

The team

Rockwell Automation manages cybersecurity risk as part of its overall Enterprise Risk Management program, with strategy executed by security leaders including the CIO, CISO, and Chief Product Security Officer. The Office of Product Safety and Security reports directly to high-level executives. Key public-facing leaders include Stephen Ford (CISO, appointed March 2024) responsible for a holistic cybersecurity strategy, and Tony Baker (VP & Chief Product Security Officer) who leads product safety and security strategy. Specific team size is not publicly available. However, at least 4 relevant AppSec job postings were found as of, indicating a focus on skills like secure SW Engineering, threat modeling, secure coding practices, CI/CD, SAST/DAST tools, Python, DevSecOps tools (Jenkins, GitLab, Docker), Azure cloud, OWASP, NIST, IEC 62443, cryptographic primitives, and Hardware Security Modules (HSMs).

What they're working on

Rockwell Automation does not publicly provide information on a dedicated Security Champions Program.
They practice "Shift Left"by integrating security throughout the Software Development Life Cycle (SDLC), guided by NIST-800-218 SSDF, and emphasize this integration for DevSecOps engineers.
Their Vulnerability Management Process involves the Product Security Incident Response Team (PSIRT) for triage, establishing CVSS scores, and driving resolution, as well as gathering information from various sources.
They maintain an ISA/IEC 62443-4-1 certified SDLC process, which includes security requirements, secure design, implementation, verification, validation, defect/patch/vulnerability management, and product end-of-life management, alongside threat modeling for high-risk services.
A recent initiative (March 2024) was the appointment of Stephen Ford as CISO to develop and execute a holistic cybersecurity strategy.