Product Security Architect

Responsibilities

 Deliver specialized privacy and security technical guidance to the product team throughout

the stages of product development, design modifications, and life-cycle management.

 Collaborate with the Product Security Leader (PSL) to assist the product team in implementing

processes that align with Healthcare Product Cybersecurity Standards and life-cycle management.

 Responsibilities related to product cybersecurity development include:

 Evaluate the privacy and cybersecurity posture of the product and delineate product roadmap

features and enhancements with stakeholder endorsement.

 Oversee security architecture and facilitate product development regarding cybersecurity features and enhancements.

 Ensure product components and Software Bill of Materials (SBoM) are integrated into the product.

 Manage defects related to cybersecurity issues.

 Define operational responsibilities and ensure compliance with cloud standards for cloud-based

products.

 Oversee the creation of the Product and Security Manual and MDS2 documentation.

 In conjunction with the PSL, take ownership of and produce Product Cybersecurity Standard artifacts, which

include:

 Conduct design input activities to identify, assess, roadmap, and implement cybersecurity and

privacy features and enhancements within product development initiatives.

 Generate Design Engineering Privacy and Security (DEPS) artifacts for privacy and

security risk assessments to engage in domain-specific product threat modeling, attack

surface analysis, and risk management and mitigation.

 Collaborate with the PSL to assist the product team in planning and executing

vulnerability scans and cybersecurity evaluations.

 Lead product Security Technical Design Reviews.

 Partner with the product Lead System Designer (LSD) to ensure compliance with the Product

Cybersecurity Standard and other relevant standards and processes.

 Ensure that released products meet all necessary regulatory standards and compliance (such as

FDA, HIPAA, GDPR, etc.).

 Collaborate with the Product Security team and Quality Assurance & Regulatory Assurance (QARA)

on the product life cycle post-release, which includes:

 Engaging in post-market product vulnerability monitoring.

 Serving as a Subject Matter Expert to assess product vulnerability impact, lead investigations, and perform risk assessments.

 Overseeing product vulnerability mitigation and modifications to design.

 Handling updates to vulnerability tools to guarantee accurate communication with customers.

 Addressing customer and Sales RFP inquiries related to privacy and security feedback/questions.

 Providing technical expertise in response to customer concerns, complaints, and CSO escalations.

 Create and maintain accurate product records within product cybersecurity tools.

Interested candidates are encouraged to share their resume at [HIDDEN TEXT]

Mandatory Soft Skills

 Ability to work effectively as an individual contributor.

 Capacity to independently execute assigned responsibilities.

 Strong focus on self-planning and organization.

Mandatory Skills

 Security Engineering

1. Possession of globally recognized Cyber Security Certifications (Advanced/Expert Level).

2. Proficient understanding of OWASP, CVSS, FIPS 140-2/140-3, and DoD RMF.

3. Minimum of 5 years of full-time information security experience focusing on technical

assessment (system/web application vulnerability assessments, penetration testing,

white-box secure code analysis, etc.) and security architecture (designing security

controls, secure system design, understanding identity and access management, etc.).

4. The Architect should be adept at identifying risks/issues and recommending optimal remediation strategies, understanding compensatory controls, and guiding the product

team towards resolution.

5. Strong comprehension of security technologies and techniques such as:

 Cryptography, Algorithms, Public Key Infrastructure (PKI) Certificate Authority (CA),

 Hardware/embedded authentication, OAuth, two-factor authentication, and

 white-box code analysis.

6. Familiarity with various security tools related to:

 SAST (Static Application Security Testing),

 DAST (Dynamic Application Security Testing),

 Vulnerability Management,

 SCA (Software Composition Analysis),

 Penetration Testing,

 Threat Modeling Tools, etc.

 Product Engineering

1. Experience in a product sector environment.

1. Knowledge of Cloud Infrastructure [Platform as a Service].

Nice-to-have Skills

 Experience in Medical Software/Device Engineering.

9. Familiarity with MDS2 documentation.

10. Background in the Healthcare domain.

 Standard Software Engineering

9. Experience in Microservices using RESTful frameworks.

 Security Engineering

9. Expertise in Penetration Testing for Web Applications, Thick Clients, Mobile Applications,

REST/SOAP.

10. Experience in Infrastructure Penetration Testing.

11. Participation in Red Teaming Activities (optional).

12. Recognition for CVE or Wall-of-Fame through Bug Bounty programs (optional).