Overview
The Product Cybersecurity and Compliance Lead serves as the technical subject matter expert for product cybersecurity and regulatory cybersecurity compliance initiatives. The role partners with the Director of Information Security, Product Development, Engineering, Regulatory Affairs, and Quality teams to integrate cybersecurity into the product lifecycle and support regulatory submissions requiring cybersecurity evidence and documentation.
This role provides technical leadership for Secure Product Development Framework (SPDF) activities, threat modeling, architecture reviews, cybersecurity risk assessments, and compliance initiatives. The position also coordinates cybersecurity workstreams, supports regulatory and product teams, and helps establish sustainable cybersecurity practices across regulated product programs.
Responsibilities
Product Cybersecurity Leadership
- Provide cybersecurity guidance for FDA, PMDA, IVDR, and related regulatory requirements.
- Lead threat modeling, security architecture reviews, and SPDF activities.
- Promote security-by-design practices throughout the product lifecycle.
- Provide cybersecurity input for new products, enhancements, and regulatory submissions.
- Partner with the Director of Information Security to mature product cybersecurity capabilities.
Cybersecurity Compliance
Partner with Regulatory Affairs, Quality, Product, and Engineering teams on cybersecurity compliance initiatives.
- Support development of cybersecurity evidence and documentation for regulatory submissions.
- Translate cybersecurity regulations and standards into technical requirements.
- Participate in audits, assessments, and remediation activities.
- Maintain cybersecurity compliance documentation and supporting artifacts.
Security Assessments & Risk Management
- Conduct product cybersecurity risk assessments and threat analyses.
- Review software supply chain security controls and contribute to SBOM processes.
- Coordinate vulnerability assessments, penetration testing, and remediation efforts.
- Support cybersecurity risk management documentation and evidence generation.
- Review product architectures and designs for cybersecurity risks.
- Serve as a technical SME for product cybersecurity activities across regulated products.
Cross-Functional Coordination & Execution
- Coordinate cybersecurity workstreams across Product, Engineering, QA, Regulatory Affairs, IT, and Information Security.
- Track cybersecurity deliverables, dependencies, and regulatory milestones.
- Facilitate technical reviews, threat modeling sessions, and cybersecurity working meetings.
- Identify risks, blockers, and resource constraints affecting deliverables.
- Support cybersecurity roadmap planning and execution.
- Security Architecture & Consultation
- Advise teams on secure design principles and secure development practices.
- Review application, cloud, infrastructure, and system designs.
- Recommend cybersecurity controls aligned with regulatory and business requirements.
- Support implementation of secure development and data protection practices.
- Help establish repeatable cybersecurity practices across product development teams.
Required Qualifications
- 7+ years of cybersecurity, application security, or product security experience.
- Experience supporting software development or product engineering organizations.
- Experience with threat modeling, architecture reviews, and secure SDLC practices.
- Experience conducting product cybersecurity risk assessments.
- Experience supporting regulated products or regulated software development environments.
- Strong communication and stakeholder management skills.
- Ability to lead cross-functional initiatives without direct authority.
Preferred Qualifications
- Experience with medical device, diagnostics, biotechnology, healthcare, or other regulated products.
- Experience supporting cybersecurity components of regulatory submissions.
- Experience with SBOM management and software supply chain security.
- Experience with HITRUST, ISO 27001, NIST CSF, or similar security frameworks.
- CISSP, CCSP, CSSLP, CISM, AWS Security Specialty, GIAC, or equivalent cybersecurity certifications.
Required
- U.S. citizen or national
- Green Card holder
- Living full time in the USA
We take geographic location into account when determining base salary to ensure equitable and competitive compensation.
Physical Requirements
Use of equipment and tools necessary to perform essential job functions.
#LI-KO1