Lead Engineer – Product Security Representative

Quest Global; Bengaluru; Hybrid; INR 2,800,000 - 4,200,000; Full time

Job summary

Quest Global in Bengaluru is seeking a Lead Engineer for Product Security to drive security across Med Tech and Healthcare projects. You will guide security throughout the product lifecycle, providing risk assessments, design guidance, and incident response while aligning with regulatory requirements.

Ideal candidates bring 7+ years in information security, strength in PKI/cryptography, OWASP, and experience with Kubernetes/microservices. Excellent communicator and stakeholder liaison required.

Qualifications

• Bachelor's degree in Computer Science or Information Security
• 7+ years information security experience
• Strong knowledge of security architecture and controls
• Experience with SAST/DAST, VMS, SCA, Penetration Testing, Threat Modelling
• FIPS, STIG, GDPR, HIPAA knowledge
• Kubernetes and microservices security
• Secure coding in C++, Java, Go and Python
• Excellent written and verbal communication
• Agile experience

Responsibilities

• Ensure security and compliance of software products
• Provide security guidance to product teams and mitigate risks
• Respond to security incidents and investigations
• Stay updated on threats and industry trends
• Communicate security findings to stakeholders
• Collaborate with Information Security and other teams
• Support audits and regulatory compliance (FIPS, STIG, GDPR, HIPAA)
• Design secure applications and guidance on secure design
• Model threats to protect PII/PHI in DICOM transfers
• Understand HL7 in healthcare domain

Job description

Job Requirements

Company: Quest Global

Job Category: Med Tech and Healthcare

We are seeking a highly skilled and experienced Product Security Representative to join our team at Quest Global. As a Lead Engineer, you will play a crucial role in product security activities for our Med Tech and Healthcare projects.

Roles and Responsibilities:

• The Product Security Representative (PSR) will be responsible for ensuring the security and compliance of software products
• Provide security guidance to product teams and assist in identifying and mitigating security risks in the development process.
• Respond to security incidents, conduct investigations, and communicate findings to relevant stakeholders.
• Stay current with industry trends and emerging threats and advise product teams on how to address these risks.
• Communicate security information to stakeholders, including customers and other relevant parties.
• Collaborate with other security teams within the organization, such as the Information Security team, to ensure alignment with the overall security strategy of the company.
• Respond to audits and work with the Product Security Leader to ensure compliance with relevant regulations and standards, including FIPS, STIG, GDPR, and HIPAA.
• Design secure applications and provide guidance on secure application design, with a good understanding of software design principles.
• Model security threats and mitigate them to ensure the protection of Personal Identifiable Information (PII) and Personally Health Information (PHI) being transferred using DICOM.
• Possess a strong understanding of HL7 and experience working with it in the healthcare domain.

Work Experience

Required Skills:

• Bachelor’s degree in computer science, Information Security, or a related field.
• 7+ years full-time information security experience.
• Good understanding of security architecture (design of security controls, secure system design, understanding of identity and authentication management, etc.)
• Sound understanding of security technologies/techniques like Cryptography, Algorithms, Public key Infrastructure (PKI) Certificate Authority (CA), Hardware/embedded authentication, OAuth, 2-factor authentication, white-box code analysis.
• Experience with a range of security tools related to SAST (Static Application Security Assessment), DAST (Dynamic Application Security Assessment), Vulnerability Management, SCA (Software Composition Analysis), Penetration Testing, Threat Modelling Tool
• Firm with knowledge of OWASP, CVSS, FIPS 140-2/140-3 and DoD RMF.
• Experience in working with Product sector environment.
• Experience in handling security assessment of Kubernetes, Microservice based architecture.
• Strong understanding of secure coding practices, including experience with C++, Java, Go and Python
• Excellent communication skills, both written and verbal, and the ability to effectively communicate security information to both technical and non-technical stakeholders.
• Strong problem-solving and analytical skills, and the ability to think critically and creatively.
• Ability to work effectively in a fast-paced and dynamic environment, and to prioritize and manage multiple tasks and projects.
• Experience in working with Agile.
• Good communication and presentation skills.

Desired Skills:

• Experience in Healthcare domain.
• Penetration Testing in Web Application, Thick Client, Mobile Application, REST/SOAP
• Infrastructure Penetration Testing
• Experience in Red Teaming Activities (add on)
• Recognition for CVE or Wall-of-Fame though Bug-Bounty (add on)
• Experience in developing software applications for Medical Devices domain CT, XR, MR, Common Platform, DICOM standard and IHE standards.
• Cybersecurity certifications such as Certified Information Systems Security Professional (CISSP), Certified Ethical Hacker (CEH), or similar certifications are desirable.
• Ability to explore large code base and understand architecture and design