Product Security Architect

Nest Digital; Bengaluru; On-site; INR 2,500,000 - 4,200,000; Full time

Job summary

Nest Digital in Bengaluru, India, seeks a seasoned Product Cybersecurity Architect to provide privacy and security expertise across the product lifecycle, collaborating with the Product Security Leader for standards and life-cycle management. Responsibilities include defining roadmaps, security architecture, SBOM integration, vulnerability scans, and regulatory compliance (FDA, HIPAA, GDPR).

Post-market monitoring and risk assessment are also part of the role, along with handling

Qualifications

• Global cyber security certifications required.
• Knowledge of OWASP, CVSS, FIPS 140-2/140-3 and DoD RMF.
• 5+ years of full-time information security experience with technical assessment and security architecture.
• Ability to define remediation strategies and guide product teams.
• Familiarity with cryptography, PKI, and authentication mechanisms.

Responsibilities

• Provide privacy and security technical expertise supporting the product team throughout product development, design change, and life-cycle management.
• Work with the Product Security Leader (PSL) to support the product team with process expertise for Healthcare Product Cybersecurity Standards and life-cycle management.
• Assess the privacy and cybersecurity state of the product and define product roadmap features/enhancements with stakeholder approval.
• Responsible for security architecture and coordination of product development for cybersecurity features and enhancements.
• Assess product components and SBoM are integrated into the product.
• Perform defect management for cybersecurity issues.
• Identify operational responsibilities and adherence to cloud standards for cloud-based products.
• Responsible for Product and Security Manual and MDS2 documentation.
• Create Design Engineering Privacy and Security (DEPS) artefacts for privacy and security risk assessments to engage in domain-specific product threat modelling, attack surface analysis, risk management and reduction.
• Coordinates with the PSL to support the product team in scheduling and performing vulnerability scans and cybersecurity assessments.
• Lead product Security Technical Design Reviews
• Along with the product Lead System Designer (LSD), responsible for the Product Cybersecurity Standard compliance and other pertinent standards and processes.
• The released products shall comply with required regulatory standards & compliance (like FDA, HIPAA, GDPR etc.)
• Participate in post-market product vulnerability monitoring.
• Participate as a Subject Matter Expert to determine product vulnerability impact, investigation, and risk assessment.
• Responsible for product vulnerability mitigation and design change.
• Responsible for vulnerability tool updates to ensure accurate customer communication.
• Address customer and Sales RFP privacy and security feedback/questions.
• Provide technical expertise on customer concerns, complaints, and CSO escalations.
• Create/Maintain responsible product records within product cybersecurity tools.

Skills

Security Engineering

5+ years information security

Security architecture

Threat modelling

Identity management

PKI / cryptography

OAuth / 2FA

Education

Cyber security certifications

Tools

SAST

DAST

Vulnerability Management

SCA

Penetration Testing

Threat Modelling Tools

Job description

Responsibilities

• Provide privacy and security technical expertise supporting the product team throughout product development, design change, and life-cycle management.
• Work with the Product Security Leader (PSL) to support the product team with process expertise for Healthcare Product Cybersecurity Standards and life-cycle management.
• Product cybersecurity development responsibilities:
• Assess the privacy and cybersecurity state of the product and define product roadmap features/enhancements with stakeholder approval.
• Responsible for security architecture and coordination of product development for cybersecurity features and enhancements.
• Assess product components and SBoM are integrated into the product.
• Perform defect management for cybersecurity issues.
• Identify operational responsibilities and adherence to cloud standards for cloud-based products.
• Responsible for Product and Security Manual and MDS2 documentation.
• In coordination with the PSL, own and deliver Product Cybersecurity Standard artefacts, which include:
• Design input activities to identify, evaluate, roadmap, and drive cybersecurity and privacy features and enhancements within product development programs.
• Create Design Engineering Privacy and Security (DEPS) artefacts for privacy and security risk assessments to engage in domain-specific product threat modelling, attack surface analysis, risk management and reduction.
• Coordinates with the PSL to support the product team in scheduling and performing vulnerability scans and cybersecurity assessments.
• Lead product Security Technical Design Reviews
• Along with the product Lead System Designer (LSD), responsible for the Product Cybersecurity Standard compliance and other pertinent standards and processes.
• The released products shall comply with required regulatory standards & compliance (like FDA, HIPPA, GDPR etc.)
• Works with the Product Security team and Quality Assurance & Regulatory Assurance (QARA) on released product life cycle, including:
• Participate in post-market product vulnerability monitoring.
• Participate as a Subject Matter Expert to determine product vulnerability impact, investigation, and risk assessment.
• Responsible for product vulnerability mitigation and design change.
• Responsible for vulnerability tool updates to ensure accurate customer communication.
• Address customer and Sales RFP privacy and security feedback/questions.
• Provide technical expertise on customer concerns, complaints, and CSO escalations.
• Create/Maintain responsible product records within product cybersecurity tools.

Mandatory Soft Skills

• Should be able to contribute as an individual contributor
• Should be able to execute his/her responsibility independently
• Focus on self-planning activities

Mandatory Skills

• Security Engineering

1. Globally recognized Cyber Security Certifications (Advanced/Expert Level).
2. Firm with knowledge of OWASP, CVSS, FIPS 140-2/140-3 and DoD RMF
3. 5+ years of full-time information security experiencewith emphasis on technical assessment (system/web application vulnerability assessment, penetration testing, white-box secure code analysis, etc.) and security architecture (design of security controls, secure system design, understanding of identity and authentication management, etc.)
4. The Architect shall be capable of not only finding risks/issues but shall also suggest the best route to remediation, knowing the compensatory controls & guiding the product team for its closure.
5. Sound understanding of security technologies/techniques like

• Cryptography, Algorithms, Public key Infrastructure (PKI) Certificate Authority (CA),
• Hardware/embedded authentication, OAuth, 2-factor authentication, and
• white-box code analysis.

• Experience with a range of security tools related to
  • SAST (Static Application Security Assessment),
  • DAST (Dynamic Application Security Assessment),
  • Vulnerability Management,
  • SCA (Software Composition Analysis),
  • Penetration Testing
  • Threat Modelling Tools etc.

• Product Engineering

1. Experience in working in a Product sector environment
2. Knowledge of Cloud Infrastructure [Platform as a Service]

Nice-to-have Skills

• Medical Software/Device Engineering

1. MDS2 documentation
2. Experience in the Healthcare domain.

• Standard Software Engineering

1. Experience in Micro Services using RESTful frameworks

• Security Engineering

1. Penetration Testing in Web Applications, Thick Clients, Mobile Applications, REST/SOAP
2. Infrastructure Penetration Testing
3. Experience in Red Teaming Activities (add-on)
4. Recognition for CVE or Wall-of-Fame through Bug-Bounty (add-on)