Staff Product Security Engineer

Wipro Enterprises; Bengaluru; On-site; INR 4,000,000 - 6,000,000; Full time

Job summary

GE HealthCare is seeking a Staff Product Security Engineer to help architect, secure, and deliver patient care solutions. You will champion security/privacy within the product development lifecycle, drive threat modeling, and manage vulnerabilities to ensure clinical safety and regulatory compliance.

You will collaborate with the Product Security Leader to implement cybersecurity standards, create DEPS artifacts, and lead risk assessments across global teams, while maintaining QMS alignment with

Qualifications

• 6+ years of product or systems experience with at least 5 years in application security.
• Knowledge of regulatory standards (NIST CSF/800-53, ISO27001, SOC2, HIPAA, GDPR).
• Understanding of secure coding principles (OWASP Top Ten).
• Experience leading product development teams in a global environment.
• Ability to collaborate with cross-functional design scrum teams.

Responsibilities

• Represent Security/Privacy needs of the product design and development teams.
• Support PSL on the GEHC Product Cybersecurity Standard and lifecycle management.
• Lead threat modeling sessions and implement security controls.
• Own Cybersecurity Management Plan and remediation planning for vulnerabilities.
• Generate and maintain SBOMs and assess product components.
• Scope and participate in penetration tests and risk assessments.
• Create DEPS artifacts across the product lifecycle.
• Maintain QMS compliance with GE HealthCare policies.

Skills

Security leadership

Threat modeling

Secure coding

OWASP Top Ten

Product security

Communication

Multi-tasking

Education

Bachelor's/Master's in CS/Engineering

Master's in STEM

Tools

Microsoft Threat Modelling Tool

Burp Suite

Syft

Grype

Other security tooling

Job description

Job Description Summary Join a dynamic team that s transforming how the Patient Care Solutions Products and Solutions at GE HealthCare are architected, secured and delivered to our customers. As a Staff Product Security Engineer you ll be working on products and solutions that provide clinical excellence at the point of care, with a focus on representing Security/Privacy on the product development team. This position requires understanding of secure product development, system design, post-market security assessments and strong analysis/problem-solving skills.

This role will develop deep product domain and customer use environment knowledge of the product s clinical functionality, expected operating environment and interoperability to accurately determine privacy and security risks. Join the Patient Care Solutions Transformation at GE HealthCare! Job Description

Responsibilities:

• Represent the Security/Privacy needs of the product design and development teams. Including security/privacy requirements capture, consulting development activities to ensure compliance and secure product testing.
• Work with the Product Security Leader (PSL) to support the product team with process expertise for the GEHC Product Cybersecurity Standard and lifecycle management.
• Lead threat modeling sessions to identify security concerns within the products and solutions. Develop methods to implement security controls based on the system threat model.
• Own the Cybersecurity Management Plan, including the identification, assessment, reporting and mitigation plans for product vulnerabilities. Collaborate with Program Managers, functional leadership and program teams on program scope and priority to address vulnerabilities in a timely manner.
• Generate and maintain the Software Bill of Materials (SBOM). Assess product components and SBOMs integrated into the product.
• Have a complete understanding of the various interdependency and limitations as they refer to security controls within the system.
• Scope and participate in penetration tests, vulnerability scanning and product security risk assessments including remediation planning and closure.
• Create Design Engineering Privacy and Security (DEPS) artifacts for privacy and security activities throughout the product lifecycle, from initial concept through end-of-life.
• Maintain effective quality management system (QMS) compliance with GE HealthCare Quality policies.

Qualifications/Requirements:

• Bachelors Degree in a relevant field (e.g. Computer Engineering, Computer Science, Information Security) or in a STEM major (Science, Technology, Engineering, or Math)
• 6+ years of product or systems experience with at least 5 years of application security
• Working knowledge of regulatory standards and compliance frameworks (e.g., NIST CSF/800-53, ISO27001, SOC2, HIPAA, HITRUST and GDPR).
• Understanding of secure coding principles, such as the OWASP Top Ten.
• Demonstrated technical leadership capability working on a product development team
• Demonstrated ability to act as a leader-among-peers in a global environment
• Demonstrated ability to work with design scrum teams on the design & implementation of security controls
• Self-starter, energizing, results oriented and able to multi-task
• Effective oral and written communication skills

Desired:

• Master s degree in STEM with a focus on application security.
• Experience working with application security tools such as Microsoft Threat Modelling Tool, Black Duck, Syft, Burpsuite, Grype, or similar tools.
• Experience with penetration testing and ethical hacking concepts (red team/blue team).
• Experience in Identity management and identity federation tools. (SAML, Oauth, SCIM, XACML).
• Experience working in a medical device regulated environment, including FDA.
• Strong technical understanding of various network protocols and strategies to secure them
• Strong technical understanding of various network services and APIs (eg. network proxies, API gateways)
• Working understanding of enterprise-grade software to embedded software technology
• Security certification(s) not limited to CISSP/CISM, CSSLP, CEH, OCP are a plus.

Additional Information

Relocation Assistance Provided: No