Staff Product Security Engineer

GE HealthCare; Bengaluru; On-site; INR 4,000,000 - 6,000,000; Full time

Job summary

GE HealthCare in Bengaluru is seeking a Staff Product Security Engineer to shape secure product development for Patient Care Solutions. You’ll represent Security/Privacy on the product development team and ensure security testing and privacy considerations are embedded from concept through end-of-life.

You’ll lead threat modeling, own the Cybersecurity Management Plan, generate SBOMs, and drive remediation with cross‑functional teams while complying with standards such as NIST CSF/800-53,

Qualifications

• 6+ years of product or systems experience with at least 5 years of application security.
• Knowledge of regulatory standards (NIST CSF/800-53, ISO27001, SOC2, HIPAA, GDPR).
• Understanding of secure coding principles (OWASP Top Ten).
• Experience leading product development security programs.
• Strong communication and leadership in global teams.

Responsibilities

• Represent Security/Privacy needs across product design and development teams.
• Align with PSL to implement GEHC cybersecurity standards.
• Lead threat modeling sessions and implement controls.
• Own Cybersecurity Management Plan and remediation timelines.
• Generate and maintain SBOM for product components.
• Evaluate interdependencies affecting security controls.
• Plan penetrations tests and vulnerability assessments.
• Create DEPS artifacts through product lifecycle.
• Ensure QMS compliance with GE HealthCare policies.

Skills

Product security leadership

Threat modeling

Secure coding principles

Regulatory standards knowledge

Communication skills

Cross-functional collaboration

Multi-tasking

Global teamwork

Vulnerability management

Education

Bachelor's degree in Computer Engineering/CS/InfoSec or STEM

Tools

Microsoft Threat Modelling Tool

Burp Suite

Black Duck

Syft

Grype

Job description

Job Description Summary

Join a dynamic team that’s transforming how the Patient Care Solutions Products and Solutions at GE HealthCare are architected, secured and delivered to our customers. As a Staff Product Security Engineer you’ll be working on products and solutions that provide clinical excellence at the point of care, with a focus on representing Security/Privacy on the product development team. This position requires understanding of secure product development, system design, post-market security assessments and strong analysis/problem-solving skills.

This role will develop deep product domain and customer use environment knowledge of the product’s clinical functionality, expected operating environment and interoperability to accurately determine privacy and security risks. Join the Patient Care Solutions Transformation at GE HealthCare!

Responsibilities

• Represent the Security/Privacy needs of the product design and development teams. Including security/privacy requirements capture, consulting development activities to ensure compliance and secure product testing.
• Work with the Product Security Leader (PSL) to support the product team with process expertise for the GEHC Product Cybersecurity Standard and lifecycle management.
• Lead threat modeling sessions to identify security concerns within the products and solutions. Develop methods to implement security controls based on the system threat model.
• Own the Cybersecurity Management Plan, including the identification, assessment, reporting and mitigation plans for product vulnerabilities. Collaborate with Program Managers, functional leadership and program teams on program scope and priority to address vulnerabilities in a timely manner.
• Generate and maintain the Software Bill of Materials (SBOM). Assess product components and SBOMs integrated into the product.
• Have a complete understanding of the various interdependency and limitations as they refer to security controls within the system.
• Scope and participate in penetration tests, vulnerability scanning and product security risk assessments including remediation planning and closure.
• Create Design Engineering Privacy and Security (DEPS) artifacts for privacy and security activities throughout the product lifecycle, from initial concept through end-of-life.
• Maintain effective quality management system (QMS) compliance with GE HealthCare Quality policies.

Qualifications/Requirements

• Bachelor’s Degree in a relevant field (e.g. Computer Engineering, Computer Science, Information Security) or in a STEM major (Science, Technology, Engineering, or Math)
• 6+ years of product or systems experience with at least 5 years of application security
• Working knowledge of regulatory standards and compliance frameworks (e.g., NIST CSF/800-53, ISO27001, SOC2, HIPAA, HITRUST and GDPR).
• Understanding of secure coding principles, such as the OWASP Top Ten.
• Demonstrated technical leadership capability working on a product development team
• Demonstrated ability to act as a leader-among-peers in a global environment
• Demonstrated ability to work with design scrum teams on the design & implementation of security controls
• Self-starter, energizing, results oriented and able to multi-task
• Effective oral and written communication skills

Desired

• Master’s degree in STEM with a focus on application security.
• Experience working with application security tools such as Microsoft Threat Modelling Tool, Black Duck, Syft, Burpsuite, Grype, or similar tools.
• Experience with penetration testing and ethical hacking concepts (red team/blue team).
• Experience in Identity management and identity federation tools. (SAML, Oauth, SCIM, XACML).
• Experience working in a medical device regulated environment, including FDA.
• Strong technical understanding of various network protocols and strategies to secure them
• Strong technical understanding of various network services and APIs (eg. network proxies, API gateways)
• Working understanding of enterprise-grade software to embedded software technology
• Security certification(s) not limited to CISSP/CISM, CSSLP, CEH, OCP are a plus.

Additional Information

Relocation Assistance Provided: No