Staff Product Security Engineer

gehc; Bengaluru; On-site; INR 3,500,000 - 6,000,000; Full time

Job summary

GE HealthCare in Bengaluru seeks a Staff Product Security Engineer to embed security/privacy into product development, drive secure design, and lead risk assessments across the product lifecycle.

You'll own cybersecurity plans, SBOMs, threat modeling, and close collaboration with PSL and cross-functional teams to deliver compliant, secure healthcare solutions. This role demands strong communication and leadership in a global environment.

Qualifications

• Bachelor's degree in computer engineering, CS, info security or STEM field.
• 6+ years in product or systems security, with at least 5 years in application security.
• Familiarity with regulatory standards (NIST CSF/800-53, ISO27001, SOC2, HIPAA, HITRUST, GDPR).
• Understanding of secure coding principles (OWASP Top Ten).
• Demonstrated technical leadership within a product team.

Responsibilities

• Represent security/privacy needs in product design and development.
• Support product team with GEHC Cybersecurity Standard and lifecycle management.
• Lead threat modelling sessions to identify security concerns and implement controls.
• Own cybersecurity management plan including vulnerability identification, assessment, and remediation.
• Create and maintain SBOMs; assess components and SBOM integration.
• Understand system interdependencies and security implications.
• Participate in penetration testing, vulnerability scanning and risk assessments.
• Create DEPS artifacts for privacy/security throughout the lifecycle.
• Maintain QMS compliance with GE HealthCare policies.

Skills

Security leadership

Global collaboration

Security controls design

Multi-tasking

Communication skills

Education

Bachelor's degree in a relevant field

Master's in STEM with focus on application security

Tools

Threat modelling tools

Job description

Job Description Summary

Join a dynamic team that's transforming how the Patient Care Solutions Products and Solutions at GE HealthCare are architected, secured and delivered to our customers. As a Staff Product Security Engineer you'll be working on products and solutions that provide clinical excellence at the point of care, with a focus on representing Security/Privacy on the product development team. This position requires understanding of secure product development, system design, post-market security assessments and strong analysis/problem-solving skills.

This role will develop deep product domain and customer use environment knowledge of the product's clinical functionality, expected operating environment and interoperability to accurately determine privacy and security risks. Join the Patient Care Solutions Transformation at GE HealthCare!

Job Description

Responsibilities

• Represent the Security/Privacy needs of the product design and development teams. Including security/privacy requirements capture, consulting development activities to ensure compliance and secure product testing.


• Work with the Product Security Leader (PSL) to support the product team with process expertise for the GEHC Product Cybersecurity Standard and lifecycle management.


• Lead threat modeling sessions to identify security concerns within the products and solutions. Develop methods to implement security controls based on the system threat model.


• Own the Cybersecurity Management Plan, including the identification, assessment, reporting and mitigation plans for product vulnerabilities. Collaborate with Program Managers, functional leadership and program teams on program scope and priority to address vulnerabilities in a timely manner.


• Generate and maintain the Software Bill of Materials (SBOM). Assess product components and SBOMs integrated into the product.


• Have a complete understanding of the various interdependency and limitations as they refer to security controls within the system.


• Scope and participate in penetration tests, vulnerability scanning and product security risk assessments including remediation planning and closure.


• Create Design Engineering Privacy and Security (DEPS) artifacts for privacy and security activities throughout the product lifecycle, from initial concept through end-of-life.


• Maintain effective quality management system (QMS) compliance with GE HealthCare Quality policies.

Qualifications/Requirements

• Bachelor's Degree in a relevant field (e.g. Computer Engineering, Computer Science, Information Security) or in a STEM major (Science, Technology, Engineering, or Math)


• 6+ years of product or systems experience with at least 5 years of application security


• Working knowledge of regulatory standards and compliance frameworks (e.g., NIST CSF/800-53, ISO27001, SOC2, HIPAA, HITRUST and GDPR).


• Understanding of secure coding principles, such as the OWASP Top Ten.


• Demonstrated technical leadership capability working on a product development team


• Demonstrated ability to act as a leader-among-peers in a global environment


• Demonstrated ability to work with design scrum teams on the design & implementation of security controls


• Self-starter, energizing, results oriented and able to multi-task


• Effective oral and written communication skills

Desired

• Master's degree in STEM with a focus on application security.


• Experience working with application security tools such as Microsoft Threat Modelling Tool, Black Duck, Syft, Burpsuite, Grype, or similar tools.


• Experience with penetration testing and ethical hacking concepts (red team/blue team).


• Experience in Identity management and identity federation tools. (SAML, Oauth, SCIM, XACML).


• Experience working in a medical device regulated environment, including FDA.


• Strong technical understanding of various network protocols and strategies to secure them


• Strong technical understanding of various network services and APIs (eg. network proxies, API gateways)


• Working understanding of enterprise-grade software to embedded software technology


• Security certification(s) not limited to CISSP/CISM, CSSLP, CEH, OCP are a plus.

Additional Information

Relocation Assistance Provided: No