Staff Product Security Engineer

I00M05 Wipro GE Healthcare Private Limited; Karnataka; On-site; INR 1,800,000 - 3,000,000; Full time

Job summary

GE HealthCare is seeking a Staff Product Security Engineer to shape security for Patient Care Solutions products. You will represent Security/Privacy in the product team, lead threat modeling, develop controls, and own the Cybersecurity Management Plan across the lifecycle.

You will collaborate with PSL and program teams, ensure SBOM integrity, and drive security-feature delivery in a global environment with strong communication and leadership.

Qualifications

• Bachelor's degree in Computer Engineering, Computer Science, Information Security or STEM with 6+ years of product or systems experience and at least 5 years in application security.
• Working knowledge of regulatory standards and frameworks (NIST CSF/800-53, ISO27001, SOC2, HIPAA, HITRUST, GDPR).
• Understanding of secure coding principles, such as the OWASP Top Ten.
• Demonstrated technical leadership on a product development team.
• Ability to act as a leader-among-peers in a global environment.
• Ability to work with design scrum teams on security controls implementation.
• Self-starter, energized, results oriented, able to multi-task.
• Strong oral and written communication skills.

Responsibilities

• Represent Security/Privacy needs of product design and development, capture security requirements and ensure secure testing.
• Support PSL with Product Cybersecurity Standard and lifecycle management processes.
• Lead threat modeling sessions to identify security concerns in products and solutions.
• Develop methods to implement security controls based on threat models.
• Own the Cybersecurity Management Plan and remediation of vulnerabilities.
• Collaborate with program managers and teams on scope and priorities for vulnerabilities.
• Generate and maintain Software Bill of Materials (SBOM).
• Assess product components and SBOMs for security relevance.
• Understand interdependencies and limitations related to security controls.
• Scope and participate in penetration tests, vulnerability scanning and risk assessments.
• Create Design Engineering Privacy and Security artifacts across lifecycle.
• Maintain QMS compliance with GE HealthCare Quality policies.

Skills

Threat modeling

Security testing

SBOM management

Regulatory standards

Product leadership

Cross-functional

Education

Bachelor's degree

Tools

Microsoft Threat Modelling Tool

Burp Suite

Black Duck

Syft

Grype

SAML

OAuth

Job description

Job Description Summary

Join a dynamic team that’s transforming how the Patient Care Solutions Products and Solutions at GE HealthCare are architected, secured and delivered to our customers. As a Staff Product Security Engineer you’ll be working on products and solutions that provide clinical excellence at the point of care, with a focus on representing Security/Privacy on the product development team. This position requires understanding of secure product development, system design, post-market security assessments and strong analysis/problem-solving skills. This role will develop deep product domain and customer use environment knowledge of the product’s clinical functionality, expected operating environment and interoperability to accurately determine privacy and security risks. Join the Patient Care Solutions Transformation at GE HealthCare!

Responsibilities

• Represent the Security/Privacy needs of the product design and development teams. Including security/privacy requirements capture, consulting development activities to ensure compliance and secure product testing.
• Work with the Product Security Leader (PSL) to support the product team with process expertise for the GEHC Product Cybersecurity Standard and lifecycle management.
• Lead threat modeling sessions to identify security concerns within the products and solutions.
• Develop methods to implement security controls based on the system threat model.
• Own the Cybersecurity Management Plan, including the identification, assessment, reporting and mitigation plans for product vulnerabilities.
• Collaborate with Program Managers, functional leadership and program teams on program scope and priority to address vulnerabilities in a timely manner.
• Generate and maintain the Software Bill of Materials (SBOM).
• Assess product components and SBOMs integrated into the product.
• Have a complete understanding of the various interdependency and limitations as they refer to security controls within the system.
• Scope and participate in penetration tests, vulnerability scanning and product security risk assessments including remediation planning and closure.
• Create Design Engineering Privacy and Security (DEPS) artifacts for privacy and security activities throughout the product lifecycle, from initial concept through end-of-life.
• Maintain effective quality management system (QMS) compliance with GE HealthCare Quality policies.

Qualifications / Requirements

• Bachelor's Degree in a relevant field (e.g. Computer Engineering, Computer Science, Information Security) or in a STEM major (Science, Technology, Engineering, or Math) 6+ years of product or systems experience with at least 5 years of application security
• Working knowledge of regulatory standards and compliance frameworks (e.g., NIST CSF/800-53, ISO27001, SOC2, HIPAA, HITRUST and GDPR).
• Understanding of secure coding principles, such as the OWASP Top Ten.
• Demonstrated technical leadership capability working on a product development team
• Demonstrated ability to act as a leader-among-peers in a global environment
• Demonstrated ability to work with design scrum teams on the design & implementation of security controls
• Self-starter, energizing, results oriented and able to multi-task
• Effective oral and written communication skills

Desired

• Master’s degree in STEM with a focus on application security.
• Experience working with application security tools such as Microsoft Threat Modelling Tool, Black Duck, Syft, Burpsuite, Grype, or similar tools.
• Experience with penetration testing and ethical hacking concepts (red team/blue team).
• Experience in Identity management and identity federation tools. (SAML, Oauth, SCIM, XACML).
• Experience working in a medical device regulated environment, including FDA.
• Strong technical understanding of various network protocols and strategies to secure them
• Strong technical understanding of various network services and APIs (eg. network proxies, API gateways)
• Working understanding of enterprise-grade software to embedded software technology
• Security certification(s) not limited to CISSP/CISM, CSSLP, CEH, OCP are a plus.

Additional Information

Relocation Assistance Provided: No At GE HealthCare, we see possibilities through innovation. We’re partnering with our customers to fulfill healthcare’s greatest potential through groundbreaking medical technology, intelligent devices, and care solutions. Better tools enabling better patient care. Together, we are not only building a healthier future but living our purpose to create a world where healthcare has no limits.