Product Cybersecurity Architect

Bausch & Lomb GmbH; United States; Remote; USD 140,000 - 180,000; Full time

Job summary

Bausch + Lomb Surgical R&D is seeking a cybersecurity leader to embed secure-by-design practices across the lifecycle of surgical capital equipment. You will coordinate with engineering, quality, regulatory, and corporate security teams to drive resilient, compliant security outcomes in a regulated medical device environment.

Responsibilities include leading vulnerability management, architecture guidance, security testing, and SBOM processes, with a focus on cross-functional collaboration

Qualifications

• Bachelor's degree in Engineering, CS, Cybersecurity or related field.
• 7+ years in product security, application security, medical device cybersecurity, or software security within a regulated environment.
• Experience supporting or leading cybersecurity activities for medical device or other regulated product development.
• Strong communication, collaboration, stakeholder management, and problem-solving skills.
• Ability to translate technical cybersecurity risks into clear, actionable guidance for engineering, quality, and regulatory stakeholders.

Responsibilities

• Architect and implement a consistent cybersecurity strategy across surgical capital equipment product lines to establish a scalable and secure product ecosystem.
• Embed secure-by-design principles throughout the product lifecycle, providing guidance on secure architecture, threat modeling, design controls, cryptography, and secure communication protocols.
• Lead execution of cybersecurity requirements across development programs, ensuring alignment with regulatory expectations, corporate standards, and product quality objectives.
• Coordinate vulnerability management activities, including intake, triage, risk assessment, remediation tracking, and documentation of product security issues through closure.
• Serve as the Surgical R&D cybersecurity representative for vulnerability disclosure and incident response activities, supporting investigations, impact assessments, root cause analyses, and remediation efforts.
• Partner with engineering teams to implement security testing practices, including SAST, DAST, SCA, penetration testing, and automated security controls within development pipelines.
• Support supplier and third-party security initiatives by defining security requirements, managing software supply chain risks, and maintaining Software Bill of Materials (SBOM) processes.
• Collaborate with Quality, Regulatory Affairs, IT, and Corporate Product Security teams to ensure compliance with evolving cybersecurity regulations and industry standards while enabling efficient product delivery.

Skills

Cybersecurity strategy

Threat modeling

Vulnerability management

Secure software development

Cross-functional collaboration

Security testing

Education

Bachelor's degree in Engineering/CS/Cybersecurity

Tools

SAST

DAST

SCA

Penetration testing

SBOM management

Job description

Select how often (in days) to receive an alert:

Bausch + Lomb (NYSE/TSX: BLCO) is a leading global eye health company dedicated to protecting and enhancing the gift of sight for millions of people around the world—from the moment of birth through every phase of life. Our mission is simple, yet powerful: helping you see better, to live better.

Our comprehensive portfolio of over 400 products is fully integrated and built to serve our customers across the full spectrum of their eye health needs throughout their lives. Our iconic brand is built on the deep trust and loyalty of our customers established over our 170-year history. We have a significant global research, development, manufacturing and commercial footprint of approximately 13,000 employees and a presence in approximately 100 countries, extending our reach to billions of potential customers across the globe. We have long been associated with many of the most significant advances in eye health, and we believe we are well positioned to continue leading the advancement of eye health in the future.

Why this Role Matters

Join the Surgical R&D organization in a role where you will help ensure the cybersecurity, safety, and reliability of innovative surgical products that support patient care. In this position, you will be responsible for embedding secure-by-design practices throughout the product lifecycle while partnering with engineering, quality, regulatory, and corporate security teams to deliver compliant and resilient solutions. This is a strong opportunity for someone who brings deep product security expertise, strong cross-functional collaboration skills, and a passion for advancing cybersecurity within a regulated medical device environment.

What You’ll Do

• Architect and implement a consistent cybersecurity strategy across surgical capital equipment product lines to establish a scalable and secure product ecosystem.
• Embed secure-by-design principles throughout the product lifecycle, providing guidance on secure architecture, threat modeling, design controls, cryptography, and secure communication protocols.
• Lead execution of cybersecurity requirements across development programs, ensuring alignment with regulatory expectations, corporate standards, and product quality objectives.
• Coordinate vulnerability management activities, including intake, triage, risk assessment, remediation tracking, and documentation of product security issues through closure.
• Serve as the Surgical R&D cybersecurity representative for vulnerability disclosure and incident response activities, supporting investigations, impact assessments, root cause analyses, and remediation efforts.
• Partner with engineering teams to implement security testing practices, including SAST, DAST, SCA, penetration testing, and automated security controls within development pipelines.
• Support supplier and third-party security initiatives by defining security requirements, managing software supply chain risks, and maintaining Software Bill of Materials (SBOM) processes.
• Collaborate with Quality, Regulatory Affairs, IT, and Corporate Product Security teams to ensure compliance with evolving cybersecurity regulations and industry standards while enabling efficient product delivery.

What You’ll Bring

Required Education & Experience:

• Bachelor's degree in Engineering, Computer Science, Cybersecurity, or a related technical discipline.
• 7+ years of experience in product security, application security, medical device cybersecurity, or software security within a regulated environment.
• Demonstrated experience supporting or leading cybersecurity activities for medical device or other regulated product development programs.
• Strong communication, collaboration, stakeholder management, and problem-solving skills.
• Ability to translate technical cybersecurity risks into clear, actionable guidance for engineering, quality, and regulatory stakeholders.

Specialized Technical, Regulatory & Industry Skills & Knowledge

• Strong expertise in secure product design, threat modeling, vulnerability management, and secure software development practices.
• Working knowledge of connected device security, embedded systems, and software-enabled product architectures.
• Experience with security testing tools and methodologies, including SAST, DAST, SCA, and penetration testing.
• Understanding of software supply chain security practices, including SBOM development and third-party risk management.
• Experience working across cross-functional and global teams to drive cybersecurity outcomes and influence stakeholders without direct authority.
• Knowledge of secure development lifecycle (SDLC) frameworks, vulnerability disclosure processes, and product incident response activities.
• Familiarity with cybersecurity governance, risk assessment, and compliance processes within regulated industries.

Preferred

• Advanced degree in Cybersecurity, Computer Science, Engineering, or a related field.
• Relevant industry certifications such as CISSP, CSSLP, OSCP, GWAPT, or equivalent.
• Experience in medical device, healthcare, or other regulated industries, and/or working within a quality-managed or GxP regulated environment.
• Working knowledge of medical device cybersecurity regulations and standards (e.g., FDA premarket/post market guidance, IEC 81001-5-1, AAMI TIR57, UL 2900, NIST frameworks).
• Experience developing cybersecurity documentation to support regulatory submissions and audits.

This position may be available in the following location(s): US - Remote

All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability, or veteran status.

For U.S. locations that require disclosure of compensation, the starting pay for this role is between $140,000 and $180,000. The estimated salary range reflects an anticipated range for this position. The actual base salary offered may depend on a variety of factors.

U.S. basedemployeesmay be eligible forshort-term and/orlong-term incentives.They may also be eligible toparticipatein medical, dental, vision insurance, disability and life insurance, a 401(k) plan and company match, a tuition reimbursement program (select degrees), company holidays, andwell-beingbenefits, among others. U.S. based employees are also eligible to receive sick time, floating holidays and paid vacation.

Applicants must be authorized to work for ANY employer in the U.S. We are unable to sponsor or take over sponsorship of an employment Visa at this time.