Senior Product Security Consultant, Advisory

Bazeta; Washington (District of Columbia); Hybride; USD 150 000 - 230 000; Plein temps

Résumé du poste

Finite State is seeking a Senior Product Security Consultant – Advisory to lead engagements from scoping to final deliverable. You will frame regulatory programs for EU CRA, FDA, and FCC cyber standards, and translate findings into actionable roadmaps for client security and engineering teams.

The role is remote-first in the United States, with periodic travel for workshops and events. You will guide clients through secure lifecycle programs and help them achieve compliance while working with a

Qualifications

• 8+ years of professional experience in consulting or advisory roles, leading client engagements.
• Strong cybersecurity program knowledge with binary analysis, SBOMs, vulnerability management, and reachability.

Responsabilités

• Lead advisory engagements end to end with scoping, milestones, client meetings, risks, and timely delivery.
• Frame regulatory programs for EU CRA, CE RED, FDA 524B, and FCC Cyber Trust Mark, including requirements and conformity paths.
• Deliver security and regulatory assessments and defend prioritized recommendations.
• Act as the named vCPSO on client accounts, running product security programs and briefing executives.
• Design secure development lifecycle programs with policy, governance, and training.
• Write deliverables that are actionable for executives and defendable by engineers.
• Work with engineering and offensive security teams to translate findings into regulatory and business terms.
• Scope bootcamps and provide advisory support through service requests; expand templates and assets.

Connaissances

Consulting leadership

Regulatory compliance

Secure product development

SBOM management

AI-assisted tooling

Description du poste

# Senior Product Security Consultant, AdvisoryUnited States6 hours agoID 3716162Price on request## DetailsEmployment type: Full-timeRemote: YesCompany: Finite State## DescriptionFinite State partners with product security teams, the guardians of our connected world, to create transparency for their connected devices and supply chains. Our platform handles connected devices and embedded systems across all industries, including those found in enterprises, healthcare, utilities, connected vehicles, manufacturing facilities, critical infrastructure, and government entities. We are a fast-growing series-B company with a fully distributed workforce. Led by a team of seasoned experts, we are a mission-driven team passionate about arming our customers with the actionable insights, critical vulnerability data, and remediation guidance necessary to mitigate product risk and protect the connected attack surface. We are committed to a remote first culture. Title: Senior Product Security Consultant – Advisory. Department: Services, Strategic Advisory. Reports to: Head of Policy and Compliance. Location: Remote, United States. Must be authorized to work in the U.S. without sponsorship. Washington, DC area a plus. Travel: Periodic, for client workshops, executive meetings, and industry events. About the role Connected products run the world: vehicles, medical devices, industrial systems, critical infrastructure. The companies that build them face a wave of regulation, from the EU Cyber Resilience Act and Radio Equipment Directive to FDA premarket cybersecurity requirements and new U.S. supply chain rules. Few of them have a product security program built for it. Finite State’s Strategic Advisory practice helps them close that gap. We tell manufacturers what a regulation requires of their products, where they stand, what evidence they need, and the order of work to get there. Then we stay to help them run the program. As a Senior Product Security Consultant, you will lead those engagements from scoping to final deliverable and advise client security and engineering leaders. On some accounts you will act as the client’s virtual Chief Product Security Officer. You won’t be starting from a blank page. You’ll have Finite State’s binary analysis platform, a dedicated engineering and offensive security team that tests the products you advise on, and AI tooling that speeds up research and drafting. Your job is the judgment, the structure, and the client relationship. What you’ll do • Lead advisory engagements end to end. Scope the work, set the work breakdown and milestone schedule at the start, run client meetings, track risks and actions, and deliver on time. • Frame regulatory programs for clients facing the EU CRA, CE RED (EN 18031), FDA 524B, and FCC Cyber Trust Mark. That covers product classification, the requirements that apply, gap assessment, what the evidence needs to show, the conformity path, and the roadmap. • Deliver security and regulatory compliance assessments, and turn the findings into prioritized recommendations you can defend. • Serve as the named vCPSO on client accounts. You’ll run the client’s product security program cadence, represent product security to their executives, and direct the work that our engineering team and the client’s engineers carry out. • Design secure development lifecycle programs, with the policy, governance, and training that go with them. • Write deliverables executives can act on and engineers can defend: assessments, roadmaps, policies, briefings, and evidence packages. Every one answers what it is, why now, and what the client should do next. • Work with our engineering and offensive security teams to turn technical findings (SBOM, vulnerability, reachability, and penetration test results) into regulatory and business terms. • Scope bootcamps and give sellers advisory support through our services request process. • Build the practice: templates, playbooks, and reusable assets that make each engagement faster than the last. Over time, add to Finite State’s public voice through writing and speaking. What you bring • 8+ years of professional experience, including at least 5 in consulting or advisory work at a professional services firm (Big Four, federal consulting, or a cybersecurity or regulatory consultancy), with a record of leading client engagements. • Cybersecurity program experience, with enough grasp of binary analysis, SBOMs, vulnerability management, and reachability to hold your own with engineers. You won’t be doing the testing. • Working depth in at least one of our core areas: automotive, IoT, industrial, or healthcare, including the regulations and standards that govern it. You can read a regulation or standard and turn it into requirements and product implications. • Discipline in running engagements: work breakdown structures, milestone schedules, status reporting, risk and action tracking, and raising problems early. • Writing and presence fit for executives. You can brief a VP of Engineering, a General Counsel, and a board in the same week, in writing and in the room. • An AI-native way of working: LLMs and agentic tools as force multipliers, with clear judgment about what a person must verify. Nice to have • A notified body, conformity assessment, or audit background. • Experience with regulatory frameworks and standards such as the EU CRA, FDA 524B, IEC 62443, or ISO/SAE 21434. • FDA premarket submission experience at a manufacturer or consultancy. • Experience designing and facilitating tabletop exercises. • CISSP, CSSLP, CISA, or ISO 27001 Lead Auditor. • Government or public policy experience in cybersecurity. About Finite State... Source: Jobspresso (https://jobspresso.co/job/senior-product-security-consultant-advisory/)This listing comes from a partner feed. Apply on the source website.