Senior Product Security Consultant – Advisory

Finite StateProduct security

Remote, United States.Full-TimeSenior

Salary not disclosed

Apply NowOpens the employer's application page

Job Details

Experience: 8+ years of professional experience, including at least 5 in consulting or advisory work

Have 8+ years of professional experience, including at least 5 years in consulting or advisory work at a professional services firm, such as Big Four, federal consulting, or a cybersecurity or regulatory consultancy.
Bring a record of leading client engagements.
Have cybersecurity program experience and sufficient understanding of binary analysis, SBOMs, vulnerability management, and reachability to work effectively with engineers.
Have working depth in at least one of automotive, IoT, industrial, or healthcare, including the regulations and standards governing that area.
Be able to interpret regulations or standards and translate them into requirements and product implications.
Be disciplined in engagement management, including work breakdown structures, milestone schedules, status reporting, risk and action tracking, and escalating problems early.
Write and brief effectively for executives, including engineering leaders, General Counsel, and boards.
Use LLMs and agentic tools to support work, while applying judgment about what requires human verification.
A notified body, conformity assessment, or audit background is a plus.
Experience with EU CRA, FDA 524B, IEC 62443, or ISO/SAE 21434; FDA premarket submissions; or tabletop exercises is a plus.
CISSP, CSSLP, CISA, or ISO 27001 Lead Auditor certification, and government or public policy cybersecurity experience, are a plus.

Lead advisory engagements end to end, including scoping, work breakdowns, milestone schedules, client meetings, risk and action tracking, and timely delivery.
Frame regulatory programs for clients facing the EU CRA, CE RED (EN 18031), FDA 524B, and FCC Cyber Trust Mark.
Assess product classification, applicable requirements, evidence needs, conformity paths, gaps, and roadmaps.
Deliver security and regulatory compliance assessments and turn findings into prioritized, defensible recommendations.
Serve as the named virtual Chief Product Security Officer on client accounts, running program cadence and representing product security to executives.
Direct work carried out by Finite State's engineering team and client engineers.
Design secure development lifecycle programs, including policy, governance, and training.
Write assessments, roadmaps, policies, briefings, and evidence packages for executive and engineering audiences.
Work with engineering and offensive security teams to translate SBOM, vulnerability, reachability, and penetration test findings into regulatory and business terms.
Scope bootcamps, support sellers through the services request process, and build reusable templates, playbooks, and practice assets.

View Full Description & ApplyYou'll be redirected to the employer's site