Security Operations Lead (CE100ST RM 4554)

Position: Security Operations Lead (CE100ST RM 4554)

Security Operations Lead:

• You will serve as the cybersecurity operational lead for an assigned product by coordinating post-market cybersecurity activities and ensuring security vulnerabilities and incidents are managed in accordance with organizational policies, regulatory expectations, and product risk management processes.
• You will evaluate cybersecurity vulnerabilities by performing technical assessments, determining controlled versus uncontrolled risk, documenting vulnerability evaluations, and coordinating cross-functional risk decisions using Threat & Risk Analysis, CVSS, existing security controls, and product risk management processes.
• You will coordinate cybersecurity incident and vulnerability response by facilitating cross-functional activities involving engineering, quality, regulatory, service, product management, legal, communications, and cybersecurity teams to ensure timely assessment, mitigation, customer communication, and resolution.
• You will coordinate security remediation and release readiness by tracking remediation activities, supporting security patch planning, verifying implementation status, coordinating security release activities, and ensuring required cybersecurity deliverables are completed prior to product release.
• You will support cybersecurity communications by coordinating product security advisories, customer communications, ProductCERT activities, coordinated vulnerability disclosure, and regulatory support documentation as required.
• You will drive continuous improvement by monitoring operational performance, identifying process improvements, developing automation opportunities, capturing lessons learned, and improving the efficiency and effectiveness of cybersecurity operations.

Your expertise:

• Bachelor’s or Master’s degree in Computer Science, Cybersecurity, Software Engineering, Computer Engineering, Information Technology, or a related technical discipline, or equivalent experience. Minimum 10+ years of experience in software engineering, product cybersecurity, vulnerability management, product support, or regulated product development, including 3+ years leading cross-functional cybersecurity initiatives or technical programs.
• Demonstrated expertise in post-market product cybersecurity operations, including Security Vulnerability Monitoring (SVM), Software Bill of Materials (SBOM) management, Common Vulnerabilities and Exposures (CVE) analysis, vulnerability assessment, coordinated vulnerability disclosure, cybersecurity incident response, Incident Handling and Vulnerability Handling (IH-VH), security patch coordination, and post-market cybersecurity risk management for complex software-enabled products.
• Strong knowledge of cybersecurity risk management principles, Threat and Risk Analysis (TRA), Common Vulnerability Scoring System (CVSS), vulnerability exploitability, compensating controls, security architecture concepts, secure software development practices, and risk-based engineering decision making, with the ability to determine whether cybersecurity risks remain controlled or require escalation for additional assessment and remediation.
• Experience supporting regulated product cybersecurity activities, including vulnerability evaluation, customer security communications, security advisories, coordinated disclosure, regulatory support, security remediation planning, Software Vulnerability Monitoring (SVM), Software Bill of Materials (SBOM) governance, cybersecurity documentation, and post-market cybersecurity deliverables supporting regulatory compliance and customer assurance.
• Demonstrated ability to coordinate cross-functional cybersecurity response activities involving software engineering, cybersecurity architecture, verification, quality, regulatory, service, legal, communications, and product management organizations, facilitating timely technical assessments, remediation planning, security releases, customer communications, and coordinated response to cybersecurity vulnerabilities and security incidents.
• Strong leadership, communication, and stakeholder management skills, with a demonstrated ability to translate complex cybersecurity risks into clear, accurate, and customer-focused communications that support informed decision making without creating unnecessary customer concern or regulatory risk. Experience in medical devices, laboratory diagnostics, or other regulated industries is highly desirable. Willingness to travel up to 25% as business needs require

**********************************************************************************************************************