Sr. Engineer, Product Cyber Security

Waters is hiring a Senior Product Cyber Security Engineer to own cybersecurity deliverables for assigned products throughout development and release. The role leads threat modeling, security testing, SBOM and vulnerability management, regulatory and customer assurance, and automation in partnership with engineering and quality teams.

Responsibilities:

• Own the cybersecurity plan and the Product Security Management Plan for assigned products, covering new development, major releases and sustaining changes, in line with our product cybersecurity procedures
• Produce the required deliverable set for each product: product security requirements gap analysis, threat model and data flow map, Product Security White Paper, Incident and Vulnerability Management Plan, Patch Management Plan, Cybersecurity Risk Summary Report, and third-party vendor assessments
• Decide with the team which deliverables apply to each product, scale them to the product's risk and regulatory status (research-use-only versus IVD), and document every exemption with its justification
• Keep the Product Security Management File complete, traceable and ready for FDA inspections and notified-body audits
• Lead STRIDE-based threat modeling sessions with product teams: assets, data flows, trust boundaries, threats, controls, and the risk register entries that result
• Assess products against our product security requirements, score findings with CVSS, and work with R&D on remediation or documented risk acceptance
• Document unresolved and accepted risks in the Cybersecurity Risk Summary Report that supports release decisions, and feed cybersecurity hazards into the product risk management file where patient safety is affected
• Run static code analysis and software composition analysis (e.g., Snyk) on product releases, triage findings with engineering, and archive the reports
• Generate and validate CycloneDX SBOMs from the actual release artifacts of every software-enabled product, integrate SBOM generation into build and release pipelines, and load SBOMs into our post-market vulnerability monitoring tool (e.g., CyBeats)
• Monitor post-market vulnerability reports against product SBOMs, assess impact with R&D, and drive remediation within the timelines our procedures set
• Coordinate penetration tests with our corporate product security engineering team: define scope from the roadmap, schedule tests early in development and before submissions, evaluate results and assess mitigations
• Support investigation of externally reported vulnerabilities and potential cybersecurity complaints together with our corporate cyber risk team
• Maintain product Patch Management Plans and author or review Security Patch Verification Protocols and Reports
• Deliver the annual operating system patch verification bulletins for IVD products in the patch verification program
• Contribute to hardened Windows 11 baseline images for instrument workstations and to the process for managing product-level exceptions
• Assemble cyber assurance packages for key customers (SBOMs, Product Security White Papers, penetration test attestations, SOC 2 summaries) and answer customer security questionnaires
• Prepare the cybersecurity content of regulatory submissions (FDA premarket cybersecurity requirements, EU IVDR) and support internal reviews, audits and regulator interactions
• Review third-party security checklists and SOC 2 reports for third-party software and services used in or with our products
• Build and maintain scripts and pipeline steps that generate SBOMs, scan results and audit evidence automatically, so deliverables stay current with every release instead of being rebuilt by hand
• Produce cross-portfolio security risk reporting and in-market risk metrics for leadership, and keep work-item tracking for security activities current
• Help evaluate and adopt AI-assisted tooling for drafting and checking security documentation
• Contribute to updates of our product security procedures and security requirements as corporate policy, FDA expectations and submission feedback evolve
• Act as the product security subject matter expert for R&D, DevOps, Quality, Regulatory and partner teams
• Provide practical guidance on secure design, secure update and installation mechanisms, vulnerability remediation and compliance expectations

Requirements:

• Bachelor's degree in Computer Science, Software Engineering, Cybersecurity or a related technical field, or equivalent practical experience
• 10+ years of experience in software engineering, product or application security, or cybersecurity engineering, including hands-on security work on software products that shipped to customers
• Basic software engineering fluency: you read and write code in some language, you are comfortable with commandline, you are aware of build systems and package ecosystems (npm, pip, NuGet) and CI/CD pipelines (Azure DevOps or similar)
• Hands-on experience with threat modeling (STRIDE or similar), vulnerability assessment, CVSS scoring, remediation workflows and risk acceptance
• Experience with static analysis and software composition analysis tools and with SBOM formats (CycloneDX or SPDX)
• Experience producing formal security deliverables (threat models, risk assessments, vulnerability reports, SBOMs) that have been reviewed in audits or regulatory submissions
• Strong written communication: clear, structured technical documentation in English suitable for auditors, regulators and customers
• Demonstrated ability to run several product workstreams in parallel in a procedure-driven, documentation-heavy environment, with a bias toward automation and reuse over manual effort
• Experience in medical devices, in vitro diagnostics, life sciences or other regulated software, including familiarity with FDA premarket cybersecurity guidance (section 524B), EU MDR/IVDR, ISO 14971, AAMI TIR57, IEC 81001-5-1 or UL 2900
• Experience with Snyk, CyBeats or similar composition analysis and SBOM monitoring platforms, and with vulnerability scanners such as Tenable or Qualys
• Experience with Windows operating system hardening, image management and security patch verification
• Experience coordinating penetration tests and performing supplier security assessments (third-party checklists, SOC 2 report reviews)
• Experience building security metrics, dashboards or operational reporting
• Experience using AI and large language model tools to accelerate documentation and analysis while keeping outputs reviewable and traceable
• Experience supporting FDA inspections, notified-body audits or ISO 13485 quality system audits