PSR Lead

Job Requirements

Role Summary:

- Serve as the Product Security Representative for multiple Imaging 360 products and releases, representing cybersecurity and privacy requirements throughout the product lifecycle.
- Drive execution of the GEHC DEPS process, including security and privacy planning, threat modeling, cybersecurity risk assessment, secure design reviews, vulnerability management, lifecycle security artifacts, and phase-appropriate security deliverables from concept through development and evaluation.
- Own Security Design Reviews across the product lifecycle, including concept definition, architecture and design, development execution, verification / evaluation, and release readiness for Imaging360 capabilities and integrations.
- Partner with Product Security Leaders and product teams to interpret and apply GEHC cybersecurity standards, regulatory expectations, and quality management system requirements.
- Lead threat modeling and security architecture reviews for cloud-hosted enterprise applications, APIs, data flows, scanner connectivity, on-premises integrations, identity services, and third-party product integrations.
- Assess cybersecurity risks associated with hybrid deployments involving cloud services, customer networks, on-premises scanners, edge components, and external vendor systems.
- Define and influence implementation of security controls for authentication, authorization, encryption, audit logging, secrets management, network segmentation, secure communication, data protection, and system hardening.
- Own or support cybersecurity management plans, vulnerability triage, remediation planning, risk acceptance discussions, and closure tracking across multiple product teams.
- Coordinate SAST, SCA, DAST, penetration testing, infrastructure scanning, container security, cloud security reviews, and remediation activities in partnership with engineering and operations teams.
- Generate, maintain, and assess Software Bill of Materials (SBOM) content, including open-source, commercial, and third-party components integrated into the product.
- Evaluate third-party product integrations for cybersecurity, privacy, data protection, interface security, supportability, and operational risk.
- Collaborate with architecture, platform, DevOps, cloud operations, quality, regulatory, privacy, and program teams to ensure secure-by-design and compliant delivery.
- Provide cybersecurity guidance to scrum teams, review design and implementation decisions, and help teams adopt secure SDLC and DevSecOps practices.
- Support fielded product security activities, including vulnerability impact assessments, customer notifications, remediation planning, patch strategy, and lifecycle risk management.
- Champion Imaging 360-level security KPI reporting, governance dashboards, and ongoing monitoring of security health indicators, including vulnerability posture, remediation progress, open risks, security test coverage, SBOM readiness, and DEPS compliance status.
- Prepare clear technical and leadership-level communication on security posture, risks, remediation status, and product security readiness

Work Experience

Qualifications

- Bachelor’s degree in Computer Science, Computer Engineering, Cybersecurity, Information Security, Software Engineering, or a related STEM discipline.
- 12+ years of experience in software engineering, product security, application security, cloud security, or cybersecurity engineering for enterprise products.
- Hands-on experience securing cloud-hosted enterprise applications and distributed systems, preferably in AWS, Azure, or similar cloud environments.
- Experience with enterprise products that integrate with on-premises systems, connected devices, customer networks, or scanner / equipment workflows.
- Strong understanding of secure software development lifecycle practices, threat modeling, cybersecurity risk management, vulnerability management, and security control implementation.
- Working knowledge of application, API, container, infrastructure, network, and cloud security concepts.
- Experience with security assessment tools and practices such as SAST, SCA, DAST, penetration testing, container scanning, cloud posture management, SBOM generation, and dependency vulnerability analysis.
- Knowledge of OWASP Top 10, secure coding principles, identity and access management, encryption, audit logging, secure communications, and privacy-by-design principles.
- Ability to work effectively in a regulated product development environment and maintain compliance with quality, privacy, and cybersecurity processes.
- Demonstrated technical leadership, stakeholder management, and communication skills across engineering, product, quality, regulatory, security, and leadership audiences.

Desired Skills

- Experience serving as a Product Security Representative, security architect, or product security owner for multiple products or releases.
- Experience with healthcare software, medical device software, imaging workflows, DICOM environments, or connected clinical systems.
- Familiarity with GEHC DEPS or equivalent product cybersecurity lifecycle processes in regulated industries.
- Understanding of applicable cybersecurity and privacy frameworks such as FDA cybersecurity guidance, NIST, ISO 27001, IEC 81001-5-1, HIPAA, GDPR, SOC 2, or similar standards.
- Experience assessing third-party products, SaaS services, APIs, vendor integrations, and data exchange workflows for cybersecurity and privacy risk.
- Hands-on experience with tools such as threat modeling tools, Black Duck, Syft, Grype, SonarQube, Burp Suite, Wiz, Twistlock / Prisma Cloud, or equivalent security platforms.
- Experience with DevSecOps practices, CI/CD security gates, automated security testing, infrastructure-as-code security, container security, and cloud-native monitoring.
- Strong understanding of identity federation and access control technologies such as SAML, OAuth, OIDC, SCIM, RBAC, and least-privilege access models.
- Security certifications such as CISSP, CSSLP, CISM, CCSP, CEH, or equivalent credentials are a plus.
- Ability to influence without authority, simplify complex security topics, and drive timely risk-based decisions across global and cross-functional teams.