Software Engineer

ZEISS in India

ZEISS in India is headquartered in Bengaluru and present in the fields of Industrial Quality Solutions, Research Microscopy Solutions, Medical Technology, Vision Care and Sports & Cine Optics.

ZEISS India has 3 production facilities, R&D center, Global IT services and about 40 Sales & Service offices in almost all Tier I and Tier II cities in India. With 2200+ employees and continued investments over 25 years in India, ZEISS’ success story in India is continuing at a rapid pace.

Further information at ZEISS India .

Purpose of this position / Position summary

We are seeking a highly skilled and experienced Security Architect - Device & Medical Device Security to lead security architecture, design, and risk management activities for connected medical devices, diagnostic equipment, embedded platforms, and related product ecosystems within Vision Care Solutions.

The ideal candidate will possess deep expertise in device security, embedded systems security, medical device cybersecurity, secure hardware and firmware design, product security engineering, and cybersecurity risk management. The role focuses on ensuring that security is built into products from concept through decommissioning while meeting regulatory, safety, privacy, and business requirements.

The Security Architect will guide product teams in the definition of security requirements for devices, communication interfaces, cloud integrations, manufacturing and provisioning environments, and service ecosystems and serve as reviewer/expert subject manner for security risk assessments, threat modelling and overall security concepts. The role complements the existing software security architecture capability and therefore places primary emphasis on physical and connected devices, embedded platforms, firmware, medical device cybersecurity, and product lifecycle security.

Primary duties and responsibilities

Key Responsibilities

• Medical Device Security Architecture:

• Define and maintain security architecture principles, reference architectures, and design patterns for medical devices and connected product ecosystems.

• Establish minimum security requirements across hardware, firmware, embedded software, connectivity, cloud integration, and service infrastructure.

• Provide security guidance throughout the product lifecycle, from concept and design through production, post-market monitoring, servicing, and retirement.

• Ensure security-by-design and privacy-by-design principles are embedded into product development processes.

• Embedded & Device Security:

• Design and review secure architectures for embedded Linux, RTOS-based, and other device platforms.

• Define secure boot, secure storage, trusted execution, hardware root of trust, device hardening, and secure provisioning mechanisms.

• Architect secure firmware update, patching, rollback protection, and recovery capabilities.

• Ensure the establishment of device identity, authentication, authorization, certificate management, and cryptographic controls in close collaboration with the product teams.

• Medical Device Cybersecurity & Regulatory Alignment:

• Lead cybersecurity activities in alignment with applicable medical device regulations, standards, and guidance, including FDA cybersecurity guidance, IEC 81001-5-1, IEC 62304, ISO 14971, AAMI TIR57/TIR97, NIST guidance, and MDR/IVDR expectations.

• Support cybersecurity documentation for technical files, regulatory submissions, audits, and product approvals.

• Work with Quality and Regulatory Affairs to maintain objective evidence and traceability of cybersecurity requirements and controls.

• Security Risk Management & Threat Modeling:

• Guide and review the creation of threat modeling and attack-surface analysis for devices, interfaces, and product ecosystems.

• Review cybersecurity risk assessments and security risk management documentation.

• Collaborate with safety, quality, privacy, and engineering teams to evaluate security-related patient, user, business, and product risks.

• Ensure identified risks are mitigated, accepted, documented, and traceable to security controls and verification evidence.

• Vulnerability Management & Product Security:

• Establish and govern product vulnerability management processes across pre-market and post-market phases.

• Assess vulnerabilities in third-party components, operating systems, firmware, libraries, and open-source software.

• Support Software Bill of Materials (SBOM) creation, maintenance, monitoring, and governance.

• Coordinate vulnerability triage, remediation, security advisories, and responsible disclosure activities.

• Connected Device & Ecosystem Security:

• Design secure communication architectures for device-to-device, device-to-cloud, service, mobile, and clinical environment integrations.

• Define security controls for DICOM, HL7/FHIR, APIs, remote service interfaces, and other applicable protocols.

• Define network segmentation, Zero Trust, secure remote access, logging, and monitoring approaches for connected device environments.

• Product Security Governance:

• Define secure engineering requirements, security architecture review processes, and security design gates for device development teams.

• Create and maintain product security standards, reusable patterns, checklists, and reference architectures.

• Provide security sign-off or documented risk-based recommendations at relevant product development milestones.

• Supplier & Supply Chain Security:

• Assess cybersecurity risks associated with suppliers, third-party components, contract manufacturers, and external development partners.

• Define security requirements for externally sourced hardware, firmware, software, and services.

• Support secure manufacturing, provisioning, distribution, maintenance, and end-of-life processes.

• Incident Response & Post-Market Security:

• Support investigation and management of cybersecurity incidents and vulnerabilities affecting products.

• Contribute to product security incident response, coordinated vulnerability disclosure, and customer communication processes.

• Support post-market cybersecurity monitoring, trend analysis, and continuous improvement activities.

• Leadership & Collaboration:

• Serve as the subject-matter expert for device and medical device security.

- Align with Senior manager for Cybersecurity and Data protection on security roadmap for devices
- Partner with R&D, Quality, Regulatory Affairs, Product Management, Software and Cloud Architecture, Manufacturing, Service, and Privacy teams.

• Mentor architects, engineers, and technical leads on device security and medical device cybersecurity practices.

• Communicate complex security risks, design decisions, and remediation options clearly to technical and non-technical stakeholders.

Put a one-sentence mission at the top

The current summary runs to three paragraphs, and the key point comes last. Something like:

"Own security architecture for VCS connected medical devices, from secure boot to post-market, so our products are secure by design and ready for regulators, working alongside the existing software security architecture capability."

Make success expectations explicit.  Either add a short, high-level "What success looks like" section to the JD, or keep it out and capture measurable first-year goals in a separate internal hiring scorecard. That scorecard would guide interviews and later become the new hire's first goals.

Can Consider to Cut the responsibilities to about 8 to 10 core bullets

Most of the current detail can move into the outcomes or competencies. Keep the core work up front (architecture, threat modelling and risk, vulnerability management) and treat incident communication and trend analysis as supporting work.

he bullets in the Leadership & Collaboration section are uneven: there's a stray character and a mix of bullet styles.

Qualifications

• Education: Bachelor's or Master's degree in Computer Science, Electronics Engineering, Medical Engineering, Cybersecurity, Embedded Systems Engineering, or a related field.

• Experience: 12-15 years of experience in cybersecurity, product security, embedded systems security, security architecture, or related engineering disciplines.

• At least 5 years of relevant experience in device security, embedded security, operational technology security, or medical device cybersecurity.

• Experience working in regulated environments such as medical devices, diagnostics, healthcare, life sciences, industrial systems, or similarly safety-critical products.

• Practical experience across multiple device or product development programs is strongly preferred.

Technical Skills

• Medical Device & Product Security:

• Medical device cybersecurity architecture and secure product lifecycle management.

• Cybersecurity risk management, threat modeling, attack-surface analysis, and security requirements engineering.

• Product vulnerability management, penetration-test oversight, SBOM governance, and software supply chain security.

• Embedded & Device Security:

• Embedded Linux and RTOS security concepts.

• Firmware security, secure boot, code signing, secure storage, device hardening, and protected update mechanisms.

• TPM, hardware root of trust, trusted execution, device identity, secure provisioning, and secure decommissioning.

• Hardware and software interface security, including wired, wireless, removable media, debug, and service interfaces.

• Security Architecture & Cryptography:

• Security architecture reviews and secure design patterns.

• Identity and access management, least privilege, Zero Trust, network segmentation, and secure remote access.

• Applied cryptography, PKI, certificates, key management, HSM technologies, TLS, hashing, and encryption.

• Connectivity & Medical Protocols:

• Security of connected device ecosystems and device-to-cloud communication.

• Knowledge of DICOM and exposure to HL7/FHIR is preferred.

• API security, secure networking, telemetry protection, monitoring, and logging.

• Cloud & Infrastructure Security:

• Understanding of Azure security services and cloud-connected device architectures.

• Experience with identity services, key management, network security, security monitoring, and cloud security controls.

• Regulatory & Standards Knowledge:

• Strong understanding of applicable medical device cybersecurity regulations, standards, and guidance such as FDA cybersecurity guidance, IEC 81001-5-1, IEC 62304, ISO 14971, AAMI TIR57/TIR97, MDR/IVDR, and relevant NIST publications.

• Ability to translate regulatory and standards requirements into implementable architecture controls and verifiable engineering requirements.

Soft Skills

• Strong analytical, problem-solving, and systems-thinking skills.

• Excellent communication, stakeholder management, and design-articulation skills.

• Ability to lead through influence and work effectively across engineering, quality, regulatory, product, manufacturing, and service functions.

• Ability to mentor technical teams and establish a strong security culture.

• Detail-oriented, evidence-driven, and able to balance security, safety, usability, regulatory, and business requirements.

• Excellent documentation and presentation skills.

Preferred Qualifications

• Certifications: CISSP, CSSLP, ISA/IEC 62443, EC 81001-5-1

, AzureSecurity Engineer, or comparable product-security and medical-device cybersecurity credentials are desirable.

Split the competencies into must-have and nice-to-have

About 30 technical skills currently read as equally required, which may put off strong candidates.

Suggested must-haves: embedded and firmware security, threat modelling and risk, medical device cybersecurity standards, PKI and applied cryptography.

Suggested nice-to-haves: DICOM and HL7/FHIR, Azure, certifications.

Your ZEISS Recruiting Team:
Itishree Pani