Senior Product Security Consultant- Advisory

Role overview Lead advisory work that helps manufacturers of connected products build security programs and respond to cybersecurity regulations. You will guide engagements from initial scope through final recommendations, advising security, engineering, and executive stakeholders; some assignments include serving as a virtual product security leader.

Responsibilities - Scope client engagements, set milestones, lead meetings, track risks and actions, and deliver agreed work on schedule. - Assess how regulations apply to products, identify compliance gaps and evidence needs, and develop practical paths and roadmaps for meeting requirements. - Evaluate security and regulatory readiness, then present prioritized recommendations in assessments, policies, briefings, and evidence packages. - Guide product security program routines and coordinate engineering work with client teams. - Design secure development lifecycle programs, including governance, policies, and training. - Translate software bills of materials, vulnerability, reachability, and testing findings into business and regulatory implications; help develop reusable methods and materials for the advisory practice.

Requirements - At least eight years of professional experience, including five or more years in consulting or advisory work and a record of leading client engagements. - Cybersecurity program experience and enough familiarity with binary analysis, software bills of materials, vulnerability management, and reachability to work credibly with engineers. - Deep working knowledge of at least one of automotive, IoT, industrial, or healthcare products, including relevant regulations or standards. - Ability to interpret regulations and standards and turn them into product requirements and clear client guidance. - Strong engagement management, executive communication, and writing skills, including experience tracking milestones, risks, and actions. - Practical use of AI tools for research or drafting, with sound judgment about checking their output.

Nice to have - Conformity assessment, notified body, audit, or FDA premarket submission experience. - Familiarity with frameworks such as the EU Cyber Resilience Act, FDA 524B, IEC 62443, or ISO/SAE 21434. - Experience facilitating tabletop exercises; relevant credentials such as CISSP, CSSLP, CISA, or ISO 27001 Lead Auditor; or cybersecurity policy experience.

Benefits and work setup - Remote role in the United States; applicants must be authorized to work there without sponsorship. Washington, DC area presence is a plus. - Periodic travel for client workshops, executive meetings, and industry events.