Staff Product Security Engineer

Overview

Staff Product Security Engineer in the AIS Digital team at GE HealthCare, providing cyber security leadership across product teams and global teams and helping to draw out the security strategy for AIS Digital products.

What you'll do

• Assess the security of software and product architecture, guiding product architects to build security into the design.
• Own development of cyber security artifacts, including threat models, and lead discussions on identifying mitigations.
• Assist engineering teams in triaging and identifying fixes for detected product vulnerabilities.
• Coordinate security and privacy assessments with internal and external teams, including VAPT, to determine compliance and security posture.
• Assist business units in developing and implementing product security and privacy practices, including policies, standards, guidelines and procedures.
• Verify that security and privacy requirements in security plans, policies and procedures are followed and that protection measures function as intended.
• Guide business units in managing the resolution of security audit or review findings.
• Provide security risk management and security advice, including advice on strategic direction for product and information security.
• Assist with security incidents and review the risk and impact of breaches to protected systems.
• Review proposed services, engineering changes and feature requests for security implications and needed security controls.

What you'll need

• Bachelor's degree in engineering.
• 10+ years of development and security experience, including application security, device security, network security, OS security and cloud security.
• Experience in REST API, Kubernetes and container security assessments.
• Product or information security experience across all phases of service or product development and deployment, including architecture, design, development, testing and deployment.
• Good understanding of AWS services, specifically related to security.
• Experience in designing security solutions.
• Hands-on experience executing and reviewing static and dynamic code analysis reports, and discussing true positives with development teams.
• Experience and knowledge of penetration testing methodologies and tools.
• Experience conducting information security analyses, audits and reviews.
• Willingness to learn new technologies and work on security for varied products.
• Strong interpersonal skills, with the ability to facilitate diverse groups, help negotiate priorities and resolve conflicts among project stakeholders.
• Sound security engineering knowledge to work collaboratively with tech leads and software or product architects to ensure secure products.
• Knowledge of information system architecture and security controls (e.g., firewall, specialized appliances).
• Sound understanding of cryptography, encryption algorithms, public key infrastructure (PKI) and certificate authority (CA), OAuth authentication, and 2FA.

Nice to have

• AWS Solutions Architect – Associate along with AWS Security Specialty certification.
• Experience of information security assessment in the healthcare sector.
• Experience with NIST 800-53 and CIS/STIG benchmark audits.
• Ideally, has worked on software development initially and then moved into software lead or security assessment roles ensuring security in product design.
• Exposure to privacy requirements.
• Understanding of HITRUST and SOC 2.
• Excellent cyber security capabilities.
• Strong knowledge of secure software development lifecycle and practices such as threat modelling, security reviews, penetration tests and security incident response.
• Understanding of security-by-design principles and architecture-level security concepts.
• Up-to-date knowledge of current and emerging security threats and techniques for exploiting security vulnerabilities.
• Ability to relate cyber security incidents from across industries.
• Good to have security certifications such as OSCP, CCSP or CISSP.

Details

• Relocation assistance: not provided.