Overview

The Staff Cyber Security Engineer will serve as the Product Security Representative (PSR) for AIS Digital Ecosystems – Imaging360, a cloud-enabled enterprise healthcare platform that connects with on-premises imaging scanners and integrates with third-party products and services.

Responsibilities

• Serve as the Product Security Representative for multiple Imaging360 products and releases, representing cybersecurity and privacy requirements throughout the product lifecycle.
• Drive execution of the GEHC DEPS process, including security and privacy planning, threat modeling, cybersecurity risk assessment, secure design reviews, vulnerability management, lifecycle security artifacts, and phase-appropriate security deliverables from concept through development and evaluation.
• Own Security Design Reviews across the product lifecycle, including concept definition, architecture and design, development execution, verification / evaluation, and release readiness for Imaging360 capabilities and integrations.
• Partner with Product Security Leaders and product teams to interpret and apply GEHC cybersecurity standards, regulatory expectations, and quality management system requirements.
• Lead threat modeling and security architecture reviews for cloud-hosted enterprise applications, APIs, data flows, scanner connectivity, on-premises integrations, identity services, and third-party product integrations.
• Assess cybersecurity risks associated with hybrid deployments involving cloud services, customer networks, on-premises scanners, edge components, and external vendor systems.
• Define and influence implementation of security controls for authentication, authorization, encryption, audit logging, secrets management, network segmentation, secure communication, data protection, and system hardening.
• Own or support cybersecurity management plans, vulnerability triage, remediation planning, risk acceptance discussions, and closure tracking across multiple product teams.
• Coordinate SAST, SCA, DAST, penetration testing, infrastructure scanning, container security, cloud security reviews, and remediation activities in partnership with engineering and operations teams.
• Generate, maintain, and assess Software Bill of Materials (SBOM) content, including open-source, commercial, and third-party components integrated into the product.
• Evaluate third-party product integrations for cybersecurity, privacy, data protection, interface security, supportability, and operational risk.
• Collaborate with architecture, platform, DevOps, cloud operations, quality, regulatory, privacy, and program teams to ensure secure-by-design and compliant delivery.
• Provide cybersecurity guidance to scrum teams, review design and implementation decisions, and help teams adopt secure SDLC and DevSecOps practices.
• Support fielded product security activities, including vulnerability impact assessments, customer notifications, remediation planning, patch strategy, and lifecycle risk management.
• Champion Imaging360-level security KPI reporting, governance dashboards, and ongoing monitoring of security health indicators, including vulnerability posture, remediation progress, open risks, security test coverage, SBOM readiness, and DEPS compliance status.
• Prepare clear technical and leadership-level communication on security posture, risks, remediation status, and product security readiness.

Qualifications

• Strong understanding of secure software development lifecycle practices, threat modeling, cybersecurity risk management, vulnerability management, and security control implementation.
• Working knowledge of application, API, container, infrastructure, network, and cloud security concepts.
• Knowledge of OWASP Top 10, secure coding principles, identity and access management, encryption, audit logging, secure communications, and privacy-by-design principles.
• Ability to work effectively in a regulated product development environment and maintain compliance with quality, privacy, and cybersecurity processes.
• Demonstrated technical leadership, stakeholder management, and communication skills across engineering, product, quality, regulatory, security, and leadership audiences.
• Familiarity with GEHC DEPS or equivalent product cybersecurity lifecycle processes in regulated industries.
• Understanding of applicable cybersecurity and privacy frameworks such as FDA cybersecurity guidance, NIST, ISO 27001, IEC 81001-5-1, HIPAA, GDPR, SOC 2, or similar standards.
• Hands-on experience with tools such as threat modeling tools, Black Duck, Syft, Grype, SonarQube, Burp Suite, Wiz, Twistlock / Prisma Cloud, or equivalent security platforms.
• Strong understanding of identity federation and access control technologies such as SAML, OAuth, OIDC, SCIM, RBAC, and least-privilege access models.
• Security certifications such as CISSP, CSSLP, CISM, CCSP, CEH, or equivalent credentials are a plus.
• Ability to influence without authority, simplify complex security topics, and drive timely risk-based decisions across global and cross-functional teams.

Education

• 12+ years of experience in software engineering, product security, application security, cloud security, or cybersecurity engineering for enterprise products.
• Hands-on experience securing cloud-hosted enterprise applications and distributed systems, preferably in AWS, Azure, or similar cloud environments.
• Bachelor’s degree in Computer Science, Computer Engineering, Cybersecurity, Information Security, Software Engineering, or a related STEM discipline