Product Security Architect

About NeST Digital!

NeST Digital, the core software division of the NeST Group, is one of the key global providers of technology solutions! With our extensive expertise spanning over two decades, we propel digital-driven innovation and have a remarkable track record of delivering cutting-edge solutions across different industry domains.

We are not just a company dreaming of the future we are shaping it! Step into our world and work with Fortune 500 companies on cutting-edge technologies, collaborate with industry experts, and constantly expand your skills and knowledge.

Its not just about the work it's about the community we build together, believing in cultivating a culture of camaraderie where teamwork, respect, and celebration are the norm.

So if you're a trailblazer, a boundary-pusher, or a true visionary with passion, you belong with us! Together, let us make a difference that will reverberate through time and redefine the infinite possibilities of this digital world!

Join us now, and let us embark on this extraordinary quest together! 

Position - Product Security Architect

Experience- 8+ years

Location- Bangalore

Responsibilities

• Provide privacy and security technical expertise supporting the product team throughout product development, design change, and life-cycle management.
• Work with the Product Security Leader (PSL) to support the product team with process expertise for Healthcare Product Cybersecurity Standards and life-cycle management.
• Product cybersecurity development responsibilities:
• Assess the privacy and cybersecurity state of the product and define product roadmap features/enhancements with stakeholder approval.
• Responsible for security architecture and coordination of product development for cybersecurity features and enhancements.
• Assess product components and SBoM are integrated into the product.
• Perform defect management for cybersecurity issues.
• Identify operational responsibilities and adherence to cloud standards for cloud-based products.
• Responsible for Product and Security Manual and MDS2 documentation.
• In coordination with the PSL, own and deliver Product Cybersecurity Standard artefacts, which include:
• Design input activities to identify, evaluate, roadmap, and drive cybersecurity and privacy features and enhancements within product development programs.
• Create Design Engineering Privacy and Security (DEPS) artefacts for privacy and security risk assessments to engage in domain-specific product threat modelling, attack surface analysis, risk management and reduction.
• Coordinates with the PSL to support the product team in scheduling and performing vulnerability scans and cybersecurity assessments.
• Lead product Security Technical Design Reviews
• Along with the product Lead System Designer (LSD), responsible for the Product Cybersecurity Standard compliance and other pertinent standards and processes.
• The released products shall comply with required regulatory standards & compliance (like FDA, HIPPA, GDPR etc.)
• Works with the Product Security team and Quality Assurance & Regulatory Assurance (QARA) on released product life cycle, including:
• Participate in post-market product vulnerability monitoring.
• Participate as a Subject Matter Expert to determine product vulnerability impact, investigation, and risk assessment.
• Responsible for product vulnerability mitigation and design change.
• Responsible for vulnerability tool updates to ensure accurate customer communication.
• Address customer and Sales RFP privacy and security feedback/questions.
• Provide technical expertise on customer concerns, complaints, and CSO escalations.
• Create/Maintain responsible product records within product cybersecurity tools.

Mandatory Soft Skills

• Should be able to contribute as an individual contributor
• Should be able to execute his/her responsibility independently
• Focus on self-planning activities

Mandatory Skills

• Security Engineering
1. Globally recognized Cyber Security Certifications (Advanced/Expert Level).
2. Firm with knowledge of OWASP, CVSS, FIPS 140-2/140-3 and DoD RMF
3. 5+ years of full-time information security experience with emphasis on technical assessment (system/web application vulnerability assessment, penetration testing, white-box secure code analysis, etc.) and security architecture (design of security controls, secure system design, understanding of identity and authentication management, etc.)
4. The Architect shall be capable of not only finding risks/issues but shall also suggest the best route to remediation, knowing the compensatory controls & guiding the product team for its closure.
5. Sound understanding of security technologies/techniques like
• Cryptography, Algorithms, Public key Infrastructure (PKI) Certificate Authority (CA),
• Hardware/embedded authentication, OAuth, 2-factor authentication, and
• white-box code analysis.
6. Experience with a range of security tools related to
• SAST (Static Application Security Assessment),
• DAST (Dynamic Application Security Assessment),
• Vulnerability Management,
• SCA (Software Composition Analysis),
• Penetration Testing
• Threat Modelling Tools etc.
• Product Engineering
1. Experience in working in a Product sector environment
2. Knowledge of Cloud Infrastructure [Platform as a Service]
• Medical Software/Device Engineering
1. MDS2 documentation
2. Experience in the Healthcare domain.
• Standard Software Engineering
1. Experience in Micro Services using RESTful frameworks
• Security Engineering
1. Penetration Testing in Web Applications, Thick Clients, Mobile Applications, REST/SOAP
2. Infrastructure Penetration Testing
3. Experience in Red Teaming Activities (add-on)
4. Recognition for CVE or Wall-of-Fame through Bug-Bounty (add-on)

Interested candidates can share their updated cv to [email removed]

Regards,

Anjusha Mohan

Talent Acquisition Team | NeST Digital