Professional, Questionnaires/MDS2/SBOM Program Lead

Zinnov is hiring for the role of

Professional, Questionnaires/MDS2/SBOM Program Lead on behalf of our Global MNC MedTech client company a company where technology sits at the centre of everything: powering how the core business operates day to day and shaping the products and digital solutions that will define the future of patient care. This role is part of the companys establishment of their new India Global Capability Centre (GCC) in Bengaluru which will drive enterprise technology, digital transformation and innovation for its global operations and contributing to technology that ultimately helps millions of people around the world.

How you'll make an impact

• Lead customer, hospital, and third-party security questionnaire responses, establishing reusable evidence, ownership, review, approval, and response-SLA processes.
• Own creation, maintenance, version control, and quality review of MDS2 documentation in partnership with Product Security, Regulatory, Quality, and engineering teams.
• Govern the SBOM lifecycle including generation, ingestion, validation, storage, versioning, component provenance, vulnerability correlation, and release alignment.
• Work with SBOM/SCA platforms such as Black Duck, Snyk, Mend, Sonatype Lifecycle, Anchore, Dependency-Track, Syft/Grype, or equivalent and support SPDX / CycloneDX formats.
• Correlate SBOM components with NVD, CISA KEV, vendor advisories, CVSS/EPSS, and product risk assessments to support remediation and disclosure decisions.
• Design or improve questionnaire and evidence workflows using platforms such as ServiceNow IRM, OneTrust, Whistic, ProcessUnity, or equivalent customer-assurance/GRC tooling.
• Automate data collection and evidence exchange using APIs, workflow tools, scripting, and integrations with engineering, vulnerability-management, and document repositories.
• Maintain traceable technical documentation aligned with FDA cybersecurity expectations, IEC 81001-5-1, AAMI TIR57, NIST SSDF, and other applicable product-security standards.
• Provide program metrics on questionnaire turnaround, MDS2 coverage, SBOM completeness, vulnerability exposure, and remediation status to leadership and cross-functional stakeholders.

What you'll bring

Skills Required:

• 5+ years of experience in cybersecurity, product security, security architecture, or a related discipline, including hands-on exposure to SBOM, vulnerability management, and security documentation.
• Working knowledge of MDS2 and experience coordinating customer or hospital security questionnaires for technology or medical-device products.
• Hands-on experience with SBOM/SCA concepts and tools, including SPDX or CycloneDX, component inventory, vulnerability correlation, and supplier software transparency.
• Understanding of CVE/CVSS, NVD, CISA KEV, vulnerability prioritization, and how software-component risk informs product-security decisions.
• Ability to design repeatable processes and integrate enterprise platforms, APIs, SaaS tools, and document/evidence repositories.
• Strong written communication, stakeholder management, evidence quality, and program governance skills across technical and regulatory teams.
• Bachelor's degree in Computer Science, Information Security, Engineering, or a related technical field.

Preferred:

• Experience in MedTech or healthcare with FDA premarket/postmarket cybersecurity expectations, Section 524B, IEC 81001-5-1, AAMI TIR57, and NIST SSDF.
• Experience with ServiceNow IRM, OneTrust, Whistic, ProcessUnity, or equivalent questionnaire/evidence-management platforms.
• CISSP, CSSLP, GIAC, or equivalent product-security certification.

.