Quest Global

Engineering services, digital transformation, asset management

Product Security Representative Lead

Security Engineering & ArchitectureUpdated on Nov 9

Full-timeNo salary listedIn-person

About the Job

Requirements

A bachelor's degree in Computer Science, Computer Engineering, Cybersecurity, Information Security, Software Engineering, or a related STEM discipline is required.
At least 6 years of experience in software engineering, product security, application security, cloud security, or cybersecurity engineering for enterprise products is required.
Hands-on experience securing cloud-hosted enterprise applications and distributed systems, preferably in AWS, Azure, or similar cloud environments, is required.
Experience with enterprise products that integrate with on-premises systems, connected devices, customer networks, or scanner and equipment workflows is required.
A strong understanding of secure software development lifecycle practices, threat modeling, cybersecurity risk management, vulnerability management, and security control implementation is required.
Working knowledge of application, API, container, infrastructure, network, and cloud security concepts is required.
Experience with security assessment tools and practices such as static application security testing, software composition analysis, dynamic application security testing, penetration testing, container scanning, cloud posture management, software bill of materials generation, and dependency vulnerability analysis is required.
Knowledge of the OWASP Top 10, secure coding principles, identity and access management, encryption, audit logging, secure communications, and privacy-by-design principles is required.
Ability to work effectively in a regulated product development environment and maintain compliance with quality, privacy, and cybersecurity processes is required.
Demonstrated technical leadership, stakeholder management, and communication across engineering, product, quality, regulatory, security, and leadership audiences is required.

Responsibilities

Serve as the Product Security Representative for multiple Imaging360 products and releases, representing cybersecurity and privacy requirements throughout the product lifecycle.
Drive execution of the GEHC DEPS process, including security and privacy planning, threat modeling, cybersecurity risk assessment, secure design reviews, vulnerability management, lifecycle security artifacts, and phase-appropriate security deliverables from concept through development and evaluation.
Own Security Design Reviews across the product lifecycle, including concept definition, architecture and design, development execution, verification and evaluation, and release readiness for Imaging360 capabilities and integrations.
Partner with Product Security Leaders and product teams to interpret and apply GEHC cybersecurity standards, regulatory expectations, and quality management system requirements.
Lead threat modeling and security architecture reviews for cloud-hosted enterprise applications, APIs, data flows, scanner connectivity, on-premises integrations, identity services, and third-party product integrations.
Assess cybersecurity risks associated with hybrid deployments involving cloud services, customer networks, on-premises scanners, edge components, and external vendor systems.
Define and influence implementation of security controls for authentication, authorization, encryption, audit logging, secrets management, network segmentation, secure communication, data protection, and system hardening.
Own or support cybersecurity management plans, vulnerability triage, remediation planning, risk acceptance discussions, and closure tracking across multiple product teams.
Coordinate static application security testing, software composition analysis, dynamic application security testing, penetration testing, infrastructure scanning, container security, cloud security reviews, and remediation activities in partnership with engineering and operations teams.
Generate, maintain, and assess software bill of materials content, including open-source, commercial, and third-party components integrated into the product.
Evaluate third-party product integrations for cybersecurity, privacy, data protection, interface security, supportability, and operational risk.
Collaborate with architecture, platform, DevOps, cloud operations, quality, regulatory, privacy, and program teams to ensure secure-by-design and compliant delivery.
Provide cybersecurity guidance to scrum teams, review design and implementation decisions, and help teams adopt secure software development lifecycle and DevSecOps practices.
Support fielded product security activities, including vulnerability impact assessments, customer notifications, remediation planning, patch strategy, and lifecycle risk management.
Champion Imaging360-level security KPI reporting, governance dashboards, and ongoing monitoring of security health indicators, including vulnerability posture, remediation progress, open risks, security test coverage, software bill of materials readiness, and DEPS compliance status.
Prepare clear technical and leadership-level communication on security posture, risks, remediation status, and product security readiness.

Desired Qualifications

Experience serving as a Product Security Representative, security architect, or product security owner for multiple products or releases is preferred.
Experience with healthcare software, medical device software, imaging workflows, DICOM environments, or connected clinical systems is preferred.
Familiarity with GEHC DEPS or equivalent product cybersecurity lifecycle processes in regulated industries is preferred.
Understanding of applicable cybersecurity and privacy frameworks such as FDA cybersecurity guidance, NIST, ISO 27001, IEC 81001-5-1, HIPAA, GDPR, SOC 2, or similar standards is preferred.
Experience assessing third-party products, SaaS services, APIs, vendor integrations, and data exchange workflows for cybersecurity and privacy risk is preferred.
Hands-on experience with threat modeling tools, Black Duck, Syft, Grype, SonarQube, Burp Suite, Wiz, Twistlock, Prisma Cloud, or equivalent security platforms is preferred.
Experience with DevSecOps practices, CI/CD security gates, automated security testing, infrastructure-as-code security, container security, and cloud-native monitoring is preferred.
A strong understanding of identity federation and access control technologies such as SAML, OAuth, OIDC, SCIM, RBAC, and least-privilege access models is preferred.
Security certifications such as CISSP, CSSLP, CISM, CCSP, CEH, or equivalent credentials are a plus.
Ability to influence without authority, simplify complex security topics, and drive timely risk-based decisions across global and cross-functional teams is preferred.

Job Requirements Key Responsibilities<ul><li>Serve as the Product Security Representative for multiple Imaging360 products and releases, representing cybersecurity and privacy requirements throughout the product lifecycle.</li><li>Drive execution of the GEHC DEPS process, including security and privacy planning, threat modeling, cybersecurity risk assessment, secure design reviews, vulnerability management, lifecycle security artifacts, and phase-appropriate security deliverables from concept through development and evaluation.</li><li>Own Security Design Reviews across the product lifecycle, including concept definition, architecture and design, development execution, verification / evaluation, and release readiness for Imaging360 capabilities and integrations.</li><li>Partner with Product Security Leaders and product teams to interpret and apply GEHC cybersecurity standards, regulatory expectations, and quality management system requirements.</li><li>Lead threat modeling and security architecture reviews for cloud-hosted enterprise applications, APIs, data flows, scanner connectivity, on-premises integrations, identity services, and third-party product integrations.</li><li>Assess cybersecurity risks associated with hybrid deployments involving cloud services, customer networks, on-premises scanners, edge components, and external vendor systems.</li><li>Define and influence implementation of security controls for authentication, authorization, encryption, audit logging, secrets management, network segmentation, secure communication, data protection, and system hardening.</li><li>Own or support cybersecurity management plans, vulnerability triage, remediation planning, risk acceptance discussions, and closure tracking across multiple product teams.</li><li>Coordinate SAST, SCA, DAST, penetration testing, infrastructure scanning, container security, cloud security reviews, and remediation activities in partnership with engineering and operations teams.</li><li>Generate, maintain, and assess Software Bill of Materials (SBOM) content, including open-source, commercial, and third-party components integrated into the product.</li><li>Evaluate third-party product integrations for cybersecurity, privacy, data protection, interface security, supportability, and operational risk.</li><li>Collaborate with architecture, platform, DevOps, cloud operations, quality, regulatory, privacy, and program teams to ensure secure-by-design and compliant delivery.</li><li>Provide cybersecurity guidance to scrum teams, review design and implementation decisions, and help teams adopt secure SDLC and DevSecOps practices.</li><li>Support fielded product security activities, including vulnerability impact assessments, customer notifications, remediation planning, patch strategy, and lifecycle risk management.</li><li>Champion Imaging360-level security KPI reporting, governance dashboards, and ongoing monitoring of security health indicators, including vulnerability posture, remediation progress, open risks, security test coverage, SBOM readiness, and DEPS compliance status.</li><li>Prepare clear technical and leadership-level communication on security posture, risks, remediation status, and product security readiness.</li></ul> Work Experience Qualifications<ul><li>Bachelor’s degree in Computer Science, Computer Engineering, Cybersecurity, Information Security, Software Engineering, or a related STEM discipline.</li><li>6+ years of experience in software engineering, product security, application security, cloud security, or cybersecurity engineering for enterprise products.</li><li>Hands-on experience securing cloud-hosted enterprise applications and distributed systems, preferably in AWS, Azure, or similar cloud environments.</li><li>Experience with enterprise products that integrate with on-premises systems, connected devices, customer networks, or scanner / equipment workflows.</li><li>Strong understanding of secure software development lifecycle practices, threat modeling, cybersecurity risk management, vulnerability management, and security control implementation.</li><li>Working knowledge of application, API, container, infrastructure, network, and cloud security concepts.</li><li>Experience with security assessment tools and practices such as SAST, SCA, DAST, penetration testing, container scanning, cloud posture management, SBOM generation, and dependency vulnerability analysis.</li><li>Knowledge of OWASP Top 10, secure coding principles, identity and access management, encryption, audit logging, secure communications, and privacy-by-design principles.</li><li>Ability to work effectively in a regulated product development environment and maintain compliance with quality, privacy, and cybersecurity processes.</li><li>Demonstrated technical leadership, stakeholder management, and communication skills across engineering, product, quality, regulatory, security, and leadership audiences.</li></ul>Desired Skills<ul><li>Experience serving as a Product Security Representative, security architect, or product security owner for multiple products or releases.</li><li>Experience with healthcare software, medical device software, imaging workflows, DICOM environments, or connected clinical systems.</li><li>Familiarity with GEHC DEPS or equivalent product cybersecurity lifecycle processes in regulated industries.</li><li>Understanding of applicable cybersecurity and privacy frameworks such as FDA cybersecurity guidance, NIST, ISO 27001, IEC 81001-5-1, HIPAA, GDPR, SOC 2, or similar standards.</li><li>Experience assessing third-party products, SaaS services, APIs, vendor integrations, and data exchange workflows for cybersecurity and privacy risk.</li><li>Hands-on experience with tools such as threat modeling tools, Black Duck, Syft, Grype, SonarQube, Burp Suite, Wiz, Twistlock / Prisma Cloud, or equivalent security platforms.</li><li>Experience with DevSecOps practices, CI/CD security gates, automated security testing, infrastructure-as-code security, container security, and cloud-native monitoring.</li><li>Strong understanding of identity federation and access control technologies such as SAML, OAuth, OIDC, SCIM, RBAC, and least-privilege access models.</li><li>Security certifications such as CISSP, CSSLP, CISM, CCSP, CEH, or equivalent credentials are a plus.</li><li>Ability to influence without authority, simplify complex security topics, and drive timely risk-based decisions across global and cross-functional teams.</li></ul>

About the Company

Quest Global

Engineering services, digital transformation, asset management

QuEST Global provides engineering and lifecycle services across aerospace, automotive, energy, healthcare, and transportation, focusing on digital transformation and asset management. It uses edge computing, cloud, AI/ML, and industrial IoT to deliver tailored engineering solutions through long-term partnerships, service contracts, project-based engagements, and strategic collaborations. It differentiates itself with a broad industry footprint, global delivery model, and emphasis on partnerships, talent development, and workplace culture. Its goal is to help clients improve operational efficiency and drive business growth by transforming engineering processes and assets with digital tools and data-driven management.

Company size: 10,001+
Company stage: Growth Equity (Venture Capital)
Total funding: $581M
Headquarters: Greenville, SC
Founded: 1997

Recently Posted Jobs

Explore more opportunities at Quest Global

See more jobs