Senior Cybersecurity Advisor - Product & IoT Security

The Senior Cybersecurity Advisor provides customer-facing technical consultancy focused on the cybersecurity and regulatory compliance of connected and software-enabled products, including consumer IoT, industrial, automotive-adjacent, and medical technologies.

In this role, you will help customers understand and address cybersecurity requirements arising from regulations and standards such as the EU Cyber Resilience Act (CRA), the Radio Equipment Directive (RED), EN 18031, ETSI EN 303 645, ISA/IEC 62443, IEC 81001-5-1, and other applicable product-security frameworks.

You will assess product architectures, technical documentation, security controls, and development practices; perform cybersecurity gap assessments, risk analysis, and threat modeling; identify vulnerabilities and compliance gaps; and translate regulatory requirements into practical recommendations and remediation activities. This is a highly customer-facing advisory position combining technical cybersecurity expertise, product-security knowledge, and regulatory consulting. 

Relevant Regulatory Frameworks and Standards

• Depending on the customer, product category, and target market, the Senior Cybersecurity Advisor may work with one or more of the following. Candidates are not expected to have experience with every item:
• EU Cyber Resilience Act (CRA), associated harmonized standards, and relevant ENISA guidance;
• EU Radio Equipment Directive (RED) Delegated Regulation and the EN 18031 series;
• ETSI EN 303 645, NISTIR 8425, and the UK Product Security and Telecommunications Infrastructure (PSTI) regime;
• ISA/IEC 62443 series for industrial automation and control systems;
• IEC 81001-5-1, U.S. FDA premarket and postmarket cybersecurity guidance, and EU MDR/IVDR for medical devices;
• ISO/SAE 21434 for automotive cybersecurity, where relevant;
• UL 2900 series, NIST Cybersecurity Framework, and NIST SP 800-53.

Core Qualifications

• Bachelor's degree in Cybersecurity, Computer Science, Computer Engineering, Electrical Engineering, or a related technical discipline.
• At least 3 years of relevant professional experience in product cybersecurity, cybersecurity consulting or advisory, security assessment, IoT or connected-device security, cybersecurity regulatory compliance, industrial/OT security, medical-device cybersecurity, or a closely related field.
• Hands-on experience analyzing technical information, identifying cybersecurity risks or compliance gaps, and developing clear findings and practical recommendations.
• Working knowledge of cybersecurity principles and practices relevant to connected products, IoT, industrial systems, medical devices, or other software-enabled products.
• Experience applying cybersecurity standards, regulations, technical requirements, risk frameworks, or assessment methodologies within customer, product, or project environments.
• Experience with risk analysis, threat modeling, vulnerability management, incident response, technical documentation, or architecture review.
• Strong written and verbal communication skills, including the ability to explain complex technical and regulatory concepts to customer stakeholders and prepare professional deliverables.
• Ability to work independently and collaboratively across multiple customer engagements, technical environments, and time zones.
• Professional fluency in English. Portuguese or Spanish proficiency is required according to the position location and customer needs.
• Ability and willingness to travel domestically and internationally approximately 10%, depending on customer engagement needs.
• Preferred Qualifications
• Master's degree in Cybersecurity, Computer Science, Engineering, or a related discipline.
• Professional certifications such as CISSP, CSSLP, GICSP, IEC 62443 Cybersecurity Expert/Specialist, ISO 27001, OSCP, or comparable credentials.
• Experience working in a cybersecurity, technology-risk, engineering, or regulatory consulting environment.
• Experience delivering technical training, workshops, or executive/customer presentations.
• Exposure to penetration testing, firmware analysis, secure software development, product-security testing, or embedded-system evaluation techniques.
• Experience in more than one regulated product domain, such as consumer IoT, industrial/OT, medical devices, or automotive products.
• Existing business/travel authorization that facilitates travel to the United States, where applicable.

What Success Looks Like

• Customers receive clear, actionable guidance that connects regulatory language to product-level cybersecurity decisions.
• Assessments and deliverables are technically sound, well documented, and completed within agreed scope and timelines.
• Cybersecurity risks, compliance gaps, and remediation options are communicated effectively to both technical teams and business stakeholders.
• The advisor builds trusted customer relationships and contributes to consistent, high-quality delivery across the global Professional Services team.

#LI-BD1

#LI-Hybrid

• Lead customer-facing cybersecurity advisory engagements for connected and software-enabled products, from initial requirements discovery through delivery of findings and recommendations.
• Conduct cybersecurity and regulatory-readiness assessments for connected products, including IoT, industrial, and medical technologies, evaluating product architecture, attack surface, technical documentation, security controls, and development practices.
• Support customers evaluating product applicability and readiness for the EU Cyber Resilience Act (CRA), including requirements mapping, gap analysis, cybersecurity risk assessment, technical documentation, and remediation planning.
• Perform gap assessments against applicable cybersecurity regulations, standards, certification requirements, and market-access expectations.
• Conduct or review cybersecurity risk analyses and threat models, identifying potential threats, vulnerabilities, misuse cases, security objectives, and appropriate mitigations.
• Review product specifications, system and software architectures, technical requirements, security documentation, and supporting evidence for completeness and alignment with applicable requirements.
• Advise customers on product vulnerability-management and incident-response practices, including vulnerability intake, prioritization, remediation planning, coordinated disclosure considerations, and post-market security activities where applicable.
• Develop clear, technically sound deliverables such as assessment reports, findings, requirements mappings, gap analyses, risk analyses, remediation recommendations, and executive or technical presentations.
• Support customers in developing or improving product-security procedures, secure-development practices, guidelines, and technical documentation.
• Develop and deliver cybersecurity training, workshops, and technical presentations for customer and internal stakeholders.
• Provide technical input for engagement scoping, project planning, and commercial discussions, including customer needs, advisory approach, assumptions, deliverables, and level of effort.
• Monitor relevant cybersecurity technologies, threats, regulations, standards, and guidance to maintain current subject-matter knowledge.
• Collaborate effectively with colleagues across regions and technical disciplines while managing multiple customer engagements and priorities.
• Represent UL Solutions professionally and communicate complex cybersecurity and regulatory concepts clearly to both technical and non-technical audiences.