[Hiring] Head of PSC Engineering @Finite State

Role Description

Connected products run the world: vehicles, medical devices, industrial systems, critical infrastructure — and securing them is one of the hardest engineering problems there is. At Finite State, PSC Engineers are the technical owners of that problem for our customers: engineers who win trust by building and shipping, from the field.

The Head of PSC Engineering leads that team. You hire, develop, and run the engineers who each own the technical relationship with a portfolio of customer accounts and deliver our services, from penetration tests and firmware analysis to PSIRT-as-a-Service (PSIRTaaS) and Standards and Regulations Compliance-as-a-Service, on our Product Security OS platform.

This is a manager-first role. About ~20 to 25 percent of your time is hands-on technical work: contested findings, high-stakes deep technical engagements, and final review of deliverables before they reach a customer. The rest is leadership: people, capacity, quality, and the operating model that lets a small team, working with AI agents, deliver what used to take an entire consulting firm. You report to the Chief Security Officer, are part of the PSC leadership team, and own the team's work plan, priorities, capacity plan, and utilization.

What You'll Do

• Lead the people, the delivery, and the operating model of PSC Engineering.
• Hire, onboard, coach, and develop PSC Engineers.
• Set objectives, run 1:1s and review cycles, give direct feedback early, and grow engineers into named technical owners of accounts and, where they are ready, into leaders.
• Own execution of every engagement, from technical scoping and staffing to deliverable review and debrief, including Level 2 support.
• Set the playbooks, peer-review gates, and quality criteria, and report the KPIs that show whether delivery is healthy: utilization, time-to-deliverable, escape rate, and customer satisfaction.
• Plan the team's work against the demand pipeline, balance billable work with managed-service shifts and capability development, and manage utilization to target.
• Stand up and scale PSIRTaaS and Standards and Regulations Compliance-as-a-Service: runbooks, staffing model, SLAs, and, with Product, the platform capabilities each service depends on.
• Collaborate with our Chief Product Security Engineer to make sure field-built tooling is logged and paved into the product.
• Serve as one of our trusted senior delivery contacts for strategic accounts, lead service reviews and escalations, and partner with Sales on technical scoping and expansion.

Qualifications

• 3+ years of direct people management.
• A record of mentoring, coaching, and teaching.
• Prior exposure to formal management or leadership training.
• 8+ years in product security, embedded and connected device security, application security, or offensive security.
• Bachelor's degree in Computer Science, Electrical or Computer Engineering, Mathematics, Physical Sciences, or a related field, or equivalent hands-on experience.
• Hands-on depth in two or more of: firmware and binary analysis; penetration testing of embedded or IoT systems; threat modeling and threat analysis and risk assessment (TARA); SBOM and software composition analysis; vulnerability disclosure and CVE/CNA workflows; PSIRT operations.
• Demonstrated ability to run a technical delivery function to SLAs, SLOs, and quality standards.
• Working knowledge of the EU Cyber Resilience Act and at least one of IEC 62443, RED EN 18031, FDA premarket cybersecurity requirements, ETSI EN 303 645, or NIST SSDF.

Requirements

• Deep, hands-on product security expertise across embedded software and hardware, firmware analysis, penetration testing, and risk assessment.
• Nothing you cannot defend reaches a customer; peer review is how your team works.
• Repeatable work becomes playbooks, runbooks, and tooling.
• Clear in writing and speech with engineers, executives, regulators, and partners.
• Use LLMs and agentic tooling as force multipliers in technical and management work.

Nice to Have

• You have built a service line before.
• You carry credentials such as CISSP, CSSLP, GIAC, or OSCP.
• You secure complex systems with sector depth in aerospace, medical, automotive, energy, or industrial cyber-physical systems.
• You know federal cyber policy including JSIG, ICD 503, NIST SP 800-160.

Benefits

• Compensation: 250-300k, bonus, equity, and full benefits.
• Remote work culture.
• Occasional travel for customer executive reviews, on-site engagements, conferences, and team gatherings.