[Hiring] Senior Security Product Consultant @Finite State

Role Description

Connected products run the world: vehicles, medical devices, industrial systems, critical infrastructure. The companies that build them face a wave of regulation, from the EU Cyber Resilience Act and Radio Equipment Directive to FDA premarket cybersecurity requirements and new U.S. supply chain rules. Few of them have a product security program built for it.

Finite State's Strategic Advisory practice helps them close that gap. We tell manufacturers what a regulation requires of their products, where they stand, what evidence they need, and the order of work to get there. Then we stay to help them run the program. As a Senior Product Security Consultant, you will lead those engagements from scoping to final deliverable and advise client security and engineering leaders. On some accounts you will act as the client's virtual Chief Product Security Officer.

You won't be starting from a blank page. You'll have Finite State's binary analysis platform, a dedicated engineering and offensive security team that tests the products you advise on, and AI tooling that speeds up research and drafting. Your job is the judgment, the structure, and the client relationship.

What you'll do

• Lead advisory engagements end to end. Scope the work, set the work breakdown and milestone schedule at the start, run client meetings, track risks and actions, and deliver on time.
• Frame regulatory programs for clients facing the EU CRA, CE RED (EN 18031), FDA 524B, and FCC Cyber Trust Mark.
• Deliver security and regulatory compliance assessments, and turn the findings into prioritized recommendations you can defend.
• Serve as the named vCPSO on client accounts, running the client's product security program cadence and representing product security to their executives.
• Design secure development lifecycle programs, with the policy, governance, and training that go with them.
• Write deliverables executives can act on and engineers can defend: assessments, roadmaps, policies, briefings, and evidence packages.
• Work with our engineering and offensive security teams to turn technical findings into regulatory and business terms.
• Scope bootcamps and give sellers advisory support through our services request process.
• Build the practice: templates, playbooks, and reusable assets that make each engagement faster than the last.

Qualifications

• 8+ years of professional experience, including at least 5 in consulting or advisory work at a professional services firm.
• Cybersecurity program experience, with enough grasp of binary analysis, SBOMs, vulnerability management, and reachability.
• Working depth in at least one of our core areas: automotive, IoT, industrial, or healthcare.
• Discipline in running engagements: work breakdown structures, milestone schedules, status reporting, risk and action tracking.
• Writing and presence fit for executives.
• An AI-native way of working: LLMs and agentic tools as force multipliers.

Requirements

• A notified body, conformity assessment, or audit background (nice to have).
• Experience with regulatory frameworks and standards such as the EU CRA, FDA 524B, IEC 62443, or ISO/SAE 21434 (nice to have).
• FDA premarket submission experience at a manufacturer or consultancy (nice to have).
• Experience designing and facilitating tabletop exercises (nice to have).
• CISSP, CSSLP, CISA, or ISO 27001 Lead Auditor (nice to have).
• Government or public policy experience in cybersecurity (nice to have).

Benefits

• Fully remote work culture.
• Opportunity to work with a dedicated engineering and offensive security team.
• Access to AI tooling that speeds up research and drafting.
• Engagement in a mission-driven team passionate about product security.

Company Description

At Finite State, we're on a mission to secure the connected world. Our platform empowers product security teams to detect vulnerabilities, manage software supply chain risks, and ensure compliance across complex device ecosystems.

• We provide unparalleled visibility into firmware and software components.
• We help organizations protect their products and customers.
• We are committed to transparency, urgency, and customer-first values.