Product Security Architect (All Genders)

Description

Based in Munich, this role sits in the engineering team for the ultrasound workspace product.

The work covers security across the whole lifecycle of medical software, from design through to post-market duties.

You will work with product, engineering, quality and security colleagues to manage risk, guide secure development and handle security issues while keeping audit-ready records.

Responsibilities

• Design and run product security reviews, covering threat modeling, architecture and risk, vulnerability assessments and security verification.
• Assess threats and weaknesses for their effect on the product, patient safety, privacy, operations and regulatory standing, and record each decision and mitigation so it can be traced.
• Track new threats, attack techniques, technologies, third-party components and security tools, and advise leadership with risk-based recommendations and priorities.
• Run security issues and incidents from intake through investigation, communication, fixes, updates and lessons learned, whether they come from inside or outside the company.
• Advise the engineering team on security topics, and help build security controls, fixes and tooling where needed.
• Lead lifecycle improvements through corrective and preventive actions, secure coding guidance, design and code reviews, training, tooling, quality gates and checks that fixes work.
• Maintain and refine security processes, procedures, templates, work instructions and audit-ready evidence within the quality management system, adopting current methods and tools.
• Keep your application security and medical device cybersecurity knowledge current.
• Success looks like product security built into the software lifecycle, risks handled openly and in proportion, and the organisation ready for audits, new threats and post-market duties.

Requirements

• Bachelor's or Master's degree in computer science, software engineering, cybersecurity, information security, electrical engineering or a comparable field.
• Hands-on software development and coding experience, so you can review code and discuss it with engineers.
• Experience with product or application security in regulated or safety-critical software, including secure architecture, risk and vulnerability management, testing, secure development practices and tooling, and giving engineers practical guidance.
• Experience working in a regulated environment.
• Experience writing and improving controlled quality management system processes, procedures and work instructions, and supporting internal and external audits or assessments by notified bodies, regulators, customers or certification bodies.
• Strong analytical and communication skills, able to support both technical and non-technical stakeholders.
• A structured, evidence-based and pragmatic approach, with a proactive attitude and the initiative to spot needs and push improvements forward.
• Advantage: relevant security certifications such as CISSP, CISM, CSSLP or comparable credentials.

Conditions

You bring strong technical skill and a proactive, structured approach. You can coordinate people across disciplines, make sound engineering decisions and drive change in a complex, quality-driven setting. You are motivated by building products that help clinicians give better care and improve patient outcomes worldwide.

Pay for this role falls between €81,216.25 and €108,288.31.

Pay within that range is set using objective factors: required skills, your relevant experience and responsibility in the role, plus internal equity and local market conditions.

This is an office-based role, with in-person work at least 3 days per week.

The team works in German and English. German is not required, but a willingness to learn it is appreciated.

Applicants who meet most but not all of the listed experience are encouraged to apply.