[Remote] Senior Security Product Consultant- Advisory

Note: The job is a remote job and is open to candidates in USA. Finite State provides product security visibility and risk management for connected devices and software supply chains. The Senior Product Security Consultant leads advisory engagements, helping manufacturers interpret regulatory requirements, assess product security programs, prioritize remediation, and deliver ongoing strategic guidance to client leaders.

Responsibilities

• Lead advisory engagements end to end. Scope the work, set the work breakdown and milestone schedule at the start, run client meetings, track risks and actions, and deliver on time
• Frame regulatory programs for clients facing the EU CRA, CE RED (EN 18031), FDA 524B, and FCC Cyber Trust Mark. That covers product classification, the requirements that apply, gap assessment, what the evidence needs to show, the conformity path, and the roadmap
• Deliver security and regulatory compliance assessments, and turn the findings into prioritized recommendations you can defend
• Serve as the named vCPSO on client accounts. You'll run the client's product security program cadence, represent product security to their executives, and direct the work that our engineering team and the client's engineers carry out
• Design secure development lifecycle programs, with the policy, governance, and training that go with them
• Write deliverables executives can act on and engineers can defend: assessments, roadmaps, policies, briefings, and evidence packages. Every one answers what it is, why now, and what the client should do next
• Work with our engineering and offensive security teams to turn technical findings (SBOM, vulnerability, reachability, and penetration test results) into regulatory and business terms
• Scope bootcamps and give sellers advisory support through our services request process
• Build the practice: templates, playbooks, and reusable assets that make each engagement faster than the last. Over time, add to Finite State's public voice through writing and speaking

Skills

• Must be authorized to work in the U.S. without sponsorship
• 8+ years of professional experience, including at least 5 in consulting or advisory work at a professional services firm (Big Four, federal consulting, or a cybersecurity or regulatory consultancy), with a record of leading client engagements
• Cybersecurity program experience, with enough grasp of binary analysis, SBOMs, vulnerability management, and reachability to hold your own with engineers
• Working depth in at least one of our core areas: automotive, IoT, industrial, or healthcare, including the regulations and standards that govern it
• You can read a regulation or standard and turn it into requirements and product implications
• Discipline in running engagements: work breakdown structures, milestone schedules, status reporting, risk and action tracking, and raising problems early
• Writing and presence fit for executives. You can brief a VP of Engineering, a General Counsel, and a board in the same week, in writing and in the room
• An AI-native way of working: LLMs and agentic tools as force multipliers, with clear judgment about what a person must verify
• Washington, DC area a plus
• A notified body, conformity assessment, or audit background
• Experience with regulatory frameworks and standards such as the EU CRA, FDA 524B, IEC 62443, or ISO/SAE 21434
• FDA premarket submission experience at a manufacturer or consultancy
• Experience designing and facilitating tabletop exercises
• CISSP, CSSLP, CISA, or ISO 27001 Lead Auditor
• Government or public policy experience in cybersecurity

Company Overview