Staff Product Security Engineer

Location: IND19-01-Bengaluru-EPIP 122 (Phase II)

Job Description Summary

As a Staff Product Security Engineer, you will be part of the AIS Digital team with the vision of building and sustaining product competencies and customer orientation to provide timely patient care. We are looking for a person with strong technical acumen in Cyber security in the cloud and preferably a person who has knowledge / expertise in device security and traditional hospital on-premises architectures. He/she will provide Leadership on Cyber security by working both with the product teams and the Global teams and helps to draw out the strategy for AIS Digital products.

GE Healthcare is a leading global medical technology and digital solutions innovator. Our mission is to improve lives in the moments that matter. Unlock your ambition, turn ideas into world-changing realities, and join an organization where every voice makes a difference, and every difference builds a healthier world.

Key Responsibilities

• Assess the security for software/Product architecture – guide the product architects to ensure security is built into at the design level itself.
• Own development of cyber security artifacts including threat model and lead discussion on identifying mitigations.
• Assist the Engineering teams in triaging and identification of fix for detected product vulnerabilities.
• Interact with internal / external team to co-ordinate security and privacy assessments which includes VAPT to determine compliance and security posture.
• Assist business units in the development and implementation of product security and Privacy practices including policies, standards, guidelines, and procedures.
• Verify that security and privacy requirements defined in the security plans, policies, and procedures are followed and protection measures are functioning as intended.
• Guide the business unit in their management of the resolution of security audit or review findings.
• Provide security risk management and security advice as well as advice on strategic direction relating to product and information security.
• Assist with security incidents and review risk and impact of breaches to protected systems.
• Review proposed services, engineering changes, and feature requests for security implications and needed security controls.

Qualifications/Requirements

• Bachelor’s degree in engineering
• Should have 10+ years of development and security experience which includes application security, device security, network security, OS security and Cloud Security.
• Experience in Rest Api, Kubernetes and container security assessments.
• Product/Information security experience in all phases of service/product development and deployment including architecture, design, development, testing and deployment.
• Good understanding of AWS services, specifically related to security.
• Experience in designing security solutions.
• Hands-on experience in execution and review of Static & Dynamic Code Analysis reports and ability to discuss with development teams for true positives.
• Experience and knowledge of penetration testing methodologies and tools.
• Conducting information security analyses, audits, and reviews
• Willingness to learn new technologies and work on security for varied products.
• Strong interpersonal skills with the ability to facilitate diverse groups, help negotiate priorities, and resolve conflicts among project stakeholders
• Sound security engineering knowledge (technical) so as to work collaboratively with the Tech Leads and software/products architects to ensure secure products.
• Knowledge of information system architecture and security controls (e.g., firewall, specialized appliances)
• Sound understanding of Cryptography, various Encryption Algorithms, Public key Infrastructure (PKI) and Certificate Authority (CA), OAUTH authentication, 2FA