Software Engineer
ZEISS Group2 days ago
Bengaluru, IndiaStaff+
Responsibilities
- Define and maintain security architectures, reference architectures, design patterns, and security requirements for connected medical devices and product ecosystems.
- Design and review secure architectures for embedded Linux, RTOS-based platforms, firmware, hardware roots of trust, secure boot, trusted execution, secure storage, device identity, and secure provisioning.
- Architect secure firmware update, patching, rollback protection, recovery, decommissioning, and device-hardening capabilities.
- Lead threat modeling, attack-surface analysis, cybersecurity risk assessments, security requirements engineering, and traceability to controls and verification evidence.
- Guide product vulnerability management, vulnerability triage, remediation, security advisories, responsible disclosure, penetration-test oversight, and SBOM governance.
- Define security controls for device-to-device, device-to-cloud, mobile, clinical, API, DICOM, HL7/FHIR, remote-service, and other connected-device integrations.
- Support regulatory submissions, technical files, audits, product approvals, and objective evidence in collaboration with Quality and Regulatory Affairs.
- Define security governance, architecture review processes, design gates, reusable standards, checklists, and risk-based security sign-off practices.
- Assess supplier, third-party component, contract-manufacturer, and external-development-partner security risks across the product supply chain.
- Support product security incident response, post-market monitoring, coordinated vulnerability disclosure, customer communications, and continuous improvement.
- Mentor architects, engineers, and technical leads and communicate security risks and design decisions to technical and non-technical stakeholders.
Requirements
- Bachelor’s or Master’s degree in Computer Science, Electronics Engineering, Medical Engineering, Cybersecurity, Embedded Systems Engineering, or a related field.
- 12–15 years of experience in cybersecurity, product security, embedded systems security, security architecture, or related engineering disciplines.
- At least 5 years of relevant experience in device security, embedded security, operational technology security, or medical device cybersecurity.
- Experience working in regulated environments such as medical devices, diagnostics, healthcare, life sciences, industrial systems, or similarly safety-critical products.
- Strong expertise in medical-device cybersecurity architecture, secure product lifecycle management, threat modeling, attack-surface analysis, cybersecurity risk management, and security requirements engineering.
- Hands-on knowledge of embedded Linux and RTOS security, firmware security, secure boot, code signing, secure storage, protected updates, TPM, hardware root of trust, trusted execution, device identity, and secure provisioning.
- Knowledge of applied cryptography, PKI, certificates, key management, HSM technologies, TLS, hashing, encryption, identity and access management, Zero Trust, network segmentation, and secure remote access.
- Experience with product vulnerability management, penetration-test oversight, SBOM governance, software supply-chain security, and connected-device security.
- Strong understanding of medical-device cybersecurity regulations and standards including FDA cybersecurity guidance, IEC 81001-5-1, IEC 62304, ISO 14971, AAMI TIR57/TIR97, MDR/IVDR, and relevant NIST publications.
- Ability to translate regulatory and standards requirements into implementable architecture controls and verifiable engineering requirements.
- Strong analytical, systems-thinking, documentation, communication, stakeholder-management, and design-articulation skills, with the ability to lead through influence and mentor technical teams.
- Experience across multiple device or product development programs is preferred.
- Knowledge of DICOM and exposure to HL7/FHIR are preferred.
- Understanding of Azure security services and cloud-connected device architectures is preferred.
- Certifications such as CISSP, CSSLP, ISA/IEC 62443, IEC 81001-5-1, Azure Security Engineer, or comparable product-security credentials are desirable.
About ZEISS Group
ZEISS Group develops and sells optics and optoelectronics for semiconductor makers, manufacturers, clinicians, researchers, and consumers, spanning lithography systems, industrial metrology, medical devices, microscopes, and eyeglass and camera lenses. Founded in 1846 and headquartered in Oberkochen, Germany, the company is wholly owned by the Carl Zeiss Foundation. It operates globally and generates around €12 billion in annual revenue across segments including Semiconductor Manufacturing Technology, Industrial Quality & Research, Medical Technology, and Consumer Markets.