Product Security Quality Assurance Engineer (w/m/d)
B. Braun Group2 months ago
Tuttlingen, GermanySenior
Responsibilities
- Plan and conduct security verification and validation for active medical devices.
- Verify security requirements and threat-mitigation measures and assess their effectiveness.
- Perform code reviews, document reviews, exploratory security testing, and support penetration testing.
- Develop security-test strategies, specifications, methods, test plans, and technical reports.
- Develop the DevSecOps platform and maintain the security toolchain and its reliable operation.
- Integrate and enhance vulnerability-management, Polarion, IriusRisk, SBOM, vulnerability-monitoring, and CI/CD security-gate solutions.
- Analyze, prioritize, and track vulnerabilities through remediation and verification.
- Support incident handling, patch deployment, end-of-life and end-of-service security measures, threat modeling, and residual-risk assessments.
- Advise product teams on security testing, vulnerability processes, secure development infrastructure, and product-security procedures.
Requirements
- Completed degree in computer science, technical computer science, electrical engineering, or a comparable field at bachelor, diploma, or equivalent level, or several years of relevant professional experience.
- More than five years of experience in security testing, software quality, vulnerability management, or DevSecOps, preferably with regulated medical devices.
- Experience with Git, Linux-based systems, bare-metal systems, C/C++, and Python.
- Practical experience with penetration testing, SAST, DAST, SCA, and the assessment and prioritization of findings.
- Knowledge of security requirements management, security risk management, and threat-mitigation assessment.
- Knowledge of the full software lifecycle and software development, verification, and validation requirements under IEC 62304 and IEC 81001-5-1; knowledge of the CRA is advantageous.
- Experience with vulnerability management, incident handling, patch deployment, continuous vulnerability monitoring, and ideally supplier vulnerability reports.
- Experience with DevSecOps processes and security toolchains, especially vulnerability management, Polarion, IriusRisk, SBOM tools, vulnerability monitoring, and CI/CD security gates or comparable solutions.
- Ideally, experience validating development and security tools and producing test plans, test reports, and technical documentation.
- Fluent written and spoken German and English; analytical, structured, independent, reliable, solution-oriented, hands-on, and collaborative working style.
Benefits
- Attractive and fair compensation based on the ERA collective agreement for the Baden-Württemberg metal and electrical industry.
- Occupational pension scheme.
- Company restaurant with varied and balanced meals.
- Company health insurance fund with a broad range of services.
- Job sharing is generally possible.
- The employer encourages applications from people of all identities, lifestyles, and backgrounds.