Senior Product Security Consultant- Advisory

The role

You will lead advisory engagements from scoping to final deliverables and advise client security and engineering leaders. You will frame regulatory programs, deliver compliance assessments, and design secure development lifecycle programs.

What you will do

• Lead advisory engagements end to end.
• Frame regulatory programs for clients facing EU CRA, CE RED, FDA 524B, and FCC Cyber Trust Mark.
• Deliver security and regulatory compliance assessments.
• Serve as the named vCPSO on client accounts.
• Design secure development lifecycle programs.
• Write assessments, roadmaps, policies, briefings, and evidence packages.
• Work with engineering and offensive security teams to translate technical findings into regulatory and business terms.
• Scope bootcamps and provide advisory support to sellers.
• Build practice templates, playbooks, and reusable assets.
• Add to public voice through writing and speaking.

Required qualifications

• 8+ years of professional experience.
• At least 5 years in consulting or advisory work at a professional services firm.
• Record of leading client engagements.
• Cybersecurity program experience with grasp of binary analysis, SBOMs, vulnerability management, and reachability.
• Working depth in at least one core area: automotive, IoT, industrial, or healthcare.
• Ability to read a regulation or standard and turn it into requirements and product implications.
• Discipline in running engagements including work breakdown structures, milestone schedules, status reporting, and risk tracking.
• Writing and presence fit for executives.
• An AI-native way of working using LLMs and agentic tools.

Nice to have

• A notified body, conformity assessment, or audit background.
• Experience with regulatory frameworks and standards such as the EU CRA, FDA 524B, IEC 62443, or ISO/SAE 21434.
• FDA premarket submission experience at a manufacturer or consultancy.
• Experience designing and facilitating tabletop exercises.
• CISSP, CSSLP, CISA, or ISO 27001 Lead Auditor.

About the company

Finite State is a fast-growing series C company with a fully distributed workforce. The company partners with product security teams to create transparency for connected devices and supply chains.