SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Finite State is a Series B, mission-driven company that partners with product security teams to create transparency for connected devices and supply chains across enterprises, healthcare, utilities, connected vehicles, manufacturing, critical infrastructure, and government. The company operates a fully distributed, remote-first workforce.
As a Senior Product Security Consultant in the Strategic Advisory practice, you will lead end-to-end advisory engagements helping manufacturers navigate an increasingly complex regulatory landscape—including the EU Cyber Resilience Act, Radio Equipment Directive, FDA premarket cybersecurity requirements, and U.S. supply chain rules. You will serve as the strategic advisor and sometimes virtual Chief Product Security Officer for client accounts, translating regulatory requirements into actionable product security programs.
Key responsibilities include:
- Leading advisory engagements from scoping through final delivery, managing work breakdown structures, milestone schedules, and client relationships
- Framing regulatory compliance programs for clients facing EU CRA, CE RED (EN 18031), FDA 524B, and FCC Cyber Trust Mark requirements
- Delivering security and regulatory compliance assessments with prioritized, defensible recommendations
- Serving as named virtual CPSO on client accounts, running product security program cadence and directing work across client and Finite State engineering teams
- Designing secure development lifecycle programs with associated policy, governance, and training
- Writing executive-ready deliverables (assessments, roadmaps, policies, briefings, evidence packages) that translate technical findings into regulatory and business terms
- Collaborating with Finite State's engineering and offensive security teams to contextualize technical findings (SBOM, vulnerability, reachability, penetration test results)
- Supporting sales through advisory bootcamp scoping and services request process guidance
- Building the advisory practice through templates, playbooks, and reusable assets; contributing to Finite State's public voice through writing and speaking
You will have access to Finite State's binary analysis platform, dedicated engineering and offensive security teams, and AI tooling to support research and drafting. Your role centers on judgment, structural thinking, and client relationship management. Periodic travel is expected for client workshops, executive meetings, and industry events.
REQUIREMENTS:
- 8+ years of professional experience, including at least 5 years in consulting or advisory work at a professional services firm (Big Four, federal consulting, cybersecurity or regulatory consultancy), with a demonstrated record of leading client engagements
- Cybersecurity program experience with working knowledge of binary analysis, SBOMs, vulnerability management, and reachability analysis sufficient to engage credibly with engineers (hands-on testing not required)
- Working depth in at least one core domain: automotive, IoT, industrial, or healthcare, including the regulations and standards governing that domain; ability to read regulations and standards and translate them into product requirements and implications
- Demonstrated discipline in engagement management: work breakdown structures, milestone schedules, status reporting, risk and action tracking, and early problem escalation
- Executive-level writing and presence; ability to brief VPs of Engineering, General Counsel, and boards in both written and verbal formats
- AI-native working approach: leveraging LLMs and agentic tools as force multipliers with clear judgment about what requires human verification
- Must be authorized to work in the U.S. without sponsorship
NICE TO HAVE:
- Notified body, conformity assessment, or audit background
- Experience with regulatory frameworks and standards such as EU CRA, FDA 524B, IEC 62443, or ISO/SAE 21434
- FDA premarket submission experience at a manufacturer or consultancy
- Experience designing and facilitating tabletop exercises
- CISSP, CSSLP, CISA, or ISO 27001 Lead Auditor certification
- Government or public policy experience in cybersecurity
