Sr. Engineer, Product Cyber Security

As a result of the combination of the BD Biosciences and Diagnostic Solutions business with Waters Corporation (NYSE: WAT), by applying to this role, you will be applying for a position with Waters. Waters is a global leader in life sciences, dedicated to accelerating the benefits of pioneering science through analytical technologies, informatics, and service. With a focus on regulated, high-volume testing environments, Waters’ innovative portfolio harnesses deep scientific expertise across biology, chemistry, and physics. Waters collaborates with analytical laboratories around the world to advance the release of effective, high-quality medicines, assure the safety of food and water, and drive better patient outcomes by detecting diseases earlier, managing routine infections, and combatting growing antibiotic resistance. Through a shared culture of relentless innovation, Waters’ passionate team of approximately 16,000 colleagues partner with customers to turn scientific challenges into breakthroughs that improve lives worldwide.



We are the people who give possibilities purpose

BD is one of the largest global medical technology companies in the world. Advancing the world of health™ is our Purpose, and it’s no small feat. It takes the imagination and passion of all of us—from design and engineering to the manufacturing and marketing of our billions of MedTech products per year—to look at the impossible and find transformative solutions that turn dreams into possibilities.





Job Description

Summary

We are seeking a Senior Product Cyber Security Engineer to own the cybersecurity deliverables for assigned products end to end and to build the automation that lets a small team cover a large portfolio. You will plan the security activities for each release, lead threat modeling, run composition and static analysis, produce and monitor Software Bills of Materials (SBOMs), coordinate penetration tests, and write the documentation that goes into our design history files, regulatory submissions and customer assurance packages.

This is a product security engineering role, not an IT security, SOC or penetration testing role. You will read code, work in build pipelines, and defend your risk assessments in front of auditors, regulators and customers. You will work daily with R&D, Software Engineering, DevOps, Systems Engineering, Quality and Regulatory Affairs, and with our corporate product security and cyber risk teams.

This position is remote within the United States, with regular overlap with Pacific time working hours.

Key Responsibilities

Product Cybersecurity Planning and Deliverables

• Own the cybersecurity plan and the Product Security Management Plan for assigned products, covering new development, major releases and sustaining changes, in line with our product cybersecurity procedures.
• Produce the required deliverable set for each product: product security requirements gap analysis, threat model and data flow map, Product Security White Paper, Incident and Vulnerability Management Plan, Patch Management Plan, Cybersecurity Risk Summary Report, and third-party vendor assessments.
• Decide with the team which deliverables apply to each product, scale them to the product's risk and regulatory status (research-use-only versus IVD), and document every exemption with its justification.
• Keep the Product Security Management File complete, traceable and ready for FDA inspections and notified-body audits.

Threat Modeling and Risk Assessment

• Lead STRIDE-based threat modeling sessions with product teams: assets, data flows, trust boundaries, threats, controls, and the risk register entries that result.
• Assess products against our product security requirements, score findings with CVSS, and work with R&D on remediation or documented risk acceptance.
• Document unresolved and accepted risks in the Cybersecurity Risk Summary Report that supports release decisions, and feed cybersecurity hazards into the product risk management file where patient safety is affected.

Security Testing, SBOM and Vulnerability Management

• Run static code analysis and software composition analysis (e.g., Snyk) on product releases, triage findings with engineering, and archive the reports.
• Generate and validate CycloneDX SBOMs from the actual release artifacts of every software-enabled product, integrate SBOM generation into build and release pipelines, and load SBOMs into our post-market vulnerability monitoring tool (e.g., CyBeats).
• Monitor post-market vulnerability reports against product SBOMs, assess impact with R&D, and drive remediation within the timelines our procedures set.
• Coordinate penetration tests with our corporate product security engineering team: define scope from the roadmap, schedule tests early in development and before submissions, evaluate results and assess mitigations.
• Support investigation of externally reported vulnerabilities and potential cybersecurity complaints together with our corporate cyber risk team.

…