Software Engineer

ZEISS in India

ZEISS in India is headquartered in Bengaluru and present in the fields of Industrial Quality Solutions, Research Microscopy Solutions, Medical Technology, Vision Care and Sports & Cine Optics.

ZEISS India has 3 production facilities, R&D center, Global IT services and about 40 Sales & Service offices in almost all Tier I and Tier II cities in India. With 2200+ employees and continued investments over 25 years in India, ZEISS’ success story in India is continuing at a rapid pace.

Further information at ZEISS India .

Purpose of this position / Position summary

We are seeking a highly skilled and experienced Security Architect - Device & Medical Device Security to lead security architecture, design, and risk management activities for connected medical devices, diagnostic equipment, embedded platforms, and related product ecosystems within Vision Care Solutions.

The ideal candidate will possess deep expertise in device security, embedded systems security, medical device cybersecurity, secure hardware and firmware design, product security engineering, and cybersecurity risk management. The role focuses on ensuring that security is built into products from concept through decommissioning while meeting regulatory, safety, privacy, and business requirements.

The Security Architect will guide product teams in the definition of security requirements for devices, communication interfaces, cloud integrations, manufacturing and provisioning environments, and service ecosystems and serve as reviewer/expert subject manner for security risk assessments, threat modelling and overall security concepts. The role complements the existing software security architecture capability and therefore places primary emphasis on physical and connected devices, embedded platforms, firmware, medical device cybersecurity, and product lifecycle security.

Primary duties and responsibilities

Key Responsibilities

Medical Device Security Architecture:

Define and maintain security architecture principles, reference architectures, and design patterns for medical devices and connected product ecosystems.

Establish minimum security requirements across hardware, firmware, embedded software, connectivity, cloud integration, and service infrastructure.

Provide security guidance throughout the product lifecycle, from concept and design through production, post-market monitoring, servicing, and retirement.

Ensure security-by-design and privacy-by-design principles are embedded into product development processes.

Embedded & Device Security:

Design and review secure architectures for embedded Linux, RTOS-based, and other device platforms.

Define secure boot, secure storage, trusted execution, hardware root of trust, device hardening, and secure provisioning mechanisms.

Architect secure firmware update, patching, rollback protection, and recovery capabilities.

Ensure the establishment of device identity, authentication, authorization, certificate management, and cryptographic controls in close collaboration with the product teams.

Medical Device Cybersecurity & Regulatory Alignment:

Lead cybersecurity activities in alignment with applicable medical device regulations, standards, and guidance, including FDA cybersecurity guidance, IEC 81001-5-1, IEC 62304, ISO 14971, AAMI TIR57/TIR97, NIST guidance, and MDR/IVDR expectations.

Support cybersecurity documentation for technical files, regulatory submissions, audits, and product approvals.

Work with Quality and Regulatory Affairs to maintain objective evidence and traceability of cybersecurity requirements and controls.

Security Risk Management & Threat Modeling:

Guide and review the creation of threat modeling and attack-surface analysis for devices, interfaces, and product ecosystems.

Review cybersecurity risk assessments and security risk management documentation.

Collaborate with safety, quality, privacy, and engineering teams to evaluate security-related patient, user, business, and product risks.

Ensure identified risks are mitigated, accepted, documented, and traceable to security controls and verification evidence.

Vulnerability Management & Product Security:

Establish and govern product vulnerability management processes across pre-market and post-market phases.

Assess vulnerabilities in third-party components, operating systems, firmware, libraries, and open-source software.

Support Software Bill of Materials (SBOM) creation, maintenance, monitoring, and governance.

Coordinate vulnerability triage, remediation, security advisories, and responsible disclosure activities.

Connected Device & Ecosystem Security:

Design secure communication architectures for device-to-device, device-to-cloud, service, mobile, and clinical environment integrations.

Define security controls for DICOM, HL7/FHIR, APIs, remote service interfaces, and other applicable protocols.

Define network segmentation, Zero Trust, secure remote access, logging, and monitoring approaches for connected device environments.

Product Security Governance:

Define secure engineering requirements, security architecture review processes, and security design gates for device development teams.

Create and maintain product security standards, reusable patterns, checklists, and reference architectures.

Provide security sign-off or documented risk-based recommendations at relevant product development milestones.

Supplier & Supply Chain Security:

Assess cybersecurity risks associated with suppliers, third-party components, contract manufacturers, and external development partners.

Define security requirements for externally sourced hardware, firmware, software, and services.

Support secure manufacturing, provisioning, distribution, maintenance, and end-of-life processes.

Incident Response & Post-Market Security:

Support investigation and management of cybersecurity incidents and vulnerabilities affecting products.

Contribute to product security incident response, coordinated vulnerability disclosure, and customer communication processes.

Support post-market cybersecurity monitoring, trend analysis, and continuous improvement activities.

Leadership & Collaboration:

Serve as the subject-matter expert for device and medical device security.

• •Align with Senior manager for Cybersecurity and Data protection on security roadmap for devices
• •Partner with R&D, Quality, Regulatory Affairs, Product Management, Software and Cloud Architecture, Manufacturing, Service, and Privacy teams.

Mentor architects, engineers, and technical leads on device security and medical device cybersecurity practices.

Communicate complex security risks, design decisions, and remediation options clearly to technical and non-technical stakeholders.

Put a one-sentence mission at the top

The current summary runs to three paragraphs, and the key point comes last. Something like:

"Own security architecture for VCS connected medical devices, from secure boot to post-market, so our products are secure by design and ready for regulators, working alongside the existing software security architecture capability."

Make success expectations explicit. Either add a short, high-level "What success looks like" section to the JD, or keep it out and capture measurable first-year goals in a separate internal hiring scorecard. That scorecard would guide interviews and later become the new hire's first goals.

Can Consider to Cut the responsibilities to about 8 to 10 core bullets

Most of the current detail can move into the outcomes or competencies. Keep the core work up front (architecture, threat modelling and risk, vulnerability management) and treat incident communication and trend analysis as supporting work.

he bullets in the Leadership & Collaboration section are uneven: there's a stray character and a mix of bullet styles.

Qualifications

Education: Bachelor's