Sr. Engineer, Product Cyber Security

As a result of the combination of the BD Biosciences and Diagnostic Solutions business with Waters Corporation (NYSE: WAT), by applying to this role, you will be applying for a position with Waters. Waters is a global leader in life sciences, dedicated to accelerating the benefits of pioneering science through analytical technologies, informatics, and service. With a focus on regulated, high-volume testing environments, Waters’ innovative portfolio harnesses deep scientific expertise across biology, chemistry, and physics. Waters collaborates with analytical laboratories around the world to advance the release of effective, high-quality medicines, assure the safety of food and water, and drive better patient outcomes by detecting diseases earlier, managing routine infections, and combatting growing antibiotic resistance. Through a shared culture of relentless innovation, Waters’ passionate team of approximately 16,000 colleagues partner with customers to turn scientific challenges into breakthroughs that improve lives worldwide.



We are the people who give possibilities purpose

BD is one of the largest global medical technology companies in the world. Advancing the world of health™ is our Purpose, and it’s no small feat. It takes the imagination and passion of all of us—from design and engineering to the manufacturing and marketing of our billions of MedTech products per year—to look at the impossible and find transformative solutions that turn dreams into possibilities.





Job Description

Summary

We are seeking a Senior Product Cyber Security Engineer to own the cybersecurity deliverables for assigned products end to end and to build the automation that lets a small team cover a large portfolio. You will plan the security activities for each release, lead threat modeling, run composition and static analysis, produce and monitor Software Bills of Materials (SBOMs), coordinate penetration tests, and write the documentation that goes into our design history files, regulatory submissions and customer assurance packages.

This is a product security engineering role, not an IT security, SOC or penetration testing role. You will read code, work in build pipelines, and defend your risk assessments in front of auditors, regulators and customers. You will work daily with R&D, Software Engineering, DevOps, Systems Engineering, Quality and Regulatory Affairs, and with our corporate product security and cyber risk teams.

This position is remote within the United States, with regular overlap with Pacific time working hours.

Key Responsibilities

Product Cybersecurity Planning and Deliverables

• •Own the cybersecurity plan and the Product Security Management Plan for assigned products, covering new development, major releases and sustaining changes, in line with our product cybersecurity procedures.
• •Produce the required deliverable set for each product: product security requirements gap analysis, threat model and data flow map, Product Security White Paper, Incident and Vulnerability Management Plan, Patch Management Plan, Cybersecurity Risk Summary Report, and third-party vendor assessments.
• •Decide with the team which deliverables apply to each product, scale them to the product's risk and regulatory status (research-use-only versus IVD), and document every exemption with its justification.
• •Keep the Product Security Management File complete, traceable and ready for FDA inspections and notified-body audits.

Threat Modeling and Risk Assessment

• •Lead STRIDE-based threat modeling sessions with product teams: assets, data flows, trust boundaries, threats, controls, and the risk register entries that result.
• •Assess products against our product security requirements, score findings with CVSS, and work with R&D on remediation or documented risk acceptance.
• •Document unresolved and accepted risks in the Cybersecurity Risk Summary Report that supports release decisions, and feed cybersecurity hazards into the product risk management file where patient safety is affected.

Security Testing, SBOM and Vulnerability Management

• •Run static code analysis and software composition analysis (e.g., Snyk) on product releases, triage findings with engineering, and archive the reports.
• •Generate and validate CycloneDX SBOMs from the actual release artifacts of every software-enabled product, integrate SBOM generation into build and release pipelines, and load SBOMs into our post-market vulnerability monitoring tool (e.g., CyBeats).
• •Monitor post-market vulnerability reports against product SBOMs, assess impact with R&D, and drive remediation within the timelines our procedures set.
• •Coordinate penetration tests with our corporate product security engineering team: define scope from the roadmap, schedule tests early in development and before submissions, evaluate results and assess mitigations.
• •Support investigation of externally reported vulnerabilities and potential cybersecurity complaints together with our corporate cyber risk team.

Patch Management and Secure Baselines

• •Maintain product Patch Management Plans and author or review Security Patch Verification Protocols and Reports.
• •Deliver the annual operating system patch verification bulletins for IVD products in the patch verification program.
• •Contribute to hardened Windows 11 baseline images for instrument workstations and to the process for managing product-level exceptions.

Customer and Regulatory Assurance

• •Assemble cyber assurance packages for key customers (SBOMs, Product Security White Papers, penetration test attestations, SOC 2 summaries) and answer customer security questionnaires.
• •Prepare the cybersecurity content of regulatory submissions (FDA premarket cybersecurity requirements, EU IVDR) and support internal reviews, audits and regulator interactions.
• •Review third-party security checklists and SOC 2 reports for third-party software and services used in or with our products.

Automation, Metrics and Scaling

• •Build and maintain scripts and pipeline steps that generate SBOMs, scan results and audit evidence automatically, so deliverables stay current with every release instead of being rebuilt by hand.
• •Produce cross-portfolio security risk reporting and in-market risk metrics for leadership, and keep work-item tracking for security activities current.
• •Help evaluate and adopt AI-assisted tooling for drafting and checking security documentation.
• •Contribute to updates of our product security procedures and security requirements as corporate policy, FDA expectations and submission feedback evolve.

Cross-Functional Guidance

• •Act as the product security subject matter expert for R&D, DevOps, Quality, Regulatory and partner teams.
• •Provide practical guidance on secure design, secure update and installation mechanisms, vulnerability remediation and compliance expectations.
• •What Success Looks Like in the First Year
• •Within 90 days: you own the cybersecurity deliverables for one product release end to end, from the cybersecurity plan to the Cybersecurity Risk Summary Report.
• •Within six months: SBOM generation and composition analysis run automatically in the build for the products you support, with results loaded into post-market monitoring.
• •Within twelve months: you cover two to three products in parallel, penetration tests and patch verification bulletins for your products are delivered on schedule, and leadership receives regular in-market risk metrics for them.

Required Qualifications

• •Bachelor's degree in Computer Science, Software Engineering, Cybersecurity or a related technical field, or equivalent practical experience.
• •10+ years of experience in software engineering, product or application security, or cybersecurity engineering, including hands-on security work on software products that shipped to customers.
• •Basic software engineering fluency: you read and write code in some language, you are comfortable with commandline, you are aw