Sr. Engineer, Product Cyber Security

As a result of the combination of the BD Biosciences and Diagnostic Solutions business with Waters Corporation (NYSE: WAT), by applying to this role, you will be applying for a position with Waters. Waters is a global leader in life sciences, dedicated to accelerating the benefits of pioneering science through analytical technologies, informatics, and service. With a focus on regulated, high-volume testing environments, Waters’ innovative portfolio harnesses deep scientific expertise across biology, chemistry, and physics. Waters collaborates with analytical laboratories around the world to advance the release of effective, high-quality medicines, assure the safety of food and water, and drive better patient outcomes by detecting diseases earlier, managing routine infections, and combatting growing antibiotic resistance. Through a shared culture of relentless innovation, Waters’ passionate team of approximately 16,000 colleagues partner with customers to turn scientific challenges into breakthroughs that improve lives worldwide.We are the people who give possibilities purpose
BD is one of the largest global medical technology companies in the world. Advancing the world of health™ is our Purpose, and it’s no small feat. It takes the imagination and passion of all of us—from design and engineering to the manufacturing and marketing of our billions of MedTech products per year—to look at the impossible and find transformative solutions that turn dreams into possibilities.
Job Description
Summary

We are seeking a Senior Product Cyber Security Engineer to own the cybersecurity deliverables for assigned products end to end and to build the automation that lets a small team cover a large portfolio. You will plan the security activities for each release, lead threat modeling, run composition and static analysis, produce and monitor Software Bills of Materials (SBOMs), coordinate penetration tests, and write the documentation that goes into our design history files, regulatory submissions and customer assurance packages.

This is a product security engineering role, not an IT security, SOC or penetration testing role. You will read code, work in build pipelines, and defend your risk assessments in front of auditors, regulators and customers. You will work daily with R&D, Software Engineering, DevOps, Systems Engineering, Quality and Regulatory Affairs, and with our corporate product security and cyber risk teams.

This position is remote within the United States, with regular overlap with Pacific time working hours.

Key Responsibilities
Product Cybersecurity Planning and Deliverables

• Own the cybersecurity plan and the Product Security Management Plan for assigned products, covering new development, major releases and sustaining changes, in line with our product cybersecurity procedures.

• Produce the required deliverable set for each product: product security requirements gap analysis, threat model and data flow map, Product Security White Paper, Incident and Vulnerability Management Plan, Patch Management Plan, Cybersecurity Risk Summary Report, and third-party vendor assessments.

• Decide with the team which deliverables apply to each product, scale them to the product's risk and regulatory status (research-use-only versus IVD), and document every exemption with its justification.

• Keep the Product Security Management File complete, traceable and ready for FDA inspections and notified-body audits.

Threat Modeling and Risk Assessment

• Lead STRIDE-based threat modeling sessions with product teams: assets, data flows, trust boundaries, threats, controls, and the risk register entries that result.

• Assess products against our product security requirements, score findings with CVSS, and work with R&D on remediation or documented risk acceptance.

• Document unresolved and accepted risks in the Cybersecurity Risk Summary Report that supports release decisions, and feed cybersecurity hazards into the product risk management file where patient safety is affected.

Security Testing, SBOM and Vulnerability Management

• Run static code analysis and software composition analysis (e.g., Snyk) on product releases, triage findings with engineering, and archive the reports.

• Generate and validate CycloneDX SBOMs from the actual release artifacts of every software-enabled product, integrate SBOM generation into build and release pipelines, and load SBOMs into our post-market vulnerability monitoring tool (e.g., CyBeats).

• Monitor post-market vulnerability reports against product SBOMs, assess impact with R&D, and drive remediation within the timelines our procedures set.

• Coordinate penetration tests with our corporate product security engineering team: define scope from the roadmap, schedule tests early in development and before submissions, evaluate results and assess mitigations.

• Support investigation of externally reported vulnerabilities and potential cybersecurity complaints together with our corporate cyber risk team.

Patch Management and Secure Baselines

• Maintain product Patch Management Plans and author or review Security Patch Verification Protocols and Reports.

• Deliver the annual operating system patch verification bulletins for IVD products in the patch verification program.

• Contribute to hardened Windows 11 baseline images for instrument workstations and to the process for managing product-level exceptions.

Customer and Regulatory Assurance

• Assemble cyber assurance packages for key customers (SBOMs, Product Security White Papers, penetration test attestations, SOC 2 summaries) and answer customer security questionnaires.

• Prepare the cybersecurity content of regulatory submissions (FDA premarket cybersecurity requirements, EU IVDR) and support internal reviews, audits and regulator interactions.

• Review third-party security checklists and SOC 2 reports for third-party software and services used in or with our products.

Automation, Metrics and Scaling

• Build and maintain scripts and pipeline steps that generate SBOMs, scan results and audit evidence automatically, so deliverables stay current with every release instead of being rebuilt by hand.

• Produce cross-portfolio security risk reporting and in-market risk metrics for leadership, and keep work-item tracking for security activities current.

• Help evaluate and adopt AI-assisted tooling for drafting and checking security documentation.

• Contribute to updates of our product security procedures and security requirements as corporate policy, FDA expectations and submission feedback evolve.

Cross-Functional Guidance

• Act as the product security subject matter expert for R&D, DevOps, Quality, Regulatory and partner teams.

• Provide practical guidance on secure design, secure update and installation mechanisms, vulnerability remediation and compliance expectations.

• What Success Looks Like in the First Year

• Within 90 days: you own the cybersecurity deliverables for one product release end to end, from the cybersecurity plan to the Cybersecurity Risk Summary Report.

• Within six months: SBOM generation and composition analysis run automatically in the build for the products you support, with results loaded into post-market monitoring.

• Within twelve months: you cover two to three products in parallel, penetration tests and patch verification bulletins for your products are delivered on schedule, and leadership receives regular in-market risk metrics for them.

Required Qualifications

• Bachelor's degree in Computer Science, Software Engineering, Cybersecurity or a related technical field, or equivalent practical experience.

• 10+ years of experience in software engineering, product or application security, or cybersecurity engineering, including hands-on security work on software products that shipped to customers.

• Basic software engineering fluency: you read and write code in some language, you are comfortable with commandline, you are aware of build systems and package ecosystems (npm, pip, NuGet) and CI/CD pipelines (Azure DevOps or similar).

• Hands-on experience with threat modeling (STRIDE or similar), vulnerability assessment, CVSS scoring, remediation workflows and risk acceptance.

• Experience with static analysis and software composition analysis tools and with SBOM formats (CycloneDX or SPDX).

• Experience producing formal security deliverables (threat models, risk assessments, vulnerability reports, SBOMs) that have been reviewed in audits or regulatory submissions.

• Strong written communication: clear, structured technical documentation in English suitable for auditors, regulators and customers.

• Demonstrated ability to run several product workstreams in parallel in a procedure-driven, documentation-heavy environment, with a bias toward automation and reuse over manual effort.

Preferred Qualifications

• Experience in medical devices, in vitro diagnostics, life sciences or other regulated software, including familiarity with FDA premarket cybersecurity guidance (section 524B), EU MDR/IVDR, ISO 14971, AAMI TIR57, IEC 81001-5-1 or UL 2900.

• Experience with Snyk, CyBeats or similar composition analysis and SBOM monitoring platforms, and with vulnerability scanners such as Tenable or Qualys.

• Experience with Windows operating system hardening, image management and security patch verification.

• Experience coordinating penetration tests and performing supplier security assessments (third-party checklists, SOC 2 report reviews).

• Experience building security metrics, dashboards or operational reporting.

• Experience using AI and large language model tools to accelerate documentation and analysis while keeping outputs reviewable and traceable.

• Experience supporting FDA inspections, notified-body audits or ISO 13485 quality system audits.

Why Join Us?
To find purpose in the possibilities, we need people who can see the bigger picture, who understand the human story that underpins everything we do. We welcome people with the imagination and drive to help us reinvent the future of healthcare. At BD, you’ll discover a culture in which you can learn, grow and thrive.
We believe that when people connect in person, we learn faster, collaborate more deeply, and build a stronger culture. Join us and enjoy a culture where face-to-face collaboration supports your learning, your progress, and your success.
To learn more about BD visit .
Becton, Dickinson, and Company is an Equal Opportunity Employer. We evaluate applicants without regard to race, color, religion, age, sex, creed, national origin, ancestry, citizenship status, marital or domestic or civil union status, familial status, affectional or sexual orientation, gender identity or expression, genetics, disability, military eligibility or veteran status, and other legally protected characteristics.
Required Skills
Optional Skills
.
Primary Work Location
USA OR Ashland - FlowJoAdditional Locations
Work Shift
At BD, we reward, support and develop our associates through our comprehensive Total Rewards program. We are committed to attracting and retaining high quality talent by providing reward and recognition opportunities that promote a performance-based culture, as well as a competitive package of compensation and benefits programs. You can learn more on our career site under "Our Commitment to You."
Our salary or hourly rate ranges reward associates fairly and competitively. We regularly review these ranges and factors, such as location, contribute to the range displayed.
Our pay is based on the role and the necessary skills and education to perform it successfully. The salary or hourly rate offered is determined by the role's specific requirements, including any applicable step rate pay system at the work location. Salary or hourly pay ranges are influenced by labor laws and Collective Bargaining Agreement (CBA) requirements applicable to the work location which may also affect the workplace arrangement of the role.
Salary Range Information
$117,800.00 - $188,600.00 USD AnnualOriginally posted on Himalayas