Senior Security Product Consultant- Advisory

Finite State partners with product security teams, the guardians of our connected world, to create transparency for their connected devices and supply chains. Our platform handles connected devices and embedded systems across all industries, including those found in enterprises, healthcare, utilities, connected vehicles, manufacturing facilities, critical infrastructure, and government entities.

Led by a team of seasoned experts, we are a mission-driven team passionate about arming our customers with the actionable insights, critical vulnerability data, and remediation guidance necessary to mitigate product risk and protect the connected attack surface. We are committed to a remote first culture.
Title:

Senior Product Security Consultant – Advisory
Reports to:

Head of Policy and Compliance
Location:

Remote, United States. Travel:

Periodic, for client workshops, executive meetings, and industry events
Connected products run the world: vehicles, medical devices, industrial systems, critical infrastructure. The companies that build them face a wave of regulation, from the EU Cyber Resilience Act and Radio Equipment Directive to FDA premarket cybersecurity requirements and new U.Few of them have a product security program built for it.
Finite States Strategic Advisory practice helps them close that gap. Then we stay to help them run the program. As a Senior Product Security Consultant, you will lead those engagements from scoping to final deliverable and advise client security and engineering leaders. On some accounts you will act as the clients virtual Chief Product Security Officer.
Youll have Finite States binary analysis platform, a dedicated engineering and offensive security team that tests the products you advise on, and AI tooling that speeds up research and drafting. Your job is the judgment, the structure, and the client relationship.
Scope the work, set the work breakdown and milestone schedule at the start, run client meetings, track risks and actions, and deliver on time.
Frame regulatory programs for clients facing the EU CRA, CE RED (EN 18031), FDA 524B, and FCC Cyber Trust Mark. Deliver security and regulatory compliance assessments, and turn the findings into prioritized recommendations you can defend.
Serve as the named vCPSO on client accounts. Youll run the clients product security program cadence, represent product security to their executives, and direct the work that our engineering team and the clients engineers carry out.
Design secure development lifecycle programs, with the policy, governance, and training that go with them.
Write deliverables executives can act on and engineers can defend: assessments, roadmaps, policies, briefings, and evidence packages. Work with our engineering and offensive security teams to turn technical findings (SBOM, vulnerability, reachability, and penetration test results) into regulatory and business terms.
Build the practice: templates, playbooks, and reusable assets that make each engagement faster than the last. Over time, add to Finite States public voice through writing and speaking.
8+ years of professional experience, including at least 5 in consulting or advisory work at a professional services firm (Big Four, federal consulting, or a cybersecurity or regulatory consultancy), with a record of leading client engagements.
Cybersecurity program experience, with enough grasp of binary analysis, SBOMs, vulnerability management, and reachability to hold your own with engineers. You wont be doing the testing.
Working depth in at least one of our core areas: automotive, IoT, industrial, or healthcare, including the regulations and standards that govern it. Discipline in running engagements: work breakdown structures, milestone schedules, status reporting, risk and action tracking, and raising problems early.
Writing and presence fit for executives. You can brief a VP of Engineering, a General Counsel, and a board in the same week, in writing and in the room.
Experience with regulatory frameworks and standards such as the EU CRA, FDA 524B, IEC 62443, or ISO/SAE 21434.
Government or public policy experience in cybersecurity.
Our platform empowers product security teams to detect vulnerabilities, manage software supply chain risks, and ensure compliance across complex device ecosystems. From IoT to critical infrastructure, we provide unparalleled visibility into firmware and software components, helping organizations protect their products and customers.
We move with urgency and intent — we’re transparent, own outcomes, put customers first, speak up, and learn fast — turning evidence into action. C

- Customer first - Learn from customers. Ship with urgency.
L - Leverage - Outsource the routine. R

- Results - Ship value. Y - "Why" - Our mission—securing the connected products humanity depends on—is the reason Finite State exists. Bold Innovation – We push boundaries, explore new ideas, and take initiative to solve complex problems.
The Finite State platform brings visibility and control to the supply chains that create connected devices and embedded systems—all in a simple to use platform and at the scale manufacturers need to keep device production on time and on budget. After unpacking and analyzing every file, configuration, and setting in a firmware build, the platform generates a complete bill of materials for software components, identifies known and 0-day vulnerabilities, shows a contextual risk score, and provides actionable insights that product teams can use to secure their software
We do not discriminate based upon race, religion, color, national origin, gender (including pregnancy, childbirth, or related medical conditions), sexual orientation, gender identity, gender expression, age, status as a protected veteran, status as an individual with a disability, or other applicable legally protected characteristics. Finite State is committed to working with and providing reasonable accommodations to applicants with physical and mental disabilities.