Senior Security Product Consultant- Advisory

Finite State•Washington, DC

19d•Remote

About The Position

Finite State is hiring a Senior Product Security Consultant for its Services, Strategic Advisory department. The role is remote in the United States, and candidates must be authorized to work in the U.S. without sponsorship. The Washington, DC area is a plus. Periodic travel is expected for client workshops, executive meetings, and industry events. The position reports to the Head of Policy and Compliance. The Strategic Advisory practice helps manufacturers understand product security regulations, assess their current state, identify required evidence, and plan and operate programs to address regulatory requirements. The consultant leads engagements from scoping through final deliverables and advises client security and engineering leaders. On some accounts, the consultant serves as the client's virtual Chief Product Security Officer (vCPSO). The consultant works with Finite State’s binary analysis platform, engineering and offensive security teams, and AI tooling. The role emphasizes sound judgment, structured delivery, and client relationships, rather than performing product security testing. Key regulatory areas include the EU Cyber Resilience Act (CRA), CE Radio Equipment Directive (RED/EN 18031), FDA 524B, and the FCC Cyber Trust Mark. Finite State is a mission-driven, fast-growing Series B company with a fully distributed workforce and a remote-first culture. Its platform provides visibility into firmware and software components, software supply chain risks, vulnerabilities, and compliance across connected devices and embedded systems. The company describes its working values through CLARITY: customer first, leverage, agency, results, integrity, transparency, and purpose. It is an equal opportunity employer and provides reasonable accommodations to applicants with disabilities.

Requirements

At least 8 years of professional experience, including at least 5 years in consulting or advisory work at a professional services firm, with a record of leading client engagements.
Cybersecurity program experience and sufficient understanding of binary analysis, SBOMs, vulnerability management, and reachability to work effectively with engineers; the role does not perform testing.
Working depth in at least one of automotive, IoT, industrial, or healthcare, including the regulations and standards governing that area.
Ability to interpret regulations or standards and translate them into requirements and product implications.
Experience managing engagements using work breakdown structures, milestone schedules, status reporting, risk and action tracking, and early escalation of problems.
Executive-level writing and presentation skills, including the ability to brief engineering leadership, General Counsel, and boards.
Ability to use LLMs and agentic tools as productivity aids while applying judgment about what requires human verification.
Authorization to work in the United States without sponsorship.

Nice To Haves

Background with a notified body, conformity assessment, or auditing.
Experience with regulatory frameworks and standards such as the EU CRA, FDA 524B, IEC 62443, or ISO/SAE 21434.
FDA premarket submission experience at a manufacturer or consultancy.
Experience designing and facilitating tabletop exercises.
CISSP, CSSLP, CISA, or ISO 27001 Lead Auditor certification.
Government or public policy experience in cybersecurity.
Washington, DC area location.

Responsibilities

Lead advisory engagements end to end, including scoping, defining work breakdowns and milestone schedules, running client meetings, tracking risks and actions, and delivering on time.
Frame regulatory programs for clients addressing the EU CRA, CE RED (EN 18031), FDA 524B, and FCC Cyber Trust Mark, including product classification, applicable requirements, gap assessment, evidence needs, conformity paths, and roadmaps.
Deliver security and regulatory compliance assessments and turn findings into prioritized, defensible recommendations.
Serve as the named vCPSO on client accounts by running product security program cadence, representing product security to executives, and directing work performed by Finite State and client engineering teams.
Design secure development lifecycle programs, including related policy, governance, and training.
Write assessments, roadmaps, policies, briefings, and evidence packages for executive and engineering audiences.
Work with engineering and offensive security teams to translate SBOM, vulnerability, reachability, and penetration test findings into regulatory and business terms.
Scope bootcamps and support sellers through the services request process.
Develop templates, playbooks, and reusable assets to improve advisory engagements.
Contribute to Finite State's public voice through writing and speaking over time.