Senior Security Product Consultant - Advisory

Finite State partners with product security teams to create transparency for connected devices and supply chains across healthcare, automotive, utilities, critical infrastructure, and government entities. We are a fast-growing Series-B company with a fully distributed workforce and a remote-first culture.

Department: Services, Strategic Advisory
Reports to: Head of Policy and Compliance
Location: Remote, United States (Washington, DC area a plus)
Travel: Periodic, for client workshops, executive meetings, and industry events

About the Role

Connected products run the world: vehicles, medical devices, industrial systems, critical infrastructure. The companies that build them face a wave of regulation, from the EU Cyber Resilience Act and Radio Equipment Directive to FDA premarket cybersecurity requirements and new U.S. supply chain rules. Few of them have a product security program built for it.

Finite State's Strategic Advisory practice helps manufacturers close that gap. We tell them what regulations require, where they stand, what evidence they need, and the order of work to get there. As a Senior Product Security Consultant, you will lead those engagements from scoping to final deliverable and advise client security and engineering leaders. On some accounts, you will act as the client's virtual Chief Product Security Officer (vCPSO).

You will leverage Finite State's binary analysis platform, dedicated engineering and offensive security teams, and AI tooling to speed up research and drafting.

What You'll Do

• Lead advisory engagements end-to-end: Scope work, set work breakdown and milestone schedules, lead client meetings, track risks, and deliver on time.
• Frame regulatory programs: Guide clients facing EU CRA, CE RED (EN 18031), FDA 524B, and FCC Cyber Trust Mark regarding product classification, requirements, gap assessments, and conformity roadmaps.
• Deliver security assessments: Conduct security and regulatory compliance assessments, turning technical findings into prioritized, defensible recommendations.
• Serve as vCPSO: Direct product security program cadences for client accounts, represent security to client executives, and align engineering work.
• Design secure development lifecycles: Develop policies, governance frameworks, and training for client teams.
• Produce executive deliverables: Write clear assessments, roadmaps, policies, briefings, and evidence packages.
• Translate technical technical details: Collaborate with internal offensive security and engineering teams to explain SBOM, vulnerability, reachability, and pentest results in regulatory and business terms.
• Build advisory practice assets: Create templates, playbooks, and reusable tools to optimize engagements, and contribute to Finite State's public voice.

What You Bring

• 8+ years of professional experience, with at least 5 years in cybersecurity consulting or advisory work at a professional services firm (Big Four, federal consulting, or regulatory consultancy).
• Cybersecurity technical depth: Understanding of binary analysis, SBOMs, vulnerability management, and reachability to collaborate effectively with engineers.
• Domain expertise: Deep knowledge in automotive, IoT, industrial, or healthcare product security and governing regulations.
• Engagement discipline: Proficiency in work breakdown structures, status reporting, risk tracking, and project execution.
• Executive communication: Ability to write and present effectively to VPs of Engineering, General Counsels, and Board members.
• AI-native workflow: Proven experience using LLMs and agentic tools as force multipliers with sound human verification.

Nice to Have

• Background in notified bodies, conformity assessment, or audit.
• Experience with frameworks and standards such as EU CRA, FDA 524B, IEC 62443, or ISO/SAE 21434.
• FDA premarket submission experience.
• Experience designing and facilitating tabletop exercises.
• Industry certifications (CISSP, CSSLP, CISA, or ISO 27001 Lead Auditor).
• Public policy or government cybersecurity background.