Senior Product Security Consultant – Advisory

Location: Remote, United States; Washington, DC area a plus. Periodic travel is required for client workshops, executive meetings, and industry events. Must be authorized to work in the U.S. without sponsorship.

Company

hirify.global provides a product security platform for connected devices and embedded systems, analyzing firmware and software components to identify supply-chain risks, vulnerabilities, and compliance gaps across industries.

What you will do

• Lead strategic advisory engagements end to end, including scoping, work breakdown structures, milestone schedules, client meetings, risk tracking, and final deliverables.
• Advise manufacturers on the EU Cyber Resilience Act, CE RED (EN 18031), FDA 524B, and FCC Cyber Trust Mark, covering classification, applicable requirements, evidence, conformity paths, and remediation roadmaps.
• Deliver security and regulatory compliance assessments and convert findings into prioritized, defensible recommendations.
• Serve as a virtual Chief Product Security Officer, running program cadences, briefing executives, and directing engineering work.
• Design secure development lifecycle programs, including policy, governance, and training.
• Translate SBOM, vulnerability, reachability, and penetration-test results into regulatory and business terms while building reusable advisory assets and supporting sales.

Requirements

• 8+ years of professional experience, including at least 5 years in consulting or advisory work at a professional services firm, cybersecurity consultancy, or regulatory consultancy, with a record of leading client engagements.
• Cybersecurity program experience and sufficient understanding of binary analysis, SBOMs, vulnerability management, and reachability to work effectively with engineers.
• Working depth in at least one core area: automotive, IoT, industrial, or healthcare, including the applicable regulations and standards.
• Ability to interpret regulations or standards and turn them into requirements and product implications.
• Experience running engagements using work breakdown structures, milestone schedules, status reporting, risk and action tracking, and early escalation of problems.
• Executive-level writing and communication skills, including briefing a VP of Engineering, General Counsel, and board.
• AI-native working approach using LLMs and agentic tools with sound judgment about what requires human verification.
• Must be authorized to work in the United States without sponsorship.

Nice to have

• Notified body, conformity assessment, or audit experience.
• Experience with the EU CRA, FDA 524B, IEC 62443, or ISO/SAE 21434.
• FDA premarket submission experience at a manufacturer or consultancy.
• Experience designing and facilitating tabletop exercises.
• CISSP, CSSLP, CISA, or ISO 27001 Lead Auditor certification.
• Government or public policy experience in cybersecurity.

Culture & Benefits

• Remote-first culture with a fully distributed workforce.
• Mission-driven work focused on securing connected products, embedded systems, and critical infrastructure.
• Culture emphasizes customer focus, ownership, transparency, integrity, urgency, and continuous learning.
• Access to a binary analysis platform, engineering and offensive security support, and AI tooling for research and drafting.