Cyber Security Consultant – Product Security & Regulatory Compliance (m/f/d)

A company in the medical technology sector is looking for an experienced Cyber Security Consultant to act as an independent advisor at the intersection of software architecture, DevOps, and regulatory affairs. The project goal is to develop and secure innovative digital health products (Software as a Medical Device / Connected Devices). The role involves purely technical consulting, technical assessments, and delivery of validated security artifacts, without operational management decisions. The focus is on translating regulatory requirements (FDA, MDR, EU CRA, NIS2) into technical solutions and objectively assessing security risks.

• Holistic Threat Modeling: Conduct STRIDE-based analyses for APIs, cloud-native services, AI components, and CI/CD pipelines, and maintain formal threat model reports.
• Security Architecture & Design: Create technical data flow diagrams (DFDs) and security architecture review reports to document security decisions in cloud and container environments.
• DevSecOps & Supply Chain Security: Advise on hardening CI/CD pipelines, implementing "security by default", and managing SBOM artifacts (third-party risk).
• Penetration Testing Support: Define the scope for pen tests and fuzzing, and technically validate the results and CVSS scorings.
• Vulnerability Management: Assess vulnerabilities (vulnerability impact assessments) and develop remediation plans.
• Audit Preparation: Compile technical evidence and documentation for regulatory submissions (FDA, MDR, MDS2).

• Degree in computer science, cyber security, or engineering.
• 5–8+ years of project experience in product security, application security, or security architecture.
• Excellent knowledge of threat modeling (STRIDE, PASTA), risk assessments (CVSS), and Secure SDLC.
• Deep expertise in cloud security (Azure/AWS), containerization (Kubernetes/Docker), API security, and CI/CD toolchains.
• Experience with AI/ML security is a plus.
• Proven experience with medical device standards (FDA Cybersecurity Guidelines, EU MDR, ISO 14971, IEC 62304) or comparable critical standards (ISO 21434, IEC 62443).
• Ability to independently drive technical topics as an independent consultant, with a structured, "audit-ready" documentation style.
• Business fluent English (C1/C2) is mandatory (project and documentation language).
• Fluent German (B2/C1) is desirable.
• Relevant certifications like CISSP, CCSP, CSSLP, CISM, or OSCP are strongly preferred.