Software Engineer at ZEISS in Bangalore

Job description

ZEISS in India ZEISS in India is headquartered in Bengaluru and present in the fields of Industrial Quality Solutions, Research Microscopy Solutions, Medical Technology, Vision Care and Sports & Cine Optics. ZEISS India has 3 production facilities, R&D center, Global IT services and about 40 Sales & Service offices in almost all Tier I and Tier II cities in India. With 2200+ employees and continued investments over 25 years in India, ZEISS’ success story in India is continuing at a rapid pace. Further information at ZEISS India . Purpose of this position / Position summary We are seeking a highly skilled and experienced Security Architect - Device & Medical Device Security to lead security architecture, design, and risk management activities for connected medical devices, diagnostic equipment, embedded platforms, and related product ecosystems within Vision Care Solutions. The ideal candidate will possess deep expertise in device security, embedded systems security, medical device cybersecurity, secure hardware and firmware design, product security engineering, and cybersecurity risk management. The role focuses on ensuring that security is built into products from concept through decommissioning while meeting regulatory, safety, privacy, and business requirements. The Security Architect will guide product teams in the definition of security requirements for devices, communication interfaces, cloud integrations, manufacturing and provisioning environments, and service ecosystems and serve as reviewer/expert subject manner for security risk assessments, threat modelling and overall security concepts. The role complements the existing software security architecture capability and therefore places primary emphasis on physical and connected devices, embedded platforms, firmware, medical device cybersecurity, and product lifecycle security. Primary duties and responsibilities Key Responsibilities • Medical Device Security Architecture: • Define and maintain security architecture principles, reference architectures, and design patterns for medical devices and connected product ecosystems. • Establish minimum security requirements across hardware, firmware, embedded software, connectivity, cloud integration, and service infrastructure. • Provide security guidance throughout the product lifecycle, from concept and design through production, post-market monitoring, servicing, and retirement. • Ensure security-by-design and privacy-by-design principles are embedded into product development processes. • Embedded & Device Security: • Design and review secure architectures for embedded Linux, RTOS-based, and other device platforms. • Define secure boot, secure storage, trusted execution, hardware root of trust, device hardening, and secure provisioning mechanisms. • Architect secure firmware update, patching, rollback protection, and recovery capabilities. • Ensure the establishment of device identity, authentication, authorization, certificate management, and cryptographic controls in close collaboration with the product teams. • Medical Device Cybersecurity & Regulatory Alignment: • Lead cybersecurity activities in alignment with applicable medical device regulations, standards, and guidance, including FDA cybersecurity guidance, IEC 81001-5-1, IEC 62304, ISO 14971, AAMI TIR57/TIR97, NIST guidance, and MDR/IVDR expectations. • Support cybersecurity documentation for technical files, regulatory submissions, audits, and product approvals. • Work with Quality and Regulatory Affairs to maintain objective evidence and traceability of cybersecurity requirements and controls. • Security Risk Management & Threat Modeling: • Guide and review the creation of threat modeling and attack-surface analysis for devices, interfaces, and product ecosystems. • Review cybersecurity risk assessments and security risk management documentation. • Collaborate with safety, quality, privacy, and engineering teams to evaluate security-related patient, user, busine