---
title: 'Head of PSC Engineering at Finite State'
canonical: 'https://feeny.ai/job/head-of-psc-engineering-finite-state-united-states-or-5e1gr6n2ehxd'
type: 'job'
last_seen: '2026-09-15'
---

# Head of PSC Engineering at Finite State

- **Company:** Finite State
- **Location:** United States OR, Canada
- **Work type:** remote
- **Posted:** 2026-09-10
- **Last confirmed live:** 2026-09-15
- **Apply:** https://job-boards.greenhouse.io/finitestate/jobs/6188459004

## Job description

Finite State partners with product security teams, the guardians of our connected world, to create transparency for their connected devices and supply chains. Our platform handles connected devices and embedded systems across all industries, including those found in enterprises, healthcare, utilities, connected vehicles, manufacturing facilities, critical infrastructure, and government entities.

We are a fast-growing series-B company with a fully distributed workforce. Led by a team of seasoned experts, we are a mission-driven team passionate about arming our customers with the actionable insights, critical vulnerability data, and remediation guidance necessary to mitigate product risk and protect the connected attack surface. We are committed to a remote first culture.

Department: Product Security Concierge (PSC)

Reports to: Chief Security Officer

Team: Field-deployed product security solution engineers across firmware and binary analysis, penetration testing, platform support and integration, and managed-service delivery

Role type: Manager and team leader first. About ~20 to 25 percent of your time may be hands-on technical work.

Location: Remote, United States or Canada. No relocation required.

Travel: Occasional. Customer executive reviews, on-site engagements, conferences, and team gatherings.

Compensation: 250-300k, bonus, equity, and full benefits.

## About the Role

Connected products run the world: vehicles, medical devices, industrial systems, critical infrastructure — and securing them is one of the hardest engineering problems there is. At Finite State, PSC Engineers are the technical owners of that problem for our customers: engineers who win trust by building and shipping, from the field.

The Head of PSC Engineering leads that team. You hire, develop, and run the engineers who each own the technical relationship with a portfolio of customer accounts and deliver our services, from penetration tests and firmware analysis to PSIRT-as-a-Service (PSIRTaaS) and Standards and Regulations Compliance-as-a-Service, on our Product Security OS platform.

This is a manager-first role. About ~20 to 25 percent of your time is hands-on technical work: contested findings, high-stakes deep technical engagements, and final review of deliverables before they reach a customer. The rest is leadership: people, capacity, quality, and the operating model that lets a small team, working with AI agents, deliver what used to take an entire consulting firm. You report to the Chief Security Officer, are part of the PSC leadership team, and own the team's work plan, priorities, capacity plan, and utilization.

## What You'll Do

You lead the people, the delivery, and the operating model of PSC Engineering.

- Lead the team. Hire, onboard, coach, and develop PSC Engineers. Set objectives, run 1:1s and review cycles, give direct feedback early, and grow engineers into named technical owners of accounts and, where they are ready, into leaders.
- Run delivery. Own execution of every engagement, from technical scoping and staffing to deliverable review and debrief, including Level 2 support. Set the playbooks, peer-review gates, and quality criteria, and report the KPIs that show whether delivery is healthy: utilization, time-to-deliverable, escape rate, and customer satisfaction.
- Own capacity and utilization. Plan the team's work against the demand pipeline, balance billable work with managed-service shifts and capability development, and manage utilization to target.
- Operationalize the managed services. Stand up and scale PSIRTaaS and Standards and Regulations Compliance-as-a-Service: runbooks, staffing model, SLAs, and, with Product, the platform capabilities each service depends on.
- Connect the field to the product. Collaborate with our Chief Product Security Engineer to make sure field-built tooling is logged and paved into the product rather than kept as a parallel roadmap, and represent the team in the Product Paving Council, our field-to-product forum.
- Own senior customer outcomes. Serve as the one of our trusted senior delivery contacts for strategic accounts, lead service reviews and escalations, and partner with Sales on technical scoping and expansion.

## Qualifications

- 3+ years of direct people management. You have hired, supervised, and developed engineers, run performance cycles, and handled underperformance directly. This is the core of the role.
- A record of mentoring, coaching, and teaching. You can point to specific people you developed, what changed for them, and how you did it.
- Prior exposure to formal management or leadership training, such as a company leadership development program, a management course or certificate, or an equivalent structured program, and you can describe what you took from it.
- 8+ years in product security, embedded and connected device security, application security, or offensive security, a meaningful portion of it in customer-facing services, consulting, or managed services.
- Bachelor's degree in Computer Science, Electrical or Computer Engineering, Mathematics, Physical Sciences, or a related field, or equivalent hands-on experience.
- Hands-on depth in two or more of: firmware and binary analysis; penetration testing of embedded or IoT systems; threat modeling and threat analysis and risk assessment (TARA); SBOM and software composition analysis; vulnerability disclosure and CVE/CNA workflows; PSIRT operations.
- Demonstrated ability to run a technical delivery function to SLAs, SLOs, and quality standards, including capacity and utilization management in a billable context.
- Working knowledge of the EU Cyber Resilience Act and at least one of IEC 62443, RED EN 18031, FDA premarket cybersecurity requirements, ETSI EN 303 645, or NIST SSDF; and of ISO/IEC 29147 and 30111, CVSS, VEX, and SBOM formats (SPDX, CycloneDX).

What Makes You a Fit

- You know your craft. Deep, hands-on product security expertise across embedded software and hardware, firmware analysis, penetration testing, and risk assessment. You can still review that work with authority.
- You hold the quality bar. Nothing you cannot defend reaches a customer. Peer review is how your team works, not a step it skips under pressure.
- You build systems, not heroics. Repeatable work becomes playbooks, runbooks, and tooling, so a small team scales without burning out.
- You communicate at every altitude. Clear in writing and speech with engineers, executives, regulators, and partners. You own escalations and can lead difficult conversations.
- You are an AI-native speaker. You use LLMs and agentic tooling as force multipliers in technical and management work, with the judgment to know where the human must own the result.

## Nice to Have

- You have built a service line before. A managed service or consulting offering, from process and runbooks to staffing model and SLAs.
- You carry credentials. CISSP, CSSLP, GIAC, or OSCP; CISM, CRISC, ISO/IEC 27001 Lead Implementer, or IEC 62443 Cybersecurity Expert. A plus, not a gate.
- You secure complex systems. Sector depth in aerospace, medical, automotive, energy, or industrial cyber-physical systems and their TARA methods (ISO/SAE 21434, IEC 62443-3-2, MITRE EMB3D).
- You know federal cyber policy. JSIG, ICD 503, NIST SP 800-160. Clearance eligibility is a plus, not a requirement.

## About Finite State

At Finite State, we're on a mission to secure the connected world. Our platform empowers product security teams to detect vulnerabilities, manage software supply chain risks, and ensure compliance across complex device ecosystems. From IoT to critical infrastructure, we provide unparalleled visibility into firmware and software components, helping organizations protect their products and customers.

We move with urgency and intent — we’re transparent, own outcomes, put customers first, speak up, and learn fast — turning evidence into action. CLARITY is how we move fast without breaking trust.

- C - Customer first - Learn from customers. Ship with urgency.
- L - Leverage - Outsource the routine. Own the result.
- A - Agency - We take responsibility—end to end.
- R - Results - Ship value. Improve fast.
- I - Integrity - Speak up. Experiment boldly. Be kind.
- T - Transparency - Clear context. Faster decisions.
- Y - "Why" - Our mission—securing the connected products humanity depends on—is the reason Finite State exists. CLARITY is how we make that mission real, every day, at speed

Bold Innovation – We push boundaries, explore new ideas, and take initiative to solve complex problems.

The Finite State platform brings visibility and control to the supply chains that create connected devices and embedded systems—all in a simple to use platform and at the scale manufacturers need to keep device production on time and on budget. After unpacking and analyzing every file, configuration, and setting in a firmware build, the platform generates a complete bill of materials for software components, identifies known and 0-day vulnerabilities, shows a contextual risk score, and provides actionable insights that product teams can use to secure their software

We are proud to be an Equal Employer Opportunity employer. We do not discriminate based upon race, religion, color, national origin, gender (including pregnancy, childbirth, or related medical conditions), sexual orientation, gender identity, gender expression, age, status as a protected veteran, status as an individual with a disability, or other applicable legally protected characteristics. Finite State is committed to working with and providing reasonable accommodations to applicants with physical and mental disabilities.

## About Finite State

## Company Overview
- **One-liner**: Finite State provides an AI-native platform that automates product security across the full lifecycle for connected devices, enabling manufacturers to design, verify, and prove compliance with regulations like the EU Cyber Resilience Act.
- **Entity Type**: Private (Series B)
- **Headquarters**: Columbus, Ohio, United States
- **Founded**: 2017
- **Founders**: Not publicly disclosed

## Core Business
- **Primary industry**: Computer and Network Security / Product Cybersecurity (focusing on IoT, medical devices, automotive, and OT/ICS)
- **Target customers**: B2B — Device OEMs and manufacturers in automotive, medical device, and industrial sectors; also serves enterprise and government clients
- **Mission or purpose statement**: To empower device OEMs to ship securely while enabling engineering teams to move at the speed of AI, transforming product artifacts into audit-ready assurance through a single automated workflow.

## Products & Services
- **[Finite State Platform]**: A SaaS platform that leverages deep binary analysis and AI-native execution to unify code, compiled components, and firmware in minutes. It automates threat modeling, generates SBOMs (Software Bills of Materials), VEX documents, and signed compliance packages. The platform connects security design with deployed software and is designed to help manufacturers meet regulations like the EU Cyber Resilience Act (CRA).
- **[Managed Services]**: A managed service offering to help medical device manufacturers and others achieve EU CRA compliance, providing industry-leading security services to navigate evolving regulations and enhance product security posture.
- **[Binary Analysis Engine]**: A core technology for reachability-based triage of vulnerabilities in binaries and firmware, enabling deep visibility into shipped code.

## Market Standing
- **Valuation/Market Cap**: Not disclosed (Private company)
- **Key Metric**: **Annual Revenue** of ~$8.7M (USD) | **Total Funding** of $69.5M across 4 rounds
- **Notable Investors/Partners**:
    - Energy Impact Partners (Lead investor in Series A and Series B)
    - Drive Capital (Lead investor in Seed Round)
    - Zetta Venture Partners (Seed Round)
    - National Grid Partners (NGP)
    - Energize Capital (Lead investor in Series B)
- **Growth Signals**:
    - Headcount grew **+24.2% YoY** (15 people added), now employing 61 people.
    - Acquired **MergeBase** in June 2024 to expand capabilities.
    - Expanding globally with offices in Canada, UK, Argentina, Singapore, and Israel.
    - Recent job postings (Senior Software Engineer AI/ML, Regional Sales Director) indicate continued investment.

## Competitive Advantages
- **AI-Native, Full Lifecycle Automation**: Differentiates by automating the entire security lifecycle (design → verify → prove) rather than just scanning or vulnerability management.
- **Deep Binary Analysis**: Proprietary reachability-based triage that goes beyond typical SCA (Software Composition Analysis) to understand which vulnerabilities are actually exploitable in a shipped device.
- **Regulatory Compliance Focus**: Specifically built to help manufacturers navigate complex, emerging regulations like the EU Cyber Resilience Act (CRA) and FDA requirements for medical devices, a key pain point for OEMs.
- **Continuous Compliance Output**: Automatically generates audit-ready artifacts (SBOMs, VEX, compliance packages) tied to every release, reducing friction between security and engineering teams.

## Strategic Focus
- **Expanding into Automotive & Medical Devices**: The platform and managed services are heavily tailored for these regulated, high-stakes industries.
- **Scaling AI & Automation**: Continued investment in AI/ML capabilities (as seen in current hiring for Senior Software Engineer AI/ML).
- **Post-Acquisition Integration**: Absorbing MergeBase’s technology and talent to broaden its software supply chain security offerings.
- **Global Market Penetration**: Growing presence in key markets (Canada, UK, Singapore, Israel) to support multinational OEMs.

## Why Work Here
- **Culture**: Described as a "leading provider" in product cybersecurity with a focus on mission-driven work — securing critical infrastructure and medical devices. LinkedIn reviews rate compensation highly (4.3/5) but suggest work-life balance is a challenge (2.8/5).
- **Engineering & Tech Stack**: A modern stack including **Python, Django, Kubernetes, PostgreSQL, Redis, GraphQL, React, Docker, and Node.js**. The team works on advanced AI/ML for binary analysis and threat modeling.
- **Remote/Hybrid Policy**: Not explicitly stated, but offices are located in Columbus, OH (HQ), with a distributed team across the US, Canada, UK, Argentina, Singapore, and Israel, suggesting a flexible or hybrid model is likely.
- **Notable Perks**: Working on a cutting-edge platform at the intersection of cybersecurity and AI; involvement in high-impact regulatory compliance work; opportunity to shape product security for connected devices globally.

## Sources
1. [finitestate.io](https://finitestate.io/)
2. [finitestate.io/careers](https://finitestate.io/careers)
3. [finitestate.io/about](https://finitestate.io/about)
4. [linkedin.com/company/finitestate](https://www.linkedin.com/company/finitestate)
5. [finitestate.io/platform](https://finitestate.io/platform)

## Other roles at Finite State

- [Staff Product Security Engineer - Offensive Testing](https://feeny.ai/job/staff-product-security-engineer-offensive-testing-finite-state-united-states-or-f2tn1ajgewnr) — United States OR, Canada
- [BDR Leader , East](https://feeny.ai/job/bdr-leader-east-finite-state-united-states-tgtxynkhtybz) — United States
- [Senior QA Engineer - AI/ML](https://feeny.ai/job/senior-qa-engineer-ai-ml-finite-state-singapore-60e18151jphz) — Singapore
- [Director of Product Management](https://feeny.ai/job/director-of-product-management-finite-state-united-states-or-3t5bjh2bypa8) — United States OR, Canada
- [Director, GTM Operations](https://feeny.ai/job/director-gtm-operations-finite-state-united-states-or-wy9kbtnze73t) — United States OR, Canada
- [Regional Sales Director (Northeast)](https://feeny.ai/job/regional-sales-director-northeast-finite-state-united-states-cpkp0rr29ggp) — United States
- [Regional Sales Director (West)](https://feeny.ai/job/regional-sales-director-west-finite-state-united-states-3xh8585q3pzv) — United States
- [Lead Architect](https://feeny.ai/job/lead-architect-finite-state-singapore-90fhaycee39k) — Singapore
- [MTS Manager](https://feeny.ai/job/mts-manager-finite-state-united-states-or-qmvzveb7wh20) — United States OR, Canada
- [Senior Software Engineer AI/ML](https://feeny.ai/job/senior-software-engineer-ai-ml-finite-state-singapore-f238mwq0563r) — Singapore