--- title: 'Senior Product Security Consultant- Advisory at Finite State' canonical: 'https://feeny.ai/job/senior-product-security-consultant-advisory-finite-state-united-states-pv32k4n29dfx' type: 'job' last_seen: '2026-10-27' --- # Senior Product Security Consultant- Advisory at Finite State - **Company:** Finite State - **Location:** United States - **Work type:** remote - **Posted:** 2026-10-20 - **Last confirmed live:** 2026-10-27 - **Apply:** https://job-boards.greenhouse.io/finitestate/jobs/6229658004 ## Job description Finite State partners with product security teams, the guardians of our connected world, to create transparency for their connected devices and supply chains. Our platform handles connected devices and embedded systems across all industries, including those found in enterprises, healthcare, utilities, connected vehicles, manufacturing facilities, critical infrastructure, and government entities. We are a fast-growing series-B company with a fully distributed workforce. Led by a team of seasoned experts, we are a mission-driven team passionate about arming our customers with the actionable insights, critical vulnerability data, and remediation guidance necessary to mitigate product risk and protect the connected attack surface. We are committed to a remote first culture. Title: Senior Product Security Consultant – Advisory Department: Services, Strategic Advisory Reports to: Head of Policy and Compliance Location: Remote, United States. Must be authorized to work in the U.S. without sponsorship. Washington, DC area a plus. Travel: Periodic, for client workshops, executive meetings, and industry events ## About the role Connected products run the world: vehicles, medical devices, industrial systems, critical infrastructure. The companies that build them face a wave of regulation, from the EU Cyber Resilience Act and Radio Equipment Directive to FDA premarket cybersecurity requirements and new U.S. supply chain rules. Few of them have a product security program built for it. Finite State's Strategic Advisory practice helps them close that gap. We tell manufacturers what a regulation requires of their products, where they stand, what evidence they need, and the order of work to get there. Then we stay to help them run the program. As a Senior Product Security Consultant, you will lead those engagements from scoping to final deliverable and advise client security and engineering leaders. On some accounts you will act as the client's virtual Chief Product Security Officer. You won't be starting from a blank page. You'll have Finite State's binary analysis platform, a dedicated engineering and offensive security team that tests the products you advise on, and AI tooling that speeds up research and drafting. Your job is the judgment, the structure, and the client relationship. ## What you'll do - Lead advisory engagements end to end. Scope the work, set the work breakdown and milestone schedule at the start, run client meetings, track risks and actions, and deliver on time. - Frame regulatory programs for clients facing the EU CRA, CE RED (EN 18031), FDA 524B, and FCC Cyber Trust Mark. That covers product classification, the requirements that apply, gap assessment, what the evidence needs to show, the conformity path, and the roadmap. - Deliver security and regulatory compliance assessments, and turn the findings into prioritized recommendations you can defend. - Serve as the named vCPSO on client accounts. You'll run the client's product security program cadence, represent product security to their executives, and direct the work that our engineering team and the client's engineers carry out. - Design secure development lifecycle programs, with the policy, governance, and training that go with them. - Write deliverables executives can act on and engineers can defend: assessments, roadmaps, policies, briefings, and evidence packages. Every one answers what it is, why now, and what the client should do next. - Work with our engineering and offensive security teams to turn technical findings (SBOM, vulnerability, reachability, and penetration test results) into regulatory and business terms. - Scope bootcamps and give sellers advisory support through our services request process. - Build the practice: templates, playbooks, and reusable assets that make each engagement faster than the last. Over time, add to Finite State's public voice through writing and speaking. ## What you bring - 8+ years of professional experience, including at least 5 in consulting or advisory work at a professional services firm (Big Four, federal consulting, or a cybersecurity or regulatory consultancy), with a record of leading client engagements. - Cybersecurity program experience, with enough grasp of binary analysis, SBOMs, vulnerability management, and reachability to hold your own with engineers. You won't be doing the testing. - Working depth in at least one of our core areas: automotive, IoT, industrial, or healthcare, including the regulations and standards that govern it. You can read a regulation or standard and turn it into requirements and product implications. - Discipline in running engagements: work breakdown structures, milestone schedules, status reporting, risk and action tracking, and raising problems early. - Writing and presence fit for executives. You can brief a VP of Engineering, a General Counsel, and a board in the same week, in writing and in the room. - An AI-native way of working: LLMs and agentic tools as force multipliers, with clear judgment about what a person must verify. ## Nice to have - A notified body, conformity assessment, or audit background. - Experience with regulatory frameworks and standards such as the EU CRA, FDA 524B, IEC 62443, or ISO/SAE 21434. - FDA premarket submission experience at a manufacturer or consultancy. - Experience designing and facilitating tabletop exercises. - CISSP, CSSLP, CISA, or ISO 27001 Lead Auditor. - Government or public policy experience in cybersecurity. ## About Finite State At Finite State, we're on a mission to secure the connected world. Our platform empowers product security teams to detect vulnerabilities, manage software supply chain risks, and ensure compliance across complex device ecosystems. From IoT to critical infrastructure, we provide unparalleled visibility into firmware and software components, helping organizations protect their products and customers. We move with urgency and intent — we’re transparent, own outcomes, put customers first, speak up, and learn fast — turning evidence into action. CLARITY is how we move fast without breaking trust. - C - Customer first - Learn from customers. Ship with urgency. - L - Leverage - Outsource the routine. Own the result. - A - Agency - We take responsibility—end to end. - R - Results - Ship value. Improve fast. - I - Integrity - Speak up. Experiment boldly. Be kind. - T - Transparency - Clear context. Faster decisions. - Y - "Why" - Our mission—securing the connected products humanity depends on—is the reason Finite State exists. CLARITY is how we make that mission real, every day, at speed Bold Innovation – We push boundaries, explore new ideas, and take initiative to solve complex problems. The Finite State platform brings visibility and control to the supply chains that create connected devices and embedded systems—all in a simple to use platform and at the scale manufacturers need to keep device production on time and on budget. After unpacking and analyzing every file, configuration, and setting in a firmware build, the platform generates a complete bill of materials for software components, identifies known and 0-day vulnerabilities, shows a contextual risk score, and provides actionable insights that product teams can use to secure their software We are proud to be an Equal Employer Opportunity employer. We do not discriminate based upon race, religion, color, national origin, gender (including pregnancy, childbirth, or related medical conditions), sexual orientation, gender identity, gender expression, age, status as a protected veteran, status as an individual with a disability, or other applicable legally protected characteristics. Finite State is committed to working with and providing reasonable accommodations to applicants with physical and mental disabilities. ## About Finite State ## Company Overview - **One-liner**: Finite State provides an AI-native platform that automates product security across the full lifecycle for connected devices, enabling manufacturers to design, verify, and prove compliance with regulations like the EU Cyber Resilience Act. - **Entity Type**: Private (Series B) - **Headquarters**: Columbus, Ohio, United States - **Founded**: 2017 - **Founders**: Not publicly disclosed ## Core Business - **Primary industry**: Computer and Network Security / Product Cybersecurity (focusing on IoT, medical devices, automotive, and OT/ICS) - **Target customers**: B2B — Device OEMs and manufacturers in automotive, medical device, and industrial sectors; also serves enterprise and government clients - **Mission or purpose statement**: To empower device OEMs to ship securely while enabling engineering teams to move at the speed of AI, transforming product artifacts into audit-ready assurance through a single automated workflow. ## Products & Services - **[Finite State Platform]**: A SaaS platform that leverages deep binary analysis and AI-native execution to unify code, compiled components, and firmware in minutes. It automates threat modeling, generates SBOMs (Software Bills of Materials), VEX documents, and signed compliance packages. The platform connects security design with deployed software and is designed to help manufacturers meet regulations like the EU Cyber Resilience Act (CRA). - **[Managed Services]**: A managed service offering to help medical device manufacturers and others achieve EU CRA compliance, providing industry-leading security services to navigate evolving regulations and enhance product security posture. - **[Binary Analysis Engine]**: A core technology for reachability-based triage of vulnerabilities in binaries and firmware, enabling deep visibility into shipped code. ## Market Standing - **Valuation/Market Cap**: Not disclosed (Private company) - **Key Metric**: **Annual Revenue** of ~$8.7M (USD) | **Total Funding** of $69.5M across 4 rounds - **Notable Investors/Partners**: - Energy Impact Partners (Lead investor in Series A and Series B) - Drive Capital (Lead investor in Seed Round) - Zetta Venture Partners (Seed Round) - National Grid Partners (NGP) - Energize Capital (Lead investor in Series B) - **Growth Signals**: - Headcount grew **+24.2% YoY** (15 people added), now employing 61 people. - Acquired **MergeBase** in June 2024 to expand capabilities. - Expanding globally with offices in Canada, UK, Argentina, Singapore, and Israel. - Recent job postings (Senior Software Engineer AI/ML, Regional Sales Director) indicate continued investment. ## Competitive Advantages - **AI-Native, Full Lifecycle Automation**: Differentiates by automating the entire security lifecycle (design → verify → prove) rather than just scanning or vulnerability management. - **Deep Binary Analysis**: Proprietary reachability-based triage that goes beyond typical SCA (Software Composition Analysis) to understand which vulnerabilities are actually exploitable in a shipped device. - **Regulatory Compliance Focus**: Specifically built to help manufacturers navigate complex, emerging regulations like the EU Cyber Resilience Act (CRA) and FDA requirements for medical devices, a key pain point for OEMs. - **Continuous Compliance Output**: Automatically generates audit-ready artifacts (SBOMs, VEX, compliance packages) tied to every release, reducing friction between security and engineering teams. ## Strategic Focus - **Expanding into Automotive & Medical Devices**: The platform and managed services are heavily tailored for these regulated, high-stakes industries. - **Scaling AI & Automation**: Continued investment in AI/ML capabilities (as seen in current hiring for Senior Software Engineer AI/ML). - **Post-Acquisition Integration**: Absorbing MergeBase’s technology and talent to broaden its software supply chain security offerings. - **Global Market Penetration**: Growing presence in key markets (Canada, UK, Singapore, Israel) to support multinational OEMs. ## Why Work Here - **Culture**: Described as a "leading provider" in product cybersecurity with a focus on mission-driven work — securing critical infrastructure and medical devices. LinkedIn reviews rate compensation highly (4.3/5) but suggest work-life balance is a challenge (2.8/5). - **Engineering & Tech Stack**: A modern stack including **Python, Django, Kubernetes, PostgreSQL, Redis, GraphQL, React, Docker, and Node.js**. The team works on advanced AI/ML for binary analysis and threat modeling. - **Remote/Hybrid Policy**: Not explicitly stated, but offices are located in Columbus, OH (HQ), with a distributed team across the US, Canada, UK, Argentina, Singapore, and Israel, suggesting a flexible or hybrid model is likely. - **Notable Perks**: Working on a cutting-edge platform at the intersection of cybersecurity and AI; involvement in high-impact regulatory compliance work; opportunity to shape product security for connected devices globally. ## Sources 1. [finitestate.io](https://finitestate.io/) 2. [finitestate.io/careers](https://finitestate.io/careers) 3. [finitestate.io/about](https://finitestate.io/about) 4. [linkedin.com/company/finitestate](https://www.linkedin.com/company/finitestate) 5. [finitestate.io/platform](https://finitestate.io/platform) ## Other roles at Finite State - [Senior Engineer - Penetration Testing](https://feeny.ai/job/senior-engineer-penetration-testing-finite-state-united-states-or-ej7w6r74jr2p) — United States OR, Canada - [Senior Engineer - Penetration Testing](https://feeny.ai/job/senior-engineer-penetration-testing-finite-state-united-states-or-18sx7cf1a6t4) — United States OR, Canada - [Senior Engineer - Penetration Testing](https://feeny.ai/job/senior-engineer-penetration-testing-finite-state-united-states-or-ye4m4jcdygvr) — United States OR, Canada - [Head of Product](https://feeny.ai/job/head-of-product-finite-state-united-states-rjcnyxvrnwka) — United States - [BDR](https://feeny.ai/job/bdr-finite-state-united-states-dw0sv6aeyrfm) — United States, East Coast - [Senior QA Engineer - AI/ML](https://feeny.ai/job/senior-qa-engineer-ai-ml-finite-state-singapore-60e18151jphz) — Singapore - [Regional Sales Director (Northeast)](https://feeny.ai/job/regional-sales-director-northeast-finite-state-united-states-cpkp0rr29ggp) — United States - [Regional Sales Director (West)](https://feeny.ai/job/regional-sales-director-west-finite-state-united-states-3xh8585q3pzv) — United States - [Staff Product Manager](https://feeny.ai/job/staff-product-manager-finite-state-united-states-or-ybrbnggh8v38) — United States OR, Canada