Senior Cyber Security Engineer

Bachelor’s degree in Computer Science, Information Security, Cybersecurity, Software Engineering, or a related field.

7+ years of hands-on cybersecurity, product security, cloud security or DevSecOps experience in software/product engineering environments.

Strong experience with GCP preferred and at least one additional cloud platform such as AWS or Azure.

Practical experience with CI/CD security, GitHub workflows, vulnerability scanning, dependency scanning, container/image scanning, secret scanning and release security gates.

Experience with tools such as Dependabot, SonarQube, JFrog Xray, Orca, Tanium, CrowdStrike, Burp Suite, SAST/DAST tools, SIEM/logging platforms or equivalent technologies.

Ability to translate scan findings into prioritized remediation plans, work with engineering teams to close findings, and produce audit-ready evidence.

Working knowledge of ISO 27001, SOC 2, NIST, GDPR, HIPAA, GxP, SaMD, medical device cybersecurity or other regulated product-security expectations is preferred.

Strong analytical, documentation, stakeholder-management and communication skills, with the ability to support developers, Quality, Global Cybersecurity and leadership stakeholders.

Cloud Security: Google Cloud Platform preferred, plus AWS or Azure; cloud, Kubernetes, Artifact Registry, IAM, workload identity, secrets, variables and registry exposure reviews

DevSecOps & Security Tooling: GitHub security pipelines, Dependabot, Secret Scanning, SonarQube, JFrog Xray, Orca, Tanium, CrowdStrike, Burp Suite, SAST/DAST and CI/CD security gates

Vulnerability & Remediation Management: severity and exploitability-based prioritization, High/Critical dependency and container fixes, patch verification, re-scans and closure evidence

Release Assurance: security quality gates, SBOM generation, release security reports, exception assessments, control checklists and evidence for Quality/release sign-off

Monitoring & Incident Response: cybersecurity signal triage, SIEM/log-source coverage, incident support, newly disclosed CVE impact assessment and escalation handling

Security Documentation & Evidence: runbooks, onboarding checklists, branch/environment/secrets guides, audit-ready evidence packs and technical reference material

Penetration Testing Support: scope definition, architecture/access/environment readiness, report review, remediation planning and closure evidence

Regulated Product Security: healthcare or SaMD product security, ISO 27001, SOC 2, NIST, HIPAA, GDPR, GxP/release audit support and security-risk evidence

Agile & Collaboration: Jira, Confluence, Scrum practices, developer enablement, stakeholder Q&A, sprint backlog integration and clear communication with cross-functional teams

Experience working in enterprise/global cybersecurity teams on cybersecurity management plans, cyber test reports, security requirements, release security reviews, risk assessments and risk-management reporting.

Familiarity with global cybersecurity governance activities such as policy and procedure creation, security-gate design, centralized control checklists, threat modeling and cybersecurity control ownership mapping.

Understanding of regulated product-security deliverables, including Cybersecurity Management Plans, Cyber Test Reports, Security Risk Management Plans/Reports, Threat Modeling Reports, residual-risk decisions and release-security evidence packs.

Ability to support global teams with incident response, customer escalations, external disclosures, newly disclosed vulnerability assessments and documented impact/risk decisions.

Exposure to certification and compliance readiness work with Quality, including ISO certification scope, certification strategy, control evidence, submission support and audit-ready security-risk documentation.

Ever feel burnt out by bureaucracy? Us too. That's why we're changing the way we work- for higher productivity, faster innovation, and better results. We call it Dynamic Shared Ownership (DSO). Learn more about what DSO will mean for you in your new role here

Bayer does not charge any fees whatsoever for recruitment process. Please do not entertain such demand for payment by any individuals / entities in connection with recruitment with any Bayer Group entity(ies) worldwide under any pretext.

Please don’t rely upon any unsolicited email from email addresses not ending with domain name “bayer.com” or job advertisements referring you to an email address that does not end with “bayer.com”. For checking the authenticity of such emails or advertisement you may approach us at HRSUPPORT_INDIA@BAYER.COM.

Bayer is an equal opportunity employer that strongly values fairness and respect at work. We welcome applications from all individuals, regardless of race, religion, gender, age, physical characteristics, disability, sexual orientation etc. We are committed to treating all applicants fairly and avoiding discrimination.

Job Segment: Cyber Security, R&D Engineer, Test Engineer, Testing, Cloud, Security, Engineering, Technology