Senior Product Cyber Security Engineer

Job Description

Summary

We are seeking a Senior Product Cyber Security Engineer to own the cybersecurity deliverables for assigned products end to end and to build the automation that lets a small team cover a large portfolio. You will plan the security activities for each release, lead threat modeling, run composition and static analysis, produce and monitor Software Bills of Materials (SBOMs), coordinate penetration tests, and write the documentation that goes into our design history files, regulatory submissions and customer assurance packages.

This is a product security engineering role, not an IT security, SOC or penetration testing role. You will read code, work in build pipelines, and defend your risk assessments in front of auditors, regulators and customers. You will work daily with R&D, Software Engineering, DevOps, Systems Engineering, Quality and Regulatory Affairs, and with our corporate product security and cyber risk teams.

This position is remote within the United States, with regular overlap with Pacific time working hours.

Key Responsibilities

Product Cybersecurity Planning and Deliverables

• Own the cybersecurity plan and the Product Security Management Plan for assigned products, covering new development, major releases and sustaining changes, in line with our product cybersecurity procedures.
• Produce the required deliverable set for each product: product security requirements gap analysis, threat model and data flow map, Product Security White Paper, Incident and Vulnerability Management Plan, Patch Management Plan, Cybersecurity Risk Summary Report, and third-party vendor assessments.
• Decide with the team which deliverables apply to each product, scale them to the product's risk and regulatory status (research-use-only versus IVD), and document every exemption with its justification.
• Keep the Product Security Management File complete, traceable and ready for FDA inspections and notified-body audits.

Threat Modeling and Risk Assessment

• Lead STRIDE-based threat modeling sessions with product teams: assets, data flows, trust boundaries, threats, controls, and the risk register entries that result.
• Assess products against our product security requirements, score findings with CVSS, and work with R&D on remediation or documented risk acceptance.
• Document unresolved and accepted risks in the Cybersecurity Risk Summary Report that supports release decisions, and feed cybersecurity hazards into the product risk management file where patient safety is affected.

Security Testing, SBOM and Vulnerability Management

• Run static code analysis and software composition analysis (e.g., Snyk) on product releases, triage findings with engineering, and archive the reports.
• Generate and validate CycloneDX SBOMs from the actual release artifacts of every software-enabled product, integrate SBOM generation into build and release pipelines, and load SBOMs into our post-market vulnerability monitoring tool (e.g., CyBeats).
• Monitor post-market vulnerability reports against product SBOMs, assess impact with R&D, and drive remediation within the timelines our procedures set.
• Coordinate penetration tests with our corporate product security engineering team: define scope from the roadmap, schedule tests early in development and before submissions, evaluate results and assess mitigations.
• Support investigation of externally reported vulnerabilities and potential cybersecurity complaints together with our corporate cyber risk team.

Patch Management and Secure Baselines

• Maintain product Patch Management Plans and author or review Security Patch Verification Protocols and Reports.
• Deliver the annual operating system patch verification bulletins for IVD products in the patch verification program.
• Contribute to hardened Windows 11 baseline images for instrument workstations and to the process for managing product-level exceptions.

Customer and Regulatory Assurance

• Assemble cyber assurance packages for key customers (SBOMs, Product Security White Papers, penetration test attestations, SOC 2 summaries) and answer customer security questionnaires.
• Prepare the cybersecurity content of regulatory submissions (FDA premarket cybersecurity requirements, EU IVDR) and support internal reviews, audits and regulator interactions.
• Review third-party security checklists and SOC 2 reports for third-party software and services used in or with our products.

Automation, Metrics and Scaling

• Build and maintain scripts and pipeline steps that generate SBOMs, scan results and audit evidence automatically, so deliverables stay current with every release instead of being rebuilt by hand.
• Produce cross-portfolio security risk reporting and in-market risk metrics for leadership, and keep work-item tracking for security activities current.
• Help evaluate and adopt AI-assisted tooling for drafting and checking security documentation.
• Contribute to updates of our product security procedures and security requirements as corporate policy, FDA expectations and submission feedback evolve.

Cross-Functional Guidance

• Act as the product security subject matter expert for R&D, DevOps, Quality, Regulatory and partner teams.
• Provide practical guidance on secure design, secure update and installation mechanisms, vulnerability remediation and compliance expectations.
• What Success Looks Like in the First Year
• Within 90 days: you own the cybersecurity deliverables for one product release end to end, from the cybersecurity plan to the Cybersecurity Risk Summary Report.
• Within six months: SBOM generation and composition analysis run automatically in the build for the products you support, with results loaded into post-market monitoring.
• Within twelve months: you cover two to three products in parallel, penetration tests and patch verification bulletins for your products are delivered on schedule, and leadership receives regular in-market risk metrics for them.

Required Qualifications

• Bachelor's degree in Computer Science, Software Engineering, Cybersecurity or a related technical field, or equivalent practical experience.
• 10+ years of experience in software engineering, product or application security, or cybersecurity engineering, including hands-on security work on software products that shipped to customers.
• Basic software engineering fluency: you read and write code in some language, you are comfortable with commandline, you are aware of build systems and package ecosystems (npm, pip, NuGet) and CI/CD pipelines (Azure DevOps or similar).
• Hands-on experience with threat modeling (STRIDE or similar), vulnerability assessment, CVSS scoring, remediation, and risk acceptance.
• Strong collaboration and communication skills, with the ability to work across R&D, Regulatory, and Customer-facing teams.

Industry: Healthcare technology with a focus on product cybersecurity for medical devices and software.