Product Security Engineer

Role Overview The Product Security Engineer is responsible for supporting the security of a BD product or subset of features within the product across the development lifecycle. This individual contributes to the delivery of secure products consistent with global regulatory requirements by executing product security program activities under the guidance of senior team members. The role works in partnership with R&D and other stakeholders to support compliance with security technical requirements and reduce security risks within the product or feature set, including hands‑on execution of product security activities such as threat modeling, vulnerability scanning and remediation, and security risk assessments. Responsibilities Support project teams in defining and implementing security requirements and technologies for a product or set of features in accordance with industry standards for medical devices, including encryption, authentication, audit logging, hardening measures, SBOM creation and composition, patch management, vulnerability monitoring, and antivirus/antimalware as applicable. Support the selection and implementation of appropriate cryptographic algorithms, key management practices, and certificate lifecycle management for devices and cloud‑connected components. Evaluate and support secure communication implementations across device interfaces and network protocols, including validation of TLS/mTLS configurations and medical or proprietary protocols as applicable. Assist in identifying and addressing security risks in cloud‑connected device backends and associated APIs, including authentication, authorization, and protection of data in transit and at rest. Participate in technical design reviews and code inspections, providing feedback and following proper coding practices. Support execution of product security risk assessments, hazard analysis, and vulnerability remediation activities in coordination with product development software engineers. Assist product development teams in complying with product security framework activities and contributing to security documentation such as Incident and Vulnerability Management Plans and Product Security White Papers. Participate in product security incident response activities as appropriate. Support the deployment of software engineering procedures and training related to vulnerability scanning and static code analysis tools. Assist R&D teams in implementing systems for automated testing of software vulnerabilities and verification of OS security patches. Contribute to quality in R&D security test deliverables, including design, data summary, report preparation, and review for adherence to applicable regulations. Perform other duties as required. Minimum Requirements Undergraduate degree in cybersecurity, computer science, computer engineering, software engineering, or related technical field. Minimum of 3+ years in product security, product development, software development, or quality assurance. Foundational knowledge of information security standards for product development. Experience with configuration and use of static code analysis and vulnerability scanning tools. Foundational understanding of applied cryptography and PKI concepts (cipher selection, key management, certificate lifecycle). Preferred Knowledge & Skills Master’s degree in cybersecurity, computer science, software engineering with minimum of 2 years of industry experience. Familiarity with product cybersecurity requirements in the context of 510(k) and/or PMA‑regulated products. Experience assessing security risks using industry standard methods (penetration test results, threat modeling, security testing) and applying compensating security controls. Foundational competence in threat modeling software systems or software‑enabled products using industry standard methods (STRIDE, PASTA, NIST, OWASP). Understanding of applied cryptography fundamentals and PKI concepts including CA hierarchies, certificate lifecycle management, and revocation mechanisms (CRL/OCSP). Familiarity with securing network communications, including TLS/mTLS configuration and validation, and medical or device‑specific protocols (e.g., HL7, FHIR, BluetoothLE) as applicable. Foundational awareness of cloud and API security principles, including authentication/authorization patterns and protection of PHI/PII in cloud‑connected product architectures. Exposure to cybersecurity tooling such as Black Duck, Coverity, Veracode, Nessus, Snyk, or Metasploit. Experience working within a structured software development lifecycle process; agile methodology. Experience with connected products, software development, lifecycles, network technologies, or regulated environments. Certifications such as CCNA, CISSP, CISM, GIAC, CCSP, CEH. Equal Opportunity Employer Statement Becton, Dickinson, and Company is an Equal Opportunity Employer. We evaluate applicants without regard to race, color, religion, age, sex, creed, national origin, ancestry, citizenship status, marital or domestic or civil union status, familial status, affectional or sexual orientation, gender identity or expression, genetics, disability, military eligibility or veteran status, and other legally protected characteristics. #J-18808-Ljbffr