Product Security Engineer

Product Security Engineer

We are seeking a Product Security Engineer to join our team and lead the implementation of enterprise security strategies across our orthopedic medical device portfolio. This position plays a key role in both pre-market and post-market product development, ensuring our products meet the highest standards of security and compliance.

Key Responsibilities

• Support and evolve the Global Product Security Framework, contributing to secure-by-design principles throughout product development.
• Collaborate cross-functionally with engineering, product management, and compliance teams to improve product security processes and policies.
• Create and present security metrics and performance dashboards to senior leadership, offering insights into organizational security posture.
• Drive governance models for product security throughout the lifecycle—ensuring alignment with FDA, 510k, and other regulatory requirements.
• Prioritize and manage product vulnerabilities, working with development teams on mitigation strategies and remediation.
• Perform threat modeling, risk assessments, and due diligence on both new and existing devices.
• Respond to customer security questionnaires and support the negotiation of security-related contractual obligations.
• Monitor vulnerabilities in marketed products, assisting with remediation and customer communications as needed.
• Conduct or support penetration testing, vulnerability scans, and analysis using tools such as CVSS, OWASP, etc.
• Support the integration and tracking of Software Bill of Materials (SBOM) for security and compliance purposes.

Required Qualifications

• Bachelor's degree in Computer Science, Engineering, or related field (Master's degree preferred).
• 5+ years of experience in product security, embedded software security, or related security roles—preferably in a regulated environment (medical device experience is a plus).
• Proficient in threat modeling, vulnerability management, and risk analysis.
• Hands-on experience with security assessment tools and methodologies.
• Familiarity with FDA cybersecurity regulations, 510k submissions, and quality design controls.
• Strong understanding of SBOM and its implications for device security.
• Excellent communication and collaboration skills, especially in presenting technical topics to non-technical stakeholders.
• Proven ability to drive security initiatives across cross-functional teams.

Preferred Certifications

• CISSP, CEH, CSSLP, MCSD, or similar (preferred, not required)