Senior Product Security Engineer - Onsite

Sr. Product Security Engineer

At Medtronic, you can begin a life-long career of exploration and innovation, while helping champion healthcare access and equity for all. You'll lead with purpose, breaking down barriers to innovation in a more connected, compassionate world.

The Sr. Product Security Engineer is responsible for designing advanced cybersecurity architectures and effective procedural frameworks to support cyber resilience throughout the product life cycle.

The primary responsibilities include overseeing all phases of the cybersecurity lifecycle for medical devices. These include proactive initiatives to identify, model, and evaluate cybersecurity threats, define security measures to mitigate those threats, develop robust implementation strategies, and rigorous verification and validation mechanisms. Proactively engage with cross-functional development teams and prepare reports meeting quality and regulatory requirements.

Key Responsibilities:

• Product Security – Implement security requirements across the medical device development lifecycle by collaborating with teams to uphold best practices from design to deployment.
• Risk Assessment – Conduct threat modeling and vulnerability assessments to identify and mitigate security risks throughout the product lifecycle.
• Security Architecture – Support the design and deployment of secure medical devices by implementing features like secure boot, communications, data protection, updates, integration, and access controls.
• Web and Cloud Security – Implement and mature the digital health platform architecture to meet customer expectations and enable development of digital solutions across Neuromodulation and Pain & Hypertension, including PH My Future, Insights Dashboard, Remote Monitoring, Remote Programming, and the DBS BrainSense Portal. Define and execute surveillance strategy across web applications and cloud native platforms.
• Security Standards & Compliance – Implement and maintain security policies for medical devices following industry standards like NIST, ISO27001, and IEC 81001-5-1. Regularly assess compliance and work with development teams to improve security practices.
• Stay updated on cybersecurity trends in medical devices and health software. Work with others to improve security strategies and apply best practices.

Minimum Requirements:

• Bachelor's degree in Computer Science or a related field with 4+ years of experience in cyber security, embedded systems security, IoT security, IT security, or a related role.
• Advanced degree in Computer Science or a related field with significant academic work in cyber security and 3+ years of experience in a related role.

Technical Skills:

• Strong understanding of cybersecurity concepts and frameworks (e.g., NIST, OWASP)
• Familiarity with security standards such as ISO 27001, ISO 14971, or HITRUST
• Working knowledge of secure software development lifecycle (SDLC) principles and DevSecOps
• Strong understanding of advanced cryptography, Hardware Security Module concepts, and secure key generation and management

Soft Skills:

• Proactive communication skills to identify, present, and persuade leadership on cybersecurity risks
• Strong problem-solving and analytical skills
• Ability to collaborate effectively in cross-functional teams

Certifications (Preferred):

CompTIA Security+, CISSP, CISM, or similar security certifications.

For Baccalaureate degrees earned outside of the United States, a degree that satisfies the requirements of 8 C.F.R. § 214.2(h)(4)(iii)(A) is required.

Physical Job Requirements

The above statements are intended to describe the general nature and level of work being performed by employees assigned to this position, but they are not an exhaustive list of all the required responsibilities and skills of this position. 

The physical demands described within the Responsibilities section of this job description are representative of those that must be met by an employee to successfully perform the essential functions of this job. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions. For Office Roles: While performing the duties of this job, the employee is regularly required to be independently mobile. The employee is also required to interact with a computer, and communicate with peers and co-workers. Contact your manager or local HR to understand the Work Conditions and Physical requirements that may be specific to each role.

U.S. Work Authorization & Sponsorship

At Medtronic, we are committed to fostering an environment where employees can thrive and make a meaningful impact. In alignment with our enterprise-wide workforce planning approach, U.S. work authorization sponsorship (H-1B, TN, J, etc.) is offered exclusively for Principal-level roles and above, where specialized expertise aligns with long-term business needs. Roles below the Principal level require candidates to possess unrestricted U.S. work authorization at the time of hire and for the duration of employment.

Join us in our mission to alleviate pain, restore health, and extend life—where your unique background and perspective are valued.