Senior Engineer, Product Cyber Security

This is a fully remote position, open to applicants in Arizona, +5 more states.

📋 Description

• Take ownership of cybersecurity deliverables for designated products from the planning stage through to their release.

• Develop Product Security Management Plans and product-specific cybersecurity strategies.

• Lead threat modeling and risk assessment initiatives using the STRIDE framework.

• Conduct static code analysis and software composition analysis; manage and categorize findings.

• Create, validate, and integrate CycloneDX Software Bill of Materials (SBOMs) into build and release processes.

• Oversee the monitoring of post-market vulnerabilities and drive remediation efforts.

• Coordinate penetration testing activities and assess mitigation strategies.

• Maintain security patch management plans along with verification protocols and reporting.

• Contribute to the development of hardened Windows 11 baseline images and manage product-level exceptions.

• Compile customer cyber assurance packages and respond to security-related questionnaires.

• Prepare cybersecurity documentation for FDA and EU IVDR regulatory submissions.

• Review third-party security checklists and SOC 2 compliance reports.

• Develop automation processes for SBOMs, scan results, and audit documentation.

• Create security risk reporting for the portfolio and track in-market risk metrics.

• Serve as the product security subject matter expert for R&D, DevOps, Quality Assurance, Regulatory, and partner teams.

⛳️ Requirements

• Bachelor’s degree in Computer Science, Software Engineering, Cybersecurity, or a related technical discipline, or equivalent practical experience.

• Over 10 years of experience in software engineering, product or application security, or cybersecurity engineering, including direct security involvement with software products delivered to customers.

• Basic proficiency in software engineering, including the ability to read and write code, command-line operations, build systems, package ecosystems, and CI/CD pipelines.

• Practical experience with threat modeling, vulnerability assessment, CVSS scoring, remediation workflows, and risk acceptance.

• Familiarity with static analysis tools, software composition analysis tools, and SBOM formats like CycloneDX or SPDX.

• Experience in producing formal security deliverables that undergo review in audits or regulatory submissions.

• Excellent written communication skills in English, suitable for interaction with auditors, regulators, and customers.

• Capacity to manage multiple product workstreams concurrently in a procedure-driven, documentation-intensive environment.

• Preferred: experience in the fields of medical devices, in vitro diagnostics, life sciences, or other regulated software sectors.

• Preferred: knowledge of FDA premarket cybersecurity guidelines, EU MDR/IVDR, ISO 14971, AAMI TIR57, IEC 81001-5-1, or UL 2900 standards.

• Preferred: experience with tools such as Snyk, CyBeats, Tenable, Qualys, Windows hardening, penetration testing, supplier security assessments, security metrics, AI/LLM tools, FDA inspections, notified-body audits, or ISO 13485 audits.

🏝️ Benefits

• Comprehensive Total Rewards program.

• Opportunities for recognition and rewards.

• Competitive compensation and benefits packages.

• Opportunities for learning, growth, and development.

• A collaborative culture that emphasizes face-to-face interaction.