Principal Product Security Engineer
Smith+Nephew
Summary
Join our Global Product Security team in Pittsburgh and help protect medical technologies, connected devices, digital solutions, and the data they rely on. You will provide cybersecurity leadership across the full product lifecycle while partnering with Global IT, Research and Development, and Compliance teams.
Job description
What will you be doing?
- Lead the definition and implementation of cybersecurity requirements and controls across technologies, capital devices, digital accessories, connected infrastructure, and software applications
- Create and maintain product cybersecurity risk registers and threat models, identifying and addressing security risks throughout the development lifecycle
- Lead security testing and assessment activities, including vulnerability testing, penetration testing, code analysis, software composition analysis, and endpoint protection
- Recommend technical solutions and support the integration of automated tools and processes that reduce security vulnerabilities
- Help develop and mature the Global Product Security Strategy and Secure Software Development Life Cycle
- Support product cybersecurity incident response activities in line with relevant industry practices and standards
- Provide technical leadership when engaging with regulators, customers, auditors, industry groups, and security researchers
What will you need to be successful?
- A bachelor's degree in life science, computer science, information systems, or equivalent formal training or professional experience
- At least five years of hands on experience in product security, device security, application security, or information technology security
- Experience with vulnerability management, penetration testing, code security, security governance, risk assessments, network infrastructure, and cloud security
- Knowledge of medical device regulations and cybersecurity frameworks, including HIPAA, FDA requirements, ISO 27001 and 27002, NIST CSF, and OWASP
- The ability to design and guide the implementation of innovative security solutions while working independently across multiple teams and business areas
- Excellent written and verbal communication, prioritization, customer service, and problem resolution skills
- A current CISM, CISSP, CRISC, or equivalent certification is preferred
Requirements
- Bachelor's degree in life science, computer science, information systems, or equivalent formal training or professional experience
- At least five years of hands-on experience in product security, device security, application security, or information technology security
- Experience with vulnerability management, penetration testing, code security, security governance, risk assessments, network infrastructure, and cloud security
- Knowledge of medical device regulations and cybersecurity frameworks, including HIPAA, FDA requirements, ISO 27001 and 27002, NIST CSF, and OWASP
- Ability to design and guide implementation of innovative security solutions while working independently across multiple teams and business areas
- Excellent written and verbal communication, prioritization, customer service, and problem resolution skills
- Current CISM, CISSP, CRISC, or equivalent certification is preferred
Benefits
- Medical, Dental & Vision
- 401(k) Matching
- 401(k) Plus Program
- Discounted Stock Options
- Tuition Reimbursement
- Flexible PTO
- Paid Holidays
- Flex Holidays
- Paid Community Service Day
- Health Savings Account
- Employee Assistance Program
- Parental Leave
- Fertility & Adoption Assistance
- Fitness Club Discounts
Company overview
Smith+Nephew is a global portfolio medical technology company with a rich history dating back to 1856, originally founded as a chemist shop in Hull, UK. The company specializes in the repair, regeneration, and replacement of soft and hard tissue through innovative medical devices and technologies. Operating through three core business units—Orthopaedics, Sports Medicine & ENT, and Advanced Wound Management—Smith+Nephew serves healthcare professionals and patients in over 100 countries worldwide. With approximately 18,000 employees, the company generated annual sales of $5.5 billion in 2023 and is listed on both the London Stock Exchange (FTSE100) and New York Stock Exchange. Their product portfolio includes joint replacement systems, robotics-assisted surgical platforms, sports medicine implants, advanced wound care solutions, and ENT technologies. The company is pioneering new frontiers in medical technology, including Spatial Surgery systems that integrate augmented reality and real-time data processing for enhanced surgical precision. Smith+Nephew's mission centers on their "Life Unlimited" purpose, aiming to restore patients' bodies and self-belief through technological innovation that removes limitations on living.