Senior Product Security Engineer – Software - CRDN

Responsibilities

• Support and lead integration of security into the product development lifecycle, ensuring that security considerations are incorporated from design to deployment.
• Work closely with scrum teams to ensure security is a core part of the product design and development process in Agile environment.
• Conduct threat modeling, security risk evaluations, and vulnerability assessments to identify and mitigate potential security risks throughout the product lifecycle.
• Contribute to the design and deployment of secure medical device architectures and product designs.
• Assist in the implementation of key security features such as secure boot, secure communications, data protection, secure updates, secure integration, and access controls.
• Collaborate with senior engineers to ensure that security architecture aligns with product security requirements and best practices.
• Assist in maintaining and implementing security standards, policies, and procedures for medical device systems and product development.
• Contribute to security testing activities, including vulnerability scanning, penetration testing, and code reviews.
• Ensure compliance with industry standards and regulations related to medical device and health software product security, such as NIST, IEC 60601-4-5, IEC 81001-5-1, and others.
• Lead and support the effective response to security incidents, ensuring swift resolution, proper mitigation, and clear communication to stakeholders, including customers when needed.
• Maintain detailed documentation of security best practices, guidance, configurations, design patterns, shared service designs, inventories, incident response plans, security architectures, and reports.
• Participate in ongoing professional development to stay current with emerging cybersecurity trends and threats related to medical devices and health software products.

Qualifications

Bachelor’s degree in computer engineering, electrical engineering, computer science, engineering, or a related technical discipline and minimum of 4 years of technical work experience OR advanced degree in computer engineering, electrical engineering, computer science, engineering, or a related technical discipline with 2 years of technical work experience.

Nice to Have

• Minimum 2 years of security experience in a regulated industry
• Security certifications (e.g. GSEC, CISSP, CISA, GCIH, CC)
• Bachelor’s degree in related engineering or cybersecurity from an accredited institution.
• Proficiency in secure coding practices and methodologies is highly desirable.
• Ability to adapt to the rapidly evolving cybersecurity landscape and contribute to proactive security strategies.
• Demonstrated ability to identify challenges and propose effective solutions.
• Familiarity with evolving regulations in the medical device sector and staying updated with relevant security standards.