Sr. Product Security Engineer - Cloud Digital Solutions

Primary Responsibilities

Cloud & Digital Security Architecture

• Define Security-by-Design and Defense-in-Depth architecture for Digital Health Platforms, cloud-native services, web/mobile applications, APIs, and remote-monitoring solutions.
• Define security requirements for identity, authentication, authorization, secrets, encryption, data protection, network segmentation, logging, and service-to-service communication.
• Design secure interfaces between connected medical-device ecosystems and cloud/digital platforms.

Threat Modeling & Security Risk

• Lead threat modeling, Security Risk Analysis, attack-surface analysis, and security requirements definition for cloud and digital solutions.
• Translate threats into architecture controls, security requirements, verification activities, and risk-control evidence.
• Maintain SBOM and software/component security requirements across cloud applications, services, containers, APIs, and third-party dependencies.

Data, Provisioning & Connected Services

• Define security requirements for data-at-rest, data-in-transit, transient data, retention, access control, and privacy across digital-health workflows.
• Design secure identity, provisioning, certificate, credential, and secrets-management strategies for cloud-connected products and services.
• Support secure eFOTA orchestration, remote monitoring, device-service authentication, telemetry, and secure digital-service integration.

Cloud Security Operations, Assurance & Compliance

• Define cloud security monitoring, logging, vulnerability management, configuration security, and DevSecOps requirements.
• Develop the application-security assurance roadmap and lead readiness, certification/attestation, and recertification activities for programs such as SOC 2, ISO/IEC 27001, HIPAA compliance, and other applicable security/privacy frameworks.
• Coordinate control implementation, evidence collection, gap remediation, audit support, and continuous compliance across engineering, IT, quality, privacy, and business stakeholders.
• Support regulatory submissions and alignment with medical-device cybersecurity, cloud-security, privacy, and digital-health requirements.

Required Qualifications

• Bachelor’s degree in related field with 4 years of relevant experience OR master’s degree in related field with 2 years of relevant experience (Computer Engineering, Electrical Engineering, Computer Science, Cybersecurity).
• Extensive experience in cloud security, application security, digital platforms, cybersecurity architecture, or regulated software development.

Preferred Qualifications

• Strong knowledge of cloud-native security, IAM, APIs, PKI, encryption, secrets management, containers, DevSecOps, logging/monitoring, and data protection.
• Experience with threat modeling, SRA, SBOM/SCA, Security-by-Design, Defense-in-Depth, and regulated medical-device environments.
• Understanding of medical device regulations and standards (e.g., FDA pre- and post-market guidance on cybersecurity for medical device manufacturers, ISO 13485, ISO 81001-5-1, ISO 27001, SOC2, HIPPA, HiTRUST).
• Strong decision-making capabilities, weighing relative costs and benefits to identify the most appropriate solution.
• High attention to detail with a focus on Good Documentation Practices (GDP).
• Ability to communicate complex, technical information in a creative and engaging way to diverse audiences, orally and in writing.
• Excellent prioritization skills, with an aptitude for breaking down work into manageable parts and assessing priority and time required.
• Demonstrated ability to develop and grow productive, trusting, and open relationships with a wide variety of constituencies.