Sr. Product Security Engineer - Embedded IoT

Description

Applications for this role close on 11 Nov 2026.

The company is a global healthcare technology business with about 95,000 employees in more than 150 countries. Its devices and therapies serve 72+ million patients each year.

The Neuromodulation and Pelvic Health R&D groups combine many Neurosciences therapies and draw on the company's talent, products, services and solutions. Their devices and therapies treat chronic pain, movement disorders, overactive bladder, non-obstructive urinary retention and other conditions.

This senior role owns cybersecurity architecture for implantable and connected medical device platforms, with a focus on building security into the design. The work covers embedded systems, device connectivity, cryptography, secure provisioning, firmware updates, and protecting communication between devices and with edge systems.

Responsibilities

• Define security architecture and requirements for implantable devices, programmers and controllers, gateways, and connected operating environments.
• Apply Security-by-Design and Defense-in-Depth across hardware, firmware, communication interfaces, authentication, authorization and data protection.
• Design secure boot, HSM and secure-element integration, encryption, key management, device identity and secure provisioning.
• Lead threat modeling, Security Risk Analysis, attack-surface analysis and security requirements definition across the full device lifecycle.
• Turn identified threats into architectural controls, product security requirements, verification activities and risk-control evidence.
• Maintain the SBOM and software and component security requirements for embedded platforms.
• Define secure communication architecture for BLE, wired and wireless interfaces, programmers, gateways and remote-monitoring connectivity.
• Support secure eFOTA and firmware update architecture, covering signing, authentication, anti-rollback, integrity checks and recovery.
• Define manufacturing security requirements for device identity, cryptographic key and certificate injection, provisioning and lifecycle management.
• Build cybersecurity requirements into systems, software, hardware, manufacturing, verification and risk-management processes.
• Support regulatory submissions and compliance with medical-device cybersecurity standards and guidance.

Requirements

• Hold a bachelor's degree in a related field plus 4 years of relevant experience, or a master's degree in a related field plus 2 years of relevant experience. Related fields include computer engineering, electrical engineering, computer science and cybersecurity.
• Bring extensive experience in embedded security, IoT security, firmware, connected devices or medical-device development.
• If your bachelor's degree was earned outside the United States, it must satisfy 8 C.F.R. § 214.2(h)(4)(iii)(A).
• Preferred: Strong knowledge of cryptography, HSM and secure elements, PKI, secure boot, provisioning, firmware signing, BLE and network security, and embedded secure development.
• Preferred: Experience with threat modeling, Security Risk Assessment, SBOM, Security-by-Design, Defense-in-Depth and regulated product development.
• Preferred: Understanding of medical device regulations and standards, such as FDA pre- and post-market cybersecurity guidance for medical device manufacturers, ISO 13485 and ISO 81001-5-1.
• Preferred: Sound decision-making that weighs relative costs and benefits to choose the most suitable solution.
• Preferred: Careful attention to detail and a commitment to Good Documentation Practices (GDP).
• Preferred: Ability to explain complex technical information clearly and engagingly to varied audiences, both orally and in writing.
• Preferred: Strong prioritization, with the ability to break work into manageable parts and judge priority and time needed.
• Preferred: Track record of building productive, trusting and open working relationships with many kinds of stakeholders.

Conditions

U.S. work authorization sponsorship (H-1B, TN, J, etc.) is offered only for Principal-level roles and above. Roles below Principal require unrestricted U.S. work authorization at hire and for the whole time you are employed.

For office roles, you must be able to move about independently, use a computer regularly and communicate with peers and colleagues. Reasonable accommodations may be made for people with disabilities. Ask your manager or local HR about conditions specific to your role.

The listed duties describe the general level of work and are not a complete list of responsibilities and skills.

Equal employment opportunity applies regardless of age, color, national origin, citizenship status, disability, race, religion, sex, gender identity, sexual orientation, veteran status or any other legally protected characteristic, and applicants with arrest or conviction records are considered under the Los Angeles County Fair Chance Ordinance and the California Fair Chance Act.

Benefits

• Competitive salary and a flexible benefits package.
• Base salary for US locations excluding Puerto Rico: $132,000.00 to $198,000.00 USD. Pay varies with experience, certification and education, market conditions and location. Pay for hires outside the US follows local-market terms.
• Role is eligible for the company Incentive Plan, a short-term incentive.
• Salary range applies across the US excluding Puerto Rico and certain California locations, and complies with federal and local rules.
• Regular employees working 20+ hours a week get health, dental and vision insurance, a Health Savings Account, a healthcare Flexible Spending Account, life insurance, long-term disability leave, a dependent daycare spending account, tuition assistance or reimbursement, and Simple Steps, a global well-being program.
• All regular employees get incentive plans, a 401(k) with employer contribution and match, short-term disability, paid time off, paid holidays, the Employee Stock Purchase Plan, the Employee Assistance Program, a non-qualified retirement plan supplement (subject to IRS earnings minimums), and a Capital Accumulation Plan (for Vice Presidents and above, or subject to IRS earnings minimums).
• Regular means not temporary, so interns are excluded. Temporary staff get paid sick time where state law requires it, plus the Employee Stock Purchase Plan. Some benefits may not apply in Puerto Rico. Full details are linked from the posting.