Sr Product Security Engineer

Description

The application window closes on 7 Nov 2026.

The company is a global healthcare technology business with 95,000 employees across more than 150 countries. The surgical business unit builds technology that helps clinicians improve patient outcomes across many kinds of surgery.

The Product Security team works with research and development, systems engineering, quality, regulatory and product teams to build cybersecurity into each product from start to finish and to strengthen connected medical devices.

You will report to the Director of Product Security. The role protects the surgical unit's medical device solutions, helps add stronger cybersecurity controls, finds and reduces weaknesses, and improves cyber-resilience across the product lifecycle.

You will act as a technical subject matter expert and mentor, work across teams, and help the security posture improve over the long term.

Responsibilities

• Keep up with new cybersecurity threats, technologies and regulations for medical devices and health software, and help shape product security strategy and roadmaps for the unit and the company.
• Push security into every product stage, from concept and design through postmarket, working with system architects, software leads and hardware engineers on secure designs for embedded and cloud-connected systems.
• Run or join threat modeling sessions, carry out security risk assessments, and choose mitigations under IEC 81001-5-1, ISO 14971 and FDA premarket cybersecurity guidance.
• Help design and build secure architectures covering secure boot, secure communications, data protection, access control, secure software updates and hardware-software integration.
• Review and explain results from vulnerability scans, penetration tests, and static and dynamic code analysis, and work with internal teams and outside vendors to reduce risk on time.
• Build security awareness across research and development, support junior engineers, and set an example through documentation, code and design reviews, and open knowledge sharing.
• Make sure products meet NIST, IEC 60601-4-5 and IEC 81001-5-1 requirements, and help prepare security documentation for global regulatory submissions.
• Assess the cybersecurity posture of third-party suppliers and open-source components used in product designs.
• Support technical investigations and fixes for postmarket security incidents and field issues, and lead root cause work, containment and risk assessments.
• Maintain security documentation such as threat model diagrams, risk assessments, shared service inventories, design patterns, security guidelines, and product security plans and reports.

Requirements

• A bachelor's degree with at least 4 years of experience in cybersecurity, product security, software security, embedded systems security or medical device security, or a master's degree with at least 2 years of related experience, or a PhD.
• Hands-on experience with threat modeling, cybersecurity risk assessments and risk mitigation.
• Experience building cybersecurity practices into a secure product development lifecycle.
• Experience with vulnerability assessment, penetration testing, static analysis, dynamic analysis or application security testing.
• Experience designing or reviewing security architectures and controls for connected products.
• Preferred: experience securing medical devices, healthcare technology, embedded systems, Internet of Things (IoT) devices or cloud-connected products.
• Preferred: knowledge of IEC 81001-5-1, IEC 60601-4-5, ISO 14971, FDA cybersecurity guidance and NIST cybersecurity frameworks.
• Preferred: experience with secure boot, cryptography, authentication, authorization, access management, secure communications, data protection and secure software update mechanisms.
• Preferred: experience supporting cybersecurity work in regulated healthcare, life sciences or medical technology settings.
• Preferred: a cybersecurity certification such as CISSP, GIAC, CEH or a similar one.
• A bachelor's degree earned outside the United States must satisfy 8 C.F.R. § 214.2(h)(4)(iii)(A).

Conditions

The role may be based in Lafayette, Colorado or North Haven, Connecticut, on an onsite basis with regular in-person work with cross-functional engineering teams and business partners.

The base salary range is $132,000.00 to $198,000.00 USD for U.S. locations, excluding Puerto Rico and certain California locations, and the final offer may vary with experience, certification or education, market conditions and location.

U.S. work authorization sponsorship (H-1B, TN, J, etc.) is offered only for Principal-level roles and above. For roles below Principal, candidates must have unrestricted U.S. work authorization at the time of hire and for the whole time they are employed.

The role is eligible for the company's short-term incentive, the company Incentive Plan (MIP).

The company provides equal employment opportunity regardless of protected characteristics, including citizenship status, and reasonable accommodation for qualified people with disabilities.

Where the role involves at least two hours a week in unincorporated Los Angeles County, applicants with arrest or conviction records are considered under the Los Angeles County Fair Chance Ordinance and the California Fair Chance Act.

While doing the job you will regularly need to move around independently, use a computer, and communicate with peers and co-workers. Ask your manager or local HR about any other physical or work conditions for the role.

The listed duties describe the general nature and level of the work and are not a complete list of every responsibility and skill.

Benefits

• A competitive salary and a flexible benefits package, plus the short-term incentive.
• Regular employees working 20+ hours per week get health, dental and vision insurance, a Health Savings Account, a healthcare Flexible Spending Account, life insurance, long-term disability leave, a dependent daycare spending account, tuition assistance or reimbursement, and the Simple Steps well-being program.
• All regular employees get incentive plans, a 401(k) with employer contribution and match, short-term disability, paid time off, paid holidays, the Employee Stock Purchase Plan, the Employee Assistance Program, a non-qualified retirement plan supplement (subject to IRS earning minimums), and a Capital Accumulation Plan (for Vice Presidents and above, or subject to IRS earning minimums).
• Temporary employees get paid sick time where state law requires it and can join the Employee Stock Purchase Plan. Some benefits may not apply in Puerto Rico.