Product Security Engineer

Job Title: Security Engineer (Product / Medical Device Security)

Contract Duration: 06 Months
Location: Hybrid Marlborough, MA or San Diego, CA
Division: Diagnostics Software Engineering (R&D

Job Summary

We are seeking an experienced Security Engineer to support the design, development, and lifecycle security of medical software and device products within our Diagnostics R&D organization. This role plays a critical part in ensuring products meet cybersecurity, regulatory, and FDA requirements while maintaining patient safety.

The Security Engineer will serve as a key cybersecurity representative for product development teams, working cross-functionally to embed security into product architecture, development processes, and post-market activities. Level (Senior vs Lead) will be determined based on depth of experience and demonstrated leadership.

Key Responsibilities

• Apply Secure by Design principles to ensure cybersecurity is integrated throughout the product lifecycle.
• Perform threat modeling using industry-standard methodologies (e.g., STRIDE, PASTA) to identify and mitigate security risks.
• Design and review secure system architectures, including support for safe software updates and patch management.
• Develop and maintain security design documentation, architecture diagrams, and standard operating procedures.
• Establish and support incident response playbooks, coordinate security incident investigations, and conduct root cause analysis (RCA).
• Define security requirements and controls based on risk assessments, use cases, and threat models.
• Establish automated vulnerability scanning and perform ongoing risk analysis, prioritizing risks impacting patient safety using CVSS.
• Ensure Software Bill of Materials (SBOMs) are accurate and support continuous vulnerability monitoring.
• Review static code analysis results and third-party software assessments in collaboration with software and DevSecOps teams.
• Collaborate with Product Engineering, DevSecOps, Quality, and Regulatory teams to ensure compliance with FDA and industry cybersecurity requirements.
• Support post-market cybersecurity monitoring, remediation, and regulatory activities.

Required Qualifications

• Bachelor s or Master s degree in Computer Science, Cybersecurity, or a related engineering field, or equivalent experience.
• 8+ years of professional experience in product security or cybersecurity engineering.
• Strong understanding of risk assessment and risk management processes.
• Experience working in regulated environments, preferably medical devices or healthcare products.
• Hands-on experience with:
• Windows and Linux systems, including system hardening
• Networking concepts and protocols (TCP/IP, firewalls, routers, switches)
• Security frameworks and testing tools
• Translating security findings into product and engineering requirements
• Scripting and basic automation (e.g., Python, PowerShell)
• Excellent communication skills with the ability to explain security concepts to technical and non-technical stakeholders.
• Proven ability to work effectively in cross-functional teams.

Preferred Qualifications

• Experience supporting FDA submissions, audits, and regulatory reviews.
• Familiarity with cybersecurity standards and regulations such as:
• FDA Cybersecurity Guidance
• NIST, AAMI, CLSI, UL, BSI
• HIPAA, GDPR, and applicable state/federal standards
• Experience translating cybersecurity requirements into product requirements and verification plans with traceability.
• Experience supporting or establishing penetration testing and continuous security testing programs.