Staff Product Security Engineer

PowerToFly; Gurugram District; On-site; INR 1,500,000 - 2,600,000; Full time

Job summary

Stryker is seeking Product Cybersecurity Engineers to design secure medical devices and applications. You will participate in risk analysis, threat modeling, and risk mitigation throughout the product lifecycle, including embedded software and hardware security facets.

You will collaborate with Quality, Regulatory, and Marketing to ensure HIPAA compliance, lead SDLC security tasks, and implement automated testing and policies across the product line.

Qualifications

• Bachelor's degree in Software Engineering/ Computer Science or related field with 6+ years of experience.
• Experience with security requirements, malware analysis, vulnerability assessment, and pen testing.
• Understanding of NIST/IEC/ISO security standards and healthcare security frameworks.

Responsibilities

• Perform cybersecurity risk analysis and threat modeling with mitigation plans.
• Collaborate with Quality, Regulatory, and Marketing on cybersecurity and HIPAA alignment.
• Lead hardware and software security activities across the SDLC and product life cycle.
• Conduct systems hardening, pentesting, vulnerability scanning, and remediation.
• Review embedded and clinical application code for security flaws.
• Develop and implement security policies to meet industry standards.
• Integrate automated security testing into SDLC and automate routine tasks with scripting.
• Support incident response, V&E assessments, and manage security incidents resolution.

Skills

Cybersecurity risk analysis

Threat modeling

Penetration testing

Code reviews

Scripting (PowerShell/Python/Ruby)

Security architecture

Incident response

Vulnerability scanning

HIPAA compliance

Regulatory compliance

Education

Bachelor's degree in Software Engineering/ Computer Science

Tools

Security testing tools

Job description

Who we want:

We seek Product Security engineers who can help us design cyber secure medical devices and applications.

What you will do:

As a Product Cybersecurity Engineer, you will participate in project planning, product cybersecurity risk analysis, and risk mitigation strategies. You will lead various product cybersecurity tasks and activities established by product design controls and SDLC procedures. You will be involved in all facets of the robotics and enabling technology product development life cycle.

Technical Responsibilities:

• You will perform cybersecurity risk analysis and threat modeling and develop mitigation strategies.

• You will work closely with cross-functional teams, including Quality, Regulatory, and Marketing, in driving alignment around product Cybersecurity and HIPAA compliance.

• You will provide input to project management on scheduling, milestone achievement, and project challenges.

• You will participate in all product hardware and software security facets, including systems hardening, automated and manual penetration testing, automated vulnerability scanning for compliance, and issue remediation.

• To identify security flaws, you will perform manual and automated code reviews for complex embedded and clinical application software.

• You will develop and implement security policies and procedures to ensure compliance with industry standards.

• You will integrate automated security testing into all phases of SDLC.

• You will automate routine tasks and extract valuable data using various scripting languages like PowerShell, Ruby, or Python.

• You will research and implement best practices in the product cybersecurity architecture around security systems, including improper access control, code injection, information exposure, firewalls, and multi-factor authentication.

• You will support cybersecurity documentation requests from legal and sales teams as needed.

• You will participate in incident response, V&E assessments and manage the resolution of security incidents.

Minimum Qualifications (Required):

Bachelor's degree in Software Engineering/ Computer Science or related discipline & 6+ years of work experience

Preferred Qualifications (Strongly desired):

• Experience with security requirements, data security, malware analysis, vulnerability assessment, and penetration testing using off-the-shelf tools and techniques is preferred.

• Understanding one or more security standards/frameworks like NIST 800-53, IEC80001-2-8, IEC 27002, ISO 27799, IEC 15408-2, and IEC 62443-3-3.

• Solid understanding of Linux operating systems.

• Experience in securing medical devices or embedded devices.

• Understanding of networking concepts.

• Understanding quality standards like IEC 62304, IEC 60601, and 21CRF 820.

• Experience with threat modeling and risk assessment.

• Security certifications such as CISSP, CSSLP, or CISM are a plus.

Stryker is a global leader in medical technologies and, together with its customers, is driven to make healthcare better. The company offers innovative products and services in MedSurg, Neurotechnology, Orthopaedics and Spine that help improve patient and healthcare outcomes. Alongside its customers around the world, Stryker impacts more than 150 million patients annually.