Principal Product Security Engineer - Medical Devices

Scorpion Therapeutics; Santa Clara (CA); On-site; USD 180,000 - 240,000; Full time

Benefits offered by this job

Vacation: 120 hours/year

Sick time: 40 hours/year

Holiday pay: 13 days/year

Parental Leave: 480 hours

Job summary

Scorpion Therapeutics in Santa Clara, CA is seeking a Principal Product Security Engineer to secure connected medical devices, robotic systems, and cloud services across the product lifecycle. You will guide security requirements, perform risk assessments, and drive remediation with cross-functional teams.

Responsibilities include threat modeling, security-by-design, and coordinating SAST/SCA testing, with extensive expertise in embedded/IoT security, crypto, and authentication/authorization

Qualifications

• BS in CS/Cybersecurity/Software Engineering or equivalent.
• 8+ years in cybersecurity/product security/cloud security.
• Experience with threat modeling, secure development, vulnerability management, pen testing, security design review, and risk assessment.

Responsibilities

• Serve as cybersecurity technical lead for complex medical device/digital health programs.
• Lead security design reviews and risk-based mitigations across embedded, cloud, and apps.
• Coordinate security testing (SAST, SCA, fuzzing, pen testing) and ensure traceability to risks and requirements.
• Lead vulnerability management and post-market security activities including patching and disclosures.

Skills

Threat modeling

Secure development

Vulnerability management

Pen testing

Security design review

Cybersecurity risk assessment

Embedded/IoT security

Cloud security

Authn/Authz

OS hardening

Cryptography

Education

BS in CS/Cybersecurity/Software Eng

Tools

SAST tools

SCA tools

Threat modeling tools

Job description

Scorpion Therapeutics in Santa Clara, CA is seeking a Principal Product Security Engineer to secure connected medical devices, robotic systems, and cloud services across the product lifecycle. You will guide security requirements, perform risk assessments, and drive remediation with cross-functional teams.

Responsibilities include threat modeling, security-by-design, and coordinating SAST/SCA testing, with extensive expertise in embedded/IoT security, crypto, and authentication/authorization