Principal Product Security Engineer (REMOTE)

Stryker; Portage (MI); Remote; USD 129,000 - 287,000; Full time

Job summary

Une entreprise innovante dans le domaine médical recherche un expert en sécurité des produits pour veiller à la sécurité des dispositifs médicaux. Ce rôle clé implique l'intégration des pratiques de sécurité tout au long du cycle de vie des produits, en collaboration avec des équipes multidisciplinaires. Le candidat idéal aura une solide expérience en cybersécurité et des qualifications pertinentes, ainsi qu'une capacité à travailler dans des environnements réglementés.

Qualifications

• 8 ans d'expérience dans la sécurité des produits, expert en systèmes embarqués.
• Certifications comme CISSP, CSSLP ou CISM souhaitées.
• Connaissance des processus de gestion des risques dans des industries régulées.

Responsibilities

• Établir un cadre complet pour le cycle de vie de développement sécurisé.
• Développer la gestion de la sécurité post-commercialisation et le contrôle des vulnérabilités.
• Intégrer les processus de sécurité dans le système de gestion de la qualité.

Skills

Secure Development

Embedded Systems Security

Regulatory Compliance

Threat Modeling

Penetration Testing

Security Assessments

Cybersecurity Communication

Education

Bachelor's degree in Cybersecurity

Bachelor's degree in Computer Science

Tools

NIST

OWASP

MITRE ATT&CK

FDA Cybersecurity Guidance

IEC 62304

ISO 14971

GDPR

Job description

Work Flexibility: Remote

Product Security is committed to improving healthcare by designing, developing, and maintaining industry-leading cybersecurity products for our customers. We are seeking a highly skilled Secure Product Lifecycle Expert to ensure the security of our medical devices throughout their lifecycle. This role is essential in embedding robust security practices into our software development lifecycle (SDL), overseeing post-market security management, and integrating product security into our quality management systems (QMS).

What You Will Do

• Secure Development Lifecycle (SDL): Establish and maintain a comprehensive SDL framework, integrating secure coding, threat modeling, and security testing for embedded systems and IoT devices, while ensuring compliance with industry regulations (e.g., FDA, IEC 62304, ISO 81001-5-1).

• Post-Market Security Management: Develop and oversee security monitoring, vulnerability management, and incident response, ensuring timely patches and regulatory compliance, while collaborating with external stakeholders.

• Quality Management System (QMS) Integration: Embed security processes into the QMS, support audits, and drive continuous improvements to align with security standards such as ISO 81001-5-1.

• Security Maturity & Collaboration: Apply security maturity frameworks (e.g., BSIMM), align with secure product lifecycle standards, and work cross-functionally with R&D, IT, and regulatory teams to prioritize security.

What You Need

Required Qualifications

• Bachelor's degree in Cybersecurity, Computer Science, or related field with 8+ years of experience, including expertise in secure development, embedded systems security, and regulatory compliance.

• Proficiency in security frameworks (e.g., NIST, OWASP, MITRE ATT&CK) and standards such as FDA cybersecurity guidance, IEC 62304, ISO 14971, and GDPR.

• Experience with threat modeling, penetration testing, security assessments, and the ability to communicate cybersecurity concepts across technical and non-technical teams.

• Industry certifications (e.g., CISSP, CSSLP, CISM).

• Experience in medical devices or regulated industries with familiarity in risk management processes (e.g., FedRAMP, RMF, ATO).

Preferred Qualifications

• Experience conducting HIPAA security assessments.

• Familiarity with VA or DHA risk management processes (FedRAMP, RMF, ATO).

Salary range: $129,600 - $286,500, plus bonus eligibility and benefits. Actual compensation may vary based on location, skills, and experience. Individual pay is determined accordingly.

Travel Percentage: 10%

Stryker Corporation is an equal opportunity employer. Qualified applicants will receive consideration regardless of race, ethnicity, color, religion, sex, gender identity, sexual orientation, national origin, disability, or veteran status. Stryker prohibits discrimination and harassment in the workplace and will not discharge or discriminate against employees or applicants for discussing or disclosing compensation information, except as legally permitted.