Product Security Engineer

Soho Square Solutions; San Diego (CA); On-site; USD 120,000 - 160,000; Full time

Job summary

BD is seeking a Product Security Engineer in San Diego to own and execute the security lifecycle for the MMS Dispensing portfolio, including devices and cloud platforms. You will drive security requirements, threat modeling, risk assessments, and vulnerability management to ensure patient safety and regulatory readiness.

In this role you will collaborate with engineering, quality, regulatory, and product teams to implement secure-by-design controls, lead design reviews, and guide the

Qualifications

• 5+ years cybersecurity experience.
• Experience with FDA Class I/II devices.
• Regulatory/Quality Control product development.
• Demonstrated working experience in embedded, cloud, and application security.
• FDA submissions.

Responsibilities

• Security Architecture & Design across devices, apps, cloud.
• Lead Threat Modeling, Risk Assessments, Requirements/Controls Mapping, Security White Papers.
• Lead and Drive Security Design Reviews & Roadmap Remediations/Mitigations.
• Lean Secure SDLC aligned to NIST, OWASP, BSIMM; SAST, SCA, secrets scanning, container/IaC scanning.
• Support FDA cybersecurity documentation and ensure audit-ready documentation.

Skills

Cybersecurity experience

FDA device cybersecurity

Embedded security

Cloud security

Application security

Risk management

Communication skills

Job description

Job Location - 3750 Torrey View Ct, San Diego, California, United States of America, 92130

We are seeking a Product Security Engineer to support BD’s MMS Dispensing business unit. The Dispensing portfolio includes FDA Class I and Class II medical devices and their associated cloud-connected platforms. The product security engineer owns, leads, and executes the activities and documentation outlined in BD’s security lifecycle. These activities and documents include Security Requirements, Threat Modeling, Risk Assessments and Analysis, Vulnerability & Risk Management Plans, Security Testing, and White Papers.

This role focuses on risk-based security that ensures patient safety, data protection, and regulatory readiness.

Role Focus

• - Execution of Product Security Engineering Lifecycle activities
• - Generation and Maintenance of Product Security Documentation
• - Apply risk-proportionate security controls
• - Emphasize secure-by-design and secure-by-default
• - Balance usability, workflow, and security

Key Responsibilities-

• - Security Architecture & Design
• - Define end-to-end security architecture across devices, apps, and cloud
• - Conduct Threat Modeling, Risk Assessments, Requirements/Controls Mapping, Security White Papers
• - Lead and Drive Security Design Reviews & Roadmap Remediations/Mitigations

Secure SDLC

• - Implement lean Secure SDLC aligned to NIST, OWASP, and BSIMM
• - Integrate SAST, SCA, secrets scanning, container/IaC scanning
• - Define minimum viable security gates

Regulatory & Compliance

• - Support FDA cybersecurity documentation (threat models, SBOMs, risk assessments)
• - Align with IEC 62304, ISO 14971
• - Ensure audit-ready documentation
• - Architect secure integrations with BD’s Cloud Platforms

SBOM & Vulnerability Management

• - Implement continuous vulnerability monitoring
• - Define risk-based remediation SLAs

Cross-Functional Leadership

• - Collaborate with engineering, quality, regulatory, and product teams
• - Translate security into patient safety and business risk
• - Mentor teams

Required Qualifications

• - 5+ years cybersecurity experience
• - Experience with FDA Class I/II devices
• - Regulatory/Quality Control product development
• - Demonstrated working experience in the domains of embedded, cloud, and application security
• - FDA submissions

Preferred Qualifications

• - Software Development, System Engineering background
• - AI (Agentic, Generative, ML) skills and agent development
• - Experience with IoMT ecosystems
• - Knowledge of FDA Cybersecurity Pre & Post Market Guidance, UL 2900, AAMI TIR57/TIR97
• - Certifications (CISSP, CCSP, CSSLP)
• - Experience working in cross-functional product development environments
• - Experience presenting technical security concepts to leadership and business stakeholders- Proven track record of driving security initiatives from concept through implementation
• - Ability to right-size security controls
• - Strong risk-based decision-making
• - Communication across technical and non-technical teams
• -Ability to build credibility and trust across cross-functional teams
• -Excellent verbal, written, and presentation communication skills
• -Ability to navigate ambiguity and drive consensus
• -Ability to balance competing priorities in a fast-paced environment

Success Metrics

• - Comprehensive Threat Modeling and effective Security Risk Management
• - Reduction in critical vulnerabilities
• - FDA submission success
• - Timely completion of security lifecycle deliverables
• - On-time support of product release and submission milestones