Staff Product Security Engineer

Abbott (abbottcareers2 board); Saint Paul (MN); On-site; USD 140,000 - 190,000; Full time

Job summary

Abbott, a global healthcare leader, is seeking a Senior Product Cybersecurity Engineer for its EP division, onsite at the Tech Center in St. Paul, MN. You will lead cybersecurity across the product lifecycle for connected medical devices.

You will partner with software, firmware, hardware, quality, and regulatory teams to design secure architectures, perform threat modeling, and drive risk mitigation. The ideal candidate has hands-on experience with embedded systems, cryptography, and secure

Qualifications

• Experience with embedded systems and secure device design.
• Knowledge of cryptography and secure firmware update methods.
• Ability to communicate cybersecurity risks to stakeholders.

Responsibilities

• Lead cybersecurity architecture reviews for connected medical devices.
• Incorporate security into software, firmware, and hardware designs across the product lifecycle.
• Develop security controls and review cryptographic services and secure provisioning processes.
• Coordinate with regulatory, quality and product teams for compliance and risk mitigation.
• Perform threat modeling and risk assessments across products.

Skills

Embedded systems

Firmware security

Hardware security

Threat modeling

Vulnerability management

Security architecture

Communication

Cross-functional collaboration

Tools

Python

Linux

C/C++

Job description

Working at Abbott

Abbott is a global healthcare leader that helps people live more fully at all stages of life. Our portfolio of life-changing technologies spans the spectrum of healthcare, with leading businesses and products in diagnostics, medical devices, nutritionals and branded generic medicines. Our 122,000 colleagues serve people in more than 160 countries.

You can do work that matters, grow, and learn, care for yourself and your family, be your true self, and live a full life. You'll also have access to:

• Career development with an international company where you can grow the career you dream of.
• Employees can qualify for free medical coverage in our Health Investment Plan (HIP) PPO medical plan in the next calendar year.
• An excellent retirement savings plan with a high employer contribution
• Tuition reimbursement, the Freedom 2 Save student debt program, and FreeU education benefit - an affordable and convenient path to getting a bachelor's degree.
• A company recognized as a great place to work in dozens of countries worldwide and named one of the most admired companies in the world by Fortune.
• A company that is recognized as one of the best big companies to work for as well as the best place to work for diversity, working mothers, female executives, and scientists.

The Opportunity

At Abbott, we develop life-changing technologies that improve patient outcomes around the world. We are seeking a Senior Product Cybersecurity Engineer who combines strong technical expertise with excellent communication and collaboration skills to help secure next-generation connected medical devices.

This position is part of our EP division and will be located onsite at our Tech Center in St. Paul, MN.

In this role, you will serve as a cybersecurity leader across the product lifecycle, partnering with software, firmware, hardware, systems engineering, quality, regulatory, and product management teams to ensure security is designed into products from concept through deployment and sustainment.

The ideal candidate is a hands-on technical expert in embedded systems, firmware, hardware security, threat modeling, vulnerability management, and security architecture who can also effectively communicate cybersecurity risks, strategies, and compliance requirements to internal stakeholders, customers, auditors, and regulatory agencies.

What You'll Work On

Cybersecurity Architecture & Secure Product Design

• Lead cybersecurity architecture reviews and security-by-design initiatives for connected and embedded medical devices.
• Drive design discussions and ensure security considerations are incorporated into product architecture, development, and deployment decisions.
• Design and evaluate secure boot architectures, hardware roots of trust, device identity frameworks, code-signing solutions, certificate management, and secure firmware update mechanisms.
• Create, review, and maintain security architecture documentation, design specifications, and cybersecurity reports.
• Collaborate with cross-functional engineering teams to implement secure design practices across software, firmware, hardware, and cloud-connected systems.

Embedded Firmware & Hardware Security

• Develop and review security controls implemented in C/C++, Python, Linux-based systems, and embedded platforms.
• Assess embedded firmware, operating systems, bootloaders, and hardware platforms for potential security weaknesses.
• Review and validate:
• Secure boot implementations
• Firmware authentication and validation
• Cryptographic services
• PKI and certificate management
• Secure key storage
• Secure provisioning processes
• Evaluate hardware security controls, including:
• Trusted Platform Modules (TPMs)
• Secure Elements
• Hardware Security Modules (HSMs)
• Trusted Execution Environments (TEEs)
• JTAG/SWD protection
• Anti-tamper technologies

Threat Modeling & Risk Management

• Conduct threat modeling using STRIDE, OWASP, Attack Trees, and similar methodologies.
• Identify threats and vulnerabilities impacting patient safety, product integrity, and data protection.
• Perform cybersecurity risk assessments and document risks in accordance with company and regulatory requirements.
• Assess CVEs, evaluate product exposure, and recommend mitigation strategies.
• Maintain and review Software Bills of Materials (SBOMs) and support vulnerability management processes.

Security Testing & Validation

• Develop and execute cybersecurity assessment plans and security test strategies.
• Support or coordinate penetration testing, fuzz testing, firmware analysis, and vulnerability assessments.
• Review internal and third-party security findings and drive remediation efforts.
• Define security acceptance criteria and support secure product releases.
• Validate compliance with established cybersecurity requirements and standards.

Regulatory, Customer & External Engagement

• Partner with Regulatory Affairs, Quality, and Product Security teams to support cybersecurity submissions and compliance activities.

Pre