Note: The job is a remote job and is open to candidates in USA. The client is a leading medical device manufacturing company with FDA Class I and Class II medical devices and associated cloud-connected platforms, on-premise software, and hosted applications. The Sr Product Security Engineer will lead product security lifecycle activities, including security architecture, threat modeling, risk assessment, secure SDLC implementation, regulatory documentation, cloud security, SBOM management, and vulnerability remediation. The role also develops AI-based skills, agents, and services and integrates AI capabilities into product development lifecycles.
Responsibilities
- Temp to Perm possibility but that depends on experience
- Sr Product Security Engineer to support Client's STS business unit and develop AI powers skills, agents, and services
- The Sr Product Security Engineer owns, leads, and executes the activities and documentation outlined in Client's security lifecycle. These activities and documents include Security Requirements, Threat Modeling, Risk Assessments and Analysis, Vulnerability & Risk Management Plans, Security Testing, and White Papers
- In addition, the use and development of AI tools/capabilities require the candidate to have both strategic and tactical experience in building with AI
- Execution of Product Security Engineering Lifecycle activities
- Building AI based skills, agents, services, and platforms
- Integration of AI driven capabilities into product development lifecycles
- Generation and Maintenance of Product Security Documentation
- Apply risk-proportionate security controls
- Emphasize secure-by-design and secure-by-default
- Balance usability, workflow, and security
- Security Engineering, Architecture & Design
- Define end-to-end security engineering/design/solutions/controls across devices, apps, and cloud
- Establish baseline security patterns (auth, encryption, secure updates)
- Conduct Threat Modeling, Risk Assessments, Requirements/Controls Mapping, Security White Papers
- Lead and Drive Security Design Reviews & Roadmap Remediations/Mitigations
- Perform architecture risk analysis on device/cloud boundaries: trust boundary decomposition, data flow diagrams, attack surface enumeration, and abuse/misuse case development
- Develop AI skills, agents, services
- Implement lean Secure SDLC aligned to NIST, OWASP, and BSIMM
- Integrate SAST, SCA, secrets scanning, container/IaC scanning
- Define minimum viable security gates
- Support FDA cybersecurity documentation (threat models, SBOMs, risk assessments)
- Align with IEC 62304, ISO 14971
- Ensure audit-ready documentation
- Design secure integrations with Client's Cloud Platforms
- Secure device-to-cloud data flows
- Establish SBOM processes (SPDX, CycloneDX)
- Implement continuous vulnerability monitoring
- Define risk-based remediation SLAs
- Collaborate with engineering, quality, regulatory, and product teams
- Translate security into patient safety and business risk
- Mentor teams
Skills
- * API Documentation
- * Application Programming Interface (API) Security
- * Application Security Architecture
- * Application Security Testing
- * Artificial Intelligence (AI)
- * Cloud Security
- * Cyber Risks
- * Cybersecurity
- * Cyber Security Assessments
- * Cybersecurity Compliance
- * Cybersecurity Risk Management
- * Cyber Threat Analysis
- * Cyber Threat Modeling
- * Design Documentation
- * Documentation Compliance
- * Security Engineering
- Applications preferred location in the Orange County / Irvine, CA area
- * 5+ years cybersecurity experience
- * Software Development, System Engineering background
- * AI (Agentic, Generative, ML) skills and agent development
- * Regulatory/Quality Control product development
- * Demonstrated working experience in the domains of embedded, cloud, and application security
- * Ability to right-size security controls
- * Strong risk-based decision-making
- * Communication across technical and non-technical teams
- * Ability to perform manual secure code review and triage SAST findings for exploitability, tuning rules to drive false-positive rates down rather than escalating raw tool output
- * Produce and consume VEX (CSAF, OpenVEX) alongside SBOMs; maintain component provenance and transitive dependency accuracy
- * Depth in web/API security beyond OWASP Top 10: OWASP ASVS levels as requirement source, API Top 10, authorization logic flaws (IDOR, broken object-level and function-level authz), SSRF, deserialization, app security in multi-tenant context
- * Design and review authentication/authorization implementations: OAuth 2.0/OIDC flow selection and misuse, token lifetime and revocation, session management, SAML assertion validation
- * Demonstrated ability to read and write production code in at least one systems language
- * Experience with FDA Class I/II devices and FDA submissions
- * Experience with IoMT ecosystems
- * Knowledge of FDA Cybersecurity Pre & Post Market Guidance, UL 2900, AAMI TIR57/TIR97
- * DevSecOps experience
- * Certifications (CISSP, CCSP, CSSLP)
Benefits
- ACA compliant medical coverage to all employees
- Dental insurance to all employees
- Vision insurance to all employees
- Sick time benefits as required per State regulations
- Remote role
Company Overview
Company H1B Sponsorship