Principal Med Device Security Engineer

What you'll do

• Implement security architecture, cryptographic controls, and threat mitigation techniques for medical devices across the product lifecycle.
• Perform threat modeling, risk assessments using STRIDE/CVSS, and code analysis to ensure secure hardware and software designs.
• Develop and manage secure boot, firmware integrity validation, and anti-tamper mechanisms for heart recovery technologies.
• Manage post-market security activities including vulnerability monitoring, patching plans, and responding to customer security questionnaires.
• Ensure compliance with regulatory standards such as FDA guidance, NIST 800-175, FIPS 140-3, and IEC 62443.
• Oversee secure over-the-air (OTA) update mechanisms and manage key management infrastructure including PKI and HSMs.
• Lead Secure Development Lifecycle practices by integrating static/dynamic analysis and fuzz testing into the engineering process.
• Generate Software Bill of Materials (SBOM) and security architecture views to support risk mitigation and transparency.

What we're looking for

• Must have 10+ years of industry experience in Information Security.
• Must have 8+ years of experience with embedded systems, IoT, or medical device cybersecurity.
• Must possess a Bachelor’s degree or equivalent.
• Ability to generate threat models without tools and perform risk assessments using CVSS 3.1 or higher with STRIDE per element.
• Ability to write technical security requirements for embedded systems and web platforms based on current regulations.
• Experience supporting regulatory submissions including FDA Cybersecurity Guidance, EU MDR, NIST 800-53, IMDRF, and AAMI TIR57.
• Knowledge of real-time operating systems hardening, cloud security principles, and generating SBOMs from source code and binaries.
• Experience with specific operating systems (QNX, QOS, Yocto, Linux Ubuntu, Alpine) and web application hardening (preferred).