[Hiring] Senior Product Cyber Security Engineer @BD

Role Description

We are seeking a Senior Product Cyber Security Engineer to own the cybersecurity deliverables for assigned products end to end and to build the automation that lets a small team cover a large portfolio. You will plan the security activities for each release, lead threat modeling, run composition and static analysis, produce and monitor Software Bills of Materials (SBOMs), coordinate penetration tests, and write the documentation that goes into our design history files, regulatory submissions and customer assurance packages.

This is a product security engineering role, not an IT security, SOC or penetration testing role. You will read code, work in build pipelines, and defend your risk assessments in front of auditors, regulators and customers. You will work daily with R&D, Software Engineering, DevOps, Systems Engineering, Quality and Regulatory Affairs, and with our corporate product security and cyber risk teams.

This position is remote within the United States, with regular overlap with Pacific time working hours.

Key Responsibilities

• Own the cybersecurity plan and the Product Security Management Plan for assigned products.
• Produce the required deliverable set for each product:
• Product security requirements gap analysis
• Threat model and data flow map
• Product Security White Paper
• Incident and Vulnerability Management Plan
• Patch Management Plan
• Cybersecurity Risk Summary Report
• Third-party vendor assessments
• Decide with the team which deliverables apply to each product and document every exemption with its justification.
• Keep the Product Security Management File complete, traceable and ready for FDA inspections and notified-body audits.
• Lead STRIDE-based threat modeling sessions with product teams.
• Assess products against our product security requirements and document unresolved and accepted risks.
• Run static code analysis and software composition analysis on product releases.
• Generate and validate CycloneDX SBOMs from the actual release artifacts of every software-enabled product.
• Monitor post-market vulnerability reports against product SBOMs.
• Coordinate penetration tests with our corporate product security engineering team.
• Maintain product Patch Management Plans and author or review Security Patch Verification Protocols and Reports.
• Assemble cyber assurance packages for key customers and prepare the cybersecurity content of regulatory submissions.
• Build and maintain scripts and pipeline steps that generate SBOMs, scan results and audit evidence automatically.
• Act as the product security subject matter expert for R&D, DevOps, Quality, Regulatory and partner teams.

Qualifications

• Bachelor's degree in Computer Science, Software Engineering, Cybersecurity or a related technical field, or equivalent practical experience.
• 10+ years of experience in software engineering, product or application security, or cybersecurity engineering.
• Basic software engineering fluency: you read and write code in some language.
• Hands-on experience with threat modeling, vulnerability assessment, CVSS scoring, remediation workflows and risk acceptance.
• Experience with static analysis and software composition analysis tools and with SBOM formats.
• Experience producing formal security deliverables that have been reviewed in audits or regulatory submissions.
• Strong written communication: clear, structured technical documentation in English.
• Demonstrated ability to run several product workstreams in parallel in a procedure-driven, documentation-heavy environment.

Requirements

• Experience in medical devices, in vitro diagnostics, life sciences or other regulated software.
• Experience with Snyk, CyBeats or similar composition analysis and SBOM monitoring platforms.
• Experience with Windows operating system hardening, image management and security patch verification.
• Experience coordinating penetration tests and performing supplier security assessments.
• Experience building security metrics, dashboards or operational reporting.
• Experience using AI and large language model tools to accelerate documentation and analysis.
• Experience supporting FDA inspections, notified-body audits or ISO 13485 quality system audits.

Benefits

• Comprehensive Total Rewards program.
• Competitive package of compensation and benefits programs.
• Opportunities for reward and recognition that promote a performance-based culture.

Salary Range Information

$117,800.00 - $188,600.00 USD Annual