Product Security Engineer

• The Product Security Engineer will support the security architecture, design review, and risk management activities for medical devices and Software as a Medical Device (SaMD) platforms.
• This role focuses on ensuring the security, privacy, and regulatory compliance of medical devices.
• The candidate will work cross-functionally with engineering, quality, regulatory, and DevOps teams to implement secure design practices. Large portion of this job requires performing threat modeling, and support cybersecurity risk management activities aligned with FDA guidance.
• This position contributes to security documentation supporting 510(k) submissions, post market cybersecurity management, and secure development lifecycle (SDL) activities.

• Perform product security risk assessments and threat modeling for medical devices and SaMD platforms.
• Support cybersecurity documentation for FDA regulatory submissions including 510(k), cybersecurity risk management files, and SBOM requirements.
• Conduct security architecture reviews for medical platforms.
• Evaluate system designs against secure architecture principles, regulatory expectations, and cybersecurity frameworks.
• Develop and maintain Product Security Risk Management Plans, Vulnerability Management Plans, and Incident Response Plans.
• Participate in secure software development lifecycle (SSDLC) activities including design reviews and security validation.
• Analyze results of static code analysis, dynamic analysis, and vulnerability scanning tools.
• Support SBOM generation and third party software risk analysis.
• Assist in investigation and remediation of security vulnerabilities affecting medical device or cloud infrastructure environments.
• Collaborate with DevOps and engineering teams to implement secure configurations, identity management, and network security controls.
• Participate in product security incident response activities and post-market cybersecurity monitoring.
• Support internal and external security audits related to FDA, ISO 13485, ISO 27001, TIR-57 and healthcare cybersecurity requirements.

• Requires a BS degree preferably Cybersecurity, Computer Science, Computer Engineering, a related Engineering discipline and 5+ years' experience in cybersecurity, product security, or cloud security roles.
• Experience supporting FDA cybersecurity documentation or 510(k) submissions strongly preferred.
• Experience working with regulated medical devices or healthcare software environments
• Strong written and verbal communication skills.
• Strong analytical thinking and attention to detail.
• Experience working in cross functional engineering environments.
• Familiarity with Threat Modeling, vulnerability scanning and remediation processes.
• Experience reviewing technical documentation and regulatory artifacts.
• Knowledge of NIST Cybersecurity Framework and NIST 800-series security controls.
• Familiarity with OWASP Top 10 and secure software development lifecycle practices.

Pavan.p@sunrisesys.com