Engineer II- Product Security

Arthrex•Remote, OR

31d

About The Position

Arthrex is seeking an Engineer II - Product Security (SecOps - Cloud) to support the security of its Engineering software delivery environment. The role focuses on cloud security monitoring and triage, detection rule maintenance, security tooling health, and pipeline and infrastructure security across AWS and Azure. It is part of the Global Product Security Engineering team and is suited to a security engineer with a foundation in cloud security and detection engineering who is developing broader engineering security expertise. The position may be based in Naples, Florida; Boston, Massachusetts; or Santa Barbara, California, or be performed remotely from anywhere in the United States. The position also contributes to product security architecture, threat modeling, design controls, security testing, regulatory support, and collaboration with software engineering and other business teams. The Engineer II supports compliance activities and reporting, helps maintain incident response documentation, and may provide security-focused product education and demonstrations to customers. Travel may be required, including international travel.

Requirements

At least 2 years of related experience; cloud security, security operations, or a related security engineering role is preferred.
Bachelor’s degree required.
Hands-on experience monitoring and investigating cloud security findings and incidents, including experience with AWS and/or Azure security services such as Security Hub, GuardDuty, or Azure Defender for Cloud.
Experience with CSPM or CNAPP platforms and security log management, including log-source validation, ingestion-health monitoring, and identifying coverage gaps across AWS and Azure.
Experience with identity federation, lifecycle management, and role-based access control using Okta and/or Microsoft Entra ID, including SAML/SSO.
Scripting skills in Python, Bash, or PowerShell for automation and tooling.
Knowledge of system and software development processes and lifecycles.
Knowledge of application security best practices.
Ability to conduct structured threat modeling, document security-related design history files, and support security testing and compliance activities, as described for the role.

Nice To Haves

Wiz experience is strongly preferred.
Experience with detection engineering fundamentals, including alert tuning, false-positive analysis, detection rule management, and runbook development.
Experience with Kubernetes, Argo, and Terraform security best practices.
AWS Security Specialty or Microsoft Azure Security Engineer (AZ-500) certification.
Bachelor’s degree preferably in Engineering (Mechanical, Biomedical, Electrical, or Software Engineering), Computer Science, Information Security, or Cybersecurity.

Responsibilities

Monitor and triage security findings across Engineering environments using Wiz, AWS Security Hub, GuardDuty, and Azure Defender for Cloud; assess severity, identify false positives, and escalate confirmed findings according to established procedures.
Support maintenance and tuning of detection rules, alert policies, and thresholds; identify coverage gaps and recommend adjustments to senior team members.
Monitor security tooling and log-ingestion pipeline health, verify log-source activity and completeness, and confirm that cloud security services are enabled and configured across in-scope Engineering accounts and subscriptions.
Help maintain security dashboards and alerting configurations, and escalate coverage gaps or tool degradation.
Contribute to incident response playbooks and triage runbooks; participate in incident triage, containment support, evidence collection, and post-incident documentation.
Support SOC 2 and HIPAA audit readiness through evidence collection, control documentation, and gap tracking.
Prepare security reporting, including finding summaries, remediation tracking, and tool-health status for Engineering leadership and compliance stakeholders.
Design security architecture for components or functional systems and modify existing designs to improve product security.
Recommend development and design changes that improve product or procedural security, considering application interactions with infrastructure and external resources.
Conduct structured threat modeling, such as STRIDE, identify and rate threats and vulnerabilities, design mitigations, and document outputs in the DHF linked to security requirements and ISO14971 risk assessments.
Maintain security-related design history file documentation for assigned projects in accordance with Arthrex’s ISO13485-based design control procedures.
Determine the need for security testing and manage testing of assigned products.
Provide technical support to Regulatory Affairs for assigned projects in support of global product approvals.
Provide technical support to Marketing and Product Management for training and marketing of assigned products.
Partner with Software Engineering to design and develop components, processes, and training using Security-by-Design and Privacy-by-Design principles.
Support surgeon and distributor customers during sales by educating and demonstrating security-focused aspects of assigned products as needed.
Collaborate with Legal, Compliance (Global Privacy and AI Governance), and IT to help ensure products comply with applicable laws, regulations, and company policies.
Report progress and status of assigned projects in a timely manner.
Travel as required, potentially including international travel.