Principal Product Security Engineer

Smith+Nephew•Pittsburgh, PA

2d•$125,500 - $198,000•Hybrid

About The Position

Join our Global Product Security team in Pittsburgh and help protect medical technologies, connected devices, digital solutions, and the data they rely on. You will provide cybersecurity leadership across the full product lifecycle while partnering with Global IT, Research and Development, and Compliance teams. This position does not offer visa sponsorship now or in the future.

Requirements

A bachelor’s degree in life science, computer science, information systems, or equivalent formal training or professional experience
At least five years of hands on experience in product security, device security, application security, or information technology security
Experience with vulnerability management, penetration testing, code security, security governance, risk assessments, network infrastructure, and cloud security
Knowledge of medical device regulations and cybersecurity frameworks, including HIPAA, FDA requirements, ISO 27001 and 27002, NIST CSF, and OWASP
The ability to design and guide the implementation of innovative security solutions while working independently across multiple teams and business areas
Excellent written and verbal communication, prioritization, customer service, and problem resolution skills

Nice To Haves

A current CISM, CISSP, CRISC, or equivalent certification is preferred

Responsibilities

Lead the definition and implementation of cybersecurity requirements and controls across technologies, capital devices, digital accessories, connected infrastructure, and software applications
Create and maintain product cybersecurity risk registers and threat models, identifying and addressing security risks throughout the development lifecycle
Lead security testing and assessment activities, including vulnerability testing, penetration testing, code analysis, software composition analysis, and endpoint protection
Recommend technical solutions and support the integration of automated tools and processes that reduce security vulnerabilities
Help develop and mature the Global Product Security Strategy and Secure Software Development Life Cycle
Support product cybersecurity incident response activities in line with relevant industry practices and standards
Provide technical leadership when engaging with regulators, customers, auditors, industry groups, and security researchers