Remote (PST)-Engineer Sr 1 - Embedded Product Security

Arthrex, Inc.•Santa Barbara, CA

34d•Remote

About The Position

Secure the Future of Healthcare-One Device at a Time. At Arthrex, we're not just building medical devices-we're shaping the future of healthcare. Our mission is simple yet powerful: Helping Surgeons Treat Their Patients Better. Now, we're looking for a visionary engineer to help us secure the next generation of connected and IoT medical technology. If you thrive on solving complex security challenges and want your work to make a real impact on lives worldwide, this is your moment. Why This Role Matters As our Sr. Embedded Product Security Engineer, you'll be a guardian of innovation-ensuring every device we create is secure, resilient, and trusted. You'll collaborate with elite product design teams, dive deep into architecture reviews, and lead the charge in vulnerability testing. Your expertise will shape global regulatory submissions and protect cutting-edge and legacy medical technology. What You'll Do Lead and take ownership of product security across a product line. Architect security solutions for embedded systems and IoT devices. Drive security initiatives for advanced technologies - including robotics and AI / Machine Learning driven systems. Hunt vulnerabilities, assess risk, and design countermeasures that keep attackers at bay. Drive Security-by-Design and Privacy-by-Design principles across development. Work closely with Legal, Compliance, Regulatory, and Enterprise IT to align product security with international regulations and organizational policies. Represent Arthrex at premier security events like DEF CON, Black Hat, and Health-ISAC Conferences. Document and champion our Secure Product Development Framework. Why You'll Love It Work on technology designed to improve patient outcomes and enhance quality of life. Experience the stability and vision of a privately held organization with global reach. Access world-class training and certifications. Network with the best minds in medical device cybersecurity and compliance. Be part of a culture that values innovation, collaboration, speed, and impact. Ready to secure the future of healthcare? Apply now and become the force that keeps our technology-and our patients-safe.

Requirements

5+ years in cybersecurity-focused positions spanning software engineering, IoT and SCADA environments, regulated industries (medical device/pharma), or hardware security testing.
Bachelor's in Software Engineering, Computer Science, Software focused-Cybersecurity, or related field.
A proven track record of leading and owning security for products, influencing design decisions and guiding teams through the full product lifecycle-from concept to global launch.
Embrace change and ambiguity as opportunities, ensuring security remains a constant in an environment of rapid innovation.
Ability to embed security into every phase of development, ensuring compliance, resilience, and innovation.
Securing Embedded systems, firmware, real-time OS (RTOS), IoT lifecycle
Proficiency in advanced application security methodologies (OWASP Top 10, MITRE CWEs and ATT&CK)
Architecture design, threat modeling, and vulnerability mitigations.
Demonstrated experience in SBOMs and third-party software risk management, coupled with building automated CI/CD workflows for embedded systems in C/C++ and Python
Knowledgeable of System and Software Development Processes and Lifecycles required.
Knowledgeable of application security best practices required.
5 years of related experience
Bachelor's degree required preferably in Engineering (Mechanical, Biomedical, Electrical or Software Engineering), Computer Science, Information Security, or Cybersecurity

Nice To Haves

CISSP, OSCP, OSWE, CSSLP, GIAC.
Yocto Project, FDA/ISO guidelines, Robotics, Machine Learning, Computer Vision, HL7, PACS, FPGA
Yocto project knowledge and embedded development processes preferred.
Knowledgeable of FDA and ISO guidelines for the development of medical devices preferred.
Project management and communication skills preferred
Proficiency in the use of threat scenarios and risk mitigation techniques preferred.
Experience in web application security and controls concepts preferred..
Experience in embedded system development, IoT lifecycle, real-time operating systems, firmware, RFID, CANbus, WiFi, or Bluetooth LE preferred.

Responsibilities

Designs security architecture of components or functional systems and modifies existing designs to develop or improve products.
Recommends alterations to development and design to improve the security of products and/or procedures.
Contributes to a broader design perspective and considers how an application interacts with the underlying infrastructure or external resources.
Develops threat scenarios and designs responses for associated vulnerabilities to mitigate risk.
Maintains design history file for assigned projects, adhering to Arthrex design control procedures.
Determines the necessity of security testing and initiates testing of assigned products.
Provides Regulatory department technical support for assigned projects as needed.
Supports Marketing and Product Management with technical information to be used for training and marketing of assigned products.
Supports Software Engineering to design and develop components, processes, and training using Security-by-Design and Privacy-by-Design principles.
Supports surgeon and distributor customers in the sales process by educating and demonstrating security-focused aspects of assigned products as needed.
Partner with Legal, Compliance, Privacy, and Information Security departments to ensure products and staff comply with required laws, regulations, and policies.
Reports progress and status of assigned projects on a timely basis.
May be required to travel; International travel may be required