Sr Product Security Engineer

Medtronic•North Haven, CT

13d•$132,000 - $198,000•Onsite

About The Position

The Senior Product Security Engineer supports the security of Medtronic Surgical Operating Unit medical device solutions. Reporting to the Director of Product Security, this technical subject matter expert helps integrate cybersecurity measures, identify and mitigate vulnerabilities, and improve cyber-resiliency throughout the product lifecycle. The role collaborates with Research & Development, Systems Engineering, Quality, Regulatory, and Product teams, and provides mentorship and technical guidance to junior engineers. The position may be based in Lafayette, Colorado, or North Haven, Connecticut, and follows an onsite work model requiring regular in-person collaboration. The work spans product security strategy, secure product development, threat modeling and risk assessment, security architecture and testing, regulatory compliance, supplier and software-component assessments, incident response, and security documentation.

Requirements

Bachelor's degree and at least 4 years of cybersecurity, product security, software security, embedded systems security, or medical device security experience; or a master's degree and at least 2 years of related experience; or a PhD.
Experience conducting threat modeling, cybersecurity risk assessments, and risk mitigation activities.
Experience integrating cybersecurity practices into a secure product development lifecycle.
Experience with vulnerability assessment, penetration testing, static analysis, dynamic analysis, or application security testing methodologies.
Experience developing or evaluating security architectures and controls for connected products.
For baccalaureate degrees earned outside the United States, a degree satisfying the requirements of 8 C.F.R. § 214.2(h)(4)(iii)(A) is required.
Roles below Principal level require unrestricted U.S. work authorization at the time of hire and for the duration of employment.

Nice To Haves

Experience securing medical devices, healthcare technologies, embedded systems, IoT devices, or cloud-connected products.
Knowledge of IEC 81001-5-1, IEC 60601-4-5, ISO 14971, FDA cybersecurity guidance, and NIST cybersecurity frameworks.
Experience with secure boot, cryptography, authentication, authorization, access management, secure communications, data protection, and secure software update mechanisms.
Experience supporting cybersecurity activities in regulated healthcare, life sciences, or medical technology environments.
CISSP, GIAC, CEH, or similar cybersecurity certification.

Responsibilities

Stay current on cybersecurity threats, technologies, and regulations relevant to medical devices and health software; contribute to Operating Unit and enterprise product security strategy and roadmaps.
Drive cybersecurity integration throughout the product lifecycle, from concept and design through postmarket, collaborating with system architects, software leads, and hardware engineers to embed secure design patterns in embedded and cloud-connected environments.
Lead or contribute to threat modeling sessions, conduct security risk assessments, and identify mitigation strategies in accordance with IEC 81001-5-1, ISO 14971, and FDA premarket cybersecurity guidance.
Collaborate on secure architecture design and implementation, including secure boot, secure communications, data protection, access control, secure software updates, and hardware-software integration.
Support and interpret vulnerability scans, penetration tests, and static and dynamic code analysis; coordinate with internal teams and third-party vendors on timely risk mitigation.
Promote security awareness within Research & Development and support junior engineers through documentation, review participation, and knowledge sharing.
Ensure alignment with applicable standards, including NIST, IEC 60601-4-5, and IEC 81001-5-1, and support security documentation for global regulatory submissions.
Review and assess the cybersecurity posture of third-party suppliers and open-source software components used in product designs.
Support technical investigation and resolution of postmarket security incidents or field issues; lead root cause investigations, containment strategies, and risk assessments.
Maintain security documentation, including threat model diagrams, risk assessments, shared service inventories, design patterns, security guidelines, and product security plans and reports.

Benefits

Competitive salary and flexible benefits package.
Short-term incentive through the Medtronic Incentive Plan (MIP).
Health, dental, and vision insurance for eligible regular employees working 20 or more hours per week.
Health Savings Account and Healthcare Flexible Spending Account for eligible regular employees working 20 or more hours per week.
Life insurance and long-term disability leave for eligible regular employees working 20 or more hours per week.
Dependent daycare spending account and tuition assistance or reimbursement for eligible regular employees working 20 or more hours per week.
Simple Steps global well-being program for eligible regular employees working 20 or more hours per week.
Incentive plans for all regular employees.
401(k) plan with employer contribution and match for all regular employees.
Short-term disability, paid time off, and paid holidays for all regular employees.
Employee Stock Purchase Plan and Employee Assistance Program for all regular employees.
Non-qualified Retirement Plan Supplement, subject to IRS earning minimums, for all regular employees.
Capital Accumulation Plan for Vice Presidents and above, or subject to IRS earning minimums.