Sr. Engineer, Product Cyber Security

Becton Dickinson Medical Devices•Ashland, CA

5d•Remote

About The Position

Waters, formed through the combination of BD Biosciences and Diagnostic Solutions with Waters Corporation, is hiring a Senior Product Cyber Security Engineer. The role owns end-to-end cybersecurity deliverables for assigned products and develops automation that helps a small team support a broad product portfolio. This is a product security engineering position—not an IT security, SOC, or penetration-testing role—and involves reading code, working in build pipelines, and explaining risk assessments to auditors, regulators, and customers. The position is remote within the United States, with regular overlap with Pacific time working hours. The engineer works closely with R&D, Software Engineering, DevOps, Systems Engineering, Quality, Regulatory Affairs, and corporate product security and cyber risk teams. Responsibilities include planning security activities for releases; leading threat modeling; conducting software composition and static analysis; generating and monitoring SBOMs; coordinating penetration tests; maintaining patch plans and hardened baselines; and preparing documentation for design history files, regulatory submissions, audits, and customer assurance packages. Success measures include taking ownership of a product release’s cybersecurity deliverables within 90 days; automating SBOM generation and composition analysis and connecting results to post-market monitoring within six months; and supporting two to three products in parallel, delivering penetration tests and patch verification bulletins on schedule, and providing leadership with regular in-market risk metrics within twelve months.

Requirements

Bachelor's degree in Computer Science, Software Engineering, Cybersecurity, or a related technical field, or equivalent practical experience.
At least 10 years of experience in software engineering, product or application security, or cybersecurity engineering, including hands-on security work on software products shipped to customers.
Software engineering fluency, including ability to read and write code in a language, comfort with command-line tools, awareness of build systems and package ecosystems such as npm, pip, or NuGet, and familiarity with CI/CD pipelines such as Azure DevOps or similar.
Hands-on experience with threat modeling (STRIDE or similar), vulnerability assessment, CVSS scoring, remediation workflows, and risk acceptance.
Experience with static analysis and software composition analysis tools and SBOM formats such as CycloneDX or SPDX.
Experience producing formal security deliverables, such as threat models, risk assessments, vulnerability reports, and SBOMs, that have been reviewed in audits or regulatory submissions.
Strong written communication and ability to create clear, structured technical documentation in English for auditors, regulators, and customers.
Demonstrated ability to run several product workstreams in parallel in a procedure-driven, documentation-heavy environment, with an emphasis on automation and reuse.

Nice To Haves

Experience in medical devices, in vitro diagnostics, life sciences, or other regulated software, including familiarity with FDA premarket cybersecurity guidance (section 524B), EU MDR/IVDR, ISO 14971, AAMI TIR57, IEC 81001-5-1, or UL 2900.
Experience with Snyk, CyBeats, or similar composition analysis and SBOM monitoring platforms, and vulnerability scanners such as Tenable or Qualys.
Experience with Windows operating system hardening, image management, and security patch verification.
Experience coordinating penetration tests and performing supplier security assessments, including third-party checklists and SOC 2 report reviews.
Experience building security metrics, dashboards, or operational reporting.
Experience using AI and large language model tools to accelerate documentation and analysis while keeping outputs reviewable and traceable.
Experience supporting FDA inspections, notified-body audits, or ISO 13485 quality system audits.

Responsibilities

Own cybersecurity plans and Product Security Management Plans for assigned products, covering new development, major releases, and sustaining changes.
Produce product security deliverables, including requirements gap analyses, threat models and data flow maps, Product Security White Papers, Incident and Vulnerability Management Plans, Patch Management Plans, Cybersecurity Risk Summary Reports, and third-party vendor assessments.
Determine which deliverables apply to each product, scale them according to product risk and regulatory status, and document justified exemptions.
Maintain complete, traceable Product Security Management Files ready for FDA inspections and notified-body audits.
Lead STRIDE-based threat modeling sessions and document assets, data flows, trust boundaries, threats, controls, and resulting risk register entries.
Assess products against security requirements, score findings with CVSS, and work with R&D on remediation or documented risk acceptance.
Document unresolved and accepted risks to support release decisions, and feed cybersecurity hazards into product risk management files when patient safety is affected.
Run static code analysis and software composition analysis on product releases, triage findings with engineering, and archive reports.
Generate and validate CycloneDX SBOMs from release artifacts, integrate SBOM generation into build and release pipelines, and load SBOMs into post-market vulnerability monitoring tools.
Monitor post-market vulnerability reports against product SBOMs, assess impact with R&D, and drive remediation within required timelines.
Coordinate penetration tests with corporate product security engineering, including defining scope, scheduling tests, evaluating results, and assessing mitigations.
Support investigations of externally reported vulnerabilities and potential cybersecurity complaints with the corporate cyber risk team.
Maintain Patch Management Plans and author or review Security Patch Verification Protocols and Reports.
Deliver annual operating system patch verification bulletins for IVD products in the patch verification program.
Contribute to hardened Windows 11 baseline images for instrument workstations and processes for managing product-level exceptions.
Assemble customer cyber assurance packages and respond to customer security questionnaires.
Prepare cybersecurity content for regulatory submissions, including FDA premarket cybersecurity requirements and EU IVDR, and support reviews, audits, and regulator interactions.
Review third-party security checklists and SOC 2 reports for software and services used in or with products.
Build and maintain scripts and pipeline steps to automatically generate SBOMs, scan results, and audit evidence.
Produce cross-portfolio security risk reporting and in-market risk metrics for leadership, and keep security work-item tracking current.
Help evaluate and adopt AI-assisted tools for drafting and checking security documentation.
Contribute to updates of product security procedures and requirements as corporate policy, FDA expectations, and submission feedback evolve.
Serve as a product security subject matter expert and advise partner teams on secure design, secure updates and installation, vulnerability remediation, and compliance expectations.