Sr II - Embedded Product Security Engineer (Remote)

Arthrex•Remote, OR

25d•$115,000 - $190,000•Remote

About The Position

Arthrex is seeking an Embedded Product Security Engineer to help secure connected and IoT medical devices. The role supports product design and development teams by contributing to architecture reviews, refining product security requirements, testing for vulnerabilities, and documenting the Secure Product Development Framework for regulatory submissions around the globe. The position is intended to support teams on the West Coast; candidates in Pacific or Mountain time zones are preferred, as are those open to working during those time zones. Training for security certifications and attendance at events such as H-ISAC conferences, DEF CON, and Black Hat may be available. The role is responsible for product software and hardware design implementations from a cybersecurity perspective, and for identifying and resolving security issues through appropriate analysis, defenses, and countermeasures throughout the product lifecycle. The goal is to produce robust and reliable products. The position may require travel, including international travel.

Requirements

Eight years of related experience.
Bachelor’s degree, preferably in Mechanical, Biomedical, Electrical, or Software Engineering; Computer Science; Information Security; or Cybersecurity.
Knowledge of system and software development processes and lifecycles.
Knowledge of application security best practices.
Knowledge of FDA and ISO guidelines for medical-device development.
Experience leading strategic discussions that address business and technical risks.
Proficiency in developing threat scenarios and risk-mitigation techniques.
Proficiency in applying the Privacy-by-Design principle.

Nice To Haves

Strong project management and communication skills.
Experience with web application security and control concepts.
Experience in embedded-system development, IoT lifecycles, real-time operating systems, firmware, RFID, CANbus, WiFi, or Bluetooth LE.
Background in electrical engineering or software system design and some experience securing and penetration-testing embedded or IoT devices.
Availability to support West Coast teams by being in the Pacific or Mountain time zones, or willingness to work during those time zones.

Responsibilities

Design security architecture for components or functional systems and modify existing designs to develop or improve products.
Recommend changes to development and design to improve product or procedural security.
Consider how applications interact with underlying infrastructure and external resources as part of broader design work.
Develop threat scenarios and design responses to associated vulnerabilities to mitigate risk.
Maintain design history files for assigned projects in accordance with Arthrex design control procedures.
Determine whether security testing is needed and initiate testing of assigned products.
Provide technical support to the Regulatory department for assigned projects as needed.
Support Marketing and Product Management with technical information for training and marketing of assigned products.
Support Software Engineering in designing and developing components, processes, and training using Security-by-Design and Privacy-by-Design principles.
Support surgeons and distributor customers during the sales process by educating and demonstrating security-focused product features as needed.
Partner with Legal, Compliance, Privacy, and Information Security departments to help ensure products and staff comply with applicable laws, regulations, and policies.
Report progress and status of assigned projects in a timely manner.