Sr. Product Security Engineer - Cloud Digital Solutions

Medtronic • Fridley, MN

4d • $132,000 - $198,000

About The Position

The Senior Product Security Engineer leads cybersecurity architecture for Digital Health Platforms, cloud services, web and mobile applications, APIs, remote monitoring, and digital ecosystems that support connected medical devices. The role is part of Medtronic’s Neuromodulation and Pelvic Health R&D organizations, which develop therapies and solutions for conditions including chronic pain, movement disorders, overactive bladder, and non-obstructive urinary retention.

The position defines security requirements and architecture across cloud and digital solutions, leads threat modeling and security risk activities, establishes data protection and connected-service security strategies, and sets cloud security operations and assurance requirements. It also supports compliance and audit readiness, regulatory submissions, and coordination across engineering, IT, quality, privacy, and business stakeholders.

Requirements

• Bachelor’s degree in a related field and 4 years of relevant experience, or a master’s degree in a related field and 2 years of relevant experience. Listed fields include Computer Engineering, Electrical Engineering, Computer Science, and Cybersecurity.
• Extensive experience in cloud security, application security, digital platforms, cybersecurity architecture, or regulated software development.
• For baccalaureate degrees earned outside the United States, a degree satisfying the requirements of 8 C.F.R. § 214.2(h)(4)(iii)(A) is required.

Nice To Haves

• Strong knowledge of cloud-native security, IAM, APIs, PKI, encryption, secrets management, containers, DevSecOps, logging and monitoring, and data protection.
• Experience with threat modeling, SRA, SBOM/SCA, Security-by-Design, Defense-in-Depth, and regulated medical-device environments.
• Understanding of medical-device regulations and standards, including FDA pre- and post-market cybersecurity guidance for medical-device manufacturers, ISO 13485, ISO 81001-5-1, ISO 27001, SOC 2, HIPAA, and HiTRUST.
• Strong decision-making capabilities, including weighing relative costs and benefits to identify appropriate solutions.
• High attention to detail and a focus on Good Documentation Practices (GDP).
• Ability to communicate complex technical information creatively and engagingly to diverse audiences, orally and in writing.
• Excellent prioritization skills, including breaking work into manageable parts and assessing priority and time required.
• Demonstrated ability to develop and grow productive, trusting, and open relationships with a wide variety of constituencies.

Responsibilities

• Define Security-by-Design and Defense-in-Depth architecture for digital health platforms, cloud-native services, web and mobile applications, APIs, and remote-monitoring solutions.
• Define security requirements for identity, authentication, authorization, secrets, encryption, data protection, network segmentation, logging, and service-to-service communication.
• Design secure interfaces between connected medical-device ecosystems and cloud and digital platforms.
• Lead threat modeling, Security Risk Analysis, attack-surface analysis, and security requirements definition for cloud and digital solutions.
• Translate threats into architecture controls, security requirements, verification activities, and risk-control evidence.
• Maintain SBOM and software/component security requirements across cloud applications, services, containers, APIs, and third-party dependencies.
• Define security requirements for data at rest, data in transit, transient data, retention, access control, and privacy across digital-health workflows.
• Design secure identity, provisioning, certificate, credential, and secrets-management strategies for cloud-connected products and services.
• Support secure eFOTA orchestration, remote monitoring, device-service authentication, telemetry, and secure digital-service integration.
• Define cloud security monitoring, logging, vulnerability management, configuration security, and DevSecOps requirements.
• Develop the application-security assurance roadmap and lead readiness, certification/attestation, and recertification activities for programs such as SOC 2, ISO/IEC 27001, HIPAA compliance, and other applicable security and privacy frameworks.
• Coordinate control implementation, evidence collection, gap remediation, audit support, and continuous compliance across engineering, IT, quality, privacy, and business stakeholders.
• Support regulatory submissions and alignment with medical-device cybersecurity, cloud-security, privacy, and digital-health requirements.

Benefits

• Competitive salary and flexible benefits package.
• Short-term incentive through the Medtronic Incentive Plan (MIP).
• For regular employees working 20 or more hours per week: health, dental, and vision insurance; Health Savings Account; Healthcare Flexible Spending Account; life insurance; long-term disability leave; dependent daycare spending account; tuition assistance or reimbursement; and the Simple Steps global well-being program.
• For all regular employees: incentive plans; 401(k) plan with employer contribution and match; short-term disability; paid time off; paid holidays; Employee Stock Purchase Plan; Employee Assistance Program; Non-qualified Retirement Plan Supplement (subject to IRS earning minimums); and Capital Accumulation Plan (available to Vice Presidents and above, or subject to IRS earning minimums).

What This Job Offers

• Job Type: Full-time
• Career Level: Senior