Staff Cybersecurity Engineer

Stryker•Redmond, WA

2d•Hybrid

About The Position

As a Staff Cybersecurity Engineer, you will provide technical leadership for cybersecurity across connected medical devices, cloud solutions, and software development environments. You will partner with cross-functional teams to design secure products, manage cybersecurity risk, and ensure compliance with applicable industry and regulatory requirements. You will lead the design and implementation of cybersecurity solutions across connected products, cloud platforms, and supporting systems, partnering with software and hardware architects to establish secure architecture, standards, and engineering best practices. The role also leads threat modeling, security assessments, architecture reviews, and cybersecurity risk assessments for new and existing products, and drives remediation of identified risks and vulnerabilities. The position drives adoption of secure software development and DevSecOps practices, integrates cybersecurity requirements throughout the product development lifecycle, and develops and maintains strategies for Software Bill of Materials (SBOM) generation, governance, and compliance across product portfolios. It also addresses risks associated with third-party software, open-source components, and the software supply chain. The engineer leads ongoing vulnerability monitoring, triage, remediation, and postmarket cybersecurity assessments, partnering with Quality and Regulatory Affairs on mitigation planning. The role supports coordinated vulnerability disclosure, including engagement with external security researchers and management of reported product security vulnerabilities. Cross-functional partners include Product Security, Software Engineering, Quality, Regulatory Affairs, Privacy, Customer Support, Sales, and IT.

Requirements

Bachelor's degree in Computer Science, Cybersecurity, Engineering, or a related technical discipline.
At least 4 years of experience in cybersecurity, software engineering, systems engineering, or a related field.
Experience leading complex technical initiatives across multiple teams and organizations.
Expertise in at least two of the following areas: Product Security, Application Security, Security Architecture, DevSecOps, Software Supply Chain Security, Identity and Access Management, Threat Detection and Monitoring, or Incident Response.

Nice To Haves

Experience in medical devices, healthcare, or other regulated industries, including securing connected products, embedded systems, and cloud-based solutions.
Experience with SBOM management, vulnerability management, and software supply chain security, including assessment and mitigation of third-party and open-source risks.
Experience supporting postmarket cybersecurity programs and working within recognized cybersecurity and regulatory frameworks, including FDA cybersecurity guidance, IEC 62443, IEC 62304, NIST Cybersecurity Framework, and ISO 27001.
CISSP, CCSP, CISM, GSEC, GIAC, or equivalent cybersecurity certification.

Responsibilities

Lead the design and implementation of cybersecurity solutions for connected products, cloud platforms, and supporting systems.
Partner with software and hardware architects to establish secure architecture, standards, and engineering best practices.
Lead threat modeling, security assessments, architecture reviews, and cybersecurity risk assessments for new and existing products.
Drive remediation of identified risks and vulnerabilities.
Drive adoption of secure software development and DevSecOps practices and integrate cybersecurity requirements throughout the product development lifecycle.
Develop and maintain strategies for SBOM generation, governance, and compliance across product portfolios.
Assess and mitigate cybersecurity risks associated with third-party software, open-source components, and the software supply chain.
Lead ongoing vulnerability monitoring, triage, remediation, and postmarket cybersecurity assessments.
Partner with Quality and Regulatory Affairs on cybersecurity mitigation planning.
Support coordinated vulnerability disclosure, including engagement with external security researchers and management of reported product security vulnerabilities.
Collaborate with Product Security, Software Engineering, Quality, Regulatory Affairs, Privacy, Customer Support, Sales, and IT to achieve cybersecurity objectives and requirements.