Product Security Engineer

Location: San Jose CA / Cincinnati OH / Raritan NJ (Onsite)
Duration: Contract (6 Months)

We are seeking a Product Security Engineer with experience in the MedTech industry particularly supporting FDA submission deliverables. The ideal candidate will have strong expertise in product security risk management and regulatory compliance for medical devices.

• Apply ISO 14971 risk management principles and integrate security risks into safety analyses such as FMEA/FMEDA and hazard analysis
• Align security activities with IEC 62304 software lifecycle requirements and safety classifications
• Ensure compliance with FDA cybersecurity premarket guidance (or equivalent regional standards)
• Perform threat modeling and attack surface analysis using methodologies such as STRIDE
• Design and implement secure-by-design architectures including authentication authorization least privilege and fail-safe mechanisms
• Work on embedded/firmware security including secure boot signed firmware hardware root of trust and secure key storage (TPM/secure elements)
• Apply cryptography best practices including TLS certificate lifecycle management and key management
• Conduct vulnerability assessments using SAST DAST fuzzing and hardware testing methods
• Support or execute penetration testing and red-team activities and develop remediation plans
• Ensure secure implementation of networking protocols (TCP/IP BLE Wi-Fi MQTT HL7/FHIR)
• Manage software supply chain security including SBOM creation and dependency vulnerability tracking
• Integrate DevSecOps practices into CI/CD pipelines (SCA SAST secrets scanning release gating)

• Product Security Plan
• Threat Model Documentation
• Risk Assessment Reports
• Vulnerability Assessment (CVSS 3.1 aligned with MITRE standards)
• MDS2 Documentation
• Security White Papers

• Proven experience in Product Security Engineering within the Medical Device / MedTech domain
• Hands-on experience supporting FDA submissions
• Strong knowledge of ISO 14971 and IEC 62304 standards
• Experience in threat modeling risk analysis and secure architecture design
• Familiarity with embedded systems and firmware security
• Experience with security testing tools and methodologies
• Strong understanding of networking protocols and cybersecurity fundamentals