Applications must be located in the Orange County / San Diego metro area.

At this time, they are primarily remote positions with the requirements to travel into the office when required. Travel into the office could extend to a 4/1 schedule but not immediately

Temp to Perm possibility

Must Have

• API Documentation
• Application Programming Interface (API) Security
• Application Security Architecture
• Application Security Testing
• Artificial Intelligence (AI)
• Cloud Security
• Cyber Risks
• Cybersecurity
• Cyber Security Assessments
• Cybersecurity Compliance
• Cybersecurity Risk Management
• Cyber Threat Analysis
• Cyber Threat Modeling
• Design Documentation
• Documentation Compliance

We are seeking a Product Security Engineer to support client’s Dispensing business unit. The Dispensing portfolio includes FDA Class I and Class II medical devices and their associated cloud-connected platforms.

• The product security engineer owns, leads, and executes the activities and documentation outlined in client’s security lifecycle.
• These activities and documents include Security Requirements, Threat Modeling, Risk Assessments and Analysis, Vulnerability & Risk Management Plans, Security Testing, and White Papers.  
• This role focuses on risk-based security that ensures patient safety, data protection, and regulatory readiness.

Role Focus

• Execution of Product Security Engineering Lifecycle activities
• Generation and Maintenance of Product Security Documentation
• Apply risk-proportionate security controls
• Emphasize secure-by-design and secure-by-default
• Enable efficient FDA submissions (510(k), De Novo)
• Balance usability, workflow, and security

Key Responsibilities

Security Architecture & Design

• Define end-to-end security architecture across devices, apps, and cloud
• Establish baseline security patterns (auth, encryption, secure updates)
• Conduct Threat Modeling, Risk Assessments, Requirements/Controls Mapping, Security White Papers
• Lead and Drive Security Design Reviews & Roadmap Remediations/Mitigations

Secure SDLC

• Implement lean Secure SDLC aligned to NIST, OWASP, and BSIMM
• Integrate SAST, SCA, secrets scanning, container/IaC scanning
• Define minimum viable security gates

Regulatory & Compliance

• Support FDA cybersecurity documentation (threat models, SBOMs, risk assessments)
• Align with IEC 62304, ISO 14971
• Ensure audit-ready documentation 

Cloud Security

• Architect secure integrations with client’s Cloud Platforms
• Secure device-to-cloud data flows

SBOM & Vulnerability Management

• Establish SBOM processes (SPDX, CycloneDX)
• Implement continuous vulnerability monitoring
• Define risk-based remediation SLAs

Cross-Functional Leadership

• Collaborate with engineering, quality, regulatory, and product teams
• Translate security into patient safety and business risk
• Mentor teams

Required Qualifications

• 5+ years cybersecurity experience
• Experience with FDA Class I/II devices 
• Regulatory/Quality Control product development
• Demonstrated working experience in the domains of embedded, cloud, and application security
• FDA submissions

Preferred Qualifications

• Software Development, System Engineering background
• AI (Agentic, Generative, ML) skills and agent development
• Experience with IoMT ecosystems
• Knowledge of FDA Cybersecurity Pre & Post Market Guidance, UL 2900, AAMI TIR57/TIR97
• DevSecOps experience
• Certifications (CISSP, CCSP, CSSLP)
• Experience working in cross-functional product development environments
• Experience presenting technical security concepts to leadership and business stakeholders
• Proven track record of driving security initiatives from concept through implementation

Key Competencies

• Ability to right-size security controls
• Strong risk-based decision-making
• Communication across technical and non-technical teams
• -Strong stakeholder management skills
• -Ability to build credibility and trust across cross-functional teams
• Excellent verbal, written, and presentation communication skills
• Ability to navigate ambiguity and drive consensus  
• Ability to balance competing priorities in a fast-paced environment

Success Metrics

• Comprehensive Threat Modeling and effective Security Risk Management
• SBOM completeness
• Reduction in critical vulnerabilities
• FDA submission success
• Time-to-remediate vulnerabilities
• Timely completion of security lifecycle deliverables
• On-time support of product release and submission milestones