Engineer II- Product Security

Engineer II
- Product Security

Arthrex is a global medical device manufacturer, and our mission is Helping Surgeons Treat Their Patients Better™. As our Engineer II
- Product Security (Sec Ops
- Cloud) you will support the security of Arthrex's Engineering software delivery environment by assisting in cloud security monitoring and triage, detection rule maintenance, tooling health, and pipeline and infrastructure security across AWS and Azure. This role works within the Global Product Security Engineering team and is well-suited for a security engineer with a foundation in cloud security and detection engineering who is building depth across the engineering security discipline.

The ideal candidate would work from our Naples, FL, Boston, MA, or Santa Barbara, CA locations; however, we are open to full-time remote anywhere in the United States.

Essential Duties and Responsibilities:

• Cloud Security Monitoring & Detection
  - Monitor and triage security findings across Arthrex's Engineering environments using CSPM/CNAPP tooling (Wiz), AWS Security Hub, Guard Duty, and Azure Defender for Cloud; assess severity, distinguish true from false positives, and escalate confirmed findings per established procedures.
• Support the maintenance and tuning of detection rules, alert policies, and thresholds to reduce noise and improve signal fidelity, surfacing coverage gaps and recommending adjustments to senior team members.
• Tooling & Log Pipeline Health
  - Monitor the health of Engineering security tooling and log ingestion pipelines, ensuring log sources are active, complete, and flowing correctly. Verify that cloud security services are properly enabled and configured across all in-scope Engineering accounts and subscriptions; assist in maintaining security dashboards and alerting configurations; escalate coverage gaps or tool degradation as needed.
• Incident Response & Runbook Development
  - Contribute to the development and upkeep of incident response playbooks and triage runbooks for Engineering security events; participate in incident response activities including triage, containment support, evidence collection, and post-incident documentation.
• Compliance & Reporting
  - Support Engineering compliance activities related to SOC 2 and HIPAA audit readiness including evidence collection, control documentation, and gap tracking. Contribute to security reporting including finding summaries, remediation tracking, and tool health status for Engineering leadership and compliance stakeholders.
• Designs security architecture of components or functional systems and modifies existing designs to develop or improve products. Recommends alterations to development and design to improve the security of products and/or procedures. Contributes to a broader design perspective and considers how an application interacts with the underlying infrastructure or external resources. Conducts structured threat modeling (e.g., STRIDE) to identify potential threats and vulnerabilities, rates associated risks, and designs mitigations.
  
  Ensures outputs are documented in DHF and linked to security requirements and ISO
  14971 risk assessments. Maintains security relevant design history file documentation for assigned projects, adhering to Arthrex's ISO
  13485 based design control procedures. Determines the necessity of security testing and manages testing of assigned products. Provides Regulatory Affairs technical support for assigned projects in support of global product approvals. Supports Marketing and Product Management with technical support for training and marketing of assigned products. Partners with Software Engineering to design and develop components, processes, and training using Security-by-Design and Privacy-by-Design principles.
  
  Supports surgeon and distributor customers in the sales process by educating and demonstrating security-focused aspects of assigned products as needed. Collaborate with Legal, Compliance (Global Privacy and AI Governance), and IT to ensure products comply with applicable laws, regulations, and company policies. Reports on progress and status of assigned projects on a timely basis. May be required to travel;
  International…