Principal Product Security Engineer Job Santa Clara area,California USA,IT/Tech

Principal Product Security Engineer (Santa Clara, CA) — up to 10% travel.

Relocation to the San Francisco Bay area will be considered on a case-by-case basis.

Position Summary:

Senior technical cybersecurity expert securing connected medical devices, robotic systems, embedded platforms, cloud services, and supporting digital health ecosystems throughout the product lifecycle. Provides hands-on leadership across product teams by identifying risks, defining security requirements, assessing security, guiding remediation, and verifying security controls in regulated medical device products.

Primary Responsibilities:

Serve as cybersecurity technical lead for complex medical device/digital health programs.
Provide technical direction for security design, implementation, verification, vulnerability remediation, and risk treatment.
Drive security-by-design; mentor software/systems/cloud/embedded teams.
Develop/review/maintain cybersecurity requirements for embedded systems, apps, cloud, and connected devices.
Perform security reviews/assessments, attack surface analysis; evaluate authn/authz, crypto, secure boot, key management, access control, logging/monitoring, updates, and OS hardening.
Lead threat modeling and cybersecurity risk assessments; develop risk-based mitigations.
Coordinate security testing (SAST, SCA, scanning, fuzzing, pen testing, config review, architecture assessments) and ensure traceability to risks/requirements/release.
Lead vulnerability management and post-market security; support disclosure, patching, and surveillance.
Provide technical input for releases, quality/regulatory submissions; support audits and customer security materials.

Qualifications:

Required:

BS in CS/Cybersecurity/Software Engineering/Computer Engineering or equivalent.
8+ years in cybersecurity/product security/cloud security.
Expertise in threat modeling, secure development, vulnerability management, pen testing, security design review, cybersecurity risk assessment.
Experience securing embedded/connected medical devices/IoT/robotics/cloud-connected or similar cyber-physical products.
Strong knowledge of authn/authz, cryptography, secure boot, key management, OS/network hardening, logging/monitoring, secure updates.
Experience writing/reviewing/validating technical cybersecurity requirements.
Ability to lead complex initiatives across cross-functional teams and communicate effectively.

Preferred:

Medical devices/healthcare tech/surgical robotics/regulated software/connect health experience.
FDA/global medical device cybersecurity expectations.
Standards/frameworks: ISO 14971, AAMI TIR
57, IEC 62304, IEC 81001-5-1, HIPAA, GDPR, HITRUST, ISO 27001, OWASP Top 10, SOC 2, FedRAMP.
AWS/Azure and web/cloud security; secure infrastructure design.
Coding experience (C/C++/C#/Java/Python or similar).
Certifications:

CISSP, CSSLP, GIAC, GICSP, or similar.
MS degree.

Benefits (time off, subject to policy/date of hire):

Vacation: 120 hours/year
Sick time: 40 hours/year (CO/Washington: 48/56)
Holiday pay (incl. Floating Holidays): 13 days/year
Work/Personal/Family Time: up to 40 hours/year
Parental Leave: 480 hours
Bereavement Leave: 240 hours immediate family (40 extended family/year)
Caregiver Leave: 80 hours (52-week rolling)
Volunteer Leave: 32 hours/year
Military Spouse Time-Off: 80 hours/year

#J-18808-Ljbffr