Senior Product Security Engineer (Medical Devices)

Location: Onsite in Lafayette, Colorado or North Haven, Connecticut, United States. Candidates below the Principal level must possess unrestricted U.S. work authorization at the time of hire and throughout employment.

Salary: $132,000–$198,000 USD annually.

Company

hirify.global develops healthcare technologies and medical devices across more than 150 countries, including connected solutions for surgical procedures.

What you will do

• Contribute to product security strategy and roadmap development for surgical medical device solutions.
• Integrate cybersecurity practices into the product lifecycle from concept and design through postmarket activities.
• Lead or support threat modeling, security risk assessments, mitigation planning, and compliance with applicable medical device standards and FDA guidance.
• Collaborate with system architects, software leads, hardware engineers, Research & Development, Quality, Regulatory, Product teams, and external vendors on secure architectures and controls.
• Support vulnerability scans, penetration tests, static and dynamic analysis, third-party and supply-chain security assessments, and postmarket incident investigations.
• Maintain security documentation, share knowledge, promote security awareness, and mentor more junior engineers.

Requirements

• Bachelor’s degree and at least 4 years of experience in cybersecurity, product security, software security, embedded systems security, or medical device security; or a Master’s degree and at least 2 years of related experience; or a PhD.
• Experience conducting threat modeling, cybersecurity risk assessments, and risk mitigation activities.
• Experience integrating cybersecurity practices into a secure product development lifecycle.
• Experience with vulnerability assessment, penetration testing, static analysis, dynamic analysis, or application security testing methodologies.
• Experience developing or evaluating security architectures and controls for connected products.
• For baccalaureate degrees earned outside the United States, the degree must satisfy the requirements of 8 C.F.R. § 214.2(h)(4)(iii)(A).
• Unrestricted U.S. work authorization is required at hire and throughout employment for roles below the Principal level.

Nice to have

• Experience securing medical devices, healthcare technologies, embedded systems, IoT devices, or cloud-connected products.
• Knowledge of IEC 81001-5-1, IEC 60601-4-5, ISO 14971, FDA cybersecurity guidance, and NIST cybersecurity frameworks.
• Experience with secure boot, cryptography, authentication, authorization, access management, secure communications, data protection, and secure software updates.
• Experience supporting cybersecurity activities in regulated healthcare, life sciences, or medical technology environments.
• CISSP, GIAC, CEH, or a similar cybersecurity certification.

Culture & Benefits

• Onsite work model with regular in-person collaboration across engineering and business teams.
• Health, dental, vision, life, and disability insurance options.
• Health Savings Account, Healthcare Flexible Spending Account, dependent daycare spending account, and tuition assistance or reimbursement.
• Paid time off, paid holidays, sick time where required, and retirement plans including 401(k) contributions and match.
• Employee Stock Purchase Plan, Employee Assistance Program, incentive plans, and a global well-being program.