Senior Product Security Engineer (Medical Devices)

Location: Brno, Czechia; hybrid work with working from home permitted for a maximum of 2 days per week. Legal eligibility to work in the Czech Republic is required.

Company

hirify.global develops precision engineered components, subsystems, and medical technologies for healthcare, advanced manufacturing, minimally invasive medicine, robotics, and 3D metal printing.

What you will do

• Manage the end-to-end vulnerability lifecycle across the medical device portfolio, from monitoring and identification through closure.
• Monitor CVEs, NVD, CISA KEV, vendor advisories, SBOMs, and SCA outputs; analyze product and third-party component vulnerabilities.
• Assess applicability, exploitability, product impact, and risk; perform triage, prioritization, CVSS evaluation, threat modeling, and risk assessments.
• Communicate vulnerability impacts and remediation plans to customers and support coordinated disclosure and regulatory reporting.
• Own and improve vulnerability assessment, reporting, governance, workflows, templates, records, and approval processes.
• Automate vulnerability intake, analysis, reporting, metrics, and SBOM and vulnerability-intelligence integration.

Requirements

• Five or more years of experience in product security, vulnerability management, cybersecurity operations, or security engineering.
• Hands-on experience with vulnerability analysis, risk evaluation, remediation tracking, and reporting.
• Experience with vulnerability management and reporting tools.
• Knowledge of operating systems, networking, embedded systems, and third-party components.
• Excellent English communication skills and the ability to explain technical findings to customers and non-technical stakeholders.
• Strong ownership, analytical thinking, and attention to detail.
• Degree in cybersecurity, computer science, software engineering, electrical engineering, or a comparable field; equivalent experience may be considered.
• Must be legally eligible to work in the Czech Republic through permanent residence or free access to the job market.

Nice to have

• Medical device or regulated-industry experience.
• Knowledge of IEC 81001-5-1, IEC 62304, ISO 14971, EU MDR, FDA medical device cybersecurity expectations, and the EU Cyber Resilience Act.
• Relevant cybersecurity certifications.

Culture & Benefits

• 25 vacation days per year, 5 sick days, and 1 paid day annually for charitable activities.
• Flexible working hours with core hours from 10:00 to 15:00 and a home-working allowance for up to 2 days per week.
• Flexi Pass vouchers worth 1,000 CZK per month, supplementary pension contributions of 1,000 CZK per month after probation, and meal vouchers worth 129.50 CZK per day.
• Annual wage reassessment from 1 April, employee referral bonuses of up to 110,000 CZK, and subsidized MultiSport membership.
• Training, language courses, career advancement, a dog-friendly and family-friendly workplace, employee events, refreshments, free parking, and workplace showers.