Get the chrome extension Sr. Engineer, Product Cyber Security
BD
We are the people who give possibilities purpose
BD is one of the largest global medical technology companies in the world. Advancing the world of health™ is our Purpose, and it’s no small feat. It takes the imagination and passion of all of us—from design and engineering to the manufacturing and marketing of our billions of MedTech products per year—to look at the impossible and find transformative solutions that turn dreams into possibilities.
Job Description
Summary
We are seeking a Senior Product Cyber Security Engineer to own the cybersecurity deliverables for assigned products end to end and to build the automation that lets a small team cover a large portfolio. You will plan the security activities for each release, lead threat modeling, run composition and static analysis, produce and monitor Software Bills of Materials (SBOMs), coordinate penetration tests, and write the documentation that goes into our design history files, regulatory submissions and customer assurance packages.
This is a product security engineering role, not an IT security, SOC or penetration testing role. You will read code, work in build pipelines, and defend your risk assessments in front of auditors, regulators and customers. You will work daily with R&D, Software Engineering, DevOps, Systems Engineering, Quality and Regulatory Affairs, and with our corporate product security and cyber risk teams.
This position is remote within the United States, with regular overlap with Pacific time working hours.
Key Responsibilities
Product Cybersecurity Planning and Deliverables
- Own the cybersecurity plan and the Product Security Management Plan for assigned products, covering new development, major releases and sustaining changes, in line with our product cybersecurity procedures.
- Produce the required deliverable set for each product: product security requirements gap analysis, threat model and data flow map, Product Security White Paper, Incident and Vulnerability Management Plan, Patch Management Plan, Cybersecurity Risk Summary Report, and third-party vendor assessments.
- Decide with the team which deliverables apply to each product, scale them to the product's risk and regulatory status (research-use-only versus IVD), and document every exemption with its justification.
- Keep the Product Security Management File complete, traceable and ready for FDA inspections and notified-body audits.
Threat Modeling and Risk Assessment
- Lead STRIDE-based threat modeling sessions with product teams: assets, data flows, trust boundaries, threats, controls, and the risk register entries that result.
- Assess products against our product security requirements, score findings with CVSS, and work with R&D on remediation or documented risk acceptance.
- Document unresolved and accepted risks in the Cybersecurity Risk Summary Report that supports release decisions, and feed cybersecurity hazards into the product risk management file where patient safety is affected.
Security Testing, SBOM and Vulnerability Management
- Run static code analysis and software composition analysis (e.g., Snyk) on product releases, triage findings with engineering, and archive the reports.
- Generate and validate CycloneDX SBOMs from the actual release artifacts of every software-enabled product, integrate SBOM generation into build and release pipelines, and load SBOMs into our post-market vulnerability monitoring tool (e.g., CyBeats).
- Monitor post-market vulnerability reports against product SBOMs, assess impact with R&D, and drive remediation within the timelines our procedures set.
- Coordinate penetration tests with our corporate product security engineering team: define scope from the roadmap, schedule tests early in development and before submissions, evaluate results and assess mitigations.
- Support investigation of externally reported vulnerabilities and potential cybersecurity complaints together with our corporate cyber risk team.
Patch Management and Secure Baselines
- Maintain product Patch Management Plans and author or review Security Patch Verification Protocols and Reports.
- Deliver the annual operating system patch verification bulletins for IVD products in the patch verification program.
- Contribute to hardened Windows 11 baseline images for instrument workstations and to the process for managing product-level exceptions.
Customer and Regulatory Assurance
- Assemble cyber assurance packages for key customers (SBOMs, Product Security White Papers, penetration test attestations, SOC 2 summaries) and answer customer security questionnaires.
- Prepare the cybersecurity content of regulatory submissions (FDA premarket cybersecurity requirements, EU IVDR) and support internal reviews, audits and regulator interactions.
- Review third-party security checklists and SOC 2 reports for third-party software and services used in or with our products.
Automation, Metrics and Scaling
- Build and maintain scripts and pipeline steps that generate SBOMs, scan results and audit evidence automatically, so deliverables stay current with every release instead of being rebuilt by hand.
- Produce cross-portfolio security risk reporting and in-market risk metrics for leadership, and keep work-item tracking for security activities current.
- Help evaluate and adopt AI-assisted tooling for drafting and checking security documentation.
- Contribute to updates of our product security procedures and security requirements as corporate policy, FDA expectations and submission feedback evolve.
Cross-Functional Guidance
- Act as the product security subject matter expert for R&D, DevOps, Quality, Regulatory and partner teams.
- Provide practical guidance on secure design, secure update and installation mechanisms, vulnerability remediation and compliance expectations.
- What Success Looks Like in the First Year
- Within 90 days: you own the cybersecurity deliverables for one product release end to end, from the cybersecurity plan to the Cybersecurity Risk Summary Report.
- Within six months: SBOM generation and composition analysis run automatically in the build for the products you support, with results loaded into post-market monitoring.
- Within twelve months: you cover two to three products in parallel, penetration tests and patch verification bulletins for your products are delivered on schedule, and leadership receives regular in-market risk metrics for them.
Required Qualifications
- Bachelor's degree in Computer Science, Software Engineering, Cybersecurity or a related technical field, or equivalent practical experience.
- 10+ years of experience in software engineering, product or application security, or cybersecurity engineering, including hands-on security work on software products that shipped to customers.
- Basic software engineering fluency: you read and write code in some language, you are comfortable with commandline, you are aware of build systems and package ecosystems (npm, pip, NuGet) and CI/CD pipelines (Azure DevOps or similar).
- Hands-on experience with threat modeling (STRIDE or similar), vulnerability assessment, CVSS scoring, remediation workflows and risk acceptance.
- Experience with static analysis and software composition analysis tools and with SBOM formats (CycloneDX or SPDX).
- Experience producing formal security deliverables (threat models, risk assessments, vulnerability reports, SBOMs) that have been reviewed in audits or regulatory submissions.
- Strong written communication: clear, structured technical documentation in English suitable for auditors, regulators and customers.
- Demonstrated ability to run several product workstreams in parallel in a procedure-driven, documentation-heavy environment, with a bias toward automation and reuse over manual effort.
Preferred Qualifications
- Experience in medical devices, in vitro diagnostics, life sciences or other regulated software, including familiarity with FDA premarket cybersecurity guidance (section 524B), EU MDR/IVDR, ISO 14971, AAMI TIR57, IEC 81001-5-1 or UL 2900.
- Experience with Snyk, CyBeats or similar composition analysis and SBOM monitoring platforms, and with vulnerability scanners such as Tenable or Qualys.
- Experience with Windows operating system hardening, image management and security patch verification.
- Experience coordinating penetration tests and performing supplier security assessments (third-party checklists, SOC 2 report reviews).
- Experience building security metrics, dashboards or operational reporting.
- Experience using AI and large language model tools to accelerate documentation and analysis while keeping outputs reviewable and traceable.
- Experience supporting FDA inspections, notified-body audits or ISO 13485 quality system audits.
Why Join Us?
To find purpose in the possibilities, we need people who can see the bigger picture, who understand the human story that underpins everything we do. We welcome people with the imagination and drive to help us reinvent the future of healthcare. At BD, you’ll discover a culture in which you can learn, grow and thrive.
We believe that when people connect in person, we learn faster, collaborate more deeply, and build a stronger culture. Join us and enjoy a culture where face-to-face collaboration supports your learning, your progress, and your success.
To learn more about BD visit .
Becton, Dickinson, and Company is an Equal Opportunity Employer. We evaluate applicants without regard to race, color, religion, age, sex, creed, national origin, ancestry, citizenship status, marital or domestic or civil union status, familial status, affectional or sexual orientation, gender identity or expression, genetics, disability, military eligibility or veteran status, and other legally protected characteristics.
Required Skills
Optional Skills
.
Primary Work Location
USA OR Ashland - FlowJoAdditional Locations
Work Shift
At BD, we reward, support and develop our associates through our comprehensive Total Rewards program. We are committed to attracting and retaining high quality talent by providing reward and recognition opportunities that promote a performance-based culture, as well as a competitive package of compensation and benefits programs. You can learn more on our career site under "Our Commitment to You."
Our salary or hourly rate ranges reward associates fairly and competitively. We regularly review these ranges and factors, such as location, contribute to the range displayed.
Our pay is based on the role and the necessary skills and education to perform it successfully. The salary or hourly rate offered is determined by the role's specific requirements, including any applicable step rate pay system at the work location. Salary or hourly pay ranges are influenced by labor laws and Collective Bargaining Agreement (CBA) requirements applicable to the work location which may also affect the workplace arrangement of the role.
Salary Range Information
$117,800.00 - $188,600.00 USD AnnualOriginally posted on Himalayas
Product Security Leader (Hampton, VA, US, 23666)
TE Connectivity
At TE, you will unleash your potential working with people from diverse backgrounds and industries to create a safer, sustainable and more connected world.
Job Overview
TE Connectivity Ltd. is a $16 billion global technology and manufacturing leader creating a safer, sustainable, productive, and connected future. For more than 75 years, our connectivity and sensor solutions, proven in the harshest environments, have enabled advancements in transportation, industrial applications, medical technology, energy, data communications, and the home. With 80,000 employees, including more than 8,000 engineers, working alongside customers in approximately 140 countries, TE ensures that EVERY CONNECTION COUNTS. Learn more at www.te.com
BUSINESS UNIT DESCRIPTION
Digital Data Networks (DDN) business in TE Connectivity you will play a key role in the design of products for high-speed products in the connector, cable assembly, and/or radio system industry—targeting high-speed communications and connectivity within datacenters and wireless infrastructure.
ROLE DESCRIPTION
The Product Security Leader is responsible for defining, implementing, and governing the cybersecurity strategy across all product development activities within the DDN Business Unit, with a focus on high-speed connectivity solutions used in data center environments. This role ensures that products containing integrated circuits, firmware, and embedded software are designed, validated, and maintained to mitigate cyber threats and prevent unauthorized access or exploitation. The position operates at the intersection of hardware, firmware, and system-level architecture, addressing cybersecurity risks throughout the full product lifecycle—from concept through deployment and sustainment. The Product Security Leader will define and govern the cybersecurity policies, procedures and governance model and oversee the incorporation into the LeanPD process for applicable products.
Job Requirements
1. Product Security Strategy & Governance
- Develop and lead the business unit’s product cybersecurity strategy aligned with business objectives and customer requirements.
- Establish cybersecurity policies, standards, and secure design principles for hardware, firmware, and embedded software.
- Define security architecture requirements for high-speed connectivity products (e.g., cables, connectors, active interconnects, modules).
- Ensure alignment with industry standards (e.g., secure development lifecycle, zero trust principles).
2. Secure Product Development Lifecycle (SPDLC)
- Integrate cybersecurity into all phases of New Product Introduction (NPI).
- Define and enforce secure coding standards, threat modeling, and design reviews.
- Ensure cybersecurity requirements are embedded in system and component specifications.
- Partner with engineering teams to implement security-by-design practices.
3. Threat Modeling & Risk Assessment
- Identify and evaluate potential attack vectors across:
- Embedded firmware
- ASIC/FPGA interfaces
- High-speed data paths
- External interfaces (I/O, management interfaces, etc.)
- Conduct product-level threat modeling and risk assessments.
- Define mitigation strategies and validate their effectiveness.
4. Vulnerability Management & Testing
- Establish processes for:
- Static and dynamic code analysis
- Penetration testing (internal and third-party)
- Firmware and hardware security validation
- Lead root cause analysis and remediation of identified vulnerabilities.
- Maintain vulnerability disclosure and response processes.
.
5. Supply Chain & Component Security
- Define cybersecurity requirements for suppliers of ICs, firmware, and software components.
- Assess third-party components for security risks (including open-source software).
- Implement secure provisioning, authentication, and anti-tampering mechanisms.
6. Product Architecture & System Security
- Collaborate with system architects to:
- Design secure communication protocols
- Implement encryption, authentication, and key management
- Ensure secure boot, firmware integrity, and update mechanisms
- Address risks associated with data center deployment environments (e.g., lateral movement, hardware-based attacks).
7. Incident Response & Monitoring
- Develop and maintain product cybersecurity incident response plans.
- Support investigation of field incidents and potential breaches involving company products.
- Coordinate with customers and internal teams during security events.
8. Compliance & Certification
- Ensure products meet relevant cybersecurity regulations and standards (customer-driven and regulatory).
- Support audits, certifications, and customer security assessments.
- Maintain documentation for compliance and traceability.
9. Training & Culture
- Drive cybersecurity awareness across engineering and product teams.
- Train engineers on secure design practices and emerging threats.
- Act as a subject matter expert and advisor to leadership.
What your background should look like
- Bachelor’s or Master’s degree in Computer Engineering, Electrical Engineering, Cybersecurity, or related field
- 10+ years in cybersecurity, with strong emphasis on embedded systems and/or hardware-integrated products.
- Experience in high-speed electronics, data center infrastructure, or networking products strongly preferred.
- Proven experience implementing secure development lifecycle practices.
-
Technical Expertise
- Embedded systems security (firmware, RTOS, low-level software)
- Hardware security (ASICs, FPGAs, side-channel risks, secure elements)
- Cryptography, secure boot, authentication protocols
- Network and data path security in high-speed systems
- Vulnerability assessment tools and penetration testing methods
- Secure firmware update and key management systems
-
Frameworks Knowledge
- Secure development lifecycle frameworks
- Product security standards relevant to data center and networking environments
- Zero Trust Architecture concepts
-
Standards Knowledge
- ISO/IEC 27001:2022: The premier international standard, providing a framework for setting up an Information Security Management System (ISMS) to identify and mitigate risks.
- ISO/IEC 27017/27018: Guidelines specifically for cloud security controls and the protection of personal data in the cloud.
- NIST Cybersecurity Framework (CSF) 2.0: A voluntary, flexible framework focused on protecting critical infrastructure using five core functions: Identify, Protect, Detect, Respond, and Recover.
- NIST SP 800-53: Prescribes security and privacy controls for information systems, often mandatory for U.S. federal data centers.
- SOC 2 Type II: Attestation reports that evaluate internal controls regarding security, availability, and confidentiality.
- ANSI/TIA-942: Establishes standards for data center design, construction, and operation, including physical security requirements for Tiers 1-4.
- Leadership & Soft Skills
- Strong cross-functional leadership (engineering, quality, product management)
- Ability to influence design decisions without direct authority
- Excellent communication skills for both technical and executive audiences
- Analytical mindset with strong problem-solving capability
- Ability to prioritize responsibilities in a fast-paced dynamic work environment.
- Willingness to travel as required, ~30%
WE VALUE
- Knowledge in data center architecture, connectors, wire harnesses, busbars, high speed connectivity products, high voltage, electronics, measurement & signal processing.
- Experience in product development for data center applications
#TANAUV #datacenters
Competencies
ABOUT TE CONNECTIVITY
TE Connectivity plc (NYSE: TEL) is a global industrial technology leader creating a safer, sustainable, productive, and connected future. As a trusted innovation partner, our broad range of connectivity and sensor solutions enable the distribution of power, signal and data to advance next-generation transportation, energy networks, automated factories, data centers enabling artificial intelligence, and more.
Our more than 90,000 employees, including 10,000 engineers, work alongside customers in approximately 130 countries. In a world that is racing ahead, TE ensures that EVERY CONNECTION COUNTS. Learn more at and on LinkedIn, Facebook, WeChat,Instagram and X (formerly Twitter).
COMPENSATION
• Competitive base salary commensurate with experience: $175,000 – $260,000 (subject to change dependent on physical location)
• Posted salary ranges are made in good faith. TE Connectivity reserves the right to adjust ranges depending on the experience/qualification of the selected candidate as well as internal and external equity.
• Total Compensation = Base Salary + Incentive(s) + Benefits
BENEFITS
• A comprehensive benefits package including health insurance, 401(k), disability, life insurance, employee stock purchase plan, paid time off and voluntary benefits.
EOE, Including Disability/Vets
IMPORTANT NOTICE REGARDING RECRUITMENT FRAUD
TE Connectivity has become aware of fraudulent recruitment activities being conducted by individuals or organizations falsely claiming to represent TE Connectivity. Please be advised that TE Connectivity never requests payment or fees from job applicants at any stage of the recruitment process. All legitimate job openings are posted exclusively on our official careers website at te.com/careers, and all email communications from our recruitment team will come only from actual email addresses ending in @te.com. If you receive any suspicious communications, we strongly advise you not to engage or provide any personal information, and to report the incident to your local authorities.
Originally posted on Himalayas