01Overview
Job Requirements
As a Lead Product Security Engineer, you will be responsible for driving Product Security activities throughout the Secure Software Development Lifecycle (SSDLC), working closely with Software Architects, Development teams, DevOps, Quality Engineering, and Product Management to build secure medical products.
This role requires a strong technical background in Product Security, Application Security, Security Architecture, Threat Modeling, DevSecOps, and Vulnerability Management.
Work Experience
Responsibilities
- Perform Threat Modeling using STRIDE, PASTA, MITRE ATT&CK; and similar methodologies.
- Conduct Security Architecture Reviews and recommend Secure-by-Design solutions.
- Define and review Product Security requirements during software development.
- Perform security assessments using SAST, DAST and Software Composition Analysis (SCA) tools.
- Drive vulnerability triage, risk assessment, remediation tracking and security verification.
- Review SBOMs and monitor third-party software risks using industry-standard tools.
- Collaborate with architects and engineering teams to implement secure coding and security best practices.
- Support cloud-native and container-based product security initiatives (Optional)
- Work with cross-functional teams to evaluate security risks and identify practical compensating controls for legacy products.
- Provide technical guidance on cryptography, IAM, network security and secure communications.
- Participate in security roadmap planning and product security governance.
Required Qualifications
- 8+ years of experience in Product Security, Application Security or Secure Software Development.
- Robust experience with Threat Modeling methodologies (STRIDE, PASTA, MITRE ATT&CK;).
- Experience with SAST, DAST and SCA tools.
- Strong understanding of Secure Design Principles and Secure Software Development Lifecycle.
- Experience in Vulnerability Management and Security Risk Assessment.
- Knowledge of Software Bill of Materials (SBOM) and Supply Chain Security.
- Strong understanding of Cryptography, Identity & Access Management and Network Security.
- Experience working with software architects and development teams.
- Excellent analytical and communication skills. .
