Product Security Engineer

Overview

Product Cybersecurity Engineer focused on product security tooling, providing hands-on cybersecurity tool engineering in support of the Product Security team to keep Smith+Nephew products and their data secure and resilient to cybersecurity threats.

What you'll do

• Collaborate with internal stakeholders to design, engineer, and ensure implementation of security tools used across the product lifecycle (e.g. threat model, Static Application Security Testing, Dynamic Application Security Testing, Software Composition Analysis).
• Run security scans (e.g. Static Application Security Testing, Dynamic Application Security Testing, Software Composition Analysis).
• Support the creation of Software Bill of Materials (SBOMs) based on an understanding of the products and the tools.
• Lead the strategy and ensure the maintenance of cybersecurity tools in support of multiple Smith+Nephew technologies, capital devices, digital accessories, connected infrastructures and software applications.
• Lead the execution and integration of cybersecurity testing and assessment activities throughout the development lifecycle, including Static Application Security Testing, Dynamic Application Security Testing, and Software Composition Analysis.
• Provide technical expertise in evaluating and assessing potential vulnerabilities, support vulnerability response efforts, and communicate risks and mitigation strategies to the business.
• Help develop and mature Global Product Security Strategy and Secure-Software Development Life Cycle (S-SDLC) so robust cyber security controls are present and effective from product conceptualization through commercial launch and product/product family decommissioning.
• Provide technical leadership and competency in creating comprehensive threat models using industry-standard methods in close collaboration with product teams and product security engineers.

What you'll need

• Bachelor's or equivalent experience, or Master's degree in Computer Science or Information Technology.
• Minimum 4+ years of experience in hands-on cybersecurity.
• Strong understanding of mitigating security controls, including Vulnerability Management, Penetration Testing, and Code Security.

Nice to have

• Current CISM, CISSP, CRISC, or similar certification.
• FDA and other medical device regulators experience.
• Knowledge of cyber security standard frameworks such as HIPAA, FDA, ISO 27001/2, NIST CSF, and OWASP.
• Understanding of network infrastructure, including firewalls, web proxy and/or email architecture, particularly as they apply in a mitigating control functionality.
• Experience with different cloud computing platforms and the cloud security framework.
• Ability to design, recommend, plan, guide, and support implementation of innovative security solutions.
• Understanding of the current Medical Device market, including what customers want to see regarding product security.
• Understanding of back-channels typically used by threat actors for malicious activity.
• Understanding of different connectivity protocols and the risks involved with them.
• Superb communication, collaboration, relationship building and collaborator engagement skills.
• Experience managing and prioritizing multiple tasks effectively.
• Ability to work independently and proactively without daily direction.

Details

• Location: Kharadi, Pune, India.
• Hybrid: work from office 2 days.
• Shift: UK shift, 12:30 PM to 9:30 PM IST.