Senior Product Security Engineer

iRhythm Technologies, Inc. is shaping a future where everyone can access the best possible cardiac health solutions. They are seeking a Senior Product Security Engineer to ensure robust protection of patient data and device integrity while driving compliance with FDA cybersecurity requirements.

Responsibilities:

• FDA Cybersecurity Compliance: Ensure compliance with FDA cybersecurity guidance and regulations in collaboration with Cybersecurity, Regulatory, Quality, and Systems Development teams
• Risk Assessments & CSRAs: Conduct comprehensive security risk assessments, including Cybersecurity Risk Assessments (CSRAs), to identify vulnerabilities and threats across device hardware, firmware, software, and cloud components
• Threat Modeling: Develop and maintain device-specific cyber threat models, factoring in patient safety, data privacy, and operational continuity
• SBOM Management: Demonstrate familiarity with Software Bill of Materials (SBOM) and effectively communicate technical details
• Security Documentation: Create and maintain cybersecurity documentation for pre- and post-market activities, ensuring regulatory alignment
• Data Flow Diagrams: Produce detailed data flow diagrams to support the threat modeling process
• Security Design Reviews: Participate in design reviews of medical device architectures and implementations, providing actionable recommendations for system security requirements
• Vulnerability Analysis & Management: Perform and support vulnerability analysis and coordinate the vulnerability management program, including scanning, patching, and remediation for medical devices
• Threat Detection Tools: Leverage and maintain application and threat detection tools (Veracode, Snyk, GitLab, or equivalent) to identify security flaws early in the SDLC
• Incident Response: Support investigation and remediation of device-related security incidents, minimizing impact and preventing recurrence
• Data Privacy Compliance: Partner with the Privacy Team to ensure adherence to HIPAA, GDPR, and other data protection regulations

Requirements:

• Bachelor's degree in Computer Science, Information Security, or related field
• 6+ years of experience in information security, with direct focus on product security for medical devices
• Strong understanding of security principles, methodologies, and tools within the PDLC and SDLC
• Demonstrated experience conducting Cybersecurity Risk Assessments (CSRAs), vulnerability analysis, and working with modern threat detection tools (Veracode, Snyk, GitLab, or similar)
• Familiarity with NIST Cybersecurity Framework, NIST SP 800-171, and deeper controls/frameworks such as NIST SP 800-53 (Security and Privacy Controls), NIST SP 800-92 (Log Management), and NIST SP 800-63 (Digital Identity Guidelines)
• Hands-on experience with vulnerability identification and threat modeling within healthcare using methodologies such as STRIDE
• Experience operating in a regulated environment (FDA, HIPAA, GDPR, international regulatory frameworks)
• Experience with medical device hardware or Software as a Medical Device (SaMD)
• Experience with medical device software development and regulatory processes
• Excellent problem-solving, analytical, and communication skills, able to take a multi-siloed approach
• Ability to understand intro dependencies of teams across; mobile applications, hardware and cloud environments
• Demonstrated experience supporting 510(k) submissions, with a focus on product security documentation, risk assessments, and regulatory compliance
• Industry certifications such as CISSP, CISM, CISA, or medical device security–specific certifications
• Experience with international frameworks and standards (EU MDR, JIS T 2304 / IEC 62304)
• Understanding penetration testing methodologies and tools, able to work with pen test teams independently with little guidance
• Proficiency with programming languages and technologies commonly used in medical device development