Product Security Engineer_26-04157

Job Title: Product Security Engineer
Job Id: 26-04157
Location: San Diego, CA
Duration: 12 Months Contract
Position Type: Hourly Contract Position (W2 only)

Technical Skills

Must Have

• API Documentation
• Application Programming Interface (API) Security
• Application Security Architecture
• Application Security Testing
• Artificial Intelligence (AI)
• Cloud Security
• Cyber Risks
• Cybersecurity
• Cyber Security Assessments
• Cybersecurity Compliance
• Cybersecurity Risk Management
• Cyber Threat Analysis
• Cyber Threat Modeling
• Design Documentation
• Documentation Compliance
• Security Engineering

Role

• Temp to Perm possibility but that depends on experience!
• Applications must be located in the Orange County / San Diego metro area.
• We are seeking a Product Security Engineer to support Client's MMS Dispensing business unit. The Dispensing portfolio includes FDA Class I and Class II medical devices and their associated cloud-connected platforms. The product security engineer owns, leads, and executes the activities and documentation outlined in B D's security lifecycle. These activities and documents include Security Requirements, Threat Modeling, Risk Assessments and Analysis, Vulnerability & Risk Management Plans, Security Testing, and White Papers.
• This role focuses on risk-based security that ensures patient safety, data protection, and regulatory readiness.

Role Focus

• Execution of Product Security Engineering Lifecycle activities
• Generation and Maintenance of Product Security Documentation
• Apply risk-proportionate security controls
• Emphasize secure-by-design and secure-by-default
• Enable efficient FDA submissions (510(k), De Novo)
• Balance usability, workflow, and security

Key Responsibilities

• Security Architecture & Design
• Define end-to-end security architecture across devices, apps, and cloud
• Establish baseline security patterns (auth, encryption, secure updates)
• Conduct Threat Modeling, Risk Assessments, Requirements/Controls Mapping, Security White Papers
• Lead and Drive Security Design Reviews & Roadmap Remediations/Mitigations

Secure SDLC

• Implement lean Secure SDLC aligned to NIST, OWASP, and BSIMM
• Integrate SAST, SCA, secrets scanning, container/IaC scanning
• Define minimum viable security gates

Regulatory & Compliance

• Support FDA cybersecurity documentation (threat models, SBOMs, risk assessments)
• Align with IEC 62304, ISO 14971
• Ensure audit-ready documentation

Cloud Security

• Architect secure integrations with B D's Cloud Platforms
• Secure device-to-cloud data flows

SBOM & Vulnerability Management

• Establish SBOM processes (SPDX, CycloneDX)
• Implement continuous vulnerability monitoring
• Define risk-based remediation SLAs

Cross-Functional Leadership

• Collaborate with engineering, quality, regulatory, and product teams
• Translate security into patient safety and business risk
• Mentor teams

Required Qualifications

• 5+ years cybersecurity experience
• Experience with FDA Class I/II devices
• Regulatory/Quality Control product development
• Demonstrated working experience in the domains of embedded, cloud, and application security
• FDA submissions

Preferred Qualifications

• Software Development, System Engineering background
• AI (Agentic, Generative, ML) skills and agent development
• Experience with IoMT ecosystems
• Knowledge of FDA Cybersecurity Pre & Post Market Guidance, UL 2900, AAMI TIR57/TIR97
• DevSecOps experience
• Certifications (CISSP, CCSP, CSSLP)
• Experience working in cross-functional product development environments
• Experience presenting technical security concepts to leadership and business stakeholders
• Proven track record of driving security initiatives from concept through implementation

Key Competencies

• Ability to right-size security controls
• Strong risk-based decision-making
• Communication across technical and non-technical teams
• Strong stakeholder management skills
• Ability to build credibility and trust across cross-functional teams
• Excellent verbal, written, and presentation communication skills
• Ability to navigate ambiguity and drive consensus
• Ability to balance competing priorities in a fast-paced environment

Success Metrics

• Comprehensive Threat Modeling and effective Security Risk Management
• SBOM completeness
• Reduction in critical vulnerabilities
• FDA submission success
• Time-to-remediate vulnerabilities
• Timely completion of security lifecycle deliverables
• On-time support of product release and submission milestones

Compensation: The hourly rate for this position is between $100-$110 per hour.

Factors which may affect starting pay within this range may include [geography/market, skills, education, experience and other qualifications of the successful candidate].

Benefits: Sunrise offers ACA compliant medical coverage/dental insurance/vision insurance to all employees. We also offer Sick time benefits as required per State regulations

Founded in 1990, Sunrise Systems is an award winning IT/Professional Staffing firm to Fortune 500 and State/Local Government Agencies.