Stryker

Operate third party compliance programs (e.g., SOC2, HITRUST) through audits, gap assessments, and continuous monitoring.. Investigate and coordinate response to security incidents and vulnerability reports including analysis of exploitability, remediation planning, and disclosure strategy.. Professional cybersecurity certifications such as CISSP, CSSLP, CCSP, Security+, HCISSP, CISA, SSCP, and GSEC.. Familiarity with VA or DHA risk management processes (FedRAMP, RMF, ATO).. Proficiency with available cybersecurity tools and their usage (e.g., Orca, Tenable, Qualys, CrowdStrike, Veracode, JamF, Okta etc.)

product security engineer

Work Flexibility: Remote Who We Want: <ul><li>Customer-oriented achievers - Individuals with an unparalleled work ethic and customer focused attitude who bring value to their partnerships.</li><li>Self-directed innovators - People who take ownership of their work and need no prompting to drive productivity, change, and outcomes.</li><li>Detail-oriented process improvers - Critical thinkers who naturally see opportunities to develop and optimize work processes - finding ways to simplify, standardize and automate.</li><li>Collaborative partners - People who build and leverage cross-functional relationships to bring together ideas, information, use cases, and industry analyses to develop best practices.</li></ul> What You Will Do: Product Security is driven to make healthcare better by ensuring that Stryker designs, develops, and maintains industry leading cyber secure products for our customers. As a Senior Staff Product Security Engineer, you will be responsible for ensuring the safety, integrity, and resilience of SaaS products developed by the Acute Care business unit at Stryker Medical. You will work with cross-functional stakeholders to identify, evaluate, and mitigate security risks across products. The ideal candidate is excited to advocate for the protection our customers and their patients through creation and implementation of efficient meaningful security processes. Key Responsibilities: <ul><li>Apply common risk assessment frameworks (e.g., NIST 800-53, ISO 27001) to assess security risks in relation to business objectives and risk tolerance.</li><li>Operate third party compliance programs (e.g., SOC2, HITRUST) through audits, gap assessments, and continuous monitoring.</li><li>Guide product teams in interpreting and mapping security requirements to control implementation.</li><li>Develop, update, and manage product security policies, procedures, and trainings based on industry security standards.</li><li>Identify security policy compliance issues and coordinate remediation with leadership and cross-functional stakeholders.</li><li>Monitor, analyze, and report product security metrics to provide visibility and accountability for the effectiveness of security tools and processes.</li><li>Assist sales teams in responding to customer queries about product security and organizational controls.</li><li>Maintain and operate vulnerability scanning and security monitoring solutions.</li><li>Investigate and coordinate response to security incidents and vulnerability reports including analysis of exploitability, remediation planning, and disclosure strategy.</li><li>Maintain vendor relationships for third-party security tools and services.</li></ul> What You Will Need: Basic Qualifications: <ul><li>Bachelor's degree in Cybersecurity, Information Technology, Computer Science, or related discipline</li><li>Minimum 6 years of related experience</li><li>Demonstrated competence with compliance, security, and privacy standards and frameworks (e.g., NIST 800-53, HIPAA, HITECH, GDPR, EU MDCG, SOC2, HITRUST)</li><li>Experience leading product security projects.</li><li>Solid understanding of security for SaaS applications and cloud-based services (e.g., AWS)</li><li>Strong ability to communicate cybersecurity information to engineering, sales, customers, and other non-subject matter experts.</li></ul> Preferred Qualifications: <ul><li>Experience conducting HIPAA security assessments.</li><li>Experience working in medical device, health care, or other regulated industry.</li><li>Professional cybersecurity certifications such as CISSP, CSSLP, CCSP, Security+, HCISSP, CISA, SSCP, and GSEC.</li><li>Familiarity with VA or DHA risk management processes (FedRAMP, RMF, ATO).</li><li>Understanding of encryption, authentication, authorization, and identity management technologies (e.g., LDAP, OAuth, PKI, FIPS 140-2). </li><li>Proficiency with available cybersecurity tools and their usage (e.g., Orca, Tenable, Qualys, CrowdStrike, Veracode, JamF, Okta etc.)</li><li>Familiarity with additional secure product lifecycle frameworks such as IEC 81001 5-1, IEC 62443 4-1</li></ul> <ul><li>$112k - $239k salary plus bonus eligible + benefits. Actual minimum and maximum may vary based on location. Individual pay is based on skills, experience, and other relevant factors.</li></ul> Travel Percentage: 10% Stryker Corporation is an equal opportunity employer. Qualified applicants will receive consideration for employment without regard to race, ethnicity, color, religion, sex, gender identity, sexual orientation, national origin, disability, or protected veteran status. Stryker is an EO employer - M/F/Veteran/Disability. Stryker Corporation will not discharge or in any other manner discriminate against employees or applicants because they have inquired about, discussed, or disclosed their own pay or the pay of another employee or applicant. However, employees who have access to the compensation information of other employees or applicants as a part of their essential job functions cannot disclose the pay of other employees or applicants to individuals who do not otherwise have access to compensation information, unless the disclosure is (a) in response to a formal complaint or charge, (b) in furtherance of an investigation, proceeding, hearing, or action, including an investigation conducted by the employer, or (c) consistent with the contractor's legal duty to furnish information.

START NEW SEARCH