Sr Staff Engr, Product Development

Title: Sr. Staff Product Development Engineer/ Senior Product Security Architect Location: San Diego, CA 92130 (Applications must be located in the Orange County / San Diego metro area.) Duration: 7months (May 18, 2026 – Jan 2, 2027) Shift Schedule: 9 AM to 5 PM Onsite Overview We are seeking a Senior Product Security Architect to lead security architecture and security engineering governance for Client’s Dispensing business unit. The Dispensing portfolio includes FDA Class I and Class II medical devices and their associated cloud-connected platforms. This role focuses on risk-based security that ensures patient safety, data protection, and regulatory readiness. Role Focus: Apply risk-proportionate security controls Emphasize secure-by-design and secure-by-default Enable efficient FDA submissions (510(k), De Novo) Balance usability, workflow, and security Key Responsibilities Security Architecture & Design Define end-to-end security architecture across devices, apps, and cloud Establish baseline security patterns (auth, encryption, secure updates) Conduct Threat Modeling, Risk Assessments, Requirements/Controls Mapping, Security White Papers Lead and Drive Security Design Reviews & Roadmap Remediations/Mitigations Secure SDLC: Implement lean Secure SDLC aligned to NIST, OWASP, and BSIMM Integrate SAST, SCA, secrets scanning, container/IaC scanning Define minimum viable security gates Regulatory & Compliance: Support FDA cybersecurity documentation (threat models, SBOMs, risk assessments) Align with IEC 62304, ISO 14971 Ensure audit-ready documentation Cloud Security: Architect secure integrations with Client’s Cloud Platforms Secure device-to-cloud data flows SBOM & Vulnerability Management: Establish SBOM processes (SPDX, CycloneDX) Implement continuous vulnerability monitoring Define risk-based remediation SLAs Cross-Functional Leadership: Collaborate with engineering, quality, regulatory, and product teams Translate security into patient safety and business risk Mentor teams Required Qualifications: 10+ years cybersecurity experience Experience with FDA Class I/II devices Knowledge of embedded, cloud, and application security Familiarity with FDA submissions Preferred Qualifications Experience with IoMT ecosystems Knowledge of FDA Cybersecurity Pre & Post Market Guidance, UL 2900, AAMI TIR57/TIR97 DevSecOps experience Certifications (CISSP, CCSP, CSSLP) Key Competencies Ability to right-size security controls Strong risk-based decision-making Communication across technical and non-technical teams Success Metrics SBOM completeness Reduction in critical vulnerabilities FDA submission success Time-to-remediate vulnerabilities