Principal Product Security Engineer

About the role

CathWorks, part of Medtronic, is looking for a Product Security Engineer to own the cybersecurity of the CathWorks platform medical device, including its OS, clinical applications, hardened environment and custom UI shell, from design through post-market. The role is the technical authority for security across the product lifecycle and sits at the intersection of software development, engineering, quality and regulatory affairs. It is based in Kfar Saba, Israel, on an onsite basis.

Key responsibilities

• Lead product threat modeling and maintain cybersecurity architecture, attack analyses and security risk assessments throughout the product lifecycle.
• Define security requirements and run design reviews for software features, system integrations and third-party components.
• Maintain secure Windows platform configurations, including OS hardening, application control, secure boot, encryption and access management.
• Integrate cybersecurity into the SDLC through secure coding, security testing, vulnerability scanning and CI/CD security controls.
• Manage Software Bill of Materials (SBOM), third-party component inventories and vulnerability monitoring.
• Run cybersecurity verification such as penetration testing, fuzz testing, vulnerability assessments and remediation tracking.
• Prepare cybersecurity documentation for regulatory submissions, audits and compliance.
• Lead post-market cybersecurity, including vulnerability triage, risk evaluations, coordinated disclosure, incident response support and customer communications.

Required profile

• Bachelor's degree and 7+ years of experience in product security, application security or cybersecurity engineering.
• Experience with Windows security technologies (access controls, UAC, WDAC, AppLocker, BitLocker, Group Policy, OS hardening).
• Experience with threat modeling, security architecture reviews and risk assessments.
• Experience with secure SDLC practices (SAST, DAST, SCA, SBOM, CI/CD security).
• Preferred: regulated medical device experience (IEC 62304, ISO 14971, ISO 13485, IEC 81001-5-1, AAMI TIR57), FDA cybersecurity submission support, knowledge of DICOM/PACS/HL7/FHIR, C#/C++/Win32, reverse engineering or exploit analysis, and certifications such as CISSP, GIAC, GXPN or OSCP.

Required skills

• Windows security hardening and access control
• SAST, DAST, SCA, SBOM and CI/CD security
• Cryptography, PKI, TLS, certificate management and code signing
• Threat modeling and security risk assessment

The position is eligible for the Medtronic Incentive Plan (MIP). Medtronic offers a competitive salary and a flexible benefits package.