Staff Product Security Analyst

Summary

Join iRhythm as a Staff Product Security Analyst and play a crucial role in securing our medical devices. You will be responsible for identifying, assessing, and mitigating security risks, working closely with various teams throughout the product development lifecycle. This role requires extensive experience in information security, particularly within the medical device industry, and a strong understanding of relevant regulations and standards. You will lead the end-to-end device product security management process, ensuring compliance with FDA Cybersecurity guidance and other regulations. The position offers a competitive salary and the opportunity to make a significant impact on patient care within a dynamic and innovative company.

Requirements

• Hold a Bachelor's degree in computer science, information security, or a related field
• Possess 12+ years of experience in information security, with a focus on product security for medical devices
• Demonstrate a strong understanding of security principles, methodologies, and tools specific to medical devices
• Possess exceptional writing, editing, and proofreading abilities
• Demonstrate familiarity with content management systems (CMS) and/or document repository systems
• Have experience with vulnerability scanning, penetration testing, and threat modeling in the healthcare context
• Possess expertise with FDA Cybersecurity guidance, regulations, and industry best practices
• Demonstrate familiarity with other Cybersecurity frameworks such as the NIST Cyber Security Framework and NIST SP 800-171
• Have knowledge of secure coding practices and development methodologies (e.g., Agile, DevOps) for medical devices
• Have experience with medical device design control requirements for software development and regulatory processes
• Possess excellent problem-solving, analytical, and communication skills
• Demonstrate the ability to work on significant and unique issues where analysis of situations or data requires an evaluation of intangibles. Exercise independent judgment in methods, techniques, and evaluation criteria for obtaining results. Create formal networks involving coordination among groups within and outside of their assigned function

Responsibilities

• Lead and own the end-to-end device product security management process
• Ensure compliance with FDA Cybersecurity guidance and regulations through collaboration with the Cyber Security, Regulatory and Quality, and Systems Development teams
• Conduct comprehensive risk assessments of medical devices, identifying potential vulnerabilities and threats specific to the device hardware, firmware, and associated software
• Develop and maintain cyber threat models for medical devices, considering factors such as patient safety, cyber security data privacy, and operational continuity
• Demonstrate familiarity with SBOMs and the ability to communicate technical details effectively
• Develop and maintain required medical device cyber security documentation as part of the device DHF including pre and post market cyber security activities and filings
• Detail data flow diagrams at sufficient detail that can be leveraged throughout the threat modeling process
• Participate in security design reviews of medical device architectures and implementations, cybersecurity impact assessment from device design changes and providing recommendations for system security requirements that meet Regulatory and QMS requirements
• Promote and guide secure coding practices within development teams, providing guidance and training specific to medical devices
• Assist in the investigation and resolution of security incidents related to medical devices, coordinating with relevant teams to minimize impact and prevent future occurrences
• Assist the Cybersecurity team in execution and maintenance of the vulnerability identification program for medical devices, including vulnerability scanning, patching, and remediation
• Collaborate with the Privacy Team to ensure compliance with data privacy regulations, such as HIPAA, GDPR, and other applicable laws

Preferred Qualifications

• Hold certifications such as CISSP, CISM, CISA, or specialized medical device security certifications
• Have experience with international medical device cybersecurity frameworks and standards (EU MDR, Japan JIS T 2304 (IEC 62304))
• Have knowledge of specific programming languages and technologies used in medical device development

Benefits

Estimated Pay Range $150,000 — $200,000 USD