Jobs at Baxter International

As a Principal Product Cybersecurity Engineer, you will own and direct the cybersecurity design, architecture, and analysis of medical devices, digital platforms, and connected healthcare solutions. You will serve as a cybersecurity subject matter expert, leading security initiatives from concept through deployment while providing technical leadership and mentorship across cross-functional teams. You will drive cybersecurity strategy, influence technical decision making, and ensure products are designed and maintained in alignment with industry best practices, regulatory expectations, and organizational objectives.

• Lead the implementation of cybersecurity principles within the overall architecture for medical devices, connected systems, digital platforms, and hosted solutions.
• Create, own, and maintain security-related documentation, including threat models, interface architecture, security requirements, security architectures, security risk assessments, security risk analyses, Data Protection Impact Assessments (DPIAs), product security whitepapers, Manufacturer Disclosure Statements for Medical Devices (MDS2), Software Bills of Materials (SBOMs), static code analysis reports, and security evidence packages.
• Partner with product development teams to establish and maintain cybersecurity requirements, plans, policies, and best practices throughout the product lifecycle.
• Lead threat modeling activities and security architecture reviews for medical devices, software applications, cloud-hosted services, and interconnected systems.
• Perform and guide vulnerability assessments, penetration testing, fuzz testing, secure code analysis, and vulnerability scanning activities.
• Establish governance processes for product vulnerability management and cybersecurity risk management.
• Monitor threat intelligence and analyze emerging threats, CWEs, CVEs, and zero-day vulnerabilities to assess potential impacts on products and platforms.
• Assess third-party software, open-source components, and off-the-shelf technologies for secure use within Baxter products and solutions.
• Drive cybersecurity improvements across Engineering, Quality, Regulatory, Risk Management, Marketing, Clinical, Human Factors, Service, and Compliance teams.
• Ensure compliance with product development processes, quality systems, design controls, and applicable cybersecurity standards and regulations.
• Support annual security audits and assessments, including SOC 2, HITRUST, and other cybersecurity compliance initiatives.
• Participate in security incident investigations, response activities, and post-incident recovery efforts.
• Interface with regulatory agencies and external stakeholders as required to represent cybersecurity aspects of Baxter products.
• Contribute to external cybersecurity communications, including security bulletins, whitepapers, FAQs, and customer-facing documentation.
• Lead project planning, estimation, and execution of cybersecurity deliverables while mentoring and guiding junior engineers and technical teams.

• Bachelor's degree in Computer Science, Engineering, Information Security, Mathematics, Information Management, or a related technical discipline.
• Minimum 5 years of experience in software development, cybersecurity engineering, product security, or secure software development lifecycle (SSDLC) activities.
• Strong understanding of application security and secure development practices throughout the software lifecycle.
• Experience addressing OWASP Top 10 vulnerabilities and implementing secure coding practices.
• Experience in threat modeling, security risk assessments, secure design reviews, and vulnerability analysis.
• Experience with threat modeling methodologies such as STRIDE, DREAD, LINDDUN, PASTA, or similar frameworks.
• Experience with vulnerability scanning, penetration testing, fuzz testing, and secure code analysis tools.
• Experience with security and software analysis tools such as Coverity, Black Duck, Fortify, Nessus, or equivalent technologies.
• Experience analyzing threat intelligence, CVEs, and CWEs and translating findings into actionable product improvements.
• Strong technical writing and communication skills, with the ability to communicate effectively with technical and non-technical audiences.
• Ability to influence technical direction, lead cross-functional initiatives, and drive decisions aligned with business objectives.

Preferred Qualifications

• Advanced degree in a relevant technical discipline.
• Experience with cybersecurity requirements for medical devices, connected healthcare systems, cloud platforms, and hosted software applications.
• Familiarity with security, privacy, and risk management frameworks, including NIST 800-53, ISO 27001/27002, IEC TR 80001, UL 2900, FIPS 140, ICS-CERT guidance, and privacy-by-design principles.
• Expertise in designing secure networks, systems, cloud architectures, and application ecosystems.
• Security certifications such as CSSLP, CAP, CISSP, or equivalent.
• Strong analytical skills, attention to detail, and demonstrated ability to solve complex cybersecurity challenges.