Sr. engineer, product cyber security

As a result of the combination of the BD Biosciences and Diagnostic Solutions business with Waters Corporation (NYSE: WAT), by applying to this role, you will be applying for a position with Waters. Waters is a global leader in life sciences, dedicated to accelerating the benefits of pioneering science through analytical technologies, informatics, and service. With a focus on regulated, high-volume testing environments, Waters’ innovative portfolio harnesses deep scientific expertise across biology, chemistry, and physics. Waters collaborates with analytical laboratories around the world to advance the release of effective, high-quality medicines, assure the safety of food and water, and drive better patient outcomes by detecting diseases earlier, managing routine infections, and combatting growing antibiotic resistance. Through a shared culture of relentless innovation, Waters’ passionate team of approximately 16,000 colleagues partner with customers to turn scientific challenges into breakthroughs that improve lives worldwide.

We are the people who give possibilities purpose. BD is one of the largest global medical technology companies in the world. Advancing the world of health™ is our Purpose, and it’s no small feat. It takes the imagination and passion of all of us—from design and engineering to the manufacturing and marketing of our billions of MedTech products per year—to look at the impossible and find transformative solutions that turn dreams into possibilities.

Job Description

Summary

We are seeking a Senior Product Cyber Security Engineer to own the cybersecurity deliverables for assigned products end to end and to build the automation that lets a small team cover a large portfolio. You will plan the security activities for each release, lead threat modeling, run composition and static analysis, produce and monitor Software Bills of Materials (SBOMs), coordinate penetration tests, and write the documentation that goes into our design history files, regulatory submissions and customer assurance packages.

This is a product security engineering role, not an IT security, SOC or penetration testing role. You will read code, work in build pipelines, and defend your risk assessments in front of auditors, regulators and customers. You will work daily with R&D, Software Engineering, DevOps, Systems Engineering, Quality and Regulatory Affairs, and with our corporate product security and cyber risk teams.

This position is remote within the United States, with regular overlap with Pacific time working hours.

Key Responsibilities

• Product Cybersecurity Planning and Deliverables
• Threat Modeling and Risk Assessment
• Security Testing, SBOM and Vulnerability Management
• Patch Management and Secure Baselines
• Customer and Regulatory Assurance
• Automation, Metrics and Scaling
• Cross-Functional Guidance

What Success Looks Like in the First Year

Within 90 days: you own the cybersecurity deliverables for one product release end to end, from the cybersecurity plan to the Cybersecurity Risk Summary Report. Within six months: SBOM generation and composition analysis run automatically in the build for the products you support, with results loaded into post-market monitoring. Within twelve months: you cover two to three products in parallel, penetration tests and patch verification bulletins for your products are delivered on schedule, and leadership receives regular in-market risk metrics for them.

Required Qualifications

• Bachelor's degree in Computer Science, Software Engineering, Cybersecurity or a related technical field, or equivalent practical experience.
• 10+ years of experience in software engineering, product or application security, or cybersecurity engineering, including hands-on security work on software products that shipped to customers.
• Basic software engineering fluency: you read and write code in some language, you are comfortable with commandline, you are aware of build systems and package ecosystems (npm, pip, NuGet) and CI/CD pipelines (Azure DevOps or similar).
• Hands-on experience with threat modeling (STRIDE or similar), vulnerability assessment, CVSS scoring, remediation workflows and risk acceptance.
• Experience with static analysis and software composition analysis tools and with SBOM formats (CycloneDX or SPDX).
• Experience producing formal security deliverables (threat models, risk assessments, vulnerability reports, SBOMs) that have been reviewed in audits or regulatory submissions.
• Strong written communication: clear, structured technical documentation in English suitable for auditors, regulators and customers.
• Demonstrated ability to run several product workstreams in parallel in a procedure-driven, documentation-heavy environment, with a bias toward automation and reuse over manual effort.

Preferred Qualifications

• Experience in medical devices, in vitro diagnostics, life sciences or other regulated software, including familiarity with FDA premarket cybersecurity guidance (section 524B), EU MDR/IVDR, ISO 14971, AAMI TIR57, IEC 81001-5-1 or UL 2900.
• Experience with Snyk, CyBeats or similar composition analysis and SBOM monitoring platforms, and with vulnerability scanners such as Tenable or Qualys.
• Experience with Windows operating system hardening, image management and security patch verification.
• Experience coordinating penetration tests and performing supplier security assessments (third-party checklists, SOC 2 report reviews).
• Experience building security metrics, dashboards or operational reporting.
• Experience using AI and large language model tools to accelerate documentation and analysis while keeping outputs reviewable and traceable.
• Experience supporting FDA inspections, notified-body audits or ISO 13485 quality system audits.

Why Join Us?

To find purpose in the possibilities, we need people who can see the bigger picture, who understand the human story that underpins everything we do. We welcome people with the imagination and drive to help us reinvent the future of healthcare. At BD, you’ll discover a culture in which you can learn, grow and thrive.

We believe that when people connect in person, we learn faster, collaborate more deeply, and build a stronger culture. Join us and enjoy a culture where face-to-face collaboration supports your learning, your progress, and your success.

To learn more about BD visit https://bd.com/careers.

Becton, Dickinson, and Company is an Equal Opportunity Employer. We evaluate applicants without regard to race, color, religion, age, sex, creed, national origin, ancestry, citizenship status, marital or domestic or civil union status, familial status, affectional or sexual orientation, gender identity or expression, genetics, disability, military eligibility or veteran status, and other legally protected characteristics.