Job Description Summary

We are seeking a talented Product Security and Threat Analyst Engineer to join our Post-Market Vulnerability Team. You will be at the forefront of our product security cybersecurity defense. This role will focus on identifying, analyzing, and mitigating cyber threats and vulnerabilities affecting BD's medical products. The successful candidate will collaborate with cross-functional teams to ensure products meet the highest standards of security and regulatory compliance, while proactively improving threat detection and response capabilities. You will play a crucial role in securing our extensive range of medical devices and systems against cyber threats. You will be responsible for monitoring, analyzing, and responding to incoming security threats, conducting in-depth research on emerging cyber threats, vulnerabilities, and attack vectors. You will evaluate product impact and reassess threats based on product security factors. You will be required to use your deep understanding of threat research to document possible threats and their impact to BD products.

• Develop and implement strategies to identify, analyze, and mitigate cyber threats targeting BD products.
• Enhance threat hunting activities to detect and respond proactively to potential security risks.
• Conduct in-depth threat research on vulnerabilities, attack vectors, and possible impacts.
• Develop and maintain artefacts required for ATO submissions, including vulnerability scans, System Security Plans (SSPs), and Risk Assessment Reports
• Determine and document likelihood of exploitability and potential safety risks for potentially impacted products.
• Calculate residual risk for vulnerabilities by considering compensating controls, mitigations, and operational environments.
• Document all threat research and vulnerability assessments in clear, concise, and actionable reports.
• Work with BD public relations teams, providing accurate and timely information on threat status, impact, and analysis for product leadership and customers.
• Partner with product security officers and cross-functional teams to define threat impacts, implement mitigations, and coordinate responses.
• Support the preparation of regular threat intelligence reports and briefings to senior management and stakeholders.
• Continuously enhance threat intelligence processes, tools, and technologies.
• Stay up to date with the latest cybersecurity trends, vulnerabilities, and emerging threats.
• May perform other duties as required.

• BS degree in Computer Science, Computer Engineering, Electrical Engineering, other related engineering field or equivalent work experience required
• At least 2 years of experience in cybersecurity, with expertise in threat hunting and vulnerability analysis.
• Strong knowledge of cybersecurity threats, vulnerabilities, attack vectors, and controls (e.g., authentication, cryptography, secure coding).
• Familiarity with DevSecOps practices and tools for SCA, SAST, DAST, and vulnerability scanning.
• Experience with security frameworks such as NIST 800-53, ISO 27001, GDPR, or IEC 81001-5.
• Knowledge and experience with various programming languages such as C/C++, C#, Python, JavaScript, Ruby, PHP, Go, Swift a plus
• Strong understanding of MS Windows and Linux operating systems (past and current) and the .NET framework.
• Experience with threat intelligence platforms, threat hunting tools, and cybersecurity frameworks.
• Experience implementing and demonstrating compliance to security frameworks such as NIST 800-53, IEC 81001-5, HITRUST, HIPAA, GDPR, ISO 27001, SOC 2
• Ability to work in a fast-paced, dynamic environment and manage multiple priorities.
• Strong analytical and problem-solving abilities.
• Strong written and verbal communication skills.
• Strong technical acumen.
• Relevant certifications such as Security+, CEH, or GIAC are a plus.