Principal Engineer, Cybersecurity

You enjoy creating and innovating. You never stop striving for better. You take responsibility and you get results. You love being part of a team. Above all, you want your work to matter: Welcome to our world! At Sonova we create sense by bringing sound to life. Our innovative hearing care solutions help millions of people enjoy life's unforgettable moments.

We offer exceptional career opportunities through market–leading brands from consumer to medical, products and services that keep pushing hearing care forward, and a culture where you can quickly belong and perform at your best.

If you want the freedom to explore, opportunities to grow, and make positive change on people lives through your work, this is the place for you.

Join Sonova. Create sense.

Principal Engineer, Cybersecurity 155021

Who we are

In a life without sound, our work provides meaning. As a leading provider of innovative hearing care solutions, we are not just a company that makes products: we are a team on a mission to help people enjoy the delight of hearing. To enable a life without limitations, through our core business brands – Advanced Bionics, Audiological Care, Phonak, Sennheiser (under license) and Unitron – we develop, manufacture and distribute solutions that push the limits of technology and redefine the future of our industry.

Principal Engineer, Product Cyber Security Systems (Remote)

The Principal Engineer, Product Cyber Security performs complex work in research, design and development of new or existing Software products, tools and processes required for the operation, maintenance and testing of products.

Cyber Security of the Advanced Bionics products and services has been recognized as very important for our customers and for Advanced Bionics business success.

Responsibilities:

The Principal Engineer, Product Cyber Security is a highly technical position serving as the SME for product cybersecurity risk assessments (threat modeling, asset tracking, vulnerability/defect identification and management, impact assessment, risk control measure development, security test planning) for proprietary hardware, embedded software, smart device applications and PC software.

• Collaborate with and contribute to the Sonova Global Product Cyber Security Center of Expertise (CoE).
• Implement Advanced Bionics Product Cyber Security strategy, roadmap, and build the necessary capabilities to execute projects.
• Continuously monitor and manage Product cyber risks to ensure confidentiality, integrity, and resilience of Sonova products and services, maintaining customer trust and regulatory compliance.
• Report on the effectiveness of security controls.
• Ensure the secure design, development, and maintenance of products, platforms, and services.
• Lead and mentor Advanced Bionics product development, quality, and maintenance teams in cyber security and secure product development lifecycle practices.
• Contribute to the development and implementation of Sonova's cross–divisional product cyber security strategy and ensure its adoption by Advanced Bionics.
• Monitor threats and regulatory landscapes, conducting gap assessments against standards and frameworks.
• Identify security requirements for business processes and products.
• Define, implement, and maintain global and Advanced Bionics–specific product security policies, standards, controls, and processes.
• Provide guidance on secure design, development, and maintenance of products, software applications, platforms, and services.
• Conduct threat modeling and cyber risk assessments.
• Define and execute security verification and validation tasks, such as design and code reviews, static and dynamic code analysis, vulnerability scanning, and penetration testing.
• Perform and support vulnerability management for products and services.
• Support the creation of security documentation and required quality management deliverables.
• Drive and contribute to the automation of security practices (DevSecOps).
• Measure and report on the effectiveness of security controls using meaningful KPIs.
• Act as an ambassador for information security and cyber risk, promoting awareness and a secure culture within the organization.
• Provide guidance on product cyber security topics and risks to relevant stakeholders.
• Support cyber security incident management, response, and customer complaint processes. Participate in tabletop exercises.
• Initiate periodic Product Security Health Checks/Risk Assessments and manage mitigation measures.
• Drive continuous improvement in your area of responsibility.
• Support security reviews, internal, and external audits.
• Communicate and report product security risk status to senior and product management.
• Build and maintain relationships with internal stakeholders and external partners.
• Support communication with external stakeholders, including customers, authorities, and other third parties related to product security.
• Stay updated on current Cyber Security trends, best practices, technologies, regulatory requirements, and risks.
• Work with the Director of Product Cyber Security Center of Expertise to set strategic direction and planning for product security risk for Advanced Bionics and Sonova globally.
• Other duties and responsibilities as assigned by your manager.

General R&D Tasks:

• Adhere to Advanced Bionics standard operating procedures as per training requirements.
• Contribute to R&D development processes, including planning, reviewing, and refining product increments.
• Participate in interdisciplinary agile development teams and their rituals.
• Support hiring and onboarding processes for new hires.
• Share and learn R&D knowledge within communities.

Reporting:

• Functionally reports to the Senior Manager of Design Assurance.

More about you:

Education

Higher level engineering degree:

• Bachelor's with 10+ Years Relevant Experience
• Masters with 8+ Years Relevant Experience

Further Education

• Further education and specialization in cybersecurity

Work Experience

10+ years of practical experience in the following areas:

• Software engineering
• Software Development Life Cycle (SDLC)
• Project management
• 5+ years in cyber security related roles

Nice to Have

• Previous Medical Device Experience
• Pragmatic
• Excellent analytical and problem–solving skills.
• Logical thinking in high–pressure situations.
• Meticulous attention to detail
• Communicate convincingly to all levels of staff and management, with the ability to communicate technical concepts in business terms to various audiences
• Team player
• Able to work in a distributed, diverse collaboration environment
• Ability to establish and foster cooperative relationships and networking across teams
• Ability to manage multiple simultaneous conflicting tasks and demands
• Expert in Leading Self
• Expert in Leading Systems
• Ability to Influence without authority
• Communicate Complex Security Concepts: Ability to explain complex security topics to those without a security background.
• Cross–Disciplinary Integration: Effectively integrate information from various disciplines, including engineering, marketing, and regulatory affairs.
• Security Expertise: Proficient in threat modeling, security assessments, security verification, and security engineering.
• Cybersecurity Tools and Technologies: Demonstrated experience with current cybersecurity tools, vulnerability identification, and management.
• Understanding Attacker Methodologies: Knowledge of common attacker strategies and threat modeling tools.
• Business and Technical Acumen: Comfortable navigating both technical and business issues, with a strong understanding of business needs.
• Strategic Thinking: Ability to think strategically and adapt to changing circumstances.
• Stay Informed: Continuously update knowledge on current cybersecurity trends, best practices, technologies, regulatory requirements, and risks.
• Familiarity with Security Standards: Knowledge of OWASP Top 10 and SANS CWE–25.

Nice to Have

• CI/CD: Knowledge of continuous integration and continuous delivery processes.
• Cryptography: Proficiency in cryptographic methods.
• Authentication & Authorization: Familiarity with protocols such as OAuth2 and WebAuthn.
• Application Security: Experience in securing applications.
• Vulnerability Management: Skilled in identifying and managing vulnerabilities.
• Security Audits: Ability to conduct security audits.
• External Communication: Capable of communicating security–related information to external stakeholders.
• Security & Privacy Standards: Knowledge of security and privacy frameworks and standards.
• Regulatory Compliance: Understanding of relevant regulations such as GDPR, MDR, FDA, and HIPAA.
• AI: Experience with artificial intelligence applications.

Practical Experience With:

• Programming Languages: Proficient in C, C++, C#, Java, Swift, Kotlin, TypeScript, and Rust.
• Scripting Languages: Skilled in Python, PowerShell, and bash.
• Software Frameworks & Services: . click apply for full job details