Sonova USA, Inc.
Principal Engineer, Cybersecurity
Sonova USA, Inc., Santa Clarita, California, United States, 91382
Who we areYou enjoy creating and innovating. You never stop striving for better. You take responsibility and you get results. You love being part of a team. Above all, you want your work to matter: Welcome to our world! At Sonova we create sense by bringing sound to life. Our innovative hearing care solutions help millions of people enjoy life's unforgettable moments.We offer exceptional career opportunities through market-leading brands from consumer to medical, products and services that keep pushing hearing care forward, and a culture where you can quickly belong and perform at your best.If you want the freedom to explore, opportunities to grow, and make positive change on people lives through your work, this is the place for you.Join Sonova. Create sense.Location:
Valencia (CA), United StatesPosition:
Principal Engineer, CybersecurityJob Code:
155021Responsibilities:Collaborate with and contribute to the Sonova Global Product Cyber Security Center of Expertise (CoE).Implement Advanced Bionics Product Cyber Security strategy, roadmap, and build the necessary capabilities to execute projects.Continuously monitor and manage Product cyber risks to ensure confidentiality, integrity, and resilience of Sonova products and services, maintaining customer trust and regulatory compliance.Report on the effectiveness of security controls.Ensure the secure design, development, and maintenance of products, platforms, and services.Lead and mentor Advanced Bionics product development, quality, and maintenance teams in cyber security and secure product development lifecycle practices.Contribute to the development and implementation of Sonova's cross-divisional product cyber security strategy and ensure its adoption by Advanced Bionics.Monitor threats and regulatory landscapes, conducting gap assessments against standards and frameworks.Identify security requirements for business processes and products.Define, implement, and maintain global and Advanced Bionics-specific product security policies, standards, controls, and processes.Provide guidance on secure design, development, and maintenance of products, software applications, platforms, and services.Conduct threat modeling and cyber risk assessments.Define and execute security verification and validation tasks, such as design and code reviews, static and dynamic code analysis, vulnerability scanning, and penetration testing.Perform and support vulnerability management for products and services.Support the creation of security documentation and required quality management deliverables.Drive and contribute to the automation of security practices (DevSecOps).Measure and report on the effectiveness of security controls using meaningful KPIs.Act as an ambassador for information security and cyber risk, promoting awareness and a secure culture within the organization.Provide guidance on product cyber security topics and risks to relevant stakeholders.Support cyber security incident management, response, and customer complaint processes. Participate in tabletop exercises.Initiate periodic Product Security Health Checks/Risk Assessments and manage mitigation measures.Drive continuous improvement in your area of responsibility.Support security reviews, internal, and external audits.Communicate and report product security risk status to senior and product management.Build and maintain relationships with internal stakeholders and external partners.Support communication with external stakeholders, including customers, authorities, and other third parties related to product security.Stay updated on current Cyber Security trends, best practices, technologies, regulatory requirements, and risks.Work with the Director of Product Cyber Security Center of Expertise to set strategic direction and planning for product security risk for Advanced Bionics and Sonova globally.Other duties and responsibilities as assigned by your manager.General R&D Tasks:Adhere to Advanced Bionics standard operating procedures as per training requirements.Contribute to R&D development processes, including planning, reviewing, and refining product increments.Participate in interdisciplinary agile development teams and their rituals.Support hiring and onboarding processes for new hires.Share and learn R&D knowledge within communities.Reporting:Functionally reports to the Senior Manager of Design Assurance.More about you:Education:Bachelor's with 10+ Years Relevant ExperienceMasters with 8+ Years Relevant ExperienceFurther Education:Further education and specialization in cybersecurityWork Experience:10+ years of practical experience in Software engineering, Software Development Life Cycle (SDLC), System design/architecture, Project management.5+ years in cyber security related roles.Nice to Have:Previous Medical Device ExperiencePersonal Competencies:PragmaticExcellent written English communication skills.Excellent analytical and problem-solving skills.Logical thinking in high-pressure situations.Meticulous attention to detailSocial Competencies:Communicate convincingly to all levels of staff and management, with the ability to communicate technical concepts in business terms to various audiences.Team playerAble to work in a distributed, diverse collaboration environment.Ability to establish and foster cooperative relationships and networking across teams.Ability to manage multiple simultaneous conflicting tasks and demands.Leadership Competencies:Expert in Leading SelfExpert in Leading SystemsAbility to Influence without authorityProfessional Competencies:Communicate Complex Security Concepts: Ability to explain complex security topics to those without a security background.Cross-Disciplinary Integration: Effectively integrate information from various disciplines, including engineering, marketing, and regulatory affairs.Security Expertise: Proficient in threat modeling, security assessments, security verification, and security engineering.Cybersecurity Tools and Technologies: Demonstrated experience with current cybersecurity tools, vulnerability identification, and management.Understanding Attacker Methodologies: Knowledge of common attacker strategies and threat modeling tools.Business and Technical Acumen: Comfortable navigating both technical and business issues, with a strong understanding of business needs.Strategic Thinking: Ability to think strategically and adapt to changing circumstances.Stay Informed: Continuously update knowledge on current cybersecurity trends, best practices, technologies, regulatory requirements, and risks.Familiarity with Security Standards: Knowledge of OWASP Top 10 and SANS CWE-25.Nice to Have:Secure SDLC Practices: Expertise in secure software development lifecycle practices.CI/CD: Knowledge of continuous integration and continuous delivery processes.Cryptography: Proficiency in cryptographic methods.Authentication & Authorization: Familiarity with protocols such as OAuth2 and WebAuthn.Application Security: Experience in securing applications.Vulnerability Management: Skilled in identifying and managing vulnerabilities.Security Audits: Ability to conduct security audits.External Communication: Capable of communicating security-related information to external stakeholders.Security & Privacy Standards: Knowledge of security and privacy frameworks and standards.Regulatory Compliance: Understanding of relevant regulations such as GDPR, MDR, FDA, and HIPAA.AI: Experience with artificial intelligence applications.Practical Experience With:Programming Languages: Proficient in C, C++, C#, Java, Swift, Kotlin, TypeScript, and Rust.Scripting Languages: Skilled in Python, PowerShell, and bash.Software Frameworks & Services: Experience with .NET Framework, .NET Core, Angular, and Azure.Communication Protocols: Knowledge of Bluetooth (Classic, LE), WLAN, and TLS, with an understanding of their security protocols.Process/Project Management: Strong capabilities in managing processes and projects.Software Development: Hands-on experience with smart device, PC, and embedded software code.Wireless Protocol Vulnerabilities: Familiarity with common wireless protocol vulnerabilities, including RF, Bluetooth, and Wi-Fi.Penetration & Fuzz Testing: Experience with penetration and fuzz testing.Language(s)/ Level:English/ FluentNice to Have:GermanIT Skills:Good working knowledge of Windows, MS Office, Linux, Mac OS, iOS and Android.Nice to Have:Confluence, MS Teams, Polarion, JiraA minimum of 200Mb/sec download and 10Mb/sec upload speed internet connectivity is required to support any remote/hybrid employee functionality at Sonova.Don't meet all the criteria? If you're willing to go all in and learn we'd love to hear from you!We are looking forward to receiving your application via our online job application platform. For this position only direct applications will be considered.Sonova does not recruit via app, telegram, carrier pigeon or any other format that does not include speaking with an actual human.What we offer:Medical, dental and vision coverage*Health Savings, Health Reimbursement, Flexible Spending/Dependent Care AccountsTeleHealth options401k plan with company match*Company paid life/ad&d insuranceCompany paid Short/Long-Term Disability coverage (STD/LTD)Accident/Hospital Indemnity coverageLegal/ID Theft AssistancePTO (or sick and vacation time), floating Diversity Day, & paid holidays*Paid parental bonding leaveEmployee Assistance Program (24/7 mental health support hotline, 5 company paid counseling sessions and more)Robust Internal Career Growth opportunitiesTuition reimbursementHearing aid discount for employees and familyInternal social recognition platformD&I focused: D&I council and employee resource groups*Plan rules/offerings dependent upon group Company/location.This role's pay range is between: $107,200/yr - $160,800/yr (based on location). This role is also bonus eligible.How we work:At Sonova, we prioritize the well-being of our employees and foster an inclusive environment that promotes engagement and collaboration. Our team-customized hybrid work model empowers teams to balance individual needs with business goals, offering flexibility and individualized time management. We recognize the importance of life outside of work and strive to create a supportive and motivating workplace where innovation thrives.Sonova is an equal opportunity employerWe team up. We grow talent. We collaborate with people of diverse backgrounds to win with the best team in the market place. We guarantee every person equal treatment in regard to employment and opportunity for employment, regardless of a candidate's ethnic or national origin, religion, sexual orientation or marital status, gender, genetic identity, age, disability or any other legally protected status.
#J-18808-Ljbffr
Valencia (CA), United StatesPosition:
Principal Engineer, CybersecurityJob Code:
155021Responsibilities:Collaborate with and contribute to the Sonova Global Product Cyber Security Center of Expertise (CoE).Implement Advanced Bionics Product Cyber Security strategy, roadmap, and build the necessary capabilities to execute projects.Continuously monitor and manage Product cyber risks to ensure confidentiality, integrity, and resilience of Sonova products and services, maintaining customer trust and regulatory compliance.Report on the effectiveness of security controls.Ensure the secure design, development, and maintenance of products, platforms, and services.Lead and mentor Advanced Bionics product development, quality, and maintenance teams in cyber security and secure product development lifecycle practices.Contribute to the development and implementation of Sonova's cross-divisional product cyber security strategy and ensure its adoption by Advanced Bionics.Monitor threats and regulatory landscapes, conducting gap assessments against standards and frameworks.Identify security requirements for business processes and products.Define, implement, and maintain global and Advanced Bionics-specific product security policies, standards, controls, and processes.Provide guidance on secure design, development, and maintenance of products, software applications, platforms, and services.Conduct threat modeling and cyber risk assessments.Define and execute security verification and validation tasks, such as design and code reviews, static and dynamic code analysis, vulnerability scanning, and penetration testing.Perform and support vulnerability management for products and services.Support the creation of security documentation and required quality management deliverables.Drive and contribute to the automation of security practices (DevSecOps).Measure and report on the effectiveness of security controls using meaningful KPIs.Act as an ambassador for information security and cyber risk, promoting awareness and a secure culture within the organization.Provide guidance on product cyber security topics and risks to relevant stakeholders.Support cyber security incident management, response, and customer complaint processes. Participate in tabletop exercises.Initiate periodic Product Security Health Checks/Risk Assessments and manage mitigation measures.Drive continuous improvement in your area of responsibility.Support security reviews, internal, and external audits.Communicate and report product security risk status to senior and product management.Build and maintain relationships with internal stakeholders and external partners.Support communication with external stakeholders, including customers, authorities, and other third parties related to product security.Stay updated on current Cyber Security trends, best practices, technologies, regulatory requirements, and risks.Work with the Director of Product Cyber Security Center of Expertise to set strategic direction and planning for product security risk for Advanced Bionics and Sonova globally.Other duties and responsibilities as assigned by your manager.General R&D Tasks:Adhere to Advanced Bionics standard operating procedures as per training requirements.Contribute to R&D development processes, including planning, reviewing, and refining product increments.Participate in interdisciplinary agile development teams and their rituals.Support hiring and onboarding processes for new hires.Share and learn R&D knowledge within communities.Reporting:Functionally reports to the Senior Manager of Design Assurance.More about you:Education:Bachelor's with 10+ Years Relevant ExperienceMasters with 8+ Years Relevant ExperienceFurther Education:Further education and specialization in cybersecurityWork Experience:10+ years of practical experience in Software engineering, Software Development Life Cycle (SDLC), System design/architecture, Project management.5+ years in cyber security related roles.Nice to Have:Previous Medical Device ExperiencePersonal Competencies:PragmaticExcellent written English communication skills.Excellent analytical and problem-solving skills.Logical thinking in high-pressure situations.Meticulous attention to detailSocial Competencies:Communicate convincingly to all levels of staff and management, with the ability to communicate technical concepts in business terms to various audiences.Team playerAble to work in a distributed, diverse collaboration environment.Ability to establish and foster cooperative relationships and networking across teams.Ability to manage multiple simultaneous conflicting tasks and demands.Leadership Competencies:Expert in Leading SelfExpert in Leading SystemsAbility to Influence without authorityProfessional Competencies:Communicate Complex Security Concepts: Ability to explain complex security topics to those without a security background.Cross-Disciplinary Integration: Effectively integrate information from various disciplines, including engineering, marketing, and regulatory affairs.Security Expertise: Proficient in threat modeling, security assessments, security verification, and security engineering.Cybersecurity Tools and Technologies: Demonstrated experience with current cybersecurity tools, vulnerability identification, and management.Understanding Attacker Methodologies: Knowledge of common attacker strategies and threat modeling tools.Business and Technical Acumen: Comfortable navigating both technical and business issues, with a strong understanding of business needs.Strategic Thinking: Ability to think strategically and adapt to changing circumstances.Stay Informed: Continuously update knowledge on current cybersecurity trends, best practices, technologies, regulatory requirements, and risks.Familiarity with Security Standards: Knowledge of OWASP Top 10 and SANS CWE-25.Nice to Have:Secure SDLC Practices: Expertise in secure software development lifecycle practices.CI/CD: Knowledge of continuous integration and continuous delivery processes.Cryptography: Proficiency in cryptographic methods.Authentication & Authorization: Familiarity with protocols such as OAuth2 and WebAuthn.Application Security: Experience in securing applications.Vulnerability Management: Skilled in identifying and managing vulnerabilities.Security Audits: Ability to conduct security audits.External Communication: Capable of communicating security-related information to external stakeholders.Security & Privacy Standards: Knowledge of security and privacy frameworks and standards.Regulatory Compliance: Understanding of relevant regulations such as GDPR, MDR, FDA, and HIPAA.AI: Experience with artificial intelligence applications.Practical Experience With:Programming Languages: Proficient in C, C++, C#, Java, Swift, Kotlin, TypeScript, and Rust.Scripting Languages: Skilled in Python, PowerShell, and bash.Software Frameworks & Services: Experience with .NET Framework, .NET Core, Angular, and Azure.Communication Protocols: Knowledge of Bluetooth (Classic, LE), WLAN, and TLS, with an understanding of their security protocols.Process/Project Management: Strong capabilities in managing processes and projects.Software Development: Hands-on experience with smart device, PC, and embedded software code.Wireless Protocol Vulnerabilities: Familiarity with common wireless protocol vulnerabilities, including RF, Bluetooth, and Wi-Fi.Penetration & Fuzz Testing: Experience with penetration and fuzz testing.Language(s)/ Level:English/ FluentNice to Have:GermanIT Skills:Good working knowledge of Windows, MS Office, Linux, Mac OS, iOS and Android.Nice to Have:Confluence, MS Teams, Polarion, JiraA minimum of 200Mb/sec download and 10Mb/sec upload speed internet connectivity is required to support any remote/hybrid employee functionality at Sonova.Don't meet all the criteria? If you're willing to go all in and learn we'd love to hear from you!We are looking forward to receiving your application via our online job application platform. For this position only direct applications will be considered.Sonova does not recruit via app, telegram, carrier pigeon or any other format that does not include speaking with an actual human.What we offer:Medical, dental and vision coverage*Health Savings, Health Reimbursement, Flexible Spending/Dependent Care AccountsTeleHealth options401k plan with company match*Company paid life/ad&d insuranceCompany paid Short/Long-Term Disability coverage (STD/LTD)Accident/Hospital Indemnity coverageLegal/ID Theft AssistancePTO (or sick and vacation time), floating Diversity Day, & paid holidays*Paid parental bonding leaveEmployee Assistance Program (24/7 mental health support hotline, 5 company paid counseling sessions and more)Robust Internal Career Growth opportunitiesTuition reimbursementHearing aid discount for employees and familyInternal social recognition platformD&I focused: D&I council and employee resource groups*Plan rules/offerings dependent upon group Company/location.This role's pay range is between: $107,200/yr - $160,800/yr (based on location). This role is also bonus eligible.How we work:At Sonova, we prioritize the well-being of our employees and foster an inclusive environment that promotes engagement and collaboration. Our team-customized hybrid work model empowers teams to balance individual needs with business goals, offering flexibility and individualized time management. We recognize the importance of life outside of work and strive to create a supportive and motivating workplace where innovation thrives.Sonova is an equal opportunity employerWe team up. We grow talent. We collaborate with people of diverse backgrounds to win with the best team in the market place. We guarantee every person equal treatment in regard to employment and opportunity for employment, regardless of a candidate's ethnic or national origin, religion, sexual orientation or marital status, gender, genetic identity, age, disability or any other legally protected status.
#J-18808-Ljbffr