Product Security Quality Assurance Engineer (w/m/d)
B. Braun Group2 months ago
Tuttlingen, GermanySenior
Responsibilities
- Plan and conduct security verification and validation for active medical devices.
- Verify security requirements and threat-mitigation measures and assess their effectiveness.
- Perform code reviews, document reviews, exploratory security tests, and support penetration testing.
- Develop security test strategies, test specifications, test methods, and traceable test documentation.
- Continuously develop the DevSecOps platform and maintain its security toolchain and reliable operation.
- Integrate and enhance vulnerability-management, Polarion, IriusRisk, SBOM, vulnerability-monitoring, and CI/CD security-gate tools.
- Analyze, prioritize, and track vulnerabilities through remediation and verification.
- Support incident handling, patch deployment, end-of-life and end-of-service security measures, and continuous vulnerability monitoring.
- Support threat modeling, residual-risk assessments, and product-team consulting on security testing and vulnerability processes.
Requirements
- Completed degree in computer science, technical computer science, electrical engineering, or a comparable field, or several years of relevant professional experience.
- More than five years of experience in security testing, software quality, vulnerability management, or DevSecOps, preferably in regulated medical devices.
- Experience with Git, Linux-based systems, bare-metal systems, C/C++, and Python.
- Practical experience with penetration testing, SAST, DAST, SCA, and the evaluation and prioritization of findings.
- Knowledge of security requirements management, security risk management, and threat-mitigation assessment.
- Knowledge of the full software lifecycle and software development, verification, and validation requirements under IEC 62304 and IEC 81001-5-1; CRA knowledge is advantageous.
- Experience with vulnerability management, incident handling, patch deployment, continuous vulnerability monitoring, and ideally supplier notifications.
- Experience with DevSecOps processes and security toolchains, including vulnerability management, Polarion, IriusRisk, SBOM tools, vulnerability monitoring, and CI/CD security gates or comparable solutions.
- Ideally, experience validating development and security tools and preparing test plans, test reports, and technical documentation.
- Fluent written and spoken German and English, with an analytical, structured, self-directed, reliable, pragmatic, and collaborative working style.
Benefits
- Attractive compensation based on the ERA collective agreement for the Baden-Württemberg metal and electrical industry.
- Company pension plan.
- On-site company restaurant with varied and balanced meals.
- Company health insurance fund with a broad range of services.
- Job sharing is possible.
- The employer welcomes applicants of all identities, life circumstances, and backgrounds.