Senior DevSecOps Engineer – Medical Devices

About the role

The Health Solutions Business Unit at Analog Devices is seeking a Senior DevSecOps Engineer to support secure cloud‑native platforms for connected medical devices and digital health solutions. The role focuses on implementing secure software development practices, cloud security controls, and regulatory compliance throughout the product lifecycle.

Key responsibilities

• Implement and maintain security controls across AWS environments for SaMD and digital health solutions.
• Integrate security capabilities into CI/CD pipelines and SSDLC processes, including SAST, DAST, SCA, secrets scanning, container security scanning, and IaC validation.
• Manage software supply chain security activities such as SBOM generation, dependency management, artifact integrity validation, and vulnerability remediation.
• Configure identity and access management, encryption, key management, and secrets management across cloud and application environments.
• Design audit logging, monitoring, and security controls to support HIPAA compliance and healthcare data protection.
• Partner with engineering teams to identify, prioritize, and remediate security vulnerabilities.
• Support risk assessments, penetration testing, incident response, and operational security efforts.
• Build and maintain security automation to improve platform security, compliance, and efficiency.

Required profile

• Bachelor's, Master’s or Ph.D. in Cybersecurity, Computer Science, Software Engineering or related field.
• 7+ years of experience in DevSecOps, cloud security, or application security.
• Experience supporting healthcare or medical device software within quality and compliance frameworks.
• Hands‑on experience securing AWS cloud‑native applications and platforms.
• Strong analytical, problem‑solving, communication and collaboration skills.

Required skills

• AWS services (ECS, EKS, Lambda, RDS, S3, SQS, Cognito, IAM, KMS, CloudFormation).
• Infrastructure as Code (Terraform, CloudFormation, AWS CDK).
• CI/CD pipelines (GitHub Actions or similar).
• Security tooling: SAST, DAST, SCA, container security scanning, secrets detection, IaC security scanning, vulnerability management.
• Application security principles, secure coding, authentication, authorization, encryption, secrets and key management.
• Software supply chain security (SBOM, dependency management, artifact signing).
• Container orchestration (Kubernetes, ECS, EKS).
• HIPAA compliance, ISO 27001, SOC 2 frameworks.