Sr. Product Security Engineer

Build a career powered by innovations that matter!  At Novanta, our innovations power technology products that are transforming healthcare and advanced manufacturing—improving productivity, enhancing people’s lives and redefining what’s possible.  We create for our global customers engineered components and sub-systems that deliver extreme precision and performance for a range of mission-critical applications—from minimally invasive surgery to robotics to 3D metal printing.

Novanta is one global team with over 26 offices located in The Americas, Europe and Asia-Pacific.  Looking for a great place to work?  You have found it with a culture that embraces teamwork, collaboration and empowerment.  Come explore Novanta.

Business Unit Overview

This position is opened for Novanta’s group specialized in the field of Minimally Invasive Medicine where we develop devices and accessories so that doctors can operate with small cuts. We also develop displays, video recorders and routing systems that make diagnosis and treatment easier for everyone. Together with customers, doctors, and technical experts, our teams continuously search for new ways to innovate.

Summary

The Senior Product Security Engineer is responsible for Vulnerability management & Security Operations for the end-to-end vulnerability management lifecycle across Novanta's medical device portfolio. The role owns vulnerability monitoring, analysis, triage, risk evaluation, reporting, customer communication, process governance, and continuous improvement of vulnerability management capabilities. The position serves as the focal point for product vulnerability operations and post-market cybersecurity activities, helping ensure that vulnerabilities are evaluated, communicated, tracked, and documented in accordance with applicable regulatory requirements, standards, internal procedures, and customer commitments.

Primary Responsibilities

Vulnerability Monitoring and Analysis
• Monitor CVE, NVD, CISA KEV, vendor advisories, SBOM and SCA outputs.
• Identify vulnerabilities affecting products and third-party components.
• Assess applicability, exploitability, product impact, and risk.
• Perform triage, prioritization, and CVSS evaluation.
• Document conclusions, evidence, mitigation options, and actions.

Security risks evaluation and assessment
• Performs threat modelling of identified system functions
• Prepares and supports decision on risk treatment / Perform Risk assessment

Reporting and Customer Communication
• Own the vulnerability reporting process from identification to closure.
• Communicate vulnerability impact and remediation plans to customers.
• Support coordinated disclosure and regulatory reporting when required.

Process Ownership
• Maintain and improve the vulnerability assessment and reporting framework.
• Define workflows, evaluation criteria, templates, records, and approval steps.

Automation and Tooling
• Automate vulnerability intake, analysis, reporting, and metrics.
• Integrate SBOM and vulnerability intelligence.
• Improve tool accuracy, data quality, coverage, and reliability.

Your Experience, Education, and Skills

- Five or more years of experience in product security, vulnerability management, cybersecurity operations, or security engineering.

- Hands-on experience with vulnerability analysis, risk evaluation, remediation tracking, and reporting.

- Experience with vulnerability management and reporting tools.

- Overview of operating systems, networking, embedded systems, and third-party components.

- Excellent English communication and ability to explain technical findings to customers and non-technical stakeholders.

- Strong ownership, analytical thinking, and attention to detail.

- Degree in Cybersecurity, Computer Science, Software Engineering, Electrical Engineering, or a comparable field; equivalent experience may be considered.

- Eligible to work legally in Czech republic (permanent residence/free access to the job market)

We prefer (nice-to-have)

- Medical device or regulated-industry experience is preferred.

- Knowledge of IEC 81001-5-1, IEC 62304, ISO 14971, EU MDR, FDA medical device cybersecurity expectations, and the EU Cyber Resilience Act is preferred.

- Relevant cybersecurity certifications are an advantage.

Benefits

- Extra week of vacation (25 days/year)

- 5 sick days per calendar year

- 1 day of paid time off for charitable activities/year

- Flexi Pass vouchers with a nominal value of 1000 CZK/month

- Contribution to supplementary pension insurance 1000 CZK/month (after the probationary period)

- Flexible working hours (core 10 – 15:00)

- Every year, wages are reassessed from 1 April

- Meal vouchers in the form of a flat rate – monetary value (129,50 CZK/day)

- Monetary allowance for working from home (max. 2 days/week)

- MultiSport for only 300 CZK/month

- Bonuses for recommending a new employee up to CZK 110,000

- Free refreshments at the workplace (juice, hot drinks – great coffee, tea; healthy snacks and fruit/vegetables 2 times a week)

- Training, language courses, career advancement

- Dog-friendly office, Family-friendly environment

- Corporate events – Summer Party, Christmas Party, Family Day, SportDay, Board Game Afternoon, Meet & Greet and more

- Free parking for employees and shower at the workplace for athletes

#LI-JM1
#LI-Hybrid

Novanta is proud to be an equal employment opportunity and affirmative action workplace. We consider all qualified applicants without regard to race, color, religion, sex (including pregnancy), sexual orientation, gender identity or expression, national origin, military and veteran status, disability, genetics, or any other category protected by federal law or Novanta policy.

Please call +1 781-266-5700 if you need a disability accommodation for any part of the employment process.