Build a career powered by innovations that matter! At Novanta, our innovations power technology products that are transforming healthcare and advanced manufacturing—improving productivity, enhancing people’s lives and redefining what’s possible. We create for our global customers engineered components and sub-systems that deliver extreme precision and performance for a range of mission-critical applications—from minimally invasive surgery to robotics to 3D metal printing.
Novanta is one global team with over 26 offices located in The Americas, Europe and Asia-Pacific. Looking for a great place to work? You have found it with a culture that embraces teamwork, collaboration and empowerment. Come explore Novanta.
Business Unit Overview
This position is opened for Novanta’s group specialized in the field of Minimally Invasive Medicine where we develop devices and accessories so that doctors can operate with small cuts. We also develop displays, video recorders and routing systems that make diagnosis and treatment easier for everyone. Together with customers, doctors, and technical experts, our teams continuously search for new ways to innovate.
Summary
The Senior Product Security Engineer is responsible for Vulnerability management & Security Operations for the end-to-end vulnerability management lifecycle across Novanta's medical device portfolio. The role owns vulnerability monitoring, analysis, triage, risk evaluation, reporting, customer communication, process governance, and continuous improvement of vulnerability management capabilities. The position serves as the focal point for product vulnerability operations and post-market cybersecurity activities, helping ensure that vulnerabilities are evaluated, communicated, tracked, and documented in accordance with applicable regulatory requirements, standards, internal procedures, and customer commitments.
Primary Responsibilities
Vulnerability Monitoring and Analysis
• Monitor CVE, NVD, CISA KEV, vendor advisories, SBOM and SCA outputs.
• Identify vulnerabilities affecting products and third-party components.
• Assess applicability, exploitability, product impact, and risk.
• Perform triage, prioritization, and CVSS evaluation.
• Document conclusions, evidence, mitigation options, and actions.
Security risks evaluation and assessment
• Performs threat modelling of identified system functions
• Prepares and supports decision on risk treatment / Perform Risk assessment
Reporting and Customer Communication
• Own the vulnerability reporting process from identification to closure.
• Communicate vulnerability impact and remediation plans to customers.
• Support coordinated disclosure and regulatory reporting when required.
Process Ownership
• Maintain and improve the vulnerability assessment and reporting framework.
• Define workflows, evaluation criteria, templates, records, and approval steps.
Automation and Tooling
• Automate vulnerability intake, analysis, reporting, and metrics.
• Integrate SBOM and vulnerability intelligence.
• Improve tool accuracy, data quality, coverage, and reliability.
Your Experience, Education, and Skills
Five or more years of experience in product security, vulnerability management, cybersecurity operations, or security engineering.
Hands-on experience with vulnerability analysis, risk evaluation, remediation tracking, and reporting.
Experience with vulnerability management and reporting tools.
Overview of operating systems, networking, embedded systems, and third-party components.
Excellent English communication and ability to explain technical findings to customers and non-technical stakeholders.
Strong ownership, analytical thinking, and attention to detail.
Degree in Cybersecurity, Computer Science, Software Engineering, Electrical Engineering, or a comparable field; equivalent experience may be considered.
Eligible to work legally in Czech republic (permanent residence/free access to the job market)
We prefer (nice-to-have)
Medical device or…