{"id":3220292,"url":"https://alion.io/job/insulet-principal-security-architect","title":"Principal Security Architect","company":{"id":5958,"name":"Insulet","domain":"insulet.com","url":"https://alion.io/company/insulet","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":{"grade":"A","score":93,"open_postings":27,"ghost_share":0,"stale_share":0.222,"repost_share":0.111,"time_to_fill_p50_days":28,"computed_at":"2026-10-26T05:57:25Z"}},"role":"Security","role_family":"Security","seniority":"lead","employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["San Diego, United States","United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":196500,"max":294750,"currency":"USD","period":"year","gross":null,"usd_annual":294750},"salary_estimate":null,"experience_years_min":10,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"HIPAA","optional":false},{"name":"Least Privilege","optional":false},{"name":"PKI","optional":false},{"name":"Threat Modeling","optional":false},{"name":"Design Controls","optional":true},{"name":"Design History File","optional":true},{"name":"IEC 62304","optional":true},{"name":"ISO 14971","optional":true}],"status":"live","first_seen_at":"2026-10-23T00:00:00Z","employer_posted_date":"2026-10-23","last_verified_at":"2026-10-25T07:37:31Z","board_verified":true,"closed_at":null,"days_open":3,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":3},"description":"Job Summary\nThe Principal Security Architect is a senior individual contributor responsible for defining and leading the cybersecurity strategy for Insulet's connected insulin delivery platform, including the insulin pump, CGM integrations, iOS and Android mobile apps, and cloud services.\n\nThe Principal Security Architect defines the cybersecurity vision and strategy for an FDA-regulated insulin delivery system. The system has the shape of a connected IoT platform: an insulin pump, a continuous glucose monitor (CGM), iOS and Android mobile apps that serve as the patient-facing controllers and command the pump over Bluetooth Low Energy (BLE), and cloud services that receive pump and CGM data. This role sets the trust model that ties those parts together, with particular depth in public key infrastructure (PKI), identity, and cryptography.\nThis is a hands-on individual-contributor architecture role in R&D Security. You will set the long-term security direction, establish the standards product engineers build to, mentor senior engineers, and stay close enough to designs and critical implementations to make the hard decisions yourself. You will partner with Product Security, which sets the corporate guidance and constraints, and apply that guidance to the software and hardware of this system. You will serve on the Security Council as the R&D security architect when a design, an early program, or a field issue needs a recorded security position. You will also partner with iOS, Android, firmware, cloud, quality, and regulatory colleagues so security controls support a safe, reliable, and maintainable medical device on both mobile apps.\nThis is a hybrid role, with 1-2 days per week in the office.\nResponsibilities:\nDefine and evolve the security architecture across the pump, the iOS and Android mobile apps, CGM integrations, and the cloud, including identity, key management, session security, secure update, telemetry, and API boundaries.\nDesign and govern PKI: certificate hierarchies, device and service identity, provisioning, rotation, revocation, and secure key storage on the pump, in the iOS and Android mobile apps, and in the cloud.\nSet the cryptographic approach for therapy commands and health data, including authenticated sessions, protection in transit and at rest, signing, and how keys are generated, stored, and retired.\nOwn identity architecture for patients, mobile apps, pumps, and cloud services, including authentication, authorization, and least-privilege access to therapy and device data.\nLead BLE security design for both mobile apps: pairing and bonding, session encryption, device authentication, and how each mobile app and the pump keep a trustworthy link across reconnects. The security model stays consistent across iOS and Android.\nDefine security requirements for CGM and other partner integrations, including BLE sensor onboarding, authenticity of incoming data, and cloud-to-cloud trust.\nEstablish security and privacy controls for protected health information, aligned with HIPAA, FDA cybersecurity expectations, and healthcare privacy obligations.\nDrive threat modeling and security risk assessment early in design, and map controls to hazards, requirements, and residual risk for a regulated quality system.\nReview architectures and critical implementations, and mentor senior engineers so security intent survives implementation.\nPartner with Product Security to apply corporate guidance and constraints to this system, including identity, cryptography, vulnerability handling, logging, and supplier expectations. When the platform cannot meet a constraint, bring the specific gap: which constraint, which limit, which alternative control, and for how long.\nServe on the Security Council as the R&D security architect. For security by design, bring the threat model and the recommended application of Product Security’s constraints. For early-phase programs, name the constraints that will be expensive to change later and when a full design review is required. For field issues, determine what the product does and what a correct fix is, so the council can record one position on scope, severity, action, and what resolved means.\nPartner with firmware, iOS, Android, cloud, quality, human factors, and regulatory teams on interface contracts, verification evidence, and submission-ready cybersecurity documentation.\nDefine how the system detects, responds to, and records vulnerabilities across the device fleet, both mobile apps, and partner-connected paths.\nReview security of shared non-UI logic where cross-platform code is used, while each therapy user interface remains native to iOS or Android.\nBasic Qualification:\nBachelor's degree in computer science, Electrical Engineering, or Computer Engineering.\nAt least 10 years of professional experience, with substantial recent work architecting security for production connected systems.\nDemonstrated experience designing PKI and cryptographic key lifecycles, including issuance, storage, rotation, and revocation.\nExperience with identity architecture spanning devices, users, and cloud services, including authentication and authorization.\nDemonstrated Bluetooth Low Energy security experience, including pairing, bonding, and encrypted sessions between a mobile app and a constrained device.\nExperience defining security architecture across embedded software, iOS and Android mobile apps, and a cloud backend.\nWorking knowledge of HIPAA and how it applies to collection, storage, and transmission of protected health information.\nExperience operating inside a regulated quality system, such as medical device, aerospace, or another design-control environment, including requirements of traceability and verification.\nAbility to write and defend architecture decisions that balance safety, security, reliability, and delivery speed.\nClear written and verbal communication with engineers and with quality, regulatory, and clinical partners.\nPreferred Qualifications:\nExperience with insulin delivery, CGM, or other Class II or Class III connected medical devices.\nWorking knowledge of IEC 62304, ISO 14971, FDA design controls, and FDA premarket cybersecurity guidance.\nApplied cryptography experience: protocol selection, certificate lifecycle operations, and review of how keys are used in product code.\nSecure boot, signed firmware update, and key storage on constrained or embedded devices.\nCloud security architecture: service identity, secrets management, least privilege, logging, and monitoring for a device fleet.\nExperience setting security requirements for third-party BLE sensors and partner cloud integrations.\nExperience contributing cybersecurity content to regulatory submissions, threat models, or design history files.\nA graduate degree in Computer Science, Electrical Engineering, or Computer Engineering, or a recognized security certification such as CISSP.\nExperience mentoring senior engineers and setting security standards across teams, as an individual contributor.\nAdditional Information:\n\nCompensation & Benefits:\n\nFor U.S.-based positions only, the annual base salary range for this role is $196,500.00 - $294,750.00\n\nThis position may also be eligible for incentive compensation.\n\nWe offer a comprehensive benefits package, including:\n• Medical, dental, and vision insurance\n• 401(k) with company match\n• Paid time off (PTO)\n• And additional employee wellness programs\n\nApplication Details:\nThis job posting will remain open until the position is filled.\nTo apply, please visit the Insulet Careers site and submit your application online.\n\nActual pay depends on skills, experience, and education.Insulet Corporation (NASDAQ: PODD), headquartered in Massachusetts, is an innovative medical device company dedicated to simplifying life for people with diabetes and other conditions through its Omnipod product platform. The Omnipod Insulin Management System provides a unique alternative to traditional insulin delivery methods. With its simple, wearable design, the tubeless disposable Pod provides up to three days of non-stop insulin delivery, without the need to see or handle a needle. Insulet’s flagship innovation, the Omnipod 5 Automated Insulin Delivery System, integrates with a continuous glucose monitor to manage blood sugar with no multiple daily injections, zero fingersticks, and can be controlled by a compatible personal smartphone in the U.S. or by the Omnipod 5 Controller. Insulet also leverages the unique design of its Pod by tailoring its Omnipod technology platform for the delivery of non-insulin subcutaneous drugs across other therapeutic areas. For more information, please visit insulet.com and omnipod.com.\nWe are looking for highly motivated, performance-driven individuals to be a part of our expanding team. We do this by hiring amazing people guided by shared values who exceed customer expectations. Our continued success depends on it!\nAt Insulet Corporation all qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability, or status as a protected veteran.\n(Know Your Rights)","description_format":"text","description_chars":9176,"description_truncated":false,"requirements":{"experience_years_min":10,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[]},"benefits":["Vision insurance","Wellness"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Information Security","Diabetes Devices"],"lifecycle":[{"event":"open","at":"2026-10-25T02:44:57Z"}],"visa":[{"country":"US","licensed_sponsor":true,"evidence":"H-1B filings in 12 months: 37 · green card filings: 17","filings_12m":37,"filings_prev_12m":51,"green_card_filings_12m":17,"median_offered_wage_usd":152778,"route":null,"cap_exempt":false,"checked_at":"2026-10-15T11:24:14+00:00","sources":["US Department of Labor: LCA disclosure data (H-1B, H-1B1, E-3)","US Department of Labor: PERM disclosure data (green cards)"],"filings_for_role_12m":0}],"liveness":{"score":90,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.903,"p_room":1,"age_days":3,"expected_fill_days":28,"reasons":["conf:22","velocity","win:early","comp:brand"],"computed_at":"2026-10-26T05:57:25Z"},"pay":{"stated_usd_annual":294750,"is_top_pay":true},"html_url":"https://alion.io/job/insulet-principal-security-architect","json_url":"https://alion.io/job/insulet-principal-security-architect.json","meta":{"generated_at":"2026-10-26T06:35:57Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":8929,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-27T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":5958},"rest":"https://alion.io/mcp/rest/get_company?id=5958"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Finsulet-principal-security-architect"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Finsulet-principal-security-architect"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Finsulet-principal-security-architect"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/insulet-principal-security-architect\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Finsulet-principal-security-architect"}]}