Cyber Security Engineer

Role & responsibilities

1. Medical Device Experience (5+ Years):

A minimum 5 years of direct, hands-on experience in medical device cybersecurity, preferably a Class III devices.

Have demonstrated experience in creating documentation for at last one FDA 510K, PMA submission, or EU MDR technical documentation submission.

Hands-on experience with standards like ISO 14971, IEC 62304 and ISO 13485 and experience in aligning these with regulatory requirements.

Proven track record of working on devices with Bluetooth communication, mobile apps, and cloud integration.

2. Regulatory Documentation Expertise:

In-depth knowledge of FDA submission requirements, including: Cybersecurity documentation for 510(k) and PMA submissions, Creation of threat models, risk management files, and security testing reports tailored to FDA guidance.

Familiarity with CE marking requirements for the EU, including: Cybersecurity sections for Technical Documentation under MDR, Ensuring compliance with ISO 14971, IEC 62304, and IEC/TR 60601-4-5.

Demonstrated ability to produce submission-ready documentation in formats acceptable to both the FDA and Notified Bodies.

3. SDLC Integration:

Expertise in integrating threat and vulnerability management across the Software Development Lifecycle (SDLC).

Ability to trace threats, risks, and mitigations through design, development, and testing stages, ensuring that all necessary artifacts are prepared and submission-ready for the specific Notified Body.

4. Cybersecurity Risk Management:

Experience in conducting and documenting:

Threat modeling (e.g., STRIDE), Risk assessments and alignments with AAMI TIR57 and ISO 14971.

Security testing results, including penetration testing and vulnerability assessments, documented in submission-ready formats.

5. Standards and Compliance:

Familiarity with relevant standards for medical device cybersecurity:

FDA Premarket Guidance for cybersecurity risk management, ISO 13485 for quality system integration and IEC 62304 for secure software lifecycle processes.

6. Communication and Collaboration:

Strong ability to work cross-functionally with engineering, regulatory, and quality teams to ensure submission documentation meets all regulatory requirements.

Experience presenting and defending cybersecurity strategies and documentation during audits or regulatory reviews.