Sr. Cybersecurity Engineer

About the role

Boston Scientific is seeking a Senior Cybersecurity Engineer with a background in DevSecOps and the design, development, and testing of cybersecurity features and controls in a regulated industry. This individual will be responsible for driving the cybersecurity strategy and DevSecOps throughout the product lifecycle, ensuring compliance with relevant standards and regulations.

Responsibilities

• Foster a collaborative security culture from conception to decommission.
• Collaborate with product development teams to embed security controls throughout the CI/CD pipeline.
• Lead threat modeling using STRIDE and security risk assessments, identifying, and evaluating potential threats and safety issues.
• Elicit and define product security needs and requirements; define product security requirements, design specifications, and verification and validation strategies.
• Establish best practices and automate processes for vulnerability detection, secure coding, configuration management, and patching.
• Implement risk mitigation strategies and maintain risk management documentation.
• Oversee and enhance incident response plans and processes, ensuring rapid and effective resolution of security incidents.
• Manage secrets, identity and access management to ensure least privilege access.
• Stay current with emerging regulations and standards related to medical device security (e.g., FDA Premarket Guidance, Post-market Cybersecurity Guidance, TIR 57).
• Collaborate closely with internal stakeholders (Software Development, Quality, Regulatory, IT) to align security goals and requirements.
• Model resiliency and show leadership by presenting topics to the Security Champions program.

Requirements

• Bachelor’s or master’s degree in Cybersecurity, Computer Science, Computer Engineering, or a related field.
• Minimum of 5 years of experience in cybersecurity engineering, with a recent focus on product security as it extends to the IoT cloud.
• Knowledge of DevSecOps tools.
• Proven experience in design and architecture reviews for complex, embedded medical devices or similar technologies.
• Demonstrated history of creating and executing security risk assessments and mitigation strategies.
• In-depth understanding of cybersecurity frameworks (e.g., NIST Cybersecurity Framework) including best practices for defense in depth.
• Excellent written and verbal communication skills for interfacing technical teams, stakeholders, and executive leadership.
• Able to work collaboratively across multidisciplinary teams, bridging gaps between technical, regulatory, and business functions.

Preferred Qualifications

• 4+ years of experience working in the medical device industry or a similarly regulated environment; security architecture or medical device administration experience in healthcare settings is also a plus.
• Development experience in securing Yocto and desktop Linux, Windows IoT, or Android.
• Hands-on experience with IoT cloud deployments such as Azure or AWS.
• Experience writing code, with secure coding practices, vulnerability scanning tools, and penetration testing methodologies.
• Knowledge of embedded systems security, network security, endpoint protections, wireless communications, network protocols, HSM and PKI.
• Experience supporting VA Handbook 6500 compliance.
• Relevant certifications (e.g., GIAC, ISSEP, ISSAP, CRISC) are a plus.
• Experience with vulnerability and risk assessments including use of CVSS.