Principal Cybersecurity Engineer

Boston Scientific is seeking a Principal Cybersecurity Engineer to drive product security strategy and DevSecOps across regulated, medical-device development.

Responsibilities

• Integrate security into the product development lifecycle across multiple product lines.
• Build and sustain a collaborative security culture from conception through decommissioning.
• Partner with product development teams to embed security controls throughout the CI/CD pipeline.
• Lead threat modeling using STRIDE and perform security risk assessments to identify and evaluate potential threats and safety issues.
• Capture and define product security needs, including security requirements, design specifications, and verification and validation strategies.
• Create best practices and automate processes for vulnerability detection, secure coding, configuration management, and patching.
• Define and execute risk mitigation strategies and maintain risk management documentation.
• Oversee and improve incident response plans and processes to support rapid, effective security incident resolution.
• Manage secrets and identity and access management to enforce least-privilege access.
• Stay current with medical-device security regulations and standards, including FDA Premarket Guidance, Post-market Cybersecurity Guidance, and TIR 57.
• Coordinate with internal stakeholders across Software Development, Quality, Regulatory, and IT to align security goals and requirements.
• Promote resiliency and demonstrate leadership by presenting topics for the Security Champions program.

Requirements

• Bachelor’s or master’s degree in Cybersecurity, Computer Science, Computer Engineering, or a related field.
• 5+ years of cybersecurity engineering experience with a recent focus on product security extending to the IoT cloud.
• Knowledge of DevSecOps tools.
• Proven experience conducting design and architecture reviews for complex, embedded medical devices or similar technologies.
• Demonstrated ability to create and execute security risk assessments and mitigation strategies.
• In-depth understanding of cybersecurity frameworks, including the NIST Cybersecurity Framework and defense-in-depth best practices.
• Strong written and verbal communication skills for interfacing with technical teams, stakeholders, and executive leadership.
• Ability to collaborate across multidisciplinary teams and bridge technical, regulatory, and business perspectives.

Technologies

• DevSecOps tools
• STRIDE
• NIST Cybersecurity Framework
• CI/CD pipeline
• IoT cloud

Work Mode

• Hybrid/onsite model requiring employees to be in the Maple Grove (Arbor Lakes), MN office at least three days per week.

Relocation

• Relocation assistance may be available for select out-of-state candidates.

Preferred Qualifications

• 4+ years in the medical device industry or a similarly regulated environment; security architecture or medical device administration experience in healthcare settings is a plus.
• Development experience securing Yocto and desktop Linux, Windows IoT, or Android.
• Deep knowledge of deployment environments for medical devices into health delivery organizations, including Active Directory (AD) and Single Sign On (SSO) integrations.
• Hands-on experience with IoT cloud deployments such as Azure, AWS, Cumulocity, Thingworx, or other platforms.
• Experience writing code with secure coding practices, vulnerability scanning tools, and penetration testing methodologies.
• Knowledge of embedded systems security, network security, endpoint protections, wireless communications, network protocols, HSM, and PKI.
• Experience supporting VA Handbook 6500 compliance.
• Relevant certifications (e.g., GIAC, ISSEP, ISSAP, CRISC) are a plus.
• Experience with vulnerability and risk assessments including use of CVSS.

Compensation

• Annual salary range: $102,100 - $194,000.
• Anticipated compensation varies based on actual location and other pertinent factors.

Additional Information

• Requisition ID: 636103.
• For MA positions: It is unlawful to require or administer a lie detector test for employment.
• Certain US based positions (including field sales and service positions that call on hospitals and/or health care centers) may require acceptable proof of COVID-19 vaccination status.
• Prohibited substance testing: This role is deemed safety-sensitive and candidates will be subject to a prohibited substance test as a requirement.

Location: Maple Grove, MN (hybrid)