Principal Cybersecurity Engineer

Bayer Healthcare LLC•Whippany, NJ

2d•Remote

About The Position

Principal Cybersecurity Engineer for Whippany, NJ to define project-level cybersecurity requirements; design & develop security solutions to mitigate product cybersecurity risks; understand medical device products & clinical applications to identify potential cybersecurity threats and develop mitigations; perform threat modeling, vulnerability testing, security risk analysis & security assessments; review security architecture & designs; secure medical devices, medical device software & IT software against cyber threats; lead cybersecurity risk assessments & cyber signal incident responses and investigations; lead cross-functional teams; coordinate strategic supplier & partner relationships. Position may telecommute on a full-time basis from anywhere in the U.S. Up to 10% travel to Pittsburgh, PA req’d.

Requirements

Master’s in Cybersecurity, Computer Science, Telecommunications or closely related field
4 years experience in cybersecurity-related position(s) in a medical device R&D environment
Performing threat modeling of regulated medical devices using STRIDE and assessing cybersecurity risk to patient safety & Protected Health Information (PHI)
Creating security designs & requirements based on user needs
Applying security technologies to medical device product designs within software & hardware, including network security, encryption, firewalls and TPM
Leading cross functional teams in reviewing security architecture and design
Applying cybersecurity standards, including NIST CSF, NIST SP 800-30, AAMI TIR57 & AAMI TIR 97, and data privacy standards, including HIPAA
Creating documentation for regulatory submissions, including cybersecurity management plans, threat model reports, security risk & cyber signal assessments, MDS2 and SBOM
Applying cybersecurity & secure design principles to medical device products in compliance with FDA Cybersecurity Guidance for Medical Devices
Conducting security testing & vulnerability scanning using Burp suite, Wireshark and Nessus and analyzing findings with qualitative risk prioritization, including CVSS and OWASP
Planning & overseeing penetration testing with third party testers
Developing cybersecurity policies & procedures

Responsibilities

Define project-level cybersecurity requirements
Design & develop security solutions to mitigate product cybersecurity risks
Understand medical device products & clinical applications to identify potential cybersecurity threats and develop mitigations
Perform threat modeling, vulnerability testing, security risk analysis & security assessments
Review security architecture & designs
Secure medical devices, medical device software & IT software against cyber threats
Lead cybersecurity risk assessments & cyber signal incident responses and investigations
Lead cross-functional teams
Coordinate strategic supplier & partner relationships