Principal Cybersecurity Engineer

Boston Scientific • Maple Grove, MN

7d • $102,100 - $194,000 • Hybrid

About The Position

Boston Scientific is seeking a Principal Cybersecurity Engineer with DevSecOps experience and a background designing, developing, and testing cybersecurity features and controls in a regulated industry. The role drives cybersecurity strategy and DevSecOps throughout the product lifecycle and ensures compliance with applicable standards and regulations. It supports R&D and business development within the Interventional Cardiology team. The work model is hybrid or onsite, with employees required to work from the Maple Grove (Arbor Lakes), Minnesota office at least three days per week. Relocation assistance may be available to select out-of-state candidates.

Requirements

• Bachelor’s or master’s degree in Cybersecurity, Computer Science, Computer Engineering, or a related field.
• At least 5 years of cybersecurity engineering experience, with a recent focus on product security extending to the IoT cloud.
• Knowledge of DevSecOps tools.
• Experience conducting design and architecture reviews for complex embedded medical devices or similar technologies.
• Demonstrated experience creating and executing security risk assessments and mitigation strategies.
• In-depth understanding of cybersecurity frameworks, such as the NIST Cybersecurity Framework, and defense-in-depth best practices.
• Excellent written and verbal communication skills for working with technical teams, stakeholders, and executive leadership.
• Ability to collaborate across multidisciplinary teams and bridge technical, regulatory, and business functions.

Nice To Haves

• At least 4 years of experience in the medical device industry or a similarly regulated environment; security architecture or medical device administration experience in healthcare settings is also a plus.
• Experience securing Yocto and desktop Linux, Windows IoT, or Android.
• Deep knowledge of medical-device deployment environments in health delivery organizations, including Active Directory or Single Sign-On integrations.
• Hands-on experience with IoT cloud deployments such as Azure, AWS, Cumulocity, or ThingWorx.
• Coding experience, including secure coding practices, vulnerability scanning tools, and penetration testing methodologies.
• Knowledge of embedded systems security, network security, endpoint protections, wireless communications, network protocols, HSM, and PKI.
• Experience supporting VA Handbook 6500 compliance.
• Relevant certifications such as GIAC, ISSEP, ISSAP, or CRISC.
• Experience with vulnerability and risk assessments, including use of CVSS.

Responsibilities

• Integrate security into the product development lifecycle across multiple product lines.
• Foster a collaborative security culture from product conception through decommissioning.
• Work with product development teams to embed security controls throughout the CI/CD pipeline.
• Lead STRIDE threat modeling and security risk assessments to identify and evaluate potential threats and safety issues.
• Elicit and define product security needs and requirements, design specifications, and verification and validation strategies.
• Establish best practices and automate vulnerability detection, secure coding, configuration management, and patching processes.
• Implement risk mitigation strategies and maintain risk management documentation.
• Oversee and improve incident response plans and processes to resolve security incidents rapidly and effectively.
• Manage secrets, identity, and access management to ensure least-privilege access.
• Monitor emerging regulations and standards related to medical device security, including FDA guidance and TIR 57.
• Collaborate with Software Development, Quality, Regulatory, and IT stakeholders to align security goals and requirements.
• Demonstrate leadership by presenting topics to the Security Champions program.

Benefits

• Relocation assistance may be available for select out-of-state candidates.
• Core and optional employee benefits are offered; details are available at www.bscbenefitsconnect.com.
• Exempt, non-sales roles may be eligible for an annual bonus target and long-term incentives, subject to plan eligibility and other requirements.

What This Job Offers

• Job Type: Full-time
• Career Level: Principal