Principal Cybersecurity Engineer

Fresenius Kabi•North Andover, MA

19h

About The Position

The Sr. Principal Engineer, Product Cybersecurity, serves as a recognized technical authority advancing secure product development across medical device software and connected technology platforms. The role provides leadership in security architecture, threat modeling, cybersecurity risk management, DevSecOps implementation, vulnerability management, and regulatory compliance to help ensure products are secure and aligned with global cybersecurity standards. The position partners with engineering, quality, regulatory, and product development teams throughout the product lifecycle, mentors engineering teams, and influences strategic technical decisions. This is a hands-on individual contributor role that guides secure product methodologies and process improvements for IMS and LVP products. The engineer develops and implements solutions to complex security problems, plans and performs security testing, leads design and architecture reviews, supports operational and post-market cybersecurity activities, and advances Secure SDLC and DevSecOps practices. The role also develops technical records and documentation for internal and external stakeholders and may supervise or direct lower-level engineers on assigned projects. The salary range is $145,000–$155,000, based on experience. The position is eligible to participate in a bonus plan with a target of 10% of base salary. Applicants must be authorized to work for any employer in the United States; Fresenius Kabi cannot sponsor or take over sponsorship of an employment visa now or in the future. Employment is at-will.

Requirements

Bachelor’s degree in Computer Science, Computer Engineering, Cybersecurity, or a related engineering discipline.
At least 8 years of experience in cybersecurity, software engineering, product security, or a related technical discipline, including applying cybersecurity practices to software-based products.
Demonstrated experience applying FDA cybersecurity guidance, IEC 81001-5-1, IEC 62304, ISO 14971, and related cybersecurity standards in regulated medical device development environments.
Experience conducting cybersecurity risk assessments and supporting risk management activities in accordance with ISO 14971.
Experience with vulnerability assessment and management, SBOM governance, security analysis, and threat modeling.
Experience applying cybersecurity principles to embedded medical device software and/or web applications.
Experience applying cybersecurity principles to on-premises and cloud-based systems, including web applications, APIs, containerized workloads, and hybrid architectures.
Experience planning and executing cybersecurity penetration testing activities.
Experience with Static Analysis (SAST), Dynamic Analysis (DAST), and Software Composition Analysis (SCA).
Ability to work as a collaborative team member.
Advanced problem-solving, analytical, troubleshooting, and debugging skills.
Strong attention to detail and a methodical approach.
Excellent written and verbal communication skills.
Ability to effectively speak, read, write, and understand English to perform essential job functions and independently understand workplace materials in a heavily regulated environment.

Nice To Haves

Experience supporting FDA submissions and regulatory audits is highly desired.

Responsibilities

Guide the conceptualization of secure methodologies and identify improvements to product cybersecurity processes and best practices for IMS and LVP products.
Develop and implement cybersecurity solutions to complex problems using multiple disciplines and technical principles.
Analyze, plan, design, execute, and document security for complex software applications and processes within established medical product design controls.
Plan and perform manual and automated security testing for new features, enhancements, and defect fixes across multiple software subsystems.
Lead secure design reviews, security requirements definition, and security architecture reviews, providing technical direction for authentication, authorization, encryption, secure communications, key management, cloud security, and secure software design patterns.
Participate in Coordinated Vulnerability Disclosure (CVD), PSIRT processes, vulnerability investigations, and post-market cybersecurity activities.
Develop and maintain product threat models using methods such as STRIDE, attack trees, abuse cases, and adversarial analysis.
Develop, review, and maintain cybersecurity standard operating procedures and recommend continuous process improvements to support compliance with global regulatory standards and agency regulations.
Conduct ongoing vulnerability scanning and risk evaluations.
Support and advance Secure Software Development Lifecycle (Secure SDLC) practices across product development teams.
Drive DevSecOps implementation, including automated security testing, policy enforcement, SBOM generation, vulnerability management, and secure CI/CD pipelines.
Provide guidance on secure coding practices and remediation of cybersecurity vulnerabilities throughout the software development lifecycle.
Work with senior leadership to improve cybersecurity engineering process efficiency.
Work with global internal and external staff to identify cybersecurity coverage needs and high-risk areas and improve software cybersecurity and robustness.
Mentor and guide junior staff, provide technical input on architecture and design decisions, and remain a hands-on contributor within the development team.
May supervise or direct lower-level engineers on assigned projects.
Develop and maintain technical records and detailed documentation for internal and external stakeholders in accordance with standard practices and good documentation procedures.
Remain current with the evolving cybersecurity landscape and its applicability to medical devices.