Principal Cybersecurity Engineer
Boston Scientific
Summary
Boston Scientific is seeking a Principal Cybersecurity Engineer with a background in DevSecOps and the design, development, and testing of cybersecurity features and controls in a regulated industry. This individual will be responsible for driving the cybersecurity strategy and DevSecOps throughout the product lifecycle, ensuring compliance with relevant standards and regulations. Be a part of the Interventional Cardiology team, one of Boston Scientific's most product-diverse divisions, supporting R&D in the design of exciting products and business development activities.
Job description
Your responsibilities will include:
- Integrate security into the product development lifecycle of multiple product lines.
- Foster a collaborative security culture from conception to decommission.
- Collaborate with product development teams to embed security controls throughout the CI/CD pipeline.
- Lead threat modeling using STRIDE and security risk assessments, identifying, and evaluating potential threats and safety issues.
- Elicit and define product security needs and requirements; define product security requirements, design specifications, and verification and validation strategies.
- Establish best practices and automate processes for vulnerability detection, secure coding, configuration management, and patching.
- Implement risk mitigation strategies and maintain risk management documentation.
- Oversee and enhance incident response plans and processes, ensuring rapid and effective resolution of security incidents.
- Manage secrets, identity and access management to ensure least privilege access.
- Stay current with emerging regulations and standards related to medical device security (e.g., FDA Premarket Guidance, Post-market Cybersecurity Guidance, TIR 57).
- Collaborate closely with internal stakeholders (Software Development, Quality, Regulatory, IT) to align security goals and requirements.
- Model resiliency and show leadership by presenting topics to the Security Champions program.
Requirements
- Bachelor's or master's degree in Cybersecurity, Computer Science, Computer Engineering, or a related field.
- 5+ years of experience in cybersecurity engineering, with a recent focus on product security as it extends to the IoT cloud.
- Knowledge of DevSecOps tools.
- Proven experience in design and architecture reviews for complex, embedded medical devices or similar technologies.
- Demonstrated history of creating and executing security risk assessments and mitigation strategies.
- In-depth understanding of cybersecurity frameworks (e.g., NIST Cybersecurity Framework) including best practices for defense in depth.
- Excellent written and verbal communication skills for interfacing technical teams, stakeholders, and executive leadership.
- Ability to work collaboratively across multidisciplinary teams, bridging gaps between technical, regulatory, and business functions.
- Preferred: 4+ years of experience working in the medical device industry or a similarly regulated environment.
- Preferred: Development experience in securing Yocto and desktop Linux, Windows IoT, or Android.
- Preferred: Deep knowledge of the deployment environment for medical devices into health delivery organizations, including Active Directory (AD) or Single Sign On (SSO) integrations.
- Preferred: Hands-on experience with IoT cloud deployments such as Azure, AWS, Cumulocity, Thingworx or other platforms.
- Preferred: Experience writing code, with secure coding practices, vulnerability scanning tools, and penetration testing methodologies.
- Preferred: Knowledge of embedded systems security, network security, endpoint protections, wireless communications, network protocols, HSM and PKI.
- Preferred: Experience supporting VA Handbook 6500 compliance.
- Preferred: Relevant certifications (e.g., GIAC, ISSEP, ISSAP, CRISC) are a plus.
- Preferred: Experience with vulnerability and risk assessments including use of CVSS.
Benefits
- Relocation assistance
- Annual bonus target
- Long-term incentives
Company overview
Boston Scientific Corporation is a global leader in the development, manufacturing, and marketing of minimally invasive medical devices used in interventional medical specialties. Founded in 1979 and headquartered in Marlborough, Massachusetts, the company focuses on transforming patient lives through innovative medical solutions across a wide range of therapeutic areas including cardiology, endoscopy, urology, pulmonology, and neuromodulation. With approximately 53,000 employees worldwide and operations in 40 countries, Boston Scientific serves over 44 million patients annually. The company invests heavily in research and development, allocating $1.6 billion to R&D in 2024, and maintains a strong commitment to quality, patient safety, and meaningful innovation. Boston Scientific's product portfolio includes advanced technologies such as cardiac rhythm management devices, coronary stents, ablation systems, endoscopy equipment, and neuromodulation therapies, all designed to improve patient outcomes and quality of life through less invasive treatment options.