Cybersecurity Engineer Iii

Company Overview
Verathon
is a global medical device company committed to being a trusted partner to our customers and advancing patient care through innovative Airway Management and Urology solutions. For more than 40 years, we have worked alongside healthcare professionals to understand their needs and deliver high-quality technologies that provide lasting clinical and economic value.Our portfolio includes leading GlideScope® video laryngoscopy and BFlex™ bronchoscopy solutions, BladderScan® bladder volume measurement, and a growing range of single-use Urology solutions. Behind our innovations is a diverse, global team united by a commitment to our customers, collaboration, and improving patient care.Verathon, a business unit of Roper Technologies, is headquartered in Bothell, Washington, with international subsidiaries in Canada, Europe, and Asia Pacific.Overview
Verathon
®
is looking for a Cybersecurity Engineer to become the newest member of our Airway R&D Team located in Burnaby, BC.The Cybersecurity Engineer is responsible for leading the system-level cybersecurity engineering activities required to design and sustain secure medical devices across Verathon's product portfolio. This role is the primary owner of product security architecture, system threat modeling, and the translation of FDA and consensus standards guidance into actionable security requirements and verification evidence. Working closely with Software Engineering, Quality, and Regulatory teams, the Cybersecurity Systems Engineer ensures that Verathon's products are designed and documented to satisfy regulatory expectations throughout the product lifecycle, from initial design through post-market sustaining activities.Responsibilities
Define product security architecture, including trust boundaries, control objectives, and interface documentation;
specify and review designs for authentication, authorization, cryptography, secure update mechanisms, event logging, data integrity, and system hardeningLead system-level threat modeling (e.G., STRIDE / MITRE ATT&CK for I&C) and allocate mitigations across hardware, firmware, and software;
ensure trust-boundary assumptions are explicit, traceable, and testableDerive cybersecurity requirements from FDA guidance and consensus standards (IEC 62443, IEC 81001-5-1, AAMI SW96);
define verification strategies specifying required evidence, timing, and ownershipProduce and maintain design-level product security documentation including architecture views, control rationale, security requirements traceability matrices, and interface/external connection recordsOwn the engineering interface during penetration testing engagements: lead scope clarification, environment setup, and technical Q&A;
assess design impact offindings;
define remediation technical approach and support retest readinessWhen post-release remediation is required, define technical scope and verification approach;
coordinate with engineering and release functions to ensure validated deployment and documentation closureLead interoperability security assessments for device interfaces with external systems, networks, and devices;
evaluate security and safety risks across normal and fault operating modes and define appropriate risk controls for interface trust boundariesConduct CVE impact analysis for fielded products;
assess applicability ofnewly disclosed vulnerabilities to system-level components and architecture;
support prioritization and remediation scopingContribute to release readiness for security-driven sustaining updates, including inputs to patch packaging, documentation updates, and design change recordsCollaborate with the Software to ensure security requirements are correctly allocated and verification evidence is complete across the systemWork cross-functionally across Systems, Software, Quality, and Regulatory disciplines to align on security architecture decisions and ensure consistent implementationOwn and maintain the Product Security Management Plan and associated Product Security Management File, ensuring all required cybersecurity activities are planned, traceable, and audit-readySupport Verathon's Quality Management System (QMS), including participation in design reviews, ECO procedures, and DHF/regulatory submission artifact preparationStay current with evolving FDA cybersecurity guidance, NIST CSF, and relevant medical device security standards;
identify implications for Verathon products and processesQualifications
Bachelor's degree in Systems Engineering, Electrical Engineering, Computer Engineering, or a related technical discipline is required5+ years of demonstrated experience in systems engineering, product security engineering, or a related field, with at least 3 years focused on cybersecurity for connected or regulated productsDemonstrated experience with system-level threat modeling methodologies (e.G., STRIDE, PASTA, or TARA as defined in IEC 81001-5-1 / AAMI SW96)Working knowledge of medical device cybersecurity regulatory requirements, including FDA premarket and postmarket cybersecurity guidance, IEC 81001-5-1, AAMI SW96, and IEC 62443Experience defining security requirements and producing verification evidence in a regulated product development environment (FDA QSR / ISO 13485 QMS preferred)Experience with CVE/NVD triage and vulnerability impact assessment at the system level including CVSS-based vulnerability scoring and cybersecurity risk assessment methodologiesExperience supporting or managing third-party penetration testing engagements, including findings triage and remediation scoping, is strongly preferredWorking knowledge of networking fundamentals (ports, protocols, firewalls) and OS-level security concepts across Linux and/or Windows environments relevant to connected medical devicesRelevant security certification (e.G., CISSP, CISM, CEH, CompTIA Security+, or equivalent) is preferred;
candidates with equivalent demonstrated experience will be consideredFamiliarity with SBOM concepts and supply chain security considerations for medical devices is an assetStrong written communication skills with demonstrated ability to produce clear, audit-ready technical documentationWhy Join Us?
Be part of an innovative team that is dedicated to improving patient outcomes.Engage in meaningful work that makes a difference in the healthcare industry.Competitive salary and comprehensive benefits package.
Salary range - $125,000 - $193,400 (Compensation will vary based on skills, experience and location;
it is not typical to behired at or above the top of the salary range).Full-time employees who are not on a commission plan are eligible for Verathon’s annual bonus plan based on company and individual performance.Verathon provides a competitive benefits package including a generous HCSA, paid holidays, paid time off and a retirement matching plan.
#J-18808-Ljbffr