Senior Cybersecurity Engineer

Company Overview
Verathon
is a global medical device company committed to being a trusted partner to our customers and advancing patient care through innovative Airway Management and Urology solutions. For more than 40 years, we have worked alongside healthcare professionals to understand their needs and deliver high-quality technologies that provide lasting clinical and economic value.Our portfolio includes leading GlideScope® video laryngoscopy and BFlex™ bronchoscopy solutions, BladderScan® bladder volume measurement, and a growing range of single-use Urology solutions. Behind our innovations is a diverse, global team united by a commitment to our customers, collaboration, and improving patient care.Verathon, a business unit of Roper Technologies, is headquartered in Bothell, Washington, with international subsidiaries in Canada, Europe, and Asia Pacific.Overview
Verathon® is looking for a Senior Cybersecurity Engineer to become the newest member of our R&D Team located in Bothell, Washington.The Senior Cybersecurity Engineer is responsible for architecting and governing the system-level cybersecurity engineering activities required to design and sustain secure medical devices across Verathon's product portfolio. Working across concurrent product programs, this role sets product security architecture direction, leads system threat modeling, and translates FDA and consensus standards guidance into actionable security requirements, policy, and verification evidence. As the primary point of contact for product security, the Senior Cybersecurity Engineer influences security design decisions across Systems, Software, Quality, and Regulatory teams, mentors other engineers, leads the cybersecurity content of regulatory submissions and audits, and engages with external stakeholders including vendors, auditors, and customers, ensuring Verathon's products satisfy regulatory expectations throughout the product lifecycle, from initial design through post-market sustaining activities.Responsibilities
Define and govern product security architecture and security reference architectures across concurrent product programs, including identification of software and hardware assets, trust boundaries, control objectives, and interface documentation;
specify and review designs for authentication, authorization, cryptography, secure update mechanisms, event logging, data integrity, and system hardening (including STIG-based hardening where applicable)Lead architecture reviews as the product security subject matter expert;
drive cybersecurity decisions for large or complex programs and influence the security design of future productsLead system-level threat modeling (e.G., STRIDE / MITRE ATT&CK for ICs) across product programs and allocate mitigations across hardware, firmware, and software;
ensure trust-boundary assumptions are explicit, traceable, and testable, and guide other engineers in applying threat-modeling methods consistentlyDerive cybersecurity requirements from FDA guidance and consensus standards (IEC 62443, IEC 81001-5-1, AAMI SW96);
define verification strategies specifying required evidence, timing, and ownershipDevelop product security policies, processes, and design standards where gaps exist, and drive their adoption across engineering teamsProduce and maintain design-level product security documentation including architecture views, control rationale, security requirements traceability matrices, and interface/external connection recordsOwn the engineering interface during penetration testing and other third-party security engagements: lead scope definition, environment setup, and technical Q&A;
assess design impact offindings;
define remediation technical approach and support retest readinessLead security tool evaluations and vendor assessments (including penetration testing providers and SBOM/vulnerability management tooling);
ensure selected tools and vendors meet product and compliance requirementsOwn the software supply chain security strategy for assigned product lines: define SBOM requirements and tooling, integrate SBOM generation into the SDLC, and establish ongoing component monitoring and triage processesOversee CVE impact analysis for fielded products across the portfolio;
assess applicability ofnewly disclosed vulnerabilities to system-level components and architecture;
drive prioritization and remediation scoping, and design architectural solutions that reduce systematic risk exposureCoordinate cross-functional product security incident response (PSIRT) for fielded products, from triage through remediation and coordinated disclosure;
ensure readiness acrossengineering and product teams and drive improvements to response playbooksWhen post-release remediation is required, define technical scope and verification approach and drive release readiness for security-driven sustaining updates, including patch packaging, documentation updates, and design change records;
coordinate with engineering and release functions to ensure validated deployment and documentation closureLead interoperability security assessments for device interfaces with external systems, networks, and devices;
evaluate security and safety risks across normal and fault operating modes and define appropriate risk controls for interface trust boundariesWork cross-functionally across Systems, Software, Quality, and Regulatory disciplines to align on security architecture decisions and ensure security requirements are correctly allocated and verification evidence is complete across the system, using influence and persuasion to drive consistent implementation in line with wider business objectivesOwn and maintain the Product Security Management Plan and associated Product Security Management File, ensuring all required cybersecurity activities are planned, traceable, and audit-readyLead the cybersecurity sections of regulatory submissions (e.G., 510(k), De Novo, PMA, EU MDR technical documentation) and represent cybersecurity in internal audits, external audits, and notified-body inspectionsSupport Verathon's Quality Management System (QMS), including participation in design reviews, ECO procedures, and DHF/regulatory submission artifact preparationMentor and guide engineers in secure design principles and product security practices;
may be accountable for team delivery of tactical targetsServe as the primary point of contact for product security matters;
maintain relationships with external stakeholders including vendors, auditors, and customers, and advise leadership on product security risk posture and emerging threatsStay current with evolving FDA cybersecurity guidance, EU MDR and MDCG 2019-16, NIST CSF, and relevant medical device security standards;
identify implications for Verathon products and processes and recommend changes to policy and practiceQualifications
Bachelor's degree in Systems Engineering, Electrical Engineering, Computer Engineering, or a related technical discipline is required;
Master's degree preferred8+ years of demonstrated experience in cybersecurity engineering, product security engineering, or a related field (or 6+ years with a Master's degree, or a PhD with 3+ years), with at least 5 years focused on cybersecurity for connected or regulated productsExtensive experience leading system-level threat modeling (e.G., STRIDE, PASTA, or TARA as defined in IEC 81001-5-1 / AAMI SW96) across multiple products or programsIn-depth knowledge of medical device cybersecurity regulatory requirements, including FDA premarket and postmarket cybersecurity guidance, IEC 81001-5-1, AAMI SW96, IEC 62443, and EU MDR / MDCG 2019-16Demonstrated track record leading the cybersecurity content of regulatory submissions (e.G., 510(k), De Novo, PMA) and representing cybersecurity in audits or notified-body inspectionsExperience defining security requirements and producing verification evidence in a regulated product development environment (FDA QMSR / ISO 13485 QMS preferred)Demonstrated experience designing and governing security architectures for connected products across multiple teams, including authentication, cryptography, secure update, and system hardeningExperience with CVE/NVD triage and vulnerability impact assessment at the system level, including CVSS-based vulnerability scoring and cybersecurity risk assessment methodologiesExperience coordinating product security incident response or PSIRT activities for fielded productsDemonstrated experience managing third-party penetration testing engagements end to end, including vendor selection, scoping, findings triage, and remediation scopingHands-on experience generating and managing SBOMs (e.G., SPDX, CycloneDX) and applying NTIA and FDA SBOM guidance;
experience establishingongoing component monitoring processes is strongly preferredStrong knowledge of networking fundamentals (ports, protocols, firewalls) and OS-level security concepts across Linux and/or Windows environments relevant to connected medical devicesSenior security certification (e.G., CISSP, CISM, CISSP-ISSAP, CCSP, or CSSLP) is preferred;
advanced technical certifications (e.G., OSCP, GXPN) and demonstrated ISA/IEC 62443 experience are an asset;
candidates with equivalent demonstrated experience will be consideredWorking knowledge of architecture and modeling tools (e.G., Visio, PlantUML, or basic SysML) for producing security architecture and threat-model artifactsExperience mentoring engineers and guiding technical teams in applying secure design principlesStrong written and verbal communication skills, with demonstrated ability to produce clear, audit-ready technical documentation and to communicate security risk to technical, non-technical, and leadership audiences
#J-18808-Ljbffr