Principal Cybersecurity Engineer

Make security a built-in part of product success. Boston Scientific is hiring a Principal Cybersecurity Engineer in Maple Grove, MN (hybrid). In this role, you will help shape cybersecurity strategy and strengthen DevSecOps across the product lifecycle for regulated, medical-device products. Expect a collaborative environment that emphasizes sound risk management, practical engineering, and alignment across technical and regulatory teams.

This position works toward integrating security from conception through decommission, including threat modeling, security risk assessments, and the development of verification and validation strategies. You will also support incident response readiness and strengthen identity and access management practices such as least privilege.

Responsibilities

• Integrate security into the product development lifecycle across multiple product lines.
• Help build a collaborative security culture from conception through decommission.
• Partner with product development teams to embed security controls into the CI/CD pipeline.
• Lead threat modeling using STRIDE and perform security risk assessments to identify and evaluate potential threats and safety issues.
• Define product security needs and requirements, including security requirements, design specifications, and verification and validation strategies.
• Establish best practices and automate processes for vulnerability detection, secure coding, configuration management, and patching.
• Implement risk mitigation strategies and maintain risk management documentation.
• Oversee and improve incident response plans and processes to support rapid, effective resolution of security incidents.
• Manage secrets and implement identity and access management to support least privilege access.
• Stay current with emerging medical-device security regulations and standards, including FDA Premarket Guidance, Post-market Cybersecurity Guidance, and TIR 57.
• Collaborate with stakeholders across Software Development, Quality, Regulatory, and IT to align security goals and requirements.
• Model resiliency and present topics to the Security Champions program.

Requirements

• Bachelor’s or master’s degree in Cybersecurity, Computer Science, Computer Engineering, or a related field.
• 5+ years of experience in cybersecurity engineering, with a recent focus on product security as it extends to the IoT cloud.
• Knowledge of DevSecOps tools.
• Proven experience conducting design and architecture reviews for complex, embedded medical devices or similar technologies.
• Demonstrated experience creating and executing security risk assessments and mitigation strategies.
• In-depth understanding of cybersecurity frameworks, including the NIST Cybersecurity Framework, with defense-in-depth best practices.
• Strong written and verbal communication skills to interface with technical teams, stakeholders, and executive leadership.
• Ability to collaborate across multidisciplinary teams while bridging technical, regulatory, and business functions.

Preferred Qualifications

• 4+ years in the medical device industry or a similarly regulated environment, with security architecture or medical device administration experience in healthcare settings as a plus.
• Development experience securing Yocto and desktop Linux, Windows IoT, or Android.
• Deep knowledge of medical device deployment environments in health delivery organizations, including Active Directory (AD) or Single Sign On (SSO) integrations.
• Hands-on experience with IoT cloud deployments such as Azure, AWS, Cumulocity, Thingworx, or similar platforms.
• Experience writing code with secure coding practices, vulnerability scanning tools, and penetration testing methodologies.
• Knowledge of embedded systems security (network security, endpoint protections, wireless communications, network protocols, HSM, and PKI).
• Experience supporting VA Handbook 6500 compliance.
• Relevant certifications (e.g., GIAC, ISSEP, ISSAP, CRISC) are a plus.
• Experience with vulnerability and risk assessments, including use of CVSS.

Work Model and Location

• Hybrid or onsite model with an office requirement of at least three days per week at the Maple Grove (Arbor Lakes), MN office.
• Relocation assistance may be available for select out-of-state candidates.

Compensation

USD 102,100 - 194,000 per year. Anticipated compensation varies by location and other factors.

Additional Information

• This role may be subject to a prohibited substance test because it is considered safety-sensitive.
• Certain US based positions that call on hospitals and/or health care centers require acceptable proof of COVID-19 vaccination status.
• For MA positions: it is unlawful to require or administer a lie detector test for employment.

Requisition ID: 636103