Cybersecurity Engineer

Talentify; Dallas (TX); Hybrid; USD 120,000 - 160,000; Full time

Job summary

Spectral AI, Inc. in Dallas seeks a Cybersecurity Engineer to join our design and development team.

The role focuses on securing medical device software through design controls, risk management, regulatory submissions, and post‑market surveillance in collaboration with multiple engineering and IT teams. You will implement secure coding, perform risk assessments, manage SBOMs, and support vulnerability management and incident response under FDA, IEC, and ISO standards.

Qualifications

• Bachelor-level degree in CS/Cybersecurity or related field.
• 3–5 years of proven cybersecurity engineering experience, preferably in medical devices or regulated software.
• Strong technical writing for comprehensive regulatory documentation.

Responsibilities

• Institute Security-by-Design across the device software, AI models, firmware, and hardware lifecycles.
• Develop and maintain cybersecurity SOPs and work instructions for regulatory and security requirements.
• Support design reviews by providing security input and ensuring design controls address cybersecurity.

Skills

Security by design

Threat modeling

Regulatory compliance

Technical writing

TLS encryption

OS hardening

Education

BS in CS/Cybersecurity/Engineering

Tools

Helm

Dependency-Check

SBOM tools

Job description

Position Summary

Spectral AI, Inc. (Spectral) is seeking a Cybersecurity Engineer to join our growing design and development team. The position is based in Dallas, Texas, with hybrid work flexibility in accordance with the Spectral Employee Handbook guidelines. The Cyber Security Engineer will support the design, development, and maintenance of secure medical device software systems, ensuring that cybersecurity controls are resilient and compliant with FDA regulations, international standards (e.g.. ANSI/AAMI SW 96:2003, IEC 62304, IEC 81001, ISO 14971, ISO 27001), and organizational security policies. The engineer will collaborate closely with Software Engineering, Hardware Engineering, Quality Assurance, Regulatory Affairs, Biomedical Engineering, Data Science, Systems Engineering, and IT internal teams to embed cybersecurity into design controls, risk management, regulatory submissions, and post-market surveillance activities.

Essential Duties and Responsibilities

Product Cybersecurity

• Institute Security-by-Design practices throughout the entire lifecycle of the Spectral device software, AI models, firmware, and hardware.
• Develop and maintain cybersecurity standard operating procedures (SOPs) and work instructions that support compliance with regulatory and security requirements in all target markets for Spectral products.
• Support design reviews by providing security input and ensuring cybersecurity is integrated into design controls.

Cybersecurity Risk Management

• Perform cybersecurity risk assessments for medical device systems using structured methodologies (Threat Modeling, STRIDE, DREAD, Attack Trees, SBOM analysis).
• Execute and document risk evaluation aligned with AAMI TIR57, AAMI TIR97, FDA Premarket Cybersecurity Guidance, and ISO 14971.
• Participate actively in Coordinated Vulnerability Disclosure (CVD) processes, working with internal team and vendors to ensure vulnerabilities are responsibly reported, remediated, and communicated in alignment with industry best practices.
• Maintain and periodically update cybersecurity documentation and supporting artifacts, including:
  • Security risk assessment
  • Security risk management reports
  • Threat models
  • Cybersecurity requirements, testing, and traceability matrices in alignment with FDA guidance and IEC 81001

Secure Software Development (IEC 81001 and IEC 62304)

• Collaborate with software engineers to implement secure coding practices and structured code review processes.
• Ensure correct implementation of security requirements, encryption standards, authentication and authorization controls, and security-relevant logging.
• Evaluate SOUP/OTS components for vulnerabilities, maintenance status, and compliance with FDA software bill of material (SBOM) requirements.
• Support the creation and ongoing maintenance of SBOM (e.g. CycloneDX, SPDX) using automated tools such as HELM and Dependency-Check.

Vulnerability and Patch Management

• Perform vulnerability scanning across firmware, software, cloud services, Linux-based, and Windows-based cart devices.
• Triage and validate Common Vulnerabilities and Exposures (CVEs) relevant to device components, run‑time environments, and third‑party libraries.
• Prepare vulnerability mitigation plans and support development teams during remediation.
• Support integration of security controls across local, handheld, and cloud‑connected medical devices.

Penetration Testing and Verification Support

• Prepare documentation, architecture diagrams, and accounts for test execution.
• Track findings, analyze root causes, and support remediation verification.

Incident Response and Monitoring

• Assist in establishing cybersecurity monitoring processes for fielded devices and cloud environments.
• Investigate security anomalies and incidents, perform log analysis, and support corrective/preventive actions (CAPA).

Qualifications

Required education and experience:

• Bachelor’s degree or above in Computer Science, Cybersecurity, Electrical/Computer Engineering, or a related field.
• 3–5 years of proven experience in cybersecurity engineering, ideally within medical devices, healthcare technology, regulated software, or other safety‑critical systems.
• Demonstrated proficiency in technical writing, ensuring accurate, comprehensive, and well‑structured documentation for software cybersecurity.

Knowledge, Skills and Abilities

• FDA Premarket Cybersecurity Guidance
• IEC 62304 Software Lifecycle
• AAMI TIR57 / TIR97
• OWASP Top 10, CWE, and secure coding principles
• Familiarity with Transport Layer Security (TLS), certificate management, encryption protocols (e.g. AES, RSA), and authentication/authorization models.
• Understanding of cybersecurity vulnerabilities and FDA reporting requirements
• Understanding of Windows and Linux OS hardening, cloud security (AWS/Azure), and secure configuration.

Preferred Qualifications

• Experience supporting FDA medical device submissions with cybersecurity documentation.
• Hands‑on experience with medical cart or handheld device security (Windows, Linux, embedded OS).
• Experience with cloud‑connected medical systems (AWS IoT, secure APIs, VPN connections).
• Certifications such as Security+, CySA+, CISSP, GSEC, CEH, or industry equivalent.

Soft Skills

• Excellent written and verbal communication skills in English.
• Detail‑oriented, strong analytical and problem‑solving skills.
• Ability to prepare quality cybersecurity documentation suitable for regulatory review.
• Ability to collaborate across functional teams such as engineering, QA/RA, hardware, and clinical teams.
• Comfortable managing multiple concurrent security tasks.

Physical Requirements

• Prolonged periods of sitting at a desk and working on a computer.

Travel

Occasional support during off‑hours for security events or release deadlines

Equal Employment Opportunity

Spectral AI, Inc. is an equal opportunity and affirmative action employer. All applicants will be considered for employment without regard to race, color, ancestry, national origin, sex, gender, sexual orientation, marital status, religion, age, disability, gender identity, results of genetic testing, protected veteran status, or any other characteristic protected by applicable federal, state, or local laws.