Principal Cybersecurity Engineer

301044 Fresenius Kabi USA, LLC; Massachusetts; On-site; USD 145,000 - 155,000; Full time

Benefits offered by this job

401(k) contributions

Paid vacation

Holidays & personal days

Employee assistance

Job summary

Fresenius Kabi USA is seeking a Sr. Principal Engineer, Product Cybersecurity, to drive secure product development across medical device software and connected platforms.

You will lead security architecture, threat modeling, risk management, DevSecOps, and regulatory compliance throughout the product lifecycle. You will mentor teams, influence design decisions, and collaborate with regulatory, quality and product groups to ensure secure, compliant solutions.

Qualifications

• Bachelor's degree in Computer Science, Computer Engineering, Cybersecurity or related Engineering is required.
• 8+ years of experience in cybersecurity, software engineering, product security, or a related technical discipline.
• Experience applying FDA cybersecurity guidance, IEC 81001-5-1, IEC 62304, ISO 14971 in regulated medical device environments.
• Experience with vulnerability assessment and management, SBOM governance, security analysis, and threat modeling.

Responsibilities

• Guides conceptualization of secure methodologies and improvements for product cybersecurity across IMS and LVP products.
• Develops and implements cybersecure solutions to complex problems using multiple disciplines.
• Analyzes, plans, designs, executes, and documents security of highly complex software applications and processes.
• Plans and performs security testing through manual and automated means for new features and defect fixes.
• Leads secure design reviews, security requirements, and security architecture reviews.

Skills

Cybersecurity leadership

Threat modeling

DevSecOps

Regulatory compliance

Vulnerability management

Secure SDLC

Education

Bachelor's degree in Computer Science, Computer Engineering, Cybersecurity or related Engineering

Tools

SAST

DAST

SCA

SBOM governance

Cloud security

Job description

Job Summary

The Sr. Principal Engineer, Product Cybersecurity, serves as a recognized technical authority responsible for advancing secure product development practices across medical device software and connected technology platforms. This role provides leadership in security architecture, threat modeling, cybersecurity risk management, DevSecOps implementation, vulnerability management, and regulatory compliance to ensure products are secure, compliant, and aligned with global cybersecurity standards. The incumbent partners with cross-functional engineering, quality, regulatory, and product development teams to drive cybersecurity excellence throughout the product lifecycle while mentoring engineering teams and influencing strategic technical decisions.

Salary

• Salary Range: $145,000-$155,000 based on experience
• Position is eligible to participate in a bonus plan with a target of 10% of the base salary (include only if applicable to the grade level)

Benefits

• 401(k) plan with company contributions
• paid vacation
• holiday and personal days
• employee assistance program
• health benefits to include medical, prescription drug, dental and vision coverage

Applicants must be authorized to work for ANY employer in the United States. Fresenius Kabi is unable to sponsor or take over sponsorship of an employment visa either now or in the future.

Responsibilities

• This person guides the conceptualization of new secure methodologies while identifying improvements for processes and best practices in product cybersecurity for all aspects of the IMS and LVP products.
• Develops and implements cybersecure solutions to complex problems using multiple disciplines and technical principles.
• Analyzes, plans, designs, executes, and documents the security of highly complex software applications and/or processes within established medical product design controls.
• Plans and performs security testing through manual and automated means for new features, enhancements, and defect fixes across multiple software subsystems.
• Leads secure design reviews, security requirements definition, and security architecture reviews, providing technical direction for authentication, authorization, encryption, secure communications, key management, cloud security, and secure software design patterns.
• Participates in operational cybersecurity activities including Coordinated Vulnerability Disclosure (CVD), PSIRT processes, vulnerability investigations, and post-market cybersecurity activities.
• Develops and maintains product threat models using methodologies such as STRIDE, attack trees, abuse cases, and adversarial analysis techniques.
• Develops, reviews, and maintains cybersecurity standard operating procedures and provides recommendations for continuous process improvements to maintain compliance with global regulatory standards and agency regulations.
• Conducts ongoing vulnerability scanning and risk evaluations.
• Supports and advances Secure Software Development Lifecycle (Secure SDLC) practices across product development teams.
• Drives implementation of DevSecOps practices including automated security testing, policy enforcement, SBOM generation, vulnerability management, and secure CI/CD pipelines.
• Provides guidance on secure coding practices and remediation of cybersecurity vulnerabilities throughout the software development lifecycle.
• Works with senior leadership to improve cybersecurity engineering process efficiency.
• Works with global internal and external staff to identify cybersecurity coverage needs, high-risk areas, and to improve overall software cybersecurity and robustness.
• Mentors and guides junior staff, routinely provides technical input on architecture and design decisions to improve cybersecurity, while remaining a hands-on individual contributor within the development team.
• May supervise or direct lower-level engineers on assigned projects.
• Develops and maintains technical records and detailed documentation for internal and external stakeholders, following standard practices and good documentation procedures.

Requirements

• Bachelor's degree in Computer Science, Computer Engineering, Cybersecurity or related Engineering is required.
• 8+ years of experience in cybersecurity, software engineering, product security, or a related technical discipline, including experience applying cybersecurity practices to software-based products.
• Demonstrated experience applying FDA cybersecurity guidance, IEC 81001-5-1, IEC 62304, ISO 14971, and related cybersecurity standards within regulated medical device development environments.
• Experience conducting cybersecurity risk assessments and supporting risk management activities in accordance with ISO 14971.
• Experience with vulnerability assessment and management, SBOM governance, security analysis, and threat modeling is required.
• Experience supporting FDA submissions and regulatory audits is highly desired.
• Experience applying cybersecurity principles to embedded medical device software and/or web applications.
• Expected to remain current with the rapidly evolving cybersecurity landscape and its applicability to medical devices.
• Experience applying cybersecurity principles to on-premises and cloud-based systems, including web applications, APIs, containerized workloads, and hybrid architectures.
• Experience in planning and execution of cybersecurity penetration testing activities.
• Experience with Static Analysis (SAST), Dynamic Analysis (DAST), and Software Composition Analysis (SCA).
• Ability to work as a collaborative team member.
• Advanced in problem solving, analytical, troubleshooting, and debugging skills.
• Strong attention to details, natural inclination to be methodical.
• Excellent in written and verbal communication skills.

The Company’s primary business language is English. The successful candidate must be able to effectively speak, read, write, and understand English to perform the essential functions of the position, including independently understanding policies, procedures, training materials, and workplace communications written in English due to our heavily regulated work environment.

Equal Opportunity/Affirmative Action

Fresenius Kabi is an Equal Opportunity/Affirmative Action employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, national origin, citizenship, immigration status, disabilities, or protected veteran status.

About Fresenius Kabi

Fresenius Kabi is a global health care company that specializes in injectable medicines, biosimilars, and technologies for infusion, transfusion, and clinical nutrition. Our expansive portfolio of products and global network of science and manufacturing centers provide essential support for the care of critical and chronically ill patients. With more than 41,000 employees worldwide, our dedicated team is united by our shared purpose: to put lifesaving medicines and technologies in the hands of people who care for patients – and to find answers to the challenges they face. We call this purpose caring for life. Our U.S. headquarters is in Lake Zurich, Illinois and the company’s global headquarters is in Bad Homburg, Germany.