Principal Cybersecurity Engineer

Fresenius Kabi; Suttons Mills (MA); On-site; USD 145,000 - 155,000; Full time

Benefits offered by this job

401(k) with company contributions

Health benefits (medical, dental, and视

Paid time off

Employee assistance program

Job summary

Fresenius Kabi USA seeks a Sr. Principal Engineer, Product Cybersecurity to advance secure product development across medical device software and connected platforms.

You will lead security architecture, threat modeling, risk management, DevSecOps, vulnerability management, and regulatory compliance, partnering across engineering, quality, regulatory, and product teams to drive cybersecurity excellence throughout the lifecycle.

Qualifications

• Bachelor’s degree in a related engineering or cybersecurity field required.
• 8+ years of cybersecurity or software engineering experience in medical/device or regulated environment preferred.
• Experience applying FDA cybersecurity guidance and IEC/ISO standards in regulated development.

Responsibilities

• Lead security architecture reviews and threat modeling across products.
• Develop and implement cybersecure solutions for complex software systems.
• Oversee vulnerability management, CVD/PSIRT processes, and security testing.

Skills

Cybersecurity architecture

Threat modeling

Secure SDLC

DevSecOps

Vulnerability management

Regulatory compliance

Leadership

Mentoring

Communication

Education

Bachelor’s degree in Computer Science / Computer Engineering / Cybersecurity

Tools

SAST

DAST

SCA

STRIDE threat modeling

Job description

Job SummaryThe Sr. Principal Engineer, Product Cybersecurity, serves as a recognized technical authority responsible for advancing secure product development practices across medical device software and connected technology platforms. This role provides leadership in security architecture, threat modeling, cybersecurity risk management, DevSecOps implementation, vulnerability management, and regulatory compliance to ensure products are secure, compliant, and aligned with global cybersecurity standards. The incumbent partners with cross-functional engineering, quality, regulatory, and product development teams to drive cybersecurity excellence throughout the product lifecycle while mentoring engineering teams and influencing strategic technical decisions.Salary Range: $145,000-$155,000 based on experience• Position is eligible to participate in a bonus plan with a target of 10% of the base salary (include only if applicable to the grade level)• Final pay determinations will depend on various factors, including, but not limited to experience level, education, knowledge, skills, and abilities.Our benefits and programs are comprehensive and thoughtfully crafted to ensure our colleagues live healthy lives and have support when it matters most. Benefits offered include a 401(k) plan with company contributions, paid vacation, holiday and personal days, employee assistance program, and health benefits to include medical, prescription drug, dental and vision coverage.Applicants must be authorized to work for ANY employer in the United States. Fresenius Kabi is unable to sponsor or take over sponsorship of an employment visa either now or in the future.ResponsibilitiesThis person guides the conceptualization of new secure methodologies while identifying improvements for processes and best practices in product cybersecurity for all aspects of the IMS and LVP products.Develops and implements cybersecure solutions to complex problems using multiple disciplines and technical principles.Analyzes, plans, designs, executes, and documents the security of highly complex software applications and/or processes within established medical product design controls.Plans and performs security testing through manual and automated means for new features, enhancements, and defect fixes across multiple software subsystems.Leads secure design reviews, security requirements definition, and security architecture reviews, providing technical direction for authentication, authorization, encryption, secure communications, key management, cloud security, and secure software design patterns.Participates in operational cybersecurity activities including Coordinated Vulnerability Disclosure (CVD), PSIRT processes, vulnerability investigations, and post-market cybersecurity activities.Develops and maintains product threat models using methodologies such as STRIDE, attack trees, abuse cases, and adversarial analysis techniques.Develops, reviews, and maintains cybersecurity standard operating procedures and provides recommendations for continuous process improvements to maintain compliance with global regulatory standards and agency regulations. Conducts ongoing vulnerability scanning and risk evaluations.Supports and advances Secure Software Development Lifecycle (Secure SDLC) practices across product development teams.Drives implementation of DevSecOps practices including automated security testing, policy enforcement, SBOM generation, vulnerability management, and secure CI/CD pipelines.Provides guidance on secure coding practices and remediation of cybersecurity vulnerabilities throughout the software development lifecycle.Works with senior leadership to improve cybersecurity engineering process efficiency. Works with global internal and external staff to identify cybersecurity coverage needs, high-risk areas, and to improve overall software cybersecurity and robustness.Mentors and guides junior staff, routinely provides technical input on architecture and design decisions to improve cybersecurity, while remaining a hands-on individual contributor within the development team. May supervise or direct lower-level engineers on assigned projects.Develops and maintains technical records and detailed documentation for internal and external stakeholders, following standard practices and good documentation procedures.Requirements· Bachelor’s degree in Computer Science, Computer Engineering, Cybersecurity or related Engineering is required.· 8+ years of experience in cybersecurity, software engineering, product security, or a related technical discipline, including experience applying cybersecurity practices to software-based products.· Demonstrated experience applying FDA cybersecurity guidance, IEC 81001-5-1, IEC 62304, ISO 14971, and related cybersecurity standards within regulated medical device development environments.· Experience conducting cybersecurity risk assessments and supporting risk management activities in accordance with ISO 14971.· Experience with vulnerability assessment and management, SBOM governance, security analysis, and threat modeling is required.· Experience supporting FDA submissions and regulatory audits is highly desired· Experience applying cybersecurity principles to embedded medical device software and/or web applications.· Expected to remain current with the rapidly evolving cybersecurity landscape and its applicability to medical devices.· Experience applying cybersecurity principles to on-premises and cloud-based systems, including web applications, APIs, containerized workloads, and hybrid architectures.· Experience in planning and execution of cybersecurity penetration testing activities.· Experience with Static Analysis (SAST), Dynamic Analysis (DAST), and Software Composition Analysis (SCA).· Ability to work as a collaborative team member.· Advanced in problem solving, analytical, troubleshooting, and debugging skills.· Strong attention to details, natural inclination to be methodical.· Excellent in written and verbal communication skillsThe Company’s primary business language is English. The successful candidate must be able to effectively speak, read, write, and understand English to perform the essential functions of the position, including independently understanding policies, procedures, training materials, and workplace communications written in English due to our heavily regulated work environment.Additional InformationWe offer an excellent salary and benefits package including medical, dental and vision coverage, as well as life insurance, disability, 401K with company contribution, and wellness program.Please note that joining our team does not create a guaranteed or permanent employment arrangement. All employment is at‑will, meaning both the employee and Fresenius Kabi have the right to end the employment relationship at any time, in accordance with applicable federal and state laws.Fresenius Kabi is an Equal Opportunity/Affirmative Action employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, national origin, citizenship, immigration status, disabilities, or protected veteran status.