Principal Engineer, S/W QA Cyber Security

Additional Locations: N/A

Diversity - Innovation - Caring - Global Collaboration - Winning Spirit - High Performance

At Boston Scientific, we’ll give you the opportunity to harness all that’s within you by working in teams of diverse and high-performing employees, tackling some of the most important health industry challenges. With access to the latest tools, information and training, we’ll help you in advancing your skills and career. Here, you’ll be supported in progressing - whatever your ambitions.

About the Role

The Principal Cybersecurity Quality Engineer is a senior individual contributor and subject matter expert responsible for providing independent Quality oversight and technical leadership for product cybersecurity activities across the medical-device product lifecycle. This position partners with Quality, R&D, Systems Engineering, Software Engineering, Global Product Cybersecurity, Regulatory Affairs, Design Assurance, Post-Market Quality, and other cross-functional stakeholders to ensure cybersecurity risks and deliverables are appropriately identified, assessed, controlled, verified, documented, and maintained.

The role supports new product development, sustaining engineering, product changes, third-party software and component assessments, vulnerability management, and post-market cybersecurity activities. The individual will also strengthen organizational cybersecurity capability by developing consistent approaches, reusable knowledge assets, and technical expertise within the Quality organization.

Your Responsibilities Will Include:

• Serve as the Quality subject matter expert for product cybersecurity activities across new product development, sustaining engineering, product changes, remediation, and integration programs.
• Provide independent Quality review and approval of cybersecurity plans, assessments, reports, and other lifecycle deliverables in accordance with applicable Quality System requirements.
• Review cybersecurity risk analyses, threat models, security architectures, attack-surface assessments, and risk-control strategies for completeness, consistency, technical adequacy, and traceability.
• Ensure cybersecurity risks, requirements, controls, and verification evidence are appropriately connected across design controls, software lifecycle documentation, system requirements, and product risk-management files.
• Review Software Bills of Materials, MDS2 documentation, cybersecurity reports, penetration-test results, static and dynamic analysis results, vulnerability assessments, and security verification evidence.
• Assess the cybersecurity quality impact of design changes, software changes, third-party software updates, operating-system changes, supplier changes, and other product lifecycle changes.
• Provide Quality oversight for cybersecurity verification and validation strategies, including acceptance criteria, test coverage, traceability, anomaly handling, and objective evidence.
• Support product vulnerability assessments and Post-Market Vulnerability Reviews, including evaluation of potential safety, quality, compliance, and product-security impacts.
• Support post-market cybersecurity investigations, remediation plans, corrective actions, and escalation activities, as applicable.
• Partner with Global Product Cybersecurity and project teams to interpret and consistently apply internal cybersecurity procedures, work instructions, standards, and regulatory expectations.
• Support cybersecurity content needed for regulatory submissions, notified-body reviews, internal audits, external inspections, and responses to regulatory questions.
• Identify Quality and compliance gaps, communicate risks clearly, and influence appropriate mitigation and escalation decisions.
• Lead complex cybersecurity quality initiatives that may span multiple projects, product families, divisions, or geographic locations.
• Develop and improve cybersecurity quality review methods, templates, checklists, playbooks, metrics, and reusable knowledge assets.
• Monitor cybersecurity quality trends and recommend process, training, governance, or capability improvements.
• Mentor engineers and cross-functional team members in cybersecurity risk management, design controls, documentation quality, and lifecycle expectations.
• Support development of independent cybersecurity subject matter experts and help establish a sustainable cybersecurity Quality capability.
• Represent Cybersecurity Quality in technical reviews, governance forums, communities of practice, and cross-functional decision-making bodies.
• Maintain current knowledge of evolving medical-device cybersecurity regulations, standards, guidance, technologies, threats, and industry practices.
• Perform other related duties as assigned.

Required Qualifications:

• Bachelor’s degree in Cybersecurity, Computer Science, Software Engineering, Information Technology, or a related technical discipline.
• Significant professional experience in cybersecurity, software quality, design assurance, product security, systems engineering, software engineering, or another relevant technical field.
• Experience working with software-enabled products in a regulated product-development environment.
• Demonstrated experience with cybersecurity risk assessment, threat modelling, vulnerability evaluation, security requirements, or secure product-development practices.
• Working knowledge of software development lifecycle and design-control principles.
• Experience reviewing complex technical documentation and determining whether evidence is complete, traceable, technically sound, and compliant.
• Demonstrated ability to lead complex technical work independently and make risk-based recommendations.
• Demonstrated ability to influence decisions across functions and organizational levels without direct reporting authority.
• Strong written and verbal communication skills, including the ability to communicate complex cybersecurity risks to both technical and non-technical stakeholders.
• Strong analytical, problem-solving, facilitation, and stakeholder-management skills.
• Ability to manage multiple priorities and operate effectively within a global, cross-functional, and matrixed organization.

Preferred Qualifications:

• Advanced degree in Cybersecurity, Computer Science, Software Engineering, Systems Engineering, or a related discipline.
• Experience in the medical-device, healthcare technology, pharmaceutical, aerospace, automotive, or another safety-critical regulated industry.
• Experience with medical-device cybersecurity, software quality assurance, design assurance, or product-security quality oversight.
• Knowledge of medical-device design controls, software lifecycle processes, and product risk management.
• Experience with threat modelling, security architecture review, vulnerability assessment, penetration-testing review, static application security testing, or dynamic application security testing.
• Experience reviewing SBOMs, third-party software components, open-source software, commercial software, and software supply-chain risks.
• Experience supporting post-market vulnerability reviews, cybersecurity investigations, vulnerability remediation, CAPA, or other corrective-action processes.
• Experience supporting regulatory submissions, audits, inspections, or regulatory inquiries involving cybersecurity or device software.
• Experience developing organizational processes, templates, metrics, training, or reusable cybersecurity knowledge assets.
• Experience mentoring engineers or developing technical subject matter experts.
• Professional certification such as CISSP, CSSLP, CISM, GIAC, or an equivalent cybersecurity or quality credential.

Leadership and Expectations:

• Acts as a recognized technical authority in cybersecurity quality.
• Operates with substantial independence in defining approaches and resolving complex or ambiguous problems.
• Provides technical direction for complex, high-risk, or highly visible cybersecurity quality matters.
• Influences cybersecurity quality decisions across multiple functions, projects, product families, or business units.
• Develops scalable methods, frameworks, and practices rather than limiting contributions to individual project execution.
• Anticipates emerging cybersecurity risks and recommends appropriate organizational responses.
• Coaches and mentors engineers while building sustainable technical capability.
• Communicates cybersecurity quality risks and recommendations clearly to technical and business leadership.
• Balances technical rigor, patient safety, regulatory compliance, product quality, and business needs.

Requisition ID: 636429

Boston Scientific transforms lives through innovative medical technologies that improve the health of patients around the world. As a global medical technology leader for more than 45 years, we advance science for life by providing a broad range of high-performance solutions that address unmet patient needs and reduce the cost of healthcare. Our portfolio of devices and therapies helps physicians diagnose and treat complex cardiovascular, respiratory, digestive, oncological, neurological and urological diseases and conditions. Learn more at www.bostonscientific.com and follow us on LinkedIn.