Job Summary

The Sr. Principal Engineer, Product Cybersecurity, serves as a recognized technical authority responsible for advancing secure product development practices across medical device software and connected technology platforms. This role provides leadership in security architecture, threat modeling, cybersecurity risk management, DevSecOps implementation, vulnerability management, and regulatory compliance to ensure products are secure, compliant, and aligned with global cybersecurity standards. The incumbent partners with cross-functional engineering, quality, regulatory, and product development teams to drive cybersecurity excellence throughout the product lifecycle while mentoring engineering teams and influencing strategic technical decisions.

Salary Range: $145,000-$155,000 based on experience

• Position is eligible to participate in a bonus plan with a target of 10% of the base salary (include only if applicable to the grade level)
• Final pay determinations will depend on various factors, including, but not limited to experience level, education, knowledge, skills, and abilities.
Our benefits and programs are comprehensive and thoughtfully crafted to ensure our colleagues live healthy lives and have support when it matters most. Benefits offered include a 401(k) plan with company contributions, paid vacation, holiday and personal days, employee assistance program, and health benefits to include medical, prescription drug, dental and vision coverage.

Applicants must be authorized to work for ANY employer in the United States. Fresenius Kabi is unable to sponsor or take over sponsorship of an employment visa either now or in the future.

Responsibilities

This person guides the conceptualization of new secure methodologies while identifying improvements for processes and best practices in product cybersecurity for all aspects of the IMS and LVP products.

Develops and implements cybersecure solutions to complex problems using multiple disciplines and technical principles.

Analyzes, plans, designs, executes, and documents the security of highly complex software applications and/or processes within established medical product design controls.

Plans and performs security testing through manual and automated means for new features, enhancements, and defect fixes across multiple software subsystems.

Leads secure design reviews, security requirements definition, and security architecture reviews, providing technical direction for authentication, authorization, encryption, secure communications, key management, cloud security, and secure software design patterns.

Participates in operational cybersecurity activities including Coordinated Vulnerability Disclosure (CVD), PSIRT processes, vulnerability investigations, and post-market cybersecurity activities.

Develops and maintains product threat models using methodologies such as STRIDE, attack trees, abuse cases, and adversarial analysis techniques.

Develops, reviews, and maintains cybersecurity standard operating procedures and provides recommendations for continuous process improvements to maintain compliance with global regulatory standards and agency regulations.  Conducts ongoing vulnerability scanning and risk evaluations.

Supports and advances Secure Software Development Lifecycle (Secure SDLC) practices across product development teams.

Drives implementation of DevSecOps practices including automated security testing, policy enforcement, SBOM generation, vulnerability management, and secure CI/CD pipelines.

Provides guidance on secure coding practices and remediation of cybersecurity vulnerabilities throughout the software development lifecycle.

Works with senior leadership to improve cybersecurity engineering process efficiency.  Works with global internal and external staff to identify cybersecurity coverage needs, high-risk areas, and to improve overall software cybersecurity and robustness.

Mentors and guides junior staff, routinely provides technical input on architecture and design decisions to improve cybersecurity, while remaining a hands-on individual contributor within the development team. May supervise or direct lower-level engineers on assigned projects.

Develops and maintains technical records and detailed documentation for internal and external stakeholders, following standard practices and good documentation procedures.

 

Requirements

· Bachelor’s degree in Computer Science, Computer Engineering, Cybersecurity or related Engineering is required.

· 8+ years of experience in cybersecurity, software engineering, product security, or a related technical discipline, including experience applying cybersecurity practices to software-based products.

· Demonstrated experience applying FDA cybersecurity guidance, IEC 81001-5-1, IEC 62304, ISO 14971, and related cybersecurity standards within regulated medical device development environments.

· Experience conducting cybersecurity risk assessments and supporting risk management activities in accordance with ISO 14971.

· Experience with vulnerability assessment and management, SBOM governance, security analysis, and threat modeling is required.

· Experience supporting FDA submissions and regulatory audits is highly desired

· Experience applying cybersecurity principles to embedded medical device software and/or web applications.

· Expected to remain current with the rapidly evolving cybersecurity landscape and its applicability to medical devices.

· Experience applying cybersecurity principles to on-premises and cloud-based systems, including web applications, APIs, containerized workloads, and hybrid architectures.

· Experience in planning and execution of cybersecurity penetration testing activities.

· Experience with Static Analysis (SAST), Dynamic Analysis (DAST), and Software Composition Analysis (SCA).

· Ability to work as a collaborative team member.

· Advanced in problem solving, analytical, troubleshooting, and debugging skills.

· Strong attention to details, natural inclination to be methodical.

· Excellent in written and verbal communication skills 

• The Company’s primary business language is English. The successful candidate must be able to effectively speak, read, write, and understand English to perform the essential functions of the position, including independently understanding policies, procedures, training materials, and workplace communications written in English due to our heavily regulated work environment.

Additional Information

We offer an excellent salary and benefits package including medical, dental and vision coverage, as well as life insurance, disability, 401K with company contribution, and wellness program.

Please note that joining our team does not create a guaranteed or permanent employment arrangement. All employment is at‑will, meaning both the employee and Fresenius Kabi have the right to end the employment relationship at any time, in accordance with applicable federal and state laws.

Fresenius Kabi is an Equal Opportunity/Affirmative Action employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, national origin, citizenship, immigration status, disabilities, or protected veteran status.