Principal Engineer, S/W QA Cyber Security

Overview

Senior individual contributor and subject matter expert providing independent Quality oversight and technical leadership for product cybersecurity activities across the medical-device product lifecycle.

What you'll do

• Serve as the Quality subject matter expert for product cybersecurity activities across new product development, sustaining engineering, product changes, remediation, and integration programs.
• Provide independent Quality review and approval of cybersecurity plans, assessments, reports, and other lifecycle deliverables in accordance with applicable Quality System requirements.
• Review cybersecurity risk analyses, threat models, security architectures, attack-surface assessments, and risk-control strategies for completeness, consistency, technical adequacy, and traceability.
• Ensure cybersecurity risks, requirements, controls, and verification evidence are appropriately connected across design controls, software lifecycle documentation, system requirements, and product risk-management files.
• Review Software Bills of Materials, MDS2 documentation, cybersecurity reports, penetration-test results, static and dynamic analysis results, vulnerability assessments, and security verification evidence.
• Assess the cybersecurity quality impact of design changes, software changes, third-party software updates, operating-system changes, supplier changes, and other product lifecycle changes.
• Provide Quality oversight for cybersecurity verification and validation strategies, including acceptance criteria, test coverage, traceability, anomaly handling, and objective evidence.
• Support product vulnerability assessments and Post-Market Vulnerability Reviews, including evaluation of potential safety, quality, compliance, and product-security impacts.
• Support post-market cybersecurity investigations, remediation plans, corrective actions, and escalation activities, as applicable.
• Partner with Global Product Cybersecurity and project teams to interpret and consistently apply internal cybersecurity procedures, work instructions, standards, and regulatory expectations.
• Support cybersecurity content needed for regulatory submissions, notified-body reviews, internal audits, external inspections, and responses to regulatory questions.
• Identify Quality and compliance gaps, communicate risks clearly, and influence appropriate mitigation and escalation decisions.
• Lead complex cybersecurity quality initiatives that may span multiple projects, product families, divisions, or geographic locations.
• Develop and improve cybersecurity quality review methods, templates, checklists, playbooks, metrics, and reusable knowledge assets.
• Monitor cybersecurity quality trends and recommend process, training, governance, or capability improvements.
• Mentor engineers and cross-functional team members in cybersecurity risk management, design controls, documentation quality, and lifecycle expectations.
• Support development of independent cybersecurity subject matter experts and help establish a sustainable cybersecurity Quality capability.
• Represent Cybersecurity Quality in technical reviews, governance forums, communities of practice, and cross-functional decision-making bodies.
• Maintain current knowledge of evolving medical-device cybersecurity regulations, standards, guidance, technologies, threats, and industry practices.
• Perform other related duties as assigned.

What you'll need

• Bachelor's degree in Cybersecurity, Computer Science, Software Engineering, Information Technology, or a related technical discipline.
• Significant professional experience in cybersecurity, software quality, design assurance, product security, systems engineering, software engineering, or another relevant technical field.
• Experience working with software-enabled products in a regulated product-development environment.
• Demonstrated experience with cybersecurity risk assessment, threat modelling, vulnerability evaluation, security requirements, or secure product-development practices.
• Working knowledge of software development lifecycle and design-control principles.
• Experience reviewing complex technical documentation and determining whether evidence is complete, traceable, technically sound, and compliant.
• Demonstrated ability to lead complex technical work independently and make risk-based recommendations.
• Demonstrated ability to influence decisions across functions and organizational levels without direct reporting authority.
• Strong written and verbal communication skills, including the ability to communicate complex cybersecurity risks to both technical and non-technical stakeholders.
• Strong analytical, problem-solving, facilitation, and stakeholder-management skills.
• Ability to manage multiple priorities and operate effectively within a global, cross-functional, and matrixed organization.

Nice to have

• Advanced degree in Cybersecurity, Computer Science, Software Engineering, Systems Engineering, or a related discipline.
• Experience in the medical-device, healthcare technology, pharmaceutical, aerospace, automotive, or another safety-critical regulated industry.
• Experience with medical-device cybersecurity, software quality assurance, design assurance, or product-security quality oversight.
• Knowledge of medical-device design controls, software lifecycle processes, and product risk management.
• Experience with threat modelling, security architecture review, vulnerability assessment, penetration-testing review, static application security testing, or dynamic application security testing.
• Experience reviewing SBOMs, third-party software components, open-source software, commercial software, and software supply-chain risks.
• Experience supporting post-market vulnerability reviews, cybersecurity investigations, vulnerability remediation, CAPA, or other corrective-action processes.
• Experience supporting regulatory submissions, audits, inspections, or regulatory inquiries involving cybersecurity or device software.
• Experience developing organizational processes, templates, metrics, training, or reusable cybersecurity knowledge assets.
• Experience mentoring engineers or developing technical subject matter experts.
• Professional certification such as CISSP, CSSLP, CISM, GIAC, or an equivalent cybersecurity or quality credential.

Details

• Location: Gurgaon, Haryana, India.