Job Title: Cybersecurity Systems EngineerJob Description
The Cybersecurity Systems Engineer leads system-level cybersecurity engineering activities to design and sustain secure medical devices across a diverse product portfolio. This role owns product security architecture, system threat modeling, and the translation of regulatory and consensus standard guidance into actionable security requirements and verification evidence. Working closely with software, firmware, systems, quality, and regulatory teams, the Cybersecurity Systems Engineer ensures that products are designed, documented, and maintained to meet regulatory expectations throughout the entire product lifecycle, from initial design through post-market sustaining activities.
Responsibilities
- Define product security architecture, including trust boundaries, control objectives, and interface documentation, ensuring that security controls are clearly specified and consistently applied.
- Specify and review designs for authentication, authorization, cryptography, secure update mechanisms, event logging, and data integrity across embedded devices and connected systems.
- Lead system-level threat modeling using recognized methodologies such as STRIDE, PASTA, TARA, or MITRE ATT&CK for ICS, and allocate mitigations across hardware, firmware, and software components.
- Ensure that trust-boundary assumptions are explicit, traceable, and testable, and that they are clearly communicated to cross-functional engineering teams.
- Derive cybersecurity requirements from FDA premarket and postmarket guidance and relevant consensus standards (including IEC 62443-4-1, IEC 81001-5-1, and AAMI SW96), and define verification strategies specifying required evidence, timing, and ownership.
- Produce and maintain design-level product security documentation, including architecture views, control rationale, security requirements traceability matrices, and interface and external connection records.
- Own the engineering interface during third-party penetration testing engagements, including defining and clarifying scope, setting up test environments, leading technical Q&A, and coordinating with testers and internal teams.
- Assess the design impact of penetration testing findings, define remediation technical approaches, and support retest readiness and closure of findings.
- Define technical scope and verification approaches for post-release remediation activities, and coordinate with engineering and release functions to ensure validated deployment and complete documentation.
- Lead interoperability security assessments for device interfaces with external systems, networks, and devices, evaluating security and safety risks across normal and fault operating modes.
- Define and implement appropriate risk controls for interface trust boundaries to protect data, systems, and users in both on-premise and connected environments.
- Conduct CVE impact analysis for fielded products, assessing the applicability of newly disclosed vulnerabilities to system-level components and architecture.
- Support prioritization and remediation scoping for vulnerabilities using CVE/NVD information, CVSS-based scoring, and cybersecurity risk assessment methodologies.
- Contribute to release readiness for security-driven sustaining updates, including inputs to patch packaging, documentation updates, and design change records.
- Collaborate closely with software and firmware teams to ensure that security requirements are correctly allocated, implemented, and verified across the full system.
- Work cross-functionally with systems, software, quality, and regulatory disciplines to align on security architecture decisions and ensure consistent implementation across products.
- Own and maintain the Product Security Management Plan and associated Product Security Management File, ensuring that all required cybersecurity activities are planned, traceable, and audit-ready.
- Support the Quality Management System by participating in design reviews, engineering change order procedures, and preparation of design history file and regulatory submission artifacts related to cybersecurity.
- Stay current with evolving FDA cybersecurity guidance, NIST Cybersecurity Framework, and relevant medical device security standards, and identify implications for products, processes, and documentation.
- Translate high-level regulatory and standards-based guidance into practical, implementable product requirements for software and firmware teams.
- Set up and refine a generic cybersecurity framework that can be applied across multiple products at different lifecycle stages, including those already in the field and those nearing release.
- Establish and document security architecture and trust boundaries, and align standard operating procedures with current FDA and applicable regulatory expectations.
- Drive full lifecycle cybersecurity activities from concept and requirements through design, implementation, testing, release, and post-market sustaining updates.
- Interface effectively with a wide range of stakeholders, including executive leadership, technical teams, and external partners, to build buy-in for cybersecurity initiatives and frameworks.
Essential Skills
- Bachelors degree in Systems Engineering, Electrical Engineering, Computer Engineering, or a related technical discipline.
- 5+ years of experience in systems engineering, product security engineering, or a related field, with at least 3 years focused specifically on cybersecurity for connected or regulated products.
- Demonstrated experience taking high-level regulatory or standards guidance and translating it into practical, actionable product security requirements.
- Hands-on experience applying security controls in a regulated environment and working with external regulators or regulatory frameworks in industries such as medical devices, aerospace, marine, automotive, or nuclear.
- Demonstrated experience with system-level threat modeling methodologies such as STRIDE, PASTA, or TARA as defined in IEC 81001-5-1 and AAMI SW96.
- Working knowledge of medical device cybersecurity regulatory requirements, including FDA premarket and postmarket cybersecurity guidance, IEC 81001-5-1, AAMI SW96, and IEC 62443-4-1.
- Experience defining security requirements and producing verification evidence in a regulated product development environment, preferably within an FDA QSR or ISO 13485 quality management system.
- Experience with CVE and NVD triage and vulnerability impact assessment at the system level, including use of CVSS-based vulnerability scoring and cybersecurity risk assessment methodologies.
- Experience supporting or managing third-party penetration testing engagements, including scoping, environment setup, findings triage, and remediation planning.
- Working knowledge of networking fundamentals, including ports, protocols, and firewalls, and OS-level security concepts across Linux and/or Windows environments relevant to connected medical devices.
- Product development experience with embedded devices, including collaboration with firmware and software teams throughout the lifecycle.
- Strong experience interfacing with software and firmware engineering teams to define, implement, and verify security requirements.
- Strong written communication skills with the ability to produce clear, concise, and audit-ready technical documentation.
- Strong verbal communication and stakeholder management skills, with the ability to communicate effectively with both executive and technical audiences.
- Minimum of 5 years of relevant professional experience in cybersecurity, systems engineering, or related disciplines.
Additional Skills & Qualifications
- Relevant security certifications such as CISSP, CISM, CEH, CompTIA Security+, or equivalent are preferred, and candidates with equivalent demonstrated experience will be considered.
- Familiarity with SBOM concepts and supply chain security considerations for medical devices is an asset.
- Experience working as a software or firmware developer is highly beneficial for understanding implementation constraints and collaborating with development teams.
- Experience with requirements management tools such as Jama is a plus.
- Experience with work tracking and collaboration tools such as Jira is a plus.
- Familiarity with CVE scanning tools and associated workflows is beneficial.
- Experience in other regulated industries such as aerospace, marine, automotive, or nuclear can be advantageous for understanding regulatory expectations and risk management practices.
- Ability to create organizational buy-in for cybersecurity frameworks and to advocate for best practices across multiple product teams.
- Demonstrated ability to work independently in a highly cross-functional environment and to manage multiple concurrent security initiatives.
Work Environment
This role is based on-site in Burnaby and supports a global medical device organization with a strong and stable presence in the healthcare industry. The work environment centers on the development and sustaining engineering of medical devices, including embedded systems, connected devices, and associated software. You will collaborate closely with R&D, software, firmware, systems, quality, and regulatory teams in a setting that emphasizes high-quality, enduring products that deliver clinical and economic value. The organization operates within a regulated quality management system, leveraging tools such as requirements management platforms and issue-tracking systems to manage documentation, design history, and change control. The business environment is steady and resilient compared to many consumer technology sectors, with consistent growth driven by successful FDA-approved products and expansion into new facilities. The culture values collaboration, clear communication, and long-term retention, and many employees enjoy strong relationships with colleagues and leadership. The company is widely recognized as a market leader in key product areas, and team members often describe a meaningful sense of purpose in contributing to medical technologies that improve patient care.
Job Type & Location
This is a Permanent position based out of Burnaby, BC.
Pay And Benefits
The pay range for this position is $125000.00 - $193400.00/yr.
Individual compensation offered for this position within this range will depend on many factors, including qualifications, skills, relevant experience, job knowledge, geographic location, internal equity, and other pertinent job-related factors.
Job Type & Location
This is a Permanent position based out of Burnaby, BC.
Workplace Type
This is a fully onsite position in Burnaby,BC.
À propos d'Actalent
Actalent est un leader mondial dans les services dingénierie et de sciences ainsi que dans les solutions de talents. Nous aidons des entreprises visionnaires à faire progresser leurs initiatives dingénierie et de science grâce à laccès à des experts spécialisés qui favorisent léchelle, linnovation et la rapidité de mise sur le marché. Avec un réseau de près de 20 000 consultants et 5 000 clients à travers les États-Unis, le Canada, lAsie et lEurope, Actalent dessert de nombreuses entreprises du Fortune 500. Nous sommes fiers dêtre lune des 500 meilleures firmes de conception de lEngineering News-Record (ENR) pour nos services de conception en ingénierie et un lauréat du prix ClearlyRated Best of Staffing® tant pour le service client que pour les talents.
Actalent est un employeur souscrivant au principe de légalité des chances et accepte toutes les candidatures sans tenir compte de la race, du sexe, de lâge, de la couleur, de la religion, des origines nationales, du statut dancien combattant, dun handicap, de lorientation sexuelle, de lidentité sexuelle, des renseignements génétiques ou de toute autre caractéristique protégée par la loi.
Si vous souhaitez faire une demande daccommodement raisonnable, tel que la modification ou lajustement du processus de demande demploi ou dentrevue à cause dun handicap, veuillez envoyer un courriel à actalentaccommodation@actalentservices.com pour connaître dautres options daccommodement.
Ordonnance sur légalité des chances de San Francisco: Conformément à lOrdonnance sur légalité des chances de San Francisco, pour tous les postes situés dans la ville et le comté de San Francisco, nous examinerons les candidatures des personnes qualifiées ayant un casier judiciaire ou des antécédents criminels.
Utilisation de lintelligence artificielle (IA): Nous pouvons utiliser lintelligence artificielle (IA) pour soutenir certaines étapes de notre processus dembauche, notamment la recherche, la présélection et lévaluation des candidatures. LIA aide à analyser les candidatures et les qualifications, mais les décisions finales sont prises par notre équipe de recrutement. En soumettant votre candidature, vous reconnaissez et acceptez que celle-ci puisse être examinée à laide doutils dIA.
About Actalent
Actalent is a global leader in engineering and sciences services and talent solutions. We help visionary companies advance their engineering and science initiatives through access to specialized experts who drive scale, innovation and speed to market. With a network of almost 20,000 consultants and 5,000 clients across the U.S., Canada, Asia and Europe, Actalent serves many of the Fortune 500. We are proud to be an Engineering News-Record (ENR) Top 500 Design Firm for our engineering design services and a ClearlyRated Best of Staffing® winner for both client and talent service.
The company is an equal opportunity employer and will consider all applications without regard to race, sex, age, color, religion, national origin, veteran status, disability, sexual orientation, gender identity, genetic information or any characteristic protected by law.
If you would like to request a reasonable accommodation, such as the modification or adjustment of the job application process or interviewing process due to a disability, please email actalentaccommodation@actalentservices.com for other accommodation options.
San Francisco Fair Chance Ordinance: Pursuant to the San Francisco Fair Chance Ordinance, for all positions located in the city and county of San Francisco, we will consider for employment qualified applicants with arrest and conviction records.
Use of Artificial Intelligence (AI):We may use Artificial Intelligence (AI) to support parts of our hiring process, including sourcing, screening, and evaluating candidates. AI helps assess applications and qualifications, but final decisions are made by our hiring team. By applying, you acknowledge and agree that your application may be reviewed using AI tools.
