Cyber Security Engineer

Verathon is a global medical device company focused on supporting customers by being their trusted partner, delivering high-quality products that endure over time and ensure clinical and economic utility. Two areas where Verathon has significantly impacted patient care, and become the market leader in each, are bladder volume measurement and airway management. The company’s Bladder Scan portable ultrasound and Glide Scope video laryngoscopy & bronchoscopy systems effectively address unmet needs for healthcare providers and meaningfully raise the standard of care for patients.

Verathon, a subsidiary of Roper Technologies, is headquartered in Bothell, Washington, USA and has international subsidiaries in Canada, Europe and Asia Pacific. For more information, please visit

The Cybersecurity Engineer is responsible for leading the system-level cybersecurity engineering activities required to design and sustain secure medical devices across Verathon's product portfolio. This role is the primary owner of product security architecture, system threat modeling, and the translation of FDA and consensus standards guidance into actionable security requirements and verification evidence. Working closely with Software Engineering, Quality, and Regulatory teams, the Cybersecurity Systems Engineer ensures that Verathon's products are designed and documented to satisfy regulatory expectations throughout the product lifecycle, from initial design through post-market sustaining activities.

• Define product security architecture, including trust boundaries, control objectives, and interface documentation; specify and review designs for authentication, authorization, cryptography, secure update mechanisms, event logging, data integrity, and system hardening
• Lead system-level threat modeling (e.g., STRIDE / MITRE ATT&CK for IC) and allocate mitigations across hardware, firmware, and software; ensure trust-boundary assumptions are explicit, traceable, and testable
• Derive cybersecurity requirements from FDA guidance and consensus standards (IEC 62443, IEC 81001-5-1, AAMI SW96); define verification strategies specifying required evidence, timing, and ownership
• Produce and maintain design-level product security documentation including architecture views, control rationale, security requirements traceability matrices, and interface/external connection records
• Own the engineering interface during penetration testing engagements: lead scope clarification, environment setup, and technical Q&A; assess design impact of findings; define remediation technical approach and support retest readiness
• When post-release remediation is required, define technical scope and verification approach; coordinate with engineering and release functions to ensure validated deployment and documentation closure
• Lead interoperability security assessments for device interfaces with external systems, networks, and devices; evaluate security and safety risks across normal and fault operating modes and define appropriate risk controls for interface trust boundaries
• Conduct CVE impact analysis for fielded products; assess applicability of newly disclosed vulnerabilities to system-level components and architecture; support prioritization and remediation scoping
• Contribute to release readiness for security-driven sustaining updates, including inputs to patch packaging, documentation updates, and design change records
• Collaborate with the Software to ensure security requirements are correctly allocated and verification evidence is complete across the system
• Work cross-functionally across Systems, Software, Quality, and Regulatory disciplines to align on security architecture decisions and ensure consistent implementation
• Own and maintain the Product Security Management Plan and associated Product Security Management File, ensuring all required cybersecurity activities are planned, traceable, and audit-ready
• Support Verathon's Quality Management System (QMS), including participation in design reviews, ECO procedures, and DHF/regulatory submission artifact preparation
• Stay current with evolving FDA cybersecurity guidance, NIST CSF, and relevant…