We are a remote, high-trust, high-ownership team securing the medical devices that modern healthcare runs on.
Blue Goat Cyber is a medical device cybersecurity company dedicated to protecting patient lives by securing the technologies that power modern healthcare. We support medical device manufacturers as they build, test, and launch secure devices that meet FDA expectations and operate safely in the real world.
We are a remote, high-trust, high-ownership team that values clear communication, rigorous thinking, proactive problem solving, continuous learning, and attention to critical details. We expect every team member to own their work, communicate clearly, and support the mission without ego.
Lead the cybersecurity documentation for 510(k), De Novo, and PMA submissions, turning complex device, regulatory, and security material into clear, submission-ready work, and raise the bar for the writers around you.
Run deep-dive penetration tests across medical devices, firmware, mobile apps, APIs, and cloud components, then translate findings into regulator-ready evidence.
Lead medical device penetration tests from scoping to debrief, mentor other testers, and run deep-dive testing across medical devices, firmware, mobile apps, APIs, and cloud components, then translate findings into regulator-ready evidence.
Run discovery calls, scope medical device cybersecurity projects accurately, and write proposals that the delivery team can actually execute.
These roles are paused. Read what the work involves, and write to careers@bluegoatcyber.com if you want to hear when one reopens.
Remote (United States), with overlap to 9 to 5 ET
Remote (United States), with regular medtech event travel
Remote (United States), occasional event travel
Real photos from conferences and team meetups, not stock images of people pointing at monitors.
No lab glamour shots, just an honest picture of the job.
Device architecture · clinical use · threats
See the whole system
Attack paths · interfaces · security controls
Find the weaknesses
Findings · evidence · manufacturer decisions
Make the work usable
Training · certifications · shared experience
Grow your expertise
A small team, all named and reachable. No layers between you and the people making decisions.
Founder & CEO
VP, Regulatory Affairs & Compliance
VP, Strategic Partnerships
VP, Sales
Director of Operations
Senior Project Manager
The same purpose, vision, and mission we hold clients to. It is the reason these roles exist.
Medical device security is patient safety.
Why we exist: so the devices people depend on can't be turned against them.
Connected medical devices that are secure by design and resilient for their entire service life.
The world we are working toward, with no end date.
By 2028, help medical device teams get 1,000 devices through FDA review with zero cybersecurity-driven rejections, and teach the industry to start cybersecurity early.
What we do daily, with a deadline: secure the devices in front of us, and through books, stages, podcasts, webinars, and mentoring, help every other team understand what cybersecurity means for their device before it costs them.
Read what we believe and who you would be working with before you apply.
How the firm started, how it grew, and the medtech-only focus that shapes every engagement.
About Blue Goat CyberThe five values we hire and promote against, with what each one looks like in practice and what it is not.
Read the valuesWhat we believe, what we promise clients, and the line we will not cross for a deadline.
Read the manifestoThe leadership team you would report to and learn from, and the people behind the research we publish.
Meet the teamFive things that describe the job before you read a single description.
Every threat model, test, and document we produce ends up in front of a regulator and, eventually, in a device attached to a person. That is the standard the work is held to.
You hold your deliverables, your dates, and your client relationships. Nobody chases you for status, and you flag risk before it becomes an escalation.
Tooling helps, but the majority of every engagement is manual work. We hire people who go past scanner output and can explain exactly why a finding matters.
Clear, structured, technically accurate writing is a core skill in every role here, not an afterthought handed to someone else.
We are distributed across the United States. We assume good faith, share what we learn, and judge work by outcomes rather than hours visible online.
These are the working standards. What we believe and why the company exists is set out in our core values and our manifesto. Read both before you apply. If you disagree with them, this is not the right company for you, and that is a useful thing to find out now.
Most cybersecurity jobs are enterprise IT jobs. If you are coming from that world, the work here is a different discipline, and the differences are the whole job.
| Enterprise IT security | Here | |
|---|---|---|
| What is at stake | Data breach, downtime, fines, reputation. | A patient. Harm is physical: a wrong dose, a missed alarm, a therapy that stops. That is the risk we are analyzing, not the record. |
| Who reads your work | An internal security team, an auditor, a compliance checklist. | An FDA reviewer, a quality system, and a manufacturer's design history file. Your writing becomes part of a regulatory submission. |
| What good looks like | Close the finding, patch the system, pass the audit. | Show the rationale. A finding with no clinical impact analysis and no traceability to a requirement and a test is not finished work here. |
| The target | Managed endpoints, cloud accounts, corporate networks. | Embedded firmware, radios, medical protocols, and devices that cannot be rebooted mid-procedure or patched on Patch Tuesday. |
| Risk framing | CVSS score, asset criticality, business impact. | ISO 14971 risk management, patient harm severity, and essential performance. A high CVSS with no patient impact may be the lower priority. |
| The deliverable | A scan report or a ticket queue. | A written argument a regulator can follow, defended months later when the deficiency letter arrives. |
Coming from enterprise IT is fine, and several people here did. What does not transfer is the assumption that finding the vulnerability is the job. Here it is the start of the job.
We would rather you rule yourself out now than six weeks into a client engagement. These are the things people most often discover too late.
There is no queue of tickets and nobody checks your progress daily. You are given an objective, a client, and a date, and you are expected to work out the rest and ask when you are stuck.
Tooling is a starting point here, not the deliverable. If manual analysis, reading firmware, and explaining why a finding matters clinically is not the part you enjoy, this will be a grind.
Every role here produces written work that a regulator or a client executive reads. If writing feels like the tax you pay for the real job, you will not enjoy this one.
We say what we know, what we tested, and what we did not. Overstating findings, coverage, or a completion date is the fastest way to not work here, and it is the one thing we do not coach through.
We are fully remote and deliberately small. Plenty of people do their best work this way and plenty do not, and the second group is not a worse engineer, just a bad match for us.
Gaps and problems that sit until someone else raises them are the pattern we screen hardest for. If you notice something that is not clearly your job, we expect you to say so.
Every commitment here has a date, and you say so before it slips, not after. People who find that uncomfortable struggle with client work.
Growth here comes from what you can own, not from a ladder. If your next step has to be a title by a fixed date, a larger company will serve you better.
No take-home projects and no ten-round gauntlet. Here is the whole process.
Fill out the application form on this site with your resume, links to your work, and a short note about why the role fits. We read every one.
A 30-minute call about your background, what you want to work on, and how we operate. Bring questions.
A deeper session with the team you would join. Expect to talk through real problems: a device you would threat model, a document you would restructure, a project you would rescue.
We go through your jobs in order, oldest first, with the same questions each time: what you were hired to do, what went well, what went badly, who you reported to, and why you left. It is the longest conversation in the process and the most useful one. We will also ask you to arrange short calls with your former managers, and we will ask them the same questions we asked you.
A call with leadership on fit, expectations, and compensation, plus the reference calls you arranged.
We move quickly once we decide. Start dates are flexible for the right person.
People ask what we mean by A players. We mean people who already work like this on several of these standards, and want to grow into the rest. This is the same bar our current team holds itself to.
Raise a safety, quality or compliance concern even when it is inconvenient, unpopular, or costs a deadline or a client conversation. For a tester that might be a finding in a device. For finance it might be a number that does not reconcile. If you are not sure it is significant enough to mention, mention it anyway. This one is not a spectrum. It is a habit, and we hire people who already have it.
Standard 1
Performs at a level others on the team learn from. Catches what others miss.
Standard 2
Clients and teammates seek this person out. Communication reduces risk instead of creating it.
Standard 3
Closes gaps that are not clearly anyone's job. Outcomes improve because this person was involved.
Standard 4
Makes the right call with incomplete information. Others check their own judgment against this person's.
Standard 5
Seeks feedback before it is offered. Adapts ahead of the role's changing needs.
Standard 6
Catches the gap in their own work before anyone else has to: the missing field, the number that does not match, the step skipped under pressure.
Standard 7
Surfaces risks before being asked to look, early enough that the fix is still cheap.
Standard 8
Finds a way to make things better for the client without compromising what they are responsible for protecting, rather than trading one for the other.
Nobody arrives at the top of all eight. Once you are here, we share the full growth guide, with a concrete first and next move for each standard. It carries no score and is not used to rank anyone.
We read applications in a specific order, and it is not the order most companies use. Knowing it up front is worth more to you than any interview tip.
Your written answers, first
The scenarios and the work sample are read before anything else, and they carry the most weight. We are looking for how you reason when the question is underspecified, not whether you reached our answer.
The work sample over the credentials
A clear paragraph of technical writing, a defensible test scope, or a well-argued risk rationale tells us more than a certification list. We have hired people with no certifications and passed on people with all of them.
Whether you read the posting
One question in the form is answered directly by the job page. Missing it is not disqualifying on its own, but paired with a low knowledge score it tells us the application went out in bulk.
Honesty about what you do not know
Every role here touches regulation, engineering and clinical risk, and nobody arrives strong in all three. Saying which one you would need to learn reads as credible. Claiming all three does not.
Where you worked
A recognizable employer does not move you forward, and an unknown one does not hold you back. We care what you personally produced there.
A polished resume
We open it, and it rarely changes the decision. It confirms dates and scope; it does not demonstrate thinking.
Using AI to write
We use it daily ourselves and we ask you to disclose it, not avoid it. What we notice is an answer with no specifics in it, which is what unedited AI output reads like.
If you are not moving forward, you will hear from us rather than hearing nothing. A real person reads every application, and no one is screened out automatically.
Every open role sits on a track with somewhere to go. Here is what growth looks like on each one, and what we pay for along the way.
You start by assembling submission evidence against a checklist and end up owning the regulatory strategy for a whole device program.
Assemble threat models, SBOMs, and test evidence into submission-ready packages. Learn Section 524B, the premarket cybersecurity guidance, and what a reviewer actually reads first.
Own full submissions end to end, draft deficiency responses, and run the internal review that catches problems before the FDA does.
Set strategy for client programs, advise on pathway and predicate decisions, and mentor analysts. Authoring guides and speaking at industry events is part of the job at this level.
You start on scoped engagements and grow into the tester we route the hardest devices to, shaping how we test a whole device class.
Run scoped tests across device firmware, wireless interfaces, mobile apps, and cloud backends. Write findings that survive an FDA reviewer reading them.
Lead multi-surface engagements, define test plans from the threat model, and take the hardware and radio work that nobody else on the bench can take.
Become the person we route a whole device class to, shape our testing methodology, review other testers' reports, and act as the technical voice with clients and reviewers.
You join as an engagement lead, keep doing hands-on testing, and grow through technical leadership and mentoring.
Set authorized scope, lead device and connected-system testing, and review findings and patient impact before client delivery.
Mentor other testers, improve test plans and evidence quality, and take ownership of complex device classes.
Lead improvements in hardware, wireless, application, and cloud testing, and help the team apply them consistently across authorized engagements.
You start by keeping engagements on schedule and grow into running how the whole delivery organization works.
Run concurrent client engagements, keep scope and schedule honest, and be the single point of contact clients trust.
Own the largest and most complex programs, improve the delivery playbook, and onboard new project managers.
Own capacity planning, delivery quality, and the systems the team runs on. This track reports into the Director of Operations and grows toward it.
You start by owning conversations and our event presence, and grow into owning how the firm goes to market.
Build pipeline with device manufacturers, own the event calendar, and turn conference presence into booked meetings and signed work.
Own the largest accounts and partner relationships, shape sponsorship and speaking strategy, and mentor the next hire on the team.
Own the go-to-market plan, the event budget, and how marketing, sales engineering, and delivery work together.
You start by scoping engagements accurately and grow into owning how we define, price, and explain the work.
Run discovery, scope engagements, and write proposals that hold up at delivery. Learn our methodology deeply enough to defend it on a call.
Own the hardest scopes, handle enterprise security questionnaires and RFPs, and tighten the scoping model with delivered-versus-scoped data.
Own how services are packaged and priced, shape new offerings with the CTO, and represent our methodology publicly.
You start by owning our channels and grow into owning how the market hears about us at all.
Own the calendar, grow LinkedIn and YouTube, and turn the team's technical work into content the industry actually reads.
Own the editorial plan across social, the blog, video, and the podcast, and run event and launch campaigns end to end.
Own demand generation, brand, and the budget behind them, working alongside business development and sales engineering.
Most of what we do is public. Read it, listen to it, and decide whether it is the work you want.
Our founder interviews device makers, regulators, and clinicians every week. It is the fastest way to hear how we think.
Listen to episodesDozens of long-form guides on FDA premarket cybersecurity, threat modeling, SBOM, and testing. This is the depth the work runs at.
Read the guidesWe speak and exhibit at medtech events including the LSI conferences in the United States and APAC.
See our eventsOur service pages describe exactly what clients receive. The roles here support that delivery directly.
Explore servicesIndustry awards for medical device cybersecurity. You would be joining the team that earned them.
Medical Device Cybersecurity Partner of the Year - 2026
MedTech World North America 2026 Awards (in collaboration with CS Lifesciences)
Medical Device Cybersecurity Solution of the Year - 2026
Medical Tech Outlook (cover story)
MedTech Service Provider Excellence Award of the Year - 2025
MedTech World Malta 2025 Awards Gala (sponsored by the Malta Medicines Authority)
Medical Device Cybersecurity Services Company of the Year - 2025
Healthcare Business Review
The questions candidates ask most. There are fuller answers on applying, the interview timeline, pay and benefits, and what the work is really like.
Use the application form. Attach your resume, add any links to your work, and tell us in a few honest paragraphs why the role fits. Do not see a role that matches? Send an open application and tell us what you do best. We keep applications on file and open roles as client demand grows.
Book a 30-minute strategy session with our team.
