Blue Goat Cyber^SMMedical Device Cybersecurity

⌘K

Careers

Apply: Project Manager, Medical Device Cybersecurity

Set aside 20 to 30 minutes. This is a long application on purpose, and a real person reads every one.

Before you start

This takes 20 to 30 minutes and asks you to do a small piece of real work. That is deliberate. We would rather read fifty considered applications than five hundred generic ones, and the questions below are the ones a resume cannot answer.

Draft it somewhere else if you prefer. The page does not save as you go.

Role

About you

Full name *

Email *

Phone

Location

LinkedIn, GitHub, or portfolio links

Resume (PDF, Word, or text, up to 10 MB)

Optional, but it helps. You can also paste a link above instead.

Video link

Paste a link to a 90 second video telling us why you are a fit. Unlisted YouTube, Loom, Google Drive, anything we can open. A phone camera is fine and we are not judging production quality. Optional, but it is the fastest way to stand out.

The work

Answer these in your own words. We are reading for how you think, not for length, and a generic answer is worse than a short one.

Why this role fits you *

Scenario one *

A client goes quiet for two weeks in the middle of an engagement and the delivery date has not moved. What do you do, in order, and what do you tell the internal team?

Scenario two *

On Thursday a tester tells you the report needs another week. The client expects it Monday. What is your first move, and who hears from you and when?

Write the email *

Write the email you would send a client when a deliverable is going to be four days late and it is our fault. Under 150 words. No filler, no blame, and do not promise anything you have not confirmed.

Specifics *

How many engagements have you run concurrently at your busiest, what did you track them in, and what type of thing slipped most often? Be specific about the pattern, not the excuse.

Quick questions

Ten of them, a few minutes at most. Pick the best answer. We are not testing trivia, and getting a few wrong will not disqualify you.

1. A client asks to add two more devices halfway through an engagement. This is:

A scope change that needs documented agreement on cost and scheduleA small courtesy to absorb without commentGrounds to cancel the engagementThe tester's decision to make

2. The most useful weekly status update to a client contains:

Everything the team did this weekA single percentage complete figureWhat changed, what is at risk, and what you need from themA copy of the internal task board

3. When a delivery date is going to slip, you tell the client:

Once you have a confirmed new dateAs soon as you know the date is at riskAt the next scheduled callOnly if they ask about it

4. The most reliable early sign an engagement is slipping is:

The team says it feels busyThe task board looks fullA tester works a weekendA dependency you are waiting on from the client has no owner or date

5. A client asks for the report a week early because their submission moved up. You first:

Agree and tell the team to compressCheck what is actually complete and what would have to be cut, then present the choiceRefuse outrightEscalate to the CEO

6. Which belongs in the kickoff, not later?

The invoiceMarketing case study approvalScope, test environment, device availability, and the escalation contactThe final report template

7. A tester and a client disagree about whether a finding is valid. Your role is to:

Get the evidence and the reasoning in front of both, and keep the schedule honestDecide the technical question yourselfRemove the finding to keep the peaceWait for the report to settle it

8. Concurrent engagements are best tracked by:

Memory and email threadsA weekly all-hands discussionIndividual testers' notesA single shared view with owner, next action, and date per engagement

9. A risk log is useful only if each entry has:

A colorA percentageAn owner, an impact, and a decision dateA severity word

10. When something goes wrong and it is our fault, the client hears:

A reason it was unavoidableWhat happened, what it changes, and what we are doing nextNothing until it is fixedA discount offer first

Detail check *

Who does this role report to? The answer is on the job posting.

How you used AI on this application *

We use AI every day and we expect you to. Tell us honestly how you used it on this application: which tool, on which parts, and what you changed afterwards. "I did not use it" is a completely fine answer. What we cannot work with is a no when the writing says otherwise.

Something unique about you

Tell us something unique about you that will not show up anywhere else in this application. A hobby that got out of hand, something you build or collect or compete in, a language, a detour in your career, an unpopular opinion about our industry. Or, if you have an idea for how we should be working, tell us that instead. Optional, and there is no right answer.

Prefer email? Write to careers@bluegoatcyber.com.

We use what you send here only to evaluate you for this and future roles. We do not sell or share it.