Careers

    Apply: Senior Regulatory Affairs Technical Writer (Medical Device Cybersecurity)

    Set aside 20 to 30 minutes. This is a long application on purpose, and a real person reads every one.

    Back to the role

    Before you start

    This takes 20 to 30 minutes and asks you to do a small piece of real work. That is deliberate. We would rather read fifty considered applications than five hundred generic ones, and the questions below are the ones a resume cannot answer.

    Your answers save in this browser as you type, so you can close the tab and come back. Nothing is sent to us until you press the button at the bottom.

    About you

    Optional, but it helps. You can also paste a link above instead.

    Optional. You still answer "Why this role fits you" below in a few sentences.

    Paste a link to a 90 second video telling us why you are a fit. Unlisted YouTube, Loom, Google Drive, anything we can open. A phone camera is fine and we are not judging production quality. Optional, but it is the fastest way to stand out.

    The work

    Answer these in your own words. We are reading for how you think, not for length, and a generic answer is worse than a short one.

    A submission document cites a standard by the wrong recognition number. Walk us through how you would catch that before it leaves the company, and what you would check it against.

    A client sends you a threat model for an AI-enabled device and it contains no threats specific to the model itself. The submission is due Friday. What do you flag, and how do you say it to them?

    Here is a sentence from a draft submission: "Our device is fully compliant with FDA cybersecurity regulations and conforms to AAMI TIR57." Rewrite it so it is accurate and defensible, then tell us in one line what was wrong with the original.

    Name the document types you have personally written or edited for a regulatory submission, and roughly how many of each. If you have never worked on a submission, tell us the closest thing you have done and what made it similar.

    Editing test

    This is the part of the job you would do every week. Below is a made up section from a made up submission for a made up pump. Some of the statements are fine. Some of them would come back from a reviewer, or would be a claim we cannot defend. Tick every statement you would not let go out as written, then explain the three worst ones in your own words. There is no trick with the count. Fifteen minutes is plenty, and we would rather see your own judgment than a polished answer.

    Cybersecurity section, Model TX-4 wireless infusion pump (fictional)

    Pick the three you consider worst and explain each in a sentence or two: what is wrong, and what you would write instead. Cite the source you would check. If you are not sure of a citation, say so rather than guessing.

    Quick questions

    Ten of them, a few minutes at most. Pick the best answer. We are not testing trivia, and getting a few wrong will not disqualify you.

    1. What is an SBOM used for in a premarket submission?
    2. Section 524B of the FD&C Act applies to:
    3. A Technical Information Report such as AAMI TIR57 is:
    4. Under Section 524B, the SBOM requirement comes from:
    5. A 'cyber device' under the statute is one that, among other criteria:
    6. Design control requirements for a device manufacturer today live in:
    7. A threat model in a premarket package should be traceable to:
    8. If a source says something different from what the draft claims, you:
    9. Which statement about consensus standards is accurate?
    10. Residual cybersecurity risk that cannot be controlled in design is normally addressed by:

    Who does this role report to? The answer is on the job posting.

    We use AI every day and we expect you to. Tell us honestly how you used it on this application: which tool, on which parts, and what you changed afterwards. "I did not use it" is a completely fine answer. What we cannot work with is a no when the writing says otherwise.

    Tell us something unique about you that will not show up anywhere else in this application. A hobby that got out of hand, something you build or collect or compete in, a language, a detour in your career, an unpopular opinion about our industry. Or, if you have an idea for how we should be working, tell us that instead. Optional, and there is no right answer.

    How you work: our core values

    Patient safety comes first here, ahead of deadlines, clients and convenience. After that we hold eight standards: role competence, client and team trust, ownership, judgment under ambiguity, growth and coachability, rigor and attention to detail, proactive risk anticipation, and innovation that never trades away what we protect. These questions are how we learn whether that is how you already work.

    Give us real examples from your own work. Specific and honest beats polished.

    Standard: Patient safety comes first

    Tell us about a time you raised a safety, quality or compliance concern when it was inconvenient: it cost a deadline, annoyed a client or a boss, or you were not sure it was big enough to mention. What was it, who did you tell, and what happened? If you have never done this, tell us about the time you should have and did not.

    Standard: 3. Ownership

    Describe a gap or problem that was clearly nobody's job, which you noticed and closed. What did you do, did you ask permission first, and what changed because you were involved?

    Standard: 5. Growth and coachability

    What is the most useful critical feedback you have received? Quote it as closely as you can, tell us how it felt at the time, and tell us specifically what you do differently now.

    Standard: 4. Judgment under ambiguity

    Tell us about a decision you made without all the information you wanted. What were the two or three ways to read the situation, which did you pick and why, and in hindsight was it the right call?

    Situation 1

    Two days before a client's FDA submission you notice something in your own earlier work that might be wrong. You are about 70% sure it is minor. What do you do?

    Situation 2

    You committed to a Friday deliverable. On Wednesday you realize it will be Monday. What do you do?

    Situation 3

    A number in a report you are about to send does not match the source by a small amount. Nobody would likely notice. What do you do?

    Situation 4

    A client asks you to drop a test step to hit their launch date. The step covers a real risk. What do you do?

    Situation 5

    Your manager tells you a piece of your work missed the mark and you disagree with part of the feedback. What do you do?

    Work sample file

    Optional but strongly encouraged: attach one real piece of your work. A redacted report, test plan, project plan, proposal, scope of work, article, or a set of posts. Remove anything confidential; we never want a client's material. PDF, Word, text or image, up to 10 MB. If you skip it, tell us why in a sentence.

    Prefer email? Write to careers@bluegoatcyber.com.

    We use what you send here only to evaluate you for this and future roles. We do not sell or share it.