Careers

Apply: Regulatory Affairs Technical Writer (Medical Device Cybersecurity)

Set aside 20 to 30 minutes. This is a long application on purpose, and a real person reads every one.

Before you start

This takes 20 to 30 minutes and asks you to do a small piece of real work. That is deliberate. We would rather read fifty considered applications than five hundred generic ones, and the questions below are the ones a resume cannot answer.

Draft it somewhere else if you prefer. The page does not save as you go.

Role

About you

Full name *

Email *

Phone

Location

LinkedIn, GitHub, or portfolio links

Resume (PDF, Word, or text, up to 10 MB)

Optional, but it helps. You can also paste a link above instead.

Video link

Paste a link to a 90 second video telling us why you are a fit. Unlisted YouTube, Loom, Google Drive, anything we can open. A phone camera is fine and we are not judging production quality. Optional, but it is the fastest way to stand out.

The work

Answer these in your own words. We are reading for how you think, not for length, and a generic answer is worse than a short one.

Why this role fits you *

Scenario one *

A submission document cites a standard by the wrong recognition number. Walk us through how you would catch that before it leaves the company, and what you would check it against.

Scenario two *

A client sends you a threat model for an AI-enabled device and it contains no threats specific to the model itself. The submission is due Friday. What do you flag, and how do you say it to them?

Fix this sentence *

Here is a sentence from a draft submission: "Our device is fully compliant with FDA cybersecurity regulations and conforms to AAMI TIR57." Rewrite it so it is accurate and defensible, then tell us in one line what was wrong with the original.

Specifics *

Name the document types you have personally written or edited for a regulatory submission, and roughly how many of each. If you have never worked on a submission, tell us the closest thing you have done and what made it similar.

Editing test

This is the part of the job you would do every week. Below is a made up section from a made up submission for a made up pump. Some of the statements are fine. Some of them would come back from a reviewer, or would be a claim we cannot defend. Tick every statement you would not let go out as written, then explain the three worst ones in your own words. There is no trick with the count. Fifteen minutes is plenty, and we would rather see your own judgment than a polished answer.

Cybersecurity section, Model TX-4 wireless infusion pump (fictional)

1. The TX-4 is a Class II networked infusion pump with wireless connectivity. Because it is not Class III, it is not a cyber device and Section 524B does not apply.2. The device is FDA certified to AAMI TIR57.3. An SBOM is provided so that known vulnerabilities in third party components can be tracked across the supported life of the device.4. The SBOM requirement is imposed by Section 301(q) of the Federal Food, Drug, and Cosmetic Act.5. Design controls for this device follow ISO 13485 clause 7.3 as incorporated by the QMSR.6. The threat model is a standalone deliverable and is not cross referenced to the security risk assessment or to the security requirements.7. Two residual risks could not be eliminated by design, so they were removed from the risk file once the scores were lowered.8. Testing achieved 100% coverage of the attack surface and confirmed that no vulnerabilities are present.9. Where the cited source did not support the sentence, the sentence was narrowed to match the source.10. The manufacturer will issue patches as needed.

The three worst ones *

Pick the three you consider worst and explain each in a sentence or two: what is wrong, and what you would write instead. Cite the source you would check. If you are not sure of a citation, say so rather than guessing.

Quick questions

Ten of them, a few minutes at most. Pick the best answer. We are not testing trivia, and getting a few wrong will not disqualify you.

1. What is an SBOM used for in a premarket submission?

Listing the software components in the device so known vulnerabilities can be trackedProving the device passed penetration testingDocumenting clinical trial resultsRecording the serial numbers of manufactured units

2. Section 524B of the FD&C Act applies to:

Every medical deviceClass III devices onlyCyber devices as defined in the statuteDevices marketed outside the United States only

3. A Technical Information Report such as AAMI TIR57 is:

A regulation the FDA enforces directlyA consensus report you cite as method, not something you certify toA required section of every 510(k)An international treaty on device safety

4. Under Section 524B, the SBOM requirement comes from:

Section 301(q)21 CFR Part 11The Quality System RegulationSection 524B(b)(1)

5. A 'cyber device' under the statute is one that, among other criteria:

Contains any electronic componentIncludes software and is able to connect to the internetIs Class II or higherIs sold outside a hospital

6. Design control requirements for a device manufacturer today live in:

21 CFR 820.3021 CFR 11.10ISO 13485 clause 7.3, incorporated by the QMSRAAMI TIR57

7. A threat model in a premarket package should be traceable to:

The security risk assessment and the security requirementsThe marketing claimsThe clinical evaluation reportThe manufacturing batch records

8. If a source says something different from what the draft claims, you:

Keep the draft wording and cite the source anywayAsk the client which they preferSoften the wording so both could be trueChange the draft to match the source, or drop the claim

9. Which statement about consensus standards is accurate?

Every recognized standard is legally bindingStandards replace the need for testing evidenceConformance to a recognized standard is voluntary and declared, not certified by the FDAA standard number never changes

10. Residual cybersecurity risk that cannot be controlled in design is normally addressed by:

Removing the risk from the fileDisclosure to the user in labeling and security documentationRaising the CVSS scoreA postmarket note only

Detail check *

Who does this role report to? The answer is on the job posting.

How you used AI on this application *

We use AI every day and we expect you to. Tell us honestly how you used it on this application: which tool, on which parts, and what you changed afterwards. "I did not use it" is a completely fine answer. What we cannot work with is a no when the writing says otherwise.

Something unique about you

Tell us something unique about you that will not show up anywhere else in this application. A hobby that got out of hand, something you build or collect or compete in, a language, a detour in your career, an unpopular opinion about our industry. Or, if you have an idea for how we should be working, tell us that instead. Optional, and there is no right answer.

Prefer email? Write to careers@bluegoatcyber.com.

We use what you send here only to evaluate you for this and future roles. We do not sell or share it.