Blue Goat Cyber^SMMedical Device Cybersecurity

⌘K

Careers

Apply: Sales Engineer, Medical Device Cybersecurity

Set aside 20 to 30 minutes. This is a long application on purpose, and a real person reads every one.

Before you start

This takes 20 to 30 minutes and asks you to do a small piece of real work. That is deliberate. We would rather read fifty considered applications than five hundred generic ones, and the questions below are the ones a resume cannot answer.

Draft it somewhere else if you prefer. The page does not save as you go.

Role

About you

Full name *

Email *

Phone

Location

LinkedIn, GitHub, or portfolio links

Resume (PDF, Word, or text, up to 10 MB)

Optional, but it helps. You can also paste a link above instead.

Video link

Paste a link to a 90 second video telling us why you are a fit. Unlisted YouTube, Loom, Google Drive, anything we can open. A phone camera is fine and we are not judging production quality. Optional, but it is the fastest way to stand out.

The work

Answer these in your own words. We are reading for how you think, not for length, and a generic answer is worse than a short one.

Why this role fits you *

Scenario one *

A prospect asks for a fixed price before telling you anything about the device. What do you ask them, and how do you explain why scope drives the number?

Scenario two *

A prospect insists an automated vulnerability scan is equivalent to what we do, and they have a quote for a tenth of our price. Answer them without disparaging the other vendor and without overselling us.

Scope it *

A prospect describes a wearable with a Bluetooth link, a phone app, and a cloud backend, heading into a 510(k) next spring. List the questions you need answered before you can scope it, then say which single answer moves the price the most and why.

Specifics *

What have you personally scoped or sold that involved a regulated product? Tell us what you got wrong on the first estimate and what you changed as a result.

Quick questions

Ten of them, a few minutes at most. Pick the best answer. We are not testing trivia, and getting a few wrong will not disqualify you.

1. Scope on a device penetration test is driven most by:

The number and type of interfaces and the depth of testing requiredThe client's stated budgetThe size of the manufacturerHow close the submission deadline is

2. Cybersecurity content in a 510(k) for a cyber device generally requires:

A penetration test report onlyA CE mark and an EU technical fileA threat model, security risk assessment, SBOM, and testing evidenceClinical trial data

3. When a prospect asks for something we cannot deliver well, the right move is:

Take the work and figure it out during deliverySay so plainly and propose what we can do insteadQuote high enough that they declineRefer them elsewhere without explaining why

4. The fastest way to get a scope wrong is:

Asking too many questionsInvolving a testerDocumenting assumptionsCounting interfaces without asking how deep the testing goes

5. A device with a phone app and a cloud backend means the scope should cover:

The device firmware onlyDevice, app, backend APIs, and the trust relationships between themThe app store listingThe cloud provider's own infrastructure

6. An automated scan differs from our work mainly because a scan:

Runs fasterCosts moreCannot reason about patient harm or chain findings into an attack pathRequires physical access

7. An assumption in a proposal exists to:

State what the price depends on so a change is visible to both sidesMake the number look lowerSatisfy legal reviewFill a template section

8. A prospect needs testing in two weeks and their device is not built. The right answer is:

Book it anywayQuote double for the rushDecline without explanationExplain what can be done now against the design and what has to wait for hardware

9. Which detail changes the price the most on a typical engagement?

The client's locationThe report formatThe number of distinct interfaces and whether firmware extraction is in scopeThe billing terms

10. During discovery, the most valuable thing you can capture is:

Their budget numberThe intended use and environment of the deviceTheir current vendorTheir headcount

Detail check *

Who does this role report to? The answer is on the job posting.

How you used AI on this application *

We use AI every day and we expect you to. Tell us honestly how you used it on this application: which tool, on which parts, and what you changed afterwards. "I did not use it" is a completely fine answer. What we cannot work with is a no when the writing says otherwise.

Something unique about you

Tell us something unique about you that will not show up anywhere else in this application. A hobby that got out of hand, something you build or collect or compete in, a language, a detour in your career, an unpopular opinion about our industry. Or, if you have an idea for how we should be working, tell us that instead. Optional, and there is no right answer.

Prefer email? Write to careers@bluegoatcyber.com.

We use what you send here only to evaluate you for this and future roles. We do not sell or share it.