Careers

    Apply: Medical Device Cybersecurity Sales Engineer

    Set aside 20 to 30 minutes. This is a long application on purpose, and a real person reads every one.

    Back to the role

    Before you start

    This takes 20 to 30 minutes and asks you to do a small piece of real work. That is deliberate. We would rather read fifty considered applications than five hundred generic ones, and the questions below are the ones a resume cannot answer.

    Your answers save in this browser as you type, so you can close the tab and come back. Nothing is sent to us until you press the button at the bottom.

    About you

    Optional, but it helps. You can also paste a link above instead.

    Optional. You still answer "Why this role fits you" below in a few sentences.

    Paste a link to a 90 second video telling us why you are a fit. Unlisted YouTube, Loom, Google Drive, anything we can open. A phone camera is fine and we are not judging production quality. Optional, but it is the fastest way to stand out.

    The work

    Answer these in your own words. We are reading for how you think, not for length, and a generic answer is worse than a short one.

    A prospect asks for a fixed price before telling you anything about the device. What do you ask them, and how do you explain why scope drives the number?

    A prospect insists an automated vulnerability scan is equivalent to what we do, and they have a quote for a tenth of our price. Answer them without disparaging the other vendor and without overselling us.

    A prospect describes a wearable with a Bluetooth link, a phone app, and a cloud backend, heading into a 510(k) next spring. List the questions you need answered before you can scope it, then say which single answer moves the price the most and why.

    What have you personally scoped or sold that involved a regulated product? Tell us what you got wrong on the first estimate and what you changed as a result.

    Quick questions

    Ten of them, a few minutes at most. Pick the best answer. We are not testing trivia, and getting a few wrong will not disqualify you.

    1. Scope on a device penetration test is driven most by:
    2. Cybersecurity content in a 510(k) for a cyber device generally requires:
    3. When a prospect asks for something we cannot deliver well, the right move is:
    4. The fastest way to get a scope wrong is:
    5. A device with a phone app and a cloud backend means the scope should cover:
    6. An automated scan differs from our work mainly because a scan:
    7. An assumption in a proposal exists to:
    8. A prospect needs testing in two weeks and their device is not built. The right answer is:
    9. Which detail changes the price the most on a typical engagement?
    10. During discovery, the most valuable thing you can capture is:

    Who does this role report to? The answer is on the job posting.

    We use AI every day and we expect you to. Tell us honestly how you used it on this application: which tool, on which parts, and what you changed afterwards. "I did not use it" is a completely fine answer. What we cannot work with is a no when the writing says otherwise.

    Tell us something unique about you that will not show up anywhere else in this application. A hobby that got out of hand, something you build or collect or compete in, a language, a detour in your career, an unpopular opinion about our industry. Or, if you have an idea for how we should be working, tell us that instead. Optional, and there is no right answer.

    How you work: our core values

    Patient safety comes first here, ahead of deadlines, clients and convenience. After that we hold eight standards: role competence, client and team trust, ownership, judgment under ambiguity, growth and coachability, rigor and attention to detail, proactive risk anticipation, and innovation that never trades away what we protect. These questions are how we learn whether that is how you already work.

    Give us real examples from your own work. Specific and honest beats polished.

    Standard: Patient safety comes first

    Tell us about a time you raised a safety, quality or compliance concern when it was inconvenient: it cost a deadline, annoyed a client or a boss, or you were not sure it was big enough to mention. What was it, who did you tell, and what happened? If you have never done this, tell us about the time you should have and did not.

    Standard: 3. Ownership

    Describe a gap or problem that was clearly nobody's job, which you noticed and closed. What did you do, did you ask permission first, and what changed because you were involved?

    Standard: 5. Growth and coachability

    What is the most useful critical feedback you have received? Quote it as closely as you can, tell us how it felt at the time, and tell us specifically what you do differently now.

    Standard: 4. Judgment under ambiguity

    Tell us about a decision you made without all the information you wanted. What were the two or three ways to read the situation, which did you pick and why, and in hindsight was it the right call?

    Situation 1

    Two days before a client's FDA submission you notice something in your own earlier work that might be wrong. You are about 70% sure it is minor. What do you do?

    Situation 2

    You committed to a Friday deliverable. On Wednesday you realize it will be Monday. What do you do?

    Situation 3

    A number in a report you are about to send does not match the source by a small amount. Nobody would likely notice. What do you do?

    Situation 4

    A client asks you to drop a test step to hit their launch date. The step covers a real risk. What do you do?

    Situation 5

    Your manager tells you a piece of your work missed the mark and you disagree with part of the feedback. What do you do?

    Work sample file

    Optional but strongly encouraged: attach one real piece of your work. A redacted report, test plan, project plan, proposal, scope of work, article, or a set of posts. Remove anything confidential; we never want a client's material. PDF, Word, text or image, up to 10 MB. If you skip it, tell us why in a sentence.

    Prefer email? Write to careers@bluegoatcyber.com.

    We use what you send here only to evaluate you for this and future roles. We do not sell or share it.