Open role

Senior Regulatory Affairs Technical Writer (Medical Device Cybersecurity)

Lead the cybersecurity documentation for 510(k), De Novo, and PMA submissions, turning complex device, regulatory, and security material into clear, submission-ready work, and raise the bar for the writers around you.

All open roles

Reports to: VP, Regulatory Affairs & Compliance
Status: Full-time employee
Location: Remote (United States), minimal travel
Compensation: Competitive, commensurate with experience, paid every two weeks, plus benefits including health, dental, vision, 401(k), and an educational allowance
Equipment: Bring your own laptop and setup, and we cover the project-specific hardware and lab gear the work needs

The job in 30 seconds

You own the cybersecurity documents in FDA submissions, from threat model write-ups to security risk assessments.
Senior: you lead documentation on client projects and review other writers' drafts.
Fully remote in the US, full time, with health, dental, vision, 401(k), and 10 paid holidays.

About the role

An FDA reviewer reads your documents and decides whether a connected medical device is safe enough to reach patients. We are looking for a Senior Regulatory Affairs Technical Writer who can turn complex medical device, regulatory, and cybersecurity information into clear, structured, submission-ready documentation. This role supports medical device manufacturers by drafting and coordinating cybersecurity documentation for 510(k) and other premarket submissions, while keeping architecture, risk, controls, testing evidence, and regulatory expectations aligned.

This role is ideal for someone who understands medical devices and regulatory affairs, writes exceptionally well, learns quickly, and can confidently work with clients and internal technical teams. You will work from Blue Goat Cyber templates and methodology, review client source material, identify gaps early, and produce accurate documentation aligned with current FDA guidance.

This is a senior role. You will own submission documentation sets end to end, act as the documentation lead on client projects, review other writers' drafts, and help shape the templates and methodology the whole team uses.

This is a full-time employee role requiring strong written and verbal communication, independent ownership, attention to detail, and the ability to manage multiple documents and client projects at once. You must be available for weekly internal meetings and client meetings as scheduled.

You are a fit if

In plain terms

You have read an FDA deficiency letter and could explain, line by line, which document failed and why.
You notice when the architecture diagram, the threat model, and the SBOM disagree, and you cannot leave it alone.
You would rather ask an engineer an awkward question today than guess and have a reviewer catch it in three months.
You edit your own work hard enough that the next reader finds nothing to fix.

What you will own

Regulatory documentation and writing

Draft cybersecurity sections of 510(k) and other premarket submissions for client medical device manufacturers.
Produce threat models, cybersecurity risk assessments, security architecture views, SBOM and third-party component documentation, unresolved anomaly assessments, cybersecurity management plans, and security labeling content.
Work from Blue Goat Cyber templates and methodology so output is consistent across clients and reviewers.
Maintain traceability across the documentation set so architecture, risk, controls, and testing evidence align.

Source material review and analysis

Review architecture views, data flow diagrams, user manuals, design documents, SBOM exports, and test reports and extract what the submission needs.
Identify gaps, contradictions, and missing details early and build a focused list of client questions.
Apply FDA cybersecurity guidance and Blue Goat Cyber methodology consistently, including risk scoring and acceptability calls.
Understand the boundary of the cybersecurity scope and remain within it unless there is a reason to raise it.

Client communication and collaboration

Attend kickoff calls, working sessions, and debriefs and answer client questions with confidence and clarity.
Communicate proactively with clients and internal teams through Slack, email, and Asana.
Flag concerns, risks, and gaps constructively and provide a recommendation.
Follow up on outstanding information so projects do not stall.
Partner with penetration testers, regulatory leads, and project managers so documentation and testing evidence remain aligned.

Leadership and review

Act as documentation lead on client projects and set the structure for each submission set.
Review and edit other writers' drafts before delivery and give feedback that sticks.
Own improvements to our templates and methodology as FDA guidance and reviewer expectations change.
Help draft responses to FDA cybersecurity deficiency questions with the regulatory lead.

Project execution and quality

Carry multiple documents and client projects simultaneously and meet committed dates.
Keep Asana current so project status is visible without anyone having to ask.
Raise blockers and timeline risks early with a suggested solution.
Self-review all work for grammar, structure, formatting, technical accuracy, and internal consistency before handoff.
Stay current on FDA cybersecurity guidance and relevant standards as they change.

A day in the life

A typical day, so you can picture the work.

Morning: Check Slack and Asana, then read a client's new architecture diagram and SBOM export. The diagram shows a cloud service the threat model never mentions, so you write it up as a focused client question.
Late morning: Lead a working session with a client's engineering team. You walk them through the open questions and agree on dates for the missing details.
Afternoon: Draft the security risk assessment for a different device, making sure every threat traces to a control and every control traces to test evidence from our pen testers.
Late afternoon: Review a teammate's draft architecture views, flag two places where they disagree with the threat model, and update Asana so the project lead can see status without asking.

Required skills and experience

5+ years of regulatory or technical writing, including at least 2 years writing for medical device premarket submissions (510(k), De Novo, or PMA).
A track record of owning submission documentation sets end to end, not just contributing sections.
Experience reviewing and editing other writers' work for accuracy, consistency, and traceability.
Strong written communication; clear, organized, technically accurate writing is core to this role.
Strong verbal communication and professional presence on client calls.
Fast learner with the aptitude to pick up new regulatory and technical material quickly and apply it.
Comfort working at pace with a high volume of documents and multiple client projects.
Ability to work independently in a remote, distributed team.

Preferred experience

Regulatory affairs education or credential such as RAC, plus hands-on submission experience.
Familiarity with FDA cybersecurity guidance, ISO 13485, ISO 14971, IEC 62304, IEC 81001-5-1, and AAMI TIR57 or ANSI/AAMI SW96.
Experience responding to FDA additional information requests or deficiency letters on cybersecurity.
Software or cybersecurity background.
Medical device project or product management experience combined with a genuine interest in regulatory writing.

Your first 90 days

What success looks like early on, so you know what you are walking into.

1
First 30 days
- Work through our templates, methodology, and risk scoring approach with the regulatory lead.
- Join two live client projects and take over drafting of major sections right away.
- Read the current FDA premarket cybersecurity guidance and our internal mapping of it to each deliverable.
2
Days 30 to 60
- Own the cybersecurity documentation for your first client project end to end, with review before delivery.
- Run your own source material review and build the client question list without prompting.
- Join client working sessions and answer scope questions directly.
3
Days 60 to 90
- Carry a steady portfolio of concurrent documentation projects and hit committed dates.
- Deliver drafts that need editing, not rewriting, and keep traceability clean across the set.
- Bring at least one template or process improvement forward from what you saw in practice.
- Start reviewing other writers' drafts before they go to clients.

Tools we use

Google Workspace
Microsoft Word and Excel
Slack
Asana
FDA guidance documents and recognized consensus standards
FIRST.org CVSS calculator
SBOM outputs from tools such as FOSSA and Snyk
Penetration test reports and supporting evidence

About Blue Goat Cyber

Blue Goat Cyber is a medical device cybersecurity company dedicated to protecting patient lives by securing the technologies that power modern healthcare. We support medical device manufacturers as they build, test, and launch secure devices that meet FDA expectations and operate safely in the real world.

We are a remote, high-trust, high-ownership team that values clear communication, rigorous thinking, proactive problem solving, continuous learning, and attention to critical details. We expect every team member to own their work, communicate clearly, and support the mission without ego.

Before you apply

The terms every person here works under. Read them now rather than at offer stage, along with our core values and the honest list of who this is not for. See also what excellence looks like here, the eight standards we hire against.

Work authorization

You must be authorized to work in the United States. We do not sponsor visas for these roles.
All roles are performed from within the United States.

Confidentiality and NDA

You will sign a mutual nondisclosure agreement before you see any client material, and client-specific NDAs where a client requires one.
You will see unreleased device designs, firmware, source code, vulnerabilities, and submission content. None of it is yours to discuss, publish, screenshot, or reference, during or after the engagement.
Client material stays in company systems. No personal cloud storage, personal email, personal repositories, or unvetted AI tools.
Anything we publish that draws on client work is anonymized and cleared with the client first.

How we expect you to use AI

Use AI every day if it helps, on the company ChatGPT and Claude accounts we provide, and keep client material inside them: firmware, source code, submission documents, findings, and client names never go anywhere else.
You own the accuracy of anything you send out, because models get recognition numbers, clause references, and test conclusions wrong in ways that read perfectly well. The full policy is in the careers FAQ.

Security and background

Offers are contingent on a background check and on reference checks.
You will use company-required security controls on any device that touches client data, including full-disk encryption, screen lock, and our password manager and multi-factor authentication.
Report a suspected compromise or data exposure immediately. We treat honest, fast reporting as the right behavior, not a fault.
Some client engagements require additional screening or training before you can be assigned.

Equal opportunity

Blue Goat Cyber is an equal opportunity employer. We do not discriminate on the basis of race, color, religion, sex, sexual orientation, gender identity, national origin, age, disability, veteran status, or any other protected characteristic.
If you need an accommodation at any point in the hiring process, tell us and we will arrange it.

Apply

Send your resume, any links to your work, and a short note about why this role fits. It takes a few minutes and a real person on our team reads every application.

Apply for this role Or apply by email

If you do not hear back within two weeks, we have decided not to move forward for now. We keep applications on file for future openings.