Software Security Expert

Xenios AG develops lifesaving technologies for extracorporeal heart and lung support systems. This position is based in Reutlingen and covers medical device cybersecurity throughout the entire product lifecycle.

• Take technical responsibility for medical device cybersecurity throughout the entire product lifecycle, from requirements analysis and threat modeling through security architecture and secure software development to security testing and regulatory approval.
• Continuously develop the medical device cybersecurity strategy and ensure it is put into practice during product development.
• Gather, analyze and specify cybersecurity requirements and support their implementation in close cooperation with software development and systems engineering.
• Carry out threat modeling and cybersecurity risk assessments, and define and assess suitable security architectures and security controls.
• Support secure software and systems development and help development teams with complex security questions.
• Plan and support the verification and validation of cybersecurity requirements and prepare suitable security testing and penetration testing plans.
• Coordinate external security and penetration testing providers, assess identified vulnerabilities and findings, and support the selection and implementation of suitable fixes.
• Create and review cybersecurity-related technical documentation and support regulatory approval procedures for the European and US markets.
• Contribute to software bills of materials (SBOM), vulnerability management and post-market cybersecurity to support product security throughout the lifecycle.
• Work closely with internal teams including software development, systems engineering, quality, risk management and regulatory affairs.
• Represent cybersecurity topics confidently and competently to internal stakeholders, auditors, notified bodies and authorities.
• Help maintain and continuously improve the secure build environment and related cybersecurity processes.

• You have completed a degree in Computer Science, Cybersecurity, Software Engineering, Electrical Engineering, Medical Engineering or a related subject, or hold a comparable qualification.
• You have several years of relevant experience in software, product or medical device cybersecurity.
• You have strong knowledge of security requirements engineering, threat modeling, cybersecurity risk management, security architecture and secure software development.
• You also have practical experience in security testing and penetration testing, as well as assessing and fixing vulnerabilities.
• You are familiar with developing safety-critical or regulated products, ideally in medical technology or a similar regulated environment.
• You know the regulatory cybersecurity requirements for medical devices in Europe and the USA.
• Ideally, you have practical experience with the EU MDR, FDA cybersecurity requirements and IEC 81001-5-1.
• You are familiar with creating and maintaining technical documentation and with audit and assessment processes.
• You work independently, systematically and with clear goals, and have strong communication and teamwork skills for working in teams across different disciplines.
• You have very good spoken and written German and English.