Medical Device Cybersecurity Engineer

Machnet Medical Robotics (MMR), founded in 2020, is on a mission to revolutionise medical robotics. Our guiding principle is simple: innovation must improve patient outcomes, support clinicians without disrupting workflows, and empower healthcare staff rather than adding burden.

MMR is a well-funded company with long-term investors and a strong financial foundation. Our hardware and software teams have developed a fully functional medical robotic platform that has successfully completed animal trials. As we move into the next phase, we are maturing the architecture for production and scaling, with a focus on safety, reliability, manufacturability, and regulatory readiness, preparing our technology for deployment in hospitals worldwide.

About the Role

We are seeking a Medical Device Software Cybersecurity Engineer to establish and lead cybersecurity processes within our software team, in line with FDA and European medical device regulations.

This is a hands-on engineering role, not an advisory one, and it is not an IT security role. You will build the secure development processes for our medical robotic platform, integrate them into our existing IEC 62304 software lifecycle, ALM, and CI/CD pipeline, and embed them in the day-to-day work of the software team. You will own the cybersecurity aspects of software architecture and design, run SBOM and vulnerability management, and produce the cybersecurity documentation that supports our regulatory submissions.

You will report to the Software Manager and work directly with the Software Regulatory team and Software Team Leads to plan and execute the cybersecurity aspects of software development and regulatory submissions. You will also act as the software team's interface to the Head of Security and QARA for coordinated vulnerability disclosure, technical triage, and containment.

Key Responsibilities

• Define and integrate cybersecurity processes into our IEC 62304 compliant software development lifecycle, using the existing regulatory framework
• Own cybersecurity activities within the software team and act as its interface to the Head of Security and QARA for coordinated vulnerability disclosure, technical triage, and containment
• Own the cybersecurity aspects of software architecture and design at system and software item level: take the "what" from the Software Architect and Software Regulatory team and personally implement the "how" within the architecture and design processes
• Facilitate the cybersecurity part of the threat analysis and risk assessment (TARA) process, integrate it with ISO 14971 risk management, and keep the documentation stack current
• Evaluate, select, and manage SBOM and CVE tooling vendors; oversee SBOM activities and personally perform CVE risk analysis with the relevant members of the software team
• Define, maintain, and audit the SOUP and SBOM vulnerability monitoring process, including CVE triage, notifications, and SLA obligations
• Select and directly integrate cybersecurity tooling (SAST, DAST, SBOM and CVE scanning) into the existing ALM and CI/CD pipeline
• Perform software licence inventory analysis and advise the software team when a package must be replaced because of its licence terms
• Prepare and maintain the cybersecurity content of regulatory submissions, including the security risk management documentation, SBOM, and testing evidence
• Coach and mentor software team members on cybersecurity activities and processes, and take an active part in software development activities (not coding)

Who We're Looking For

• Demonstrable cybersecurity engineering background in a regulated industry (medical, automotive, industrial control, aerospace, or similar), with prior hands-on security engineering experience
• Working depth in at least one of IEC 62443, the EU Cyber Resilience Act, or FDA cybersecurity guidance
• Practical understanding of secure SDLC activities, including threat modelling, STRIDE, CVSS, secure code review, vulnerability management, SBOM tooling, and PHI/PII handling under GDPR and HIPAA, sufficient to implement security measures and train the team
• Experience integrating ISO 14971 risk management with cybersecurity risk as part of a TARA process
• Experience working within a strict SDLC in a highly regulated environment, including SAST and DAST implementation and integration of security processes with ALM and CI/CD systems
• Experience with Agile or hybrid methodologies adapted for safety critical or regulated environments
• Able to explain cybersecurity concepts to developers who do not want a lecture; this is a people-facing role as much as a technical one
• Excellent communication and collaboration skills, able to align engineering, regulatory, IT, and business stakeholders

Experience We Value

• Experience developing medical device software under IEC 62304 or similar safety critical standards
• Familiarity with FDA premarket cybersecurity guidance, including the February 2026 update, and with Section 524B requirements for cyber devices
• Familiarity with IEC 81001-5-1 and the MDCG 2019-16 guidance on cybersecurity for medical devices
• Experience with connected or networked medical devices, robotics, or other systems with patient safety or functional safety implications
• Familiarity with robotic assisted intervention systems, imaging workflows, or catheterisation lab environments
• Exposure to AI/ML security considerations such as model integrity, data poisoning, and adversarial robustness
• Experience implementing CI/CD, automated testing, and automated SBOM and CVE tooling
• Experience in fast paced startup environments, comfortable with evolving priorities and broad ownership

Why Join Us?

At MMR, you will work at the intersection of robotics, AI, and healthcare, building technology that directly impacts patient care and clinical outcomes. You will join a mission-driven, collaborative team where your technical expertise will meaningfully shape the future of medical robotics. We believe technology must serve people responsibly. Human-centred innovation, integrity, and long-term responsibility guide how we design products and how we support our team members' growth and well-being.

What We Offer

• An international, interdisciplinary team based in Central London and Zwolle, Netherlands
• A collaborative and supportive workplace culture within a growing medical device and robotics startup
• A central London office with a well-equipped prototyping and development space
• Ongoing professional development through training, workshops, and conferences
• Competitive salary package including pension contribution
• Employee wellbeing benefits, including gym membership and cycle to work scheme
• Regular team socials, office events, and Friday treats
• An inclusive environment where people are encouraged to learn, contribute, and grow professionally