Cybersecurity Risk Management Jobs in Boston, MA

Axoft is building a new class of implantable neural interface-ultra-flexible, minimally reactive, and designed to remain functional for decades inside the human brain. Our software connects that hardware to the world: acquisition firmware, embedded configuration tools, clinical monitoring applications, and the cloud infrastructure that ties them together. Every release we ship ultimately affects a patient.

We are a small, technical team building compliant medical device systems the right way: risk-driven, Agile, and grounded in the international standards that govern product development, quality systems, and medical device software globally. We are looking for someone to help own the organizational risk management infrastructure that makes that possible, with software risk as the immediate priority.

We are hiring a Design, Process, and Software Quality Risk Specialist to help own Axoft’s organizational risk management system across product design, development processes, and software. The immediate priority will be software risk, but the role is intended to support risk management more broadly across the organization as our device and quality system mature.

The ideal candidate has hands-on experience with FMEA or structured risk assessment from any regulated industry, some grounding in quality systems, and enough software literacy to engage credibly with engineers. If you have a cybersecurity engineering background and are looking to apply it to medical device safety, this role is a natural transition—we will teach you the medical device regulatory framework, and your security expertise will be immediately valuable as we establish our secure product development framework.

• Design risk assessments (dFMEA)

• Process risk assessments (pFMEA)

• Software Risk Assessment (SRA)

• Cybersecurity Risk Analysis (CRA)

• Software QMS management. Track and manage changes to software requirements and design documents.

• Phase review coordination.

• Cybersecurity threat modeling.

• Software complaint management.

• Triage anomalies for safety and cybersecurity impact, drive disposition decisions, and manage quality remediation of serious issues.

• Maintain audit-ready quality records and support regulatory inspections and internal audits of the product development process.

• Software Complaint management: Triage anomalies for safety and cybersecurity impact, drive disposition decisions, and manage quality remediation of serious issues

• Maintain audit-ready quality records and support regulatory inspections and internal audits of the product development process

• 2-4 years of direct experience conducting FMEA or another structured risk assessment methodology in medical devices, aerospace, automotive, industrial, or another regulated industry where you were responsible for identifying failure modes, evaluating severity and probability, and defining controls.

• Practical experience managing elements of a formal QMS: document control, change management, audit preparation, supplier qualification, nonconformance or CAPA handling; industry does not matter as long as you have worked inside a real quality system rather than just alongside one.

• Software literacy sufficient to read a requirements document, understand a system architecture diagram, and evaluate whether a risk control measure is implemented and tested appropriately; this can come from engineering experience, a technical degree, or a background in DevSecOps or security engineering.

• Familiarity with ISO 14971 or a closely analogous risk management framework; you understand the structure of hazard analysis and how risk control measures are documented and verified.

• Strong written communication; you can produce clear, specific, well-reasoned risk and quality documentation that stands up to regulatory scrutiny.

• Familiarity with ISO 13485 quality management systems and FDA QMSR.

• Experience withIEC 62304medical device software lifecycle processes: software safety classification, required documentation by class, and how development and verification activities trace to risk controls

• Experience withAAMI SW96,IEC 81001-5-1, or cybersecurity risk management in another regulated context

• Familiarity with CVSS or other methods of scoring security vulnerabilities.

• Experience in Threat Modeling using STRIDE

For a software-driven implantable device, the quality system and the risk management file are not bureaucratic overhead—they are the engineering artifacts that determine what gets built, what gets tested, and what the FDA will accept as evidence that the product is safe. The person in this role is directly responsible for the integrity of that record.

Your risk assessments will drive requirements, and you will work closely with smart people on a small team. Your QMS management will determine what goes into the design history file that supports our regulatory submissions. The decisions you make will affect whether the product reaches patients, and whether it does so safely.

If you want risk and quality work that has direct, traceable consequences—this is it.