Why KARL STORZ?
At KARL STORZ, we are driven by innovation and a commitment to improving patient outcomes through cutting-edge medical technology. As a global leader in endoscopy and medical imaging, we offer an environment where collaboration, technical excellence, and continuous learning are highly valued. Join a team where your cybersecurity expertise will directly contribute to the development of secure, compliant, and life-changing healthcare technologies.
Position Summary
The Application Security Engineer III serves as the technical lead for cybersecurity compliance and secure product development initiatives, with primary responsibility for achieving and maintaining Department of Defense (DoD) Authorization to Operate (ATO) certifications under the Risk Management Framework (RMF). This role partners closely with Software Engineering, Systems Engineering, Quality, Regulatory, and Product Management teams to ensure products meet cybersecurity requirements throughout the development lifecycle.
Key Responsibilities
DoD RMF & ATO Leadership
- Lead and maintain DoD Authorization to Operate (ATO) certifications.
- Serve as the primary cybersecurity contact for DoD-related projects.
- Manage RMF compliance activities, including STIG and SCAP scanning, POA&M management, and risk mitigation planning.
- Author and maintain cybersecurity documentation, risk analyses, and compliance reports.
- Support certification audits, renewals, and customer-facing cybersecurity reviews.
Product Security & Verification
- Verify cybersecurity requirements through testing, documentation, and validation activities.
- Partner with engineering teams to implement secure development practices.
- Support threat modeling, vulnerability management, and security testing throughout the SDLC.
- Participate in product security reviews and provide risk mitigation recommendations.
DevSecOps & Security Operations
- Design and maintain DevSecOps pipelines with automated security testing and vulnerability scanning.
- Support secure CI/CD practices and compliance monitoring.
- Establish and maintain cybersecurity lab environments and test infrastructure.
Cross-Functional Collaboration
- Collaborate with R&D, Quality, Regulatory, IT, Operations, and Product Management teams.
- Communicate cybersecurity risks, requirements, and recommendations to technical and non-technical stakeholders.
- Participate in customer meetings, technical reviews, and occasional on-site visits.
Qualifications
Required
- Bachelor's degree in Computer Science, Cybersecurity, Information Systems, or a related technical field.
- 5+ years of cybersecurity experience (4+ years with a Master's degree).
- Experience supporting application, product, or embedded cybersecurity in regulated industries such as medical devices, defense, or aerospace.
- Hands-on experience with DoD RMF, STIGs, SCAP tools, and POA&M management.
- Knowledge of NIST frameworks, including NIST 800-53 and NIST 800-171.
- Experience with secure software development, vulnerability management, risk assessment, and DevSecOps practices.
- Experience with Windows and Linux hardening, network security, and system compliance validation.
- Strong communication, analytical, organizational, and problem-solving skills.
Preferred
- Experience obtaining or maintaining DoD ATO certifications.
- Knowledge of FDA cybersecurity guidance and medical device security standards.
- Certifications such as CISSP, Security+, CEH, or GSEC.
- Experience with cloud security, container security, and automated testing frameworks.
- Experience working in Linux, Windows Server, virtualized environments, and network security architectures.
- Master's degree in a related technical discipline.
Additional Information
- Travel: Up to 10%
- Physical Requirements: Ability to sit for extended periods and lift equipment up to 20 pounds occasionally.
- Work Environment: Fast-paced, collaborative environment supporting highly regulated medical technology products.
MA Applicants: It is unlawful in Massachusetts to require or administer a lie detector test as a condition of employment or continued employment. An employer who violates this law shall be subject to criminal penalties and civil liability.
Eligible Employee Benefits
- Medical / Dental / Vision including a state-of-the-art wellness program and access to pet insurance, too!
- 3 weeks vacation accrual for full time roles,* paid holidays plus paid sick time too
- Up to 8 weeks of 100% paid company parental leave; includes maternal/ paternal leave, adoption, and fostering of a child.
- 401(k) retirement savings plan providing a match of 66.67% (4%) of the employee's first 6% contribution (up to IRS limits)
- Section 125 Flexible Spending Accounts
- HSA Savings Accounts with company contribution
- Life, STD & LTD Insurance
- We prepay your tuition up to $5,250 per year! - Tuition pre-imbursement
- Fitness reimbursement of up to $200 annually
- And much more!
* Field sales, internships, and roles that are regularly scheduled to work less than 30 hours per week are not eligible for vacation, except where required by law.
Non-employees, including temporary workers and consultants, are not eligible to participate in the KARL STORZ benefits program.
KARL STORZ reserves the right to change or modify the employee's job description whether orally or in writing, at any time during the employment relationship. Additionally, KARL STORZ, through its supervisors, may require an employee to perform duties outside their normal description within the sole discretion of the supervisor. Employees must comply will all applicable KARL STORZ policies and procedures.
Credentialing requirements at KARL STORZ
KARL STORZ is committed to maintaining a safe work environment for our employees and customers. Most field-based roles at KARL STORZ require hospital credentialing/health screens as a condition of employment. Credentialing can include required vaccinations, health screens & other requirements as outlined by our customers. During the interview process, we encourage you to ask how credentialing/health screens may impact the role you are seeking and if you require any reasonable accommodations regarding these requirements.
Pay Transparency
The pay range and/or hourly pay rate listed is a good faith determination of potential base compensation that may be offered to a successful applicant for this position at the time of this job posting and may be modified in the future. When determining a specific team member's base salary and/or hourly pay rate, several factors will be considered including such things as location, specialty, service line, years of relevant experience, education, professional credentials, internal equity, and the amount budgeted for the role.
Equal Employment Opportunity & Reasonable Accommodation Statement
KARL STORZ is committed to creating an inclusive space where employees are valued for their skills and unique experiences. To achieve this goal, we are committed to diverse voices, and all applicants will receive consideration without regard to race, color, sex, national origin, disability, veteran status, or any other protected characteristic. KARL STORZ is also committed to providing reasonable accommodations during our recruitment process. Should you need assistance or accommodation please email us at taoperations@karlstorz.com.
Get in Contact
5566
