Senior Principal Cybersecurity Engineer

About the role

Roche Diagnostics is looking for a Senior Principal Cybersecurity Engineer in Rotkreuz. Data security and privacy are central to its digital transformation, and the role applies end-to-end product security and privacy operations across the division to keep products and services secure and compliant throughout their lifecycle.

Key responsibilities

• Define security and privacy baselines for medical devices, health and clinical solutions, and cloud or on-premises products across the SDLC
• Help develop and implement the product lifecycle security and privacy risk management framework
• Lead threat modeling and cybersecurity risk assessments to protect patient safety, customer property and business continuity
• Oversee pre- and post-market vulnerability handling and assess risks from SAST, DAST, SCA, IaC and penetration testing, steering remediation with engineering teams
• Coordinate external security verification such as penetration tests and support incident response and forensics with Roche Intelligence and Defense
• Maintain compliance documentation, playbooks and tools for audit readiness
• Present risk evaluations and mitigation proposals to executive risk committees and lead cross-functional security initiatives

Required profile

• Bachelor's degree in Engineering, Computer Science or a related field (Master's or PhD preferred)
• BS with 12+ years of relevant experience (minimum 7+ in security engineering, security operations, vulnerability management or application security), OR MS with 8+ years, OR PhD with 4+ years
• Track record working with product software and cloud platform teams, preferably in international healthcare or highly regulated sectors
• Fluent English, German a plus; willingness to travel up to 20%

Required skills

• Threat modeling, product security posture analysis and privacy controls
• Knowledge of ISO 27000, FDA guidance, MDCG, HITRUST, GDPR and CPRA; familiarity with medical device submissions (FDA, CE Mark, NMPA) strongly recommended
• Certifications such as CISSP, CSSP, CISM, CISA, CEH, SANS GIAC or ISO 27001 Lead Auditor
• Ability to mentor, coach and build security champion networks