Specialist Roles — Compliance, Operations & Human-Factors UX

Guides engineering teams on secure architecture, threat modeling, vulnerability remediation, and organizational security policies.

• Perform STRIDE threat modeling sessions across system components and interfaces
• Define organizational cryptography, secrets management, and access control policies
• Conduct third-party vendor security risk assessments

• STRIDE Threat Model Report PRODUCED
• Security Architecture Review PRODUCED

• Ensure adherence to ISO 27001 Control A.5.2
• Provide security sign-off for release architecture

Executes offensive penetration testing, dynamic application security scans (DAST), and vulnerability discovery.

• Conduct automated DAST and manual penetration testing against API and web surfaces
• Attempt authorization bypass, SQL injection, and broken object level authorization (BOLA)
• Document discovered vulnerabilities with CVSS severity scores and proof-of-concept exploits

• Penetration Test Report & CVSS Scores PRODUCED
• DAST Security Scan Logs PRODUCED

• Verify system resilience against external attack vectors
• Confirm remediation of all Critical and High CVEs

Conducts hazard analyses, Fault Tree Analysis (FTA), and Failure Modes & Effects Analysis (FMEA) per ISO 14971.

• Lead cross-functional ISO 14971 risk management sessions to identify potential safety hazards
• Calculate pre-mitigation risk priority numbers and define software risk controls
• Maintain the master Risk Traceability Matrix linking hazards to verified mitigations

• ISO 14971 Risk Management File (RMF) PRODUCED
• Software FMEA / FTA Analysis PRODUCED

• Ensure risk mitigations are fully verified and traceable
• Provide formal safety assurance sign-off

Executes specialized fault injection, boundary stress, and fail-safe recovery tests to verify software risk controls.

• Inject network latency, database corruption, and hardware disconnect faults in test environments
• Verify system cleanly transitions to defined fail-safe states without hazardous outputs
• Record formal safety verification test evidence for regulatory audit dossiers

• Fault Injection Test Protocol & Logs PRODUCED
• Safety Verification Evidence Summary PRODUCED

• Prove all software risk controls operate correctly under extreme failure modes
• Maintain independent testing records

Audits data confidentiality, integrity, and availability controls against FedRAMP, NIST CSF, and SOC-2 frameworks.

• Audit access control lists, least privilege enforcement, and cryptographic key lifecycles
• Compile System Security Plans (SSP) and FedRAMP / SOC-2 evidence dossiers
• Review infrastructure audit logs for unauthorized access anomalies

• System Security Plan (SSP) PRODUCED
• SOC-2 / FedRAMP Audit Dossier PRODUCED

• Ensure information systems satisfy government and enterprise assurance baselines
• Manage continuous audit evidence collection

Enforces Health Insurance Portability and Accountability Act (HIPAA) Privacy, Security, and Breach Notification rules.

• Audit Protected Health Information (PHI) access, transmission encryption, and storage isolation
• Oversee Business Associate Agreements (BAAs) and third-party data processing agreements
• Conduct mandatory annual HIPAA training and lead incident breach response investigations

• HIPAA Compliance Assessment Report PRODUCED
• Business Associate Agreement (BAA) Register PRODUCED

• Ensure zero unauthorized disclosure of protected patient data
• Authorize HIPAA compliance sign-off for release

Leads systematic investigations into production incidents and anomalies using 5-Whys and Fishbone analyses to drive CAPA.

• Facilitate blameless post-mortem investigations following major system incidents or defects
• Identify root procedural or technical causes using Fishbone / Ishikawa diagrams
• Author Corrective and Preventive Action (CAPA) requests and monitor mitigation completion

• Root Cause Analysis (RCA) Report PRODUCED
• Corrective & Preventive Action (CAPA) Record PRODUCED

• Ensure systemic issues are permanently mitigated
• Maintain compliance with ISO 13485 Cl. 8.5.2 and 8.5.3

Performs independent quality assurance verification to confirm regulatory dossiers, DHF records, and submissions meet FDA/EU MDR standards.

• Perform independent review of Design History Files (DHF) and Device Master Records (DMR)
• Verify bidirectional traceability from User Needs to Requirements down to Verification Proof
• Authorize formal regulatory release gating sign-offs before production deployment

• Design History File (DHF) Index & Sign-off PRODUCED
• Regulatory Submission Dossier PRODUCED

• Provide final independent regulatory release sign-off
• Maintain independent audit records under ISO 13485 Cl. 8.2.2

Provisions, configures, and maintains secure cloud infrastructure, virtual networks, compute clusters, and storage buckets.

• Maintain Infrastructure as Code (IaC) templates for repeatable cloud environments
• Manage firewall rules, virtual private clouds (VPCs), and least-privilege IAM roles
• Execute routine operational maintenance, kernel updates, and security patch rollouts

• Infrastructure as Code (IaC) Repositories PRODUCED
• Environment Configuration Baseline PRODUCED

• Ensure infrastructure security and baseline configuration control
• Maintain operational compliance logs

Orchestrates deterministic production deployments, blue/green cutovers, canary rollouts, and rollback procedures.

• Execute automated, zero-downtime deployment pipelines for web services and databases
• Validate deployment pre-flight checklist gates and verify database schema migration scripts
• Manage automated rollback strategies and author post-deployment verification logs

• Production Release Manifest & Checksums PRODUCED
• Deployment Verification Sign-Off PRODUCED

• Ensure smooth, error-free software transfer to production under ISO 13485 Cl. 7.3.8
• Maintain release provenance

Maintains system uptime, defines Service Level Objectives (SLOs), builds automated telemetry, and manages incident escalation.

• Define Service Level Objectives (SLOs) and Service Level Indicators (SLIs) for critical services
• Configure distributed tracing, Prometheus metrics, and real-time PagerDuty alerts
• Automate incident remediation and participate in on-call escalation rotations

• Service Level Agreement (SLA) & SLO Dashboard PRODUCED
• Incident Post-Mortem Records PRODUCED

• Guarantee system availability meets or exceeds contractual SLOs
• Drive MTTR reduction through automated mitigations

Designs intuitive digital workflows, task interaction models, state transitions, and responsive user feedback loops.

• Create interactive wireframes, component prototypes, and user journey flowcharts
• Define micro-interactions, loading states, error dialogues, and confirmation prompts
• Collaborate with developers to ensure UI implementation matches design specifications

• Interaction Wireframes & Prototypes PRODUCED
• User Journey Flowcharts PRODUCED

• Ensure UI flows minimize cognitive load and eliminate user error states
• Maintain design consistency across platforms

Conducts formal usability engineering per IEC 62366-1, evaluating safety risks associated with human use errors.

• Design and facilitate formative and summative usability testing sessions with real users
• Identify potential use-related hazards (e.g. accidental dosing or misinterpretation of charts)
• Compile formal Usability Engineering Files required for FDA human factors clearance

• Usability Engineering File (UEF) PRODUCED
• Human Factors Summative Test Report PRODUCED

• Validate software can be used safely without inducing dangerous use errors
• Author human factors compliance dossiers

Crafts visual design systems, color tokens, typography scales, responsive layouts, and icon libraries.

• Maintain the core design token palette, dark/light theme tokens, and typography scales
• Design polished UI components adhering to strict pixel-perfect visual standards
• Deliver scalable SVG icons and graphical assets optimized for high-DPI displays

• Visual Design Token System PRODUCED
• UI Component Library Spec PRODUCED

• Ensure UI feels state-of-the-art and visually stunning
• Maintain strict brand and theme token fidelity

Enforces Section 508 and WCAG 2.1 AA accessibility standards, high-contrast color ratios, keyboard navigation, and screen reader compatibility.

• Audit color contrast ratios across dark/light themes to ensure >= 4.5:1 ratio for normal text
• Verify full keyboard navigation, logical focus rings, and ARIA landmarks across all components
• Ensure all SVG diagrams include descriptive `<title>`, `<desc>`, and `role="img"` markup

• Section 508 Accessibility Audit Report PRODUCED
• WCAG 2.1 AA Compliance Checklist PRODUCED

• Guarantee 100% of platform pages are accessible to users with sensory impairments
• Sign off on Section 508 release audits