David Dashti · Product Security
Securing regulated medical software from design through market clearance. QA/RA & Security Specialist at Hermes Medical Solutions, Stockholm.
FDA Premarket · IEC 81001-5-1 · EU MDR · Security+
Hermes Medical Solutions
May 2024 — Present · Stockholm, Sweden
Product security for regulated medical software: threat modeling, FDA premarket security documentation, IEC 81001-5-1 secure-lifecycle work, SBOM and vulnerability management — alongside QA/RA work on V&V and regulatory submissions.
Learn more about Hermes Medical Solutions
Philips Healthcare
Mar 2022 — May 2024 · Stockholm, Sweden
Level 1 support for IntelliSpace Portal and IntelliSpace Cardiovascular across the Nordics and UK/Ireland — full incident lifecycle, upgrade assessment, and cross-regional knowledge sharing for enterprise imaging informatics.
Learn more about Philips Healthcare
Karolinska University Hospital
Jun 2021 — Dec 2021 · Stockholm, Sweden
First-line support for one of Europe's largest imaging-equipment fleets: RIS/PACS incident management, DICOM/HL7 integration work, and multi-vendor coordination across GE, Philips, and Siemens systems.
Learn more about Karolinska University Hospital
SoftPro Medical Solutions
Oct 2020 — Jun 2021 · Stockholm, Sweden
Thesis research integrating the Medusa inventory system with radiology equipment workflows — process modeling and multi-actor analysis to improve quality assurance in a radiology department.
Learn more about SoftPro Medical Solutions
Södersjukhuset - SÖS
Jun 2020 — Jun 2021 · Stockholm, Sweden
Radiology IT systems management at one of Stockholm's largest emergency hospitals: PACS/DICOM operations, supplier contract evaluations, workflow optimization, and system documentation.
Learn more about Södersjukhuset - SÖS
Issued Jan 2026 · valid to Jan 2029
Security+
Cybersecurity
Industry-standard certification covering network security, threats, vulnerabilities, and risk management.
View certificate
Oct 2024 — Dec 2024
Cybersecurity Fundamentals (Course)
Information Security
Eight-week YH course covering the threat landscape and cyber kill chain, systematic information security work, incident response and digital forensics, SCADA/ICS security, and secure software development.
View certificate
Aug 2018 — Jun 2021
Master of Science
Biomedical Engineering – Computer Science
Master's Thesis — 'Improving Quality Assurance of Radiology Equipment Using Process Modelling and Multi-actor System Analysis'
Aug 2015 — Jun 2018
Bachelor of Science
Biomedical Engineering
Bachelor's Thesis — 'Development of a User-friendly Method of Processing Data from Ergonomics Measurements Utilizing Inclinometers'
Research at KTH Royal Institute of Technology, in collaboration with SoftPro Medical Solutions: methods to improve quality assurance of radiology equipment through process modelling and multi-actor system analysis.
Research at Lund University: a user-friendly method for processing ergonomics measurements from inclinometer sensors, for occupational-health and workplace ergonomics assessment.
Cited, versioned conformance vectors for CI/CD OIDC trust decisions — the answer key for whether a workload-identity trust condition actually matches, and whether it is safe. Finished: 0.7.0 on PyPI is the final release.
CI gate against cloud trust-policy drift: decodes a GitHub Actions OIDC token's claims and checks them against an expected-claims policy before an over-broad trust policy lets the wrong branch assume a role.
This site: a Vue 3 + TypeScript static build on a FastAPI and PostgreSQL backend, with a hash-locked content-security policy, SHA-pinned GitHub Actions and a post-deploy check of the production security headers.
Merged upstream pull requests in open-source security tools: SBOM generation and vulnerability matching (Syft, Grype and their container-image library, Stereoscope), DefectDojo report parsers and AWS IAM trust graphs (Cartography). Also merged: pull requests to other open-source libraries. Each entry links to the pull request itself.
Product and application security for regulated medical software. I write the cybersecurity documentation that a medical device has to bring to a regulator.
I'm a QA/RA & Security Specialist at Hermes Medical Solutions, where I author the product cybersecurity evidence that goes into regulatory submissions — threat models, security risk assessments and the premarket security documentation itself — inside an ISO 13485 quality system, against IEC 81001-5-1 and FDA premarket cybersecurity requirements (FD&C Act section 524B). The role also covers EU AI Act readiness.
Current focus areas
Technical skills
Windows Server, Unix/Linux, Docker, Kubernetes, PowerShell, Bash, Python and Git
I care about making healthcare technology safer and more trustworthy — protecting patients by making sure the software inside their care is secure by design.
This site is itself a work sample — its content-security policy, CI gates and supply-chain posture are documented in the repository.
