David Dashti · Product Security
Securing regulated medical software from design through market clearance — and, as a second regulatory regime, EU AI Act readiness. QA/RA & Security Specialist at Hermes Medical Solutions, Stockholm.
FDA Premarket · IEC 81001-5-1 · EU MDR · Security+
Hermes Medical Solutions
May 2024 — Present · Stockholm, Sweden
Product security for regulated medical software: threat modeling, FDA premarket security documentation, IEC 81001-5-1 secure-lifecycle work, SBOM and vulnerability management — alongside QA/RA responsibility for V&V and market clearance.
Learn more about Hermes Medical Solutions
Philips Healthcare
Mar 2022 — May 2024 · Stockholm, Sweden
Level 1 support for Intellispace Portal and Cardiovascular across the Nordics and UK/Ireland — full incident lifecycle, upgrade assessment, and cross-regional knowledge sharing for enterprise imaging informatics.
Learn more about Philips Healthcare
Karolinska University Hospital
Jun 2021 — Dec 2021 · Stockholm, Sweden
First-line support for one of Europe's largest imaging-equipment fleets: RIS/PACS incident management, DICOM/HL7 integration work, and multi-vendor coordination across GE, Philips, and Siemens systems.
Learn more about Karolinska University Hospital
SoftPro Medical Solutions
Oct 2020 — Jun 2021 · Stockholm, Sweden
Thesis research integrating the Medusa inventory system with radiology equipment workflows — process modeling and multi-actor analysis to improve quality assurance in a radiology department.
Learn more about SoftPro Medical Solutions
Södersjukhuset - SÖS
Jun 2020 — Jun 2021 · Stockholm, Sweden
Radiology IT systems management at one of Stockholm's largest emergency hospitals: PACS/DICOM operations, supplier contract evaluations, workflow optimization, and system documentation.
Learn more about Södersjukhuset - SÖS
Issued Jan 2026 · valid to Jan 2029
Security+
Cybersecurity
Industry-standard certification covering network security, threats, vulnerabilities, and risk management.
View certificate
Oct 2024 — Dec 2024
Cybersecurity Fundamentals (Course)
Information Security
Eight-week YH course covering the threat landscape and cyber kill chain, systematic information security work, incident response and digital forensics, SCADA/ICS security, and secure software development.
View certificate
Aug 2018 — Jun 2021
Master of Science
Biomedical Engineering – Computer Science
Master's Thesis — 'Improving Quality Assurance of Radiology Equipment Using Process Modelling and Multi-actor System Analysis'
Aug 2015 — Jun 2018
Bachelor of Science
Biomedical Engineering
Bachelor's Thesis — 'Development of a User-friendly Method of Processing Data from Ergonomics Measurements Utilizing Inclinometers'
Research conducted at KTH Royal Institute of Technology in collaboration with SoftPro Medical Solutions. The thesis investigates methods to improve QA processes for radiology equipment through process modelling techniques and multi-actor system analysis, contributing to enhanced medical device quality management.
Research project at Lund University focusing on developing user-friendly data processing methods for ergonomics measurements using inclinometer sensors. The thesis explores practical applications in occupational health and workplace ergonomics assessment.
Cited, versioned conformance vectors for CI/CD OIDC trust decisions — the answer key for whether a workload-identity trust condition actually matches, and whether it is safe.
CI gate against cloud trust-policy drift: decodes a GitHub Actions OIDC token's claims and checks them against an expected-claims policy before an over-broad trust policy lets the wrong branch assume a role.
System administration automation scripts for Windows and Linux environments. Streamlines common IT operations and maintenance tasks.
Professional portfolio website built with Vue 3 and FastAPI. Features dynamic content management, GitHub OAuth, and CI/CD deployment.
Merged upstream contributions — supply-chain tooling, DICOM infrastructure, and LLM-security scanning. Each entry links to the pull request itself.
Product and application security for regulated medical software. I write the cybersecurity documentation that a medical device has to bring to a regulator.
I'm a QA/RA & Security Specialist at Hermes Medical Solutions, where I author the product cybersecurity evidence that goes into regulatory submissions — threat models, security risk assessments and the premarket security documentation itself — inside an ISO 13485 quality system, against IEC 81001-5-1 and FDA premarket cybersecurity requirements (FD&C Act section 524B). EU AI Act readiness is the other named half of the role, and the applicability and gap assessment has started. Article 15 asks for accuracy, robustness and cybersecurity in one sentence, which is where the Act extends work I already do rather than starting something separate.
Current focus areas
Technical skills
Windows Server, Unix/Linux, Docker, Kubernetes, PowerShell, Bash, Python and Git
I care about making healthcare technology safer and more trustworthy — protecting patients by making sure the software, and increasingly the AI, inside their care is secure by design.
This site is itself a work sample — its content-security policy, CI gates and supply-chain posture are documented in the repository.
