FDA-Ready Product Security Engineer (Medical Device)

Cognito Therapeutics, Inc.; Cambridge (MA); On-site; USD 120,000 - 190,000; Full time

Job summary

Cognito Therapeutics, Inc. is building a Security, Privacy, and IT organization from the ground up.

The Product Security Engineer is a founding hire in Information Security, working with hardware, software, and systems engineers to embed security into the product from design through to post-market operations, and to own the cybersecurity portions of the FDA submission. The role reports to the Information Security Director and will help shape threat modeling, regulatory documentation, risk

Responsibilities

• Partner with hardware, software, and systems engineers throughout the product development lifecycle to build security into the product's design, requirements, and architecture from the start - not bolted on after the fact.
• Own system-level threat modeling spanning hardware, firmware, software, and connectivity, and maintain the security requirements that feed into design reviews.
• Own the cybersecurity portions of our FDA submission - premarket cybersecurity documentation, SBOM, security risk assessments, architecture views, threat models, and related documents.
• Respond to FDA review questions during the submission process.
• Operate within Cognito's Quality Management System (ISO 13485 / 21 CFR 820) ensuring security work products meet documentation, traceability, and change-control requirements.
• Own the security risk management process for the product, aligning cybersecurity risk with medical device risk management practice (ISO 14971).
• Plan and execute security testing across the product - penetration testing, vulnerability scanning, and other assessments, driving findings to closure.
• Run the vulnerability management program for the fielded product with triage, remediation tracking, and SBOM monitoring.
• Build reusable security documentation, templates, and repeatable processes to scale security across the organization.

Job description

Cognito Therapeutics, Inc. is building a Security, Privacy, and IT organization from the ground up.

The Product Security Engineer is a founding hire in Information Security, working with hardware, software, and systems engineers to embed security into the product from design through to post-market operations, and to own the cybersecurity portions of the FDA submission. The role reports to the Information Security Director and will help shape threat modeling, regulatory documentation, risk