Lead Product Security Engineer

Jobtailor; Massachusetts; On-site; USD 120,000 - 180,000; Full time

Job summary

Jobtailor is seeking a seasoned information security professional to lead our product security program. The role partners with engineering and cross-functional teams to drive adherence to regulatory and security requirements across the development lifecycle.

You will define security controls, manage risk, and support compliance activities for FDA-regulated environments, privacy, and data protection while maintaining clear communication with stakeholders.

Qualifications

• Bachelor’s degree in Computer Science, Information Systems, or related field.
• 4+ years industry experience in Information Security.
• Working knowledge of regulatory standards and compliance frameworks (e.g., NIST Cybersecurity Framework, ISO27001, SOC2, HIPAA, GDPR).
• Experience with security risk management techniques and tactics.
• Experience working in a regulated environment, FDA-regulated preferred.
• Demonstrated organizational skills, attention to detail.
• Strong communication and interpersonal skills.

Responsibilities

• Partner with engineering and other cross-functional teams to drive successful adherence to product security program.
• Deliver documentation for pre-market development activities including security plans, architecture and data flow diagrams, threat models, requirements, SBOM, and risk documentation.
• Define and implement key management infrastructure (PKI, HSMs, TPMs, and secure enclave integration) for device identity, authentication, and software signing.
• Monitor and drive post-market vulnerability management activities, with adherence to strict timelines.
• Support compliance certification activities, such as SOC2, FedRAMP, ISO 27001, etc.
• Identify, research, evaluate, and integrate new compliance requirements and industry standards/trends into the product security program.
• Guide teams to make decisions that balance business needs with security objectives.

Skills

Security risk management

Regulatory compliance

Communication skills

Attention to detail

Team collaboration

Education

Bachelor's degree in Computer Science

Information Systems related field

Job description

Responsibilities

• Partner with engineering and other cross-functional teams (cloud, console, pump, etc.) to drive successful adherence to J&J Heart Recovery's product security program.
• Deliver documentation for pre-market development activities including security plans, architecture and data flow diagrams, threat models, requirements, SBOM, and risk documentation.
• Define and implement key management infrastructure (PKI, HSMs, TPMs, and secure enclave integration) for device identity, authentication, and software signing.
• Monitor and drive post-market vulnerability management activities, with adherence to strict timelines.
• Support compliance certification activities, such as SOC2, FedRAMP, ISO 27001, etc.
• Identify, research, evaluate, and integrate new compliance requirements and industry standards/trends into the product security program.
• Guide teams to make decisions that balance business needs with security objectives.

Requirements

• Bachelor’s degree in Computer Science, Information Systems, or related field
• 4+ years industry experience in Information Security
• Working knowledge of regulatory standards and compliance frameworks (e.g., NIST Cybersecurity Framework, ISO27001, SOC2, HIPAA, GDPR)
• Experience with security risk management techniques and tactics
• Experience working in a regulated environment, FDA-regulated preferred
• Demonstrated organizational skills, attention to detail
• Strong communication and interpersonal skills