Principal MedTech Product Security Engineer

Johnson and Johnson; Danvers (MA); Hybrid; USD 102,000 - 177,000; Full time

Job summary

Johnson & Johnson’s MedTech cybersecurity team seeks a Principal Product Security Engineer in Danvers, MA to own security across Heart Recovery devices. This role drives secure development, threat modelling, and regulatory submissions for enterprise-scale medical devices and connected platforms.

The position requires extensive experience in embedded cybersecurity, risk assessment, and secure SDLC, with travel up to 10–20% and collaboration across R&D engineering and external partners.

Qualifications

• 10+ years industry experience in Information Security.
• 8+ years experience with embedded system, IoT, or medical device cybersecurity.
• Bachelor's degree or equivalent.
• Experience generating Threat models without the use of threat modeling tools.
• Experience performing risk assessments utilizing CVSS 3.1 or higher, with STRIDE per element.
• Ability to write technical security requirements for embedded systems and web platforms based on the latest regulations.
• Understanding and execution of third-party penetration testing, vulnerability scanning, CVSS and/or other general security testing principles.
• Experience supporting regulatory security submissions.
• Knowledge of SDLC security practices and secure coding.
• Data privacy experience including HIPAA and GDPR.

Responsibilities

• Lead secure lifecycle practices, integrating threat modeling and static/dynamic analysis.
• Define hardware security architecture and secure boot/firmware integrity concepts.
• Coordinate third-party penetration testing and vulnerability management.
• Develop security requirements for RTOS and embedded systems across product lines.
• Monitor post-market security responses and customer security questionnaires.

Skills

Information Security

Embedded systems

Threat modelling

Regulatory security

Risk assessment (CVSS)

Security requirements for embedded

Penetration testing

FDA cybersecurity guidance

Cloud security

Secure SDLC

Memory safety RTOS

SBOMs

Threat modelling tools

Education

Bachelor's degree or equivalent

Tools

QNX QOS

Yocto

Linux (Ubuntu)

Alpine

Job description

Johnson & Johnson’s MedTech cybersecurity team seeks a Principal Product Security Engineer in Danvers, MA to own security across Heart Recovery devices. This role drives secure development, threat modelling, and regulatory submissions for enterprise-scale medical devices and connected platforms.

The position requires extensive experience in embedded cybersecurity, risk assessment, and secure SDLC, with travel up to 10–20% and collaboration across R&D engineering and external partners.