Principal MedTech Product Security Engineer

Johnson & Johnson; Slab City (CA, NH); Hybrid; USD 140,000 - 190,000; Full time

Job summary

Johnson & Johnson’s MedTech cybersecurity team seeks a Principal Product Security Engineer located in Danvers, MA, with remote options considered case-by-case. Travel up to 10-20% may be required.

You will own the Product Security process for Heart Recovery devices, shaping security throughout the lifecycle of next‑gen cardiac support systems. Lead architecture, threat modelling, and SDLC practices; coordinate penetration testing and ensure regulatory alignment with FDA cybersecurity guidance

Qualifications

• 10+ years industry experience in Information Security.
• 8+ years experience with embedded system, IOT, or medical device cybersecurity.
• Knowledge of regulatory security submissions, FDA Guidance, NIST 800-53, IMDRF, and AAMI TIR57.
• Ability to write technical security requirements for embedded systems and web platforms.
• Data privacy experience, including HIPAA and GDPR.

Responsibilities

• Define and implement security architecture for Heart Recovery devices and supporting platforms.
• Lead Secure Development Lifecycle practices across hardware and software.
• Coordinate third-party penetration testing and vulnerability assessments.
• Respond to customer cybersecurity questionnaires and regulatory security submissions.
• Collaborate with R&D to define hardware security architecture and secure firmware protections.

Skills

Threat modeling

Regulatory security submissions

Secure coding practices

Risk assessment (CVSS)

Embedded systems security

Cloud security principles

HIPAA & GDPR knowledge

SBOM generation

Project leadership

Penetration testing coordination

Education

Bachelor’s degree or equivalent

Tools

Penetration testing

Job description

Johnson & Johnson’s MedTech cybersecurity team seeks a Principal Product Security Engineer located in Danvers, MA, with remote options considered case-by-case. Travel up to 10-20% may be required.

You will own the Product Security process for Heart Recovery devices, shaping security throughout the lifecycle of next‑gen cardiac support systems. Lead architecture, threat modelling, and SDLC practices; coordinate penetration testing and ensure regulatory alignment with FDA cybersecurity guidance