Principal MedTech Product Security Engineer (Remote)

Johnson & Johnson; Elkhorn City (KY); Hybrid; USD 120,000 - 190,000; Full time

Job summary

Johnson & Johnson MedTech seeks a Principal Product Security Engineer in Danvers, MA to lead security across Heart Recovery devices and platforms. You will own security architecture, threat modeling, and secure development practices for pre-market and post-market activities.

You will implement cryptographic controls, secure boot, and PKI/HSM-based key management while ensuring FDA/NIST/IEC standards. Remote work may be considered; up to 10–20% travel expected.

Qualifications

• 10+ years in Information Security with focus on medical devices or embedded systems.
• 8+ years in embedded system, IoT, or medical device cybersecurity.
• Ability to write security requirements for embedded systems and web platforms.
• Experience supporting regulatory submissions and compliance activities.

Responsibilities

• Lead security architecture for Heart Recovery devices and platforms.
• Define secure boot, firmware integrity, and anti-tamper measures.
• Enforce data protection protocols (data at rest/in transit) per FDA/NIST/IEC.
• Define and manage key management infrastructure (PKI/HSMs/TPMs).
• Coordinate third-party penetration testing and threat modelling work.
• Oversee post-market monitoring, patching, and customer security questionnaires.

Skills

Information Security

Embedded security

Threat modeling

Regulatory security submissions

Security architecture

Risk assessments (CVSS)

Secure SDLC

Cryptographic controls

Education

Bachelor's degree

Job description

Johnson & Johnson MedTech seeks a Principal Product Security Engineer in Danvers, MA to lead security across Heart Recovery devices and platforms. You will own security architecture, threat modeling, and secure development practices for pre-market and post-market activities.

You will implement cryptographic controls, secure boot, and PKI/HSM-based key management while ensuring FDA/NIST/IEC standards. Remote work may be considered; up to 10–20% travel expected.