Principal MedTech Security Engineer - Remote Options

Johnson & Johnson; Spruance City (DE); Hybrid; USD 140,000 - 200,000; Full time

Job summary

Johnson & Johnson MedTech seeks a Principal Product Security Engineer in Danvers, MA, to lead security across Heart Recovery devices. You will define secure architectures, oversee SDLC security activities, and coordinate threat modeling, testing, and regulatory submissions. Travel 10–20% may be required. Remote work options considered case-by-case.

You will work with cross-functional teams to ensure FDA/NIST-aligned security, data protection, and firmware integrity across product lifecycles.

Qualifications

• 10+ years industry experience in Information Security.
• 8+ years experience with embedded system, IOT, or medical device cybersecurity.
• Bachelor’s degree or equivalent.
• Experience generating Threat models without the use of threat modeling tools.
• Experience performing risk assessments utilizing CVSS 3.1 or higher, with STRIDE per element.
• Ability to write technical security requirements for embedded systems and web platforms based on the latest regulations.
• Understanding and execution of third-party penetration testing, vulnerability scanning, CVSS and/or other general security testing principles.
• Experience supporting regulatory security submissions, ensuring compliance with FDA Cybersecurity Guidance (2025), EU MDR, NIST 800-53, IMDRF, and AAMI TIR57.
• Knowledge of real-time operating systems hardening techniques.
• Knowledge of cloud security principles.

Responsibilities

• Lead Secure Development Lifecycle practices, integrating threat modeling, static/dynamic analysis, fuzz testing, and formal verification.
• Define hardware security architecture, including HRoT and secure microcontroller protections.
• Implement memory safety strategies to mitigate risks in RTOS and bare-metal firmware.
• Coordinate third-party penetration testing and vulnerability management.
• Respond to customer cybersecurity questionnaires and contractual language for post-market devices.

Skills

Information Security

Embedded Systems Security

Threat Modeling

Regulatory Compliance

Cloud Security

Secure Software Lifecycle

Cryptography

Risk Assessments

Education

Bachelor’s degree or equivalent

Job description

Johnson & Johnson MedTech seeks a Principal Product Security Engineer in Danvers, MA, to lead security across Heart Recovery devices. You will define secure architectures, oversee SDLC security activities, and coordinate threat modeling, testing, and regulatory submissions. Travel 10–20% may be required. Remote work options considered case-by-case.

You will work with cross-functional teams to ensure FDA/NIST-aligned security, data protection, and firmware integrity across product lifecycles.