Product Security Engineer

Cognito Therapeutics, Inc.; Cambridge (MA); On-site; USD 120,000 - 190,000; Full time

Job summary

Cognito Therapeutics, Inc. is building a Security, Privacy, and IT organization from the ground up.

The Product Security Engineer is a founding hire in Information Security, working with hardware, software, and systems engineers to embed security into the product from design through to post-market operations, and to own the cybersecurity portions of the FDA submission. The role reports to the Information Security Director and will help shape threat modeling, regulatory documentation, risk

Responsibilities

• Partner with hardware, software, and systems engineers throughout the product development lifecycle to build security into the product's design, requirements, and architecture from the start - not bolted on after the fact.
• Own system-level threat modeling spanning hardware, firmware, software, and connectivity, and maintain the security requirements that feed into design reviews.
• Own the cybersecurity portions of our FDA submission - premarket cybersecurity documentation, SBOM, security risk assessments, architecture views, threat models, and related documents.
• Respond to FDA review questions during the submission process.
• Operate within Cognito's Quality Management System (ISO 13485 / 21 CFR 820) ensuring security work products meet documentation, traceability, and change-control requirements.
• Own the security risk management process for the product, aligning cybersecurity risk with medical device risk management practice (ISO 14971).
• Plan and execute security testing across the product - penetration testing, vulnerability scanning, and other assessments, driving findings to closure.
• Run the vulnerability management program for the fielded product with triage, remediation tracking, and SBOM monitoring.
• Build reusable security documentation, templates, and repeatable processes to scale security across the organization.

Job description

This is a rare opportunity to join a team that is bringing an entirely new category of brain health to the world. At Cognito, we are developing therapies designed to promote dignity, clarity, and coherence in the lives they touch.

Cognito is a neurotechnology company developing a new therapeutic approach to cognitive and neurological health, designed to work with the brain's own activity and biology. Born from pioneering neuroscience research at MIT, Cognito brings together neuroscience, engineering, medicine and technology to translate breakthroughs in brain science into practical therapies designed for everyday life.

Our first therapeutic application, Spectris AD, is an investigational, prescription, at-home therapy for Alzheimer's disease. With our pivotal HOPE study now complete, Cognito is entering an important new phase as we advance Spectris AD toward regulatory review, prepare for potential commercialization and continue exploring the broader potential of our science across neurological health.

We are building an interdisciplinary team united by a shared purpose: protecting and progressing the human ability to think, learn and remember. For innovators who want to work at the intersection of breakthrough science, technology and human health, Cognito offers the chance to help shape what comes next.

About The Job

Cognito is building a Security, Privacy, and IT organization from the ground up under the SVP of Security, Privacy, and IT, structured across three functions. The Product Security Engineer is a founding hire in Information Security. This is a specialized medical device product security role: you'll work directly alongside our hardware, software, and systems engineers to build security into the product's design and architecture, own the cybersecurity portions of our FDA submission, and run security operations for the product once it's in the field. This role reports to the Information Security Director; until that role is filled, it may report directly to the SVP.

Responsibilities

• Partner directly with hardware, software, and systems engineers throughout the product development lifecycle to build security into the product's design, requirements, and architecture from the start - not bolted on after the fact.
• Own system-level threat modeling (e.g., STRIDE or an equivalent structured method) spanning hardware, firmware, software, and connectivity, and maintain the security requirements that feed into design reviews.

FDA Submission & Regulatory Documentation

• Own the cybersecurity portions of our FDA submission - premarket cybersecurity documentation, software bill of materials (SBOM), security risk assessments, architecture views, threat models, Secure Product Development Framework, Cybersecurity Management Plan, Coordinated Vulnerability Disclosures, and other portions of our FDA submission.
• Respond directly to FDA review questions during the submission process.

Quality Management System (QMS) Integration & Risk Management

• Operate within Cognito's Quality Management System (e.g., ISO 13485 / 21 CFR 820 design controls), ensuring security work products - risk assessments, verification and validation evidence, design history file inputs - meet QMS documentation, traceability, and change-control requirements.
• Own the security risk management process for the product, integrating cybersecurity risk into the broader product risk management file in alignment with medical device risk management practice (e.g., ISO 14971-aligned methodology).

Security Testing

• Plan and execute (or coordinate third-party) security testing across the product - penetration testing, vulnerability scanning, and other targeted assessments - both pre-release and as part of periodic post-market testing, driving findings through to verified closure.

Post-Market Security Operations

• Run the vulnerability management program for the fielded product: intake, CVSS-based triage and prioritization, remediation tracking against defined SLAs, and SBOM-based monitoring of third-party and open-source component vulnerabilities.
• Build and operate ongoing post-market monitoring - threat intelligence review, vulnerability disclosure intake, and field data review - to meet FDA post-market cybersecurity obligations, including trend analysis and escalation into the complaint-handling / CAPA process where security issues are involved.

Cross-Functional Partnership & Program Building

• Serve as the embedded security point of contact across hardware, software, and systems engineering teams, joining design reviews and risk management activities as needed.
• Build reusable documentation, templates, and repeatable processes now so these practices scale as the security team grows.

Qualifications