Senior Medical Device Security Architect

Jobtailor; Maine; On-site; USD 180,000 - 240,000; Full time

Job summary

Abiomed, a Johnson & Johnson MedTech company, is seeking a Principal Product Security Engineer to drive security architecture and lifecycle practices for Heart Recovery devices. You will lead threat modelling, cryptographic controls, and secure software development across embedded and connected systems.

The role requires deep expertise in regulatory cybersecurity submissions, data protection, and secure OTA update governance to ensure robust product security across the lifecycle.

Qualifications

• 8+ years industry experience in Information Security.
• 5+ years experience with embedded system, IOT, or medical device cybersecurity.

Responsibilities

• Define and implement secure boot, firmware integrity validation, and anti‑tamper mechanisms.
• Enforce cryptographic protocols for data‑at‑rest and data‑in‑transit, in compliance with FDA and NIST standards.
• Lead security architecture reviews and threat modelling across Heart Recovery product lines.
• Coordinate third‑party penetration testing and vulnerability assessments.
• Oversee Secure Development Lifecycle practices and hardware security considerations.
• Respond to customer cybersecurity questionnaires and contractual language as needed.

Skills

Threat Modeling Expertise

Regulatory Compliance Knowledge

Secure Development Lifecycle

Cryptographic Protocols

Data Privacy Regulations

Secure Boot Implementation

Education

Bachelor's Degree

Tools

HSMs

TPMs

OTA Update Mechanisms

SBOM Generation

Static/Dynamic Analysis Tools

Fuzz Testing

Job description

Abiomed, a Johnson & Johnson MedTech company, is seeking a Principal Product Security Engineer to drive security architecture and lifecycle practices for Heart Recovery devices. You will lead threat modelling, cryptographic controls, and secure software development across embedded and connected systems.

The role requires deep expertise in regulatory cybersecurity submissions, data protection, and secure OTA update governance to ensure robust product security across the lifecycle.