Senior Medical Device Security Engineer

Johnson & Johnson Co.; Danvers (MA); On-site; USD 102,000 - 177,000; Full time

Job summary

Johnson & Johnson’s MedTech security team in Danvers, MA seeks a Principal Product Security Engineer to own security across Heart Recovery devices. Remote work may be considered case-by-case; travel up to 10–20% is expected as needed.

You will drive secure design, risk assessments, and post-market support, interfacing with R&D and regulatory teams to protect patient safety and compliance throughout product lifecycles.

Qualifications

• 10+ years industry experience in Information Security.
• 8+ years experience with embedded system, IoT, or medical device cybersecurity.
• Experience generating Threat models without the use of threat modeling tools.
• Experience performing risk assessments using CVSS 3.1+ with STRIDE per element.
• Ability to write technical security requirements for embedded systems and web platforms.
• Experience supporting regulatory security submissions (FDA, NIST, HIPAA/GDPR familiarity).
• Knowledge of hardware security, cryptography, and secure coding practices.
• Strong written and verbal communication; able to influence across teams.

Responsibilities

• Define and implement secure boot, firmware integrity validation, and anti-tamper mechanisms.
• Enforce cryptographic protocols for data-at-rest and data-in-transit with regulatory alignment.
• Define key management infrastructure for device identity and software signing.
• Develop real-time vulnerability assessment for wireless communications in medical devices.
• Lead Secure Development Lifecycle with threat modeling, static/dynamic analysis, and fuzzing.
• Collaborate with R&D to define hardware security architecture and HRoT protections.
• Respond to customer security questionnaires and review security language in contracts.

Skills

Information Security

Embedded systems cybersecurity

Threat modelling

Regulatory compliance

Penetration testing

Secure SDLC

Cryptography

Leadership

Education

Bachelor's degree or equivalent

Tools

QNX QOS

Yocto

Linux

AWS

Azure

Job description

Johnson & Johnson’s MedTech security team in Danvers, MA seeks a Principal Product Security Engineer to own security across Heart Recovery devices. Remote work may be considered case-by-case; travel up to 10–20% is expected as needed.

You will drive secure design, risk assessments, and post-market support, interfacing with R&D and regulatory teams to protect patient safety and compliance throughout product lifecycles.