Senior Medical Device Security Engineer

Johnson & Johnson; Slab City (NH); Hybrid; USD 102,000 - 177,000; Full time

Benefits offered by this job

Vacation hours

Sick time

Holiday pay

Retirement plan

Parental Leave

Volunteer Leave

Job summary

Johnson & Johnson is seeking a Principal Product Security Engineer to own security architecture for Heart Recovery medical devices. You will lead threat modeling, secure development practices, and post‑market security monitoring across the product lifecycle, aligning with FDA and NIST standards.

Remote work may be considered case-by-case; travel is possible. The role requires 10+ years in information security and 8+ years in embedded system cybersecurity, with a Bachelor’s degree or equivalent.

Qualifications

• Bachelor’s degree or equivalent.
• 10+ years in Information Security.
• Experience with embedded systems, IoT, or medical device cybersecurity.
• Experience creating threat models without modeling tools.
• Experience supporting regulatory security submissions (FDA, EU MDR, NIST, etc.).

Responsibilities

• Define and implement secure product security framework for Heart Recovery devices.
• Lead threat modeling, SDLC security integration, and code reviews.
• Coordinate third‑party pentesting and regulatory submissions.
• Develop security requirements for embedded systems and IoT devices.
• Monitor post‑market security, respond to customer security questionnaires.

Skills

Information Security

Embedded Systems

Threat Modeling

Risk Assessment

Regulatory Compliance

Security Architecture

Project Leadership

Communication

Education

Bachelor’s degree or equivalent

Tools

QNX QOS

Yocto

Linux Ubuntu

Alpine

Job description

Johnson & Johnson is seeking a Principal Product Security Engineer to own security architecture for Heart Recovery medical devices. You will lead threat modeling, secure development practices, and post‑market security monitoring across the product lifecycle, aligning with FDA and NIST standards.

Remote work may be considered case-by-case; travel is possible. The role requires 10+ years in information security and 8+ years in embedded system cybersecurity, with a Bachelor’s degree or equivalent.