Principal Product Security Cloud Engineer

Role Description

We are seeking the best talent for a Principal Product Security Cloud Engineer specializing in MS Azure to join our MedTech Product Security team. The role can be Remote-based or located onsite in Danvers, MA or Raritan, NJ. The role must work US East Coast hours and will require up to 10-15% travel.

The Principal Product Security Cloud Engineer should have MS Azure experience and will be responsible for implementation of J&J’s enterprise Product Security strategy and framework for the Heart Recovery cloud and supporting platforms. This role will join Abiomed, part of Johnson & Johnson MedTech, to provide MS Azure Cloud technical expertise and strategic leadership in securing Impella heart pump cloud technologies, next-generation cardiac support systems, and connected medical devices to the MS Azure cloud.

• Deliver MS Azure cloud security architecture, cryptographic controls, and Public Key Infrastructure (PKI).
• Ensure robust, regulatory-compliant security across the product lifecycle.
• Support heart recovery throughout a new product’s development phases.
• Define product security requirements and recommend security design solutions.
• Complete Quality documentation including product security plan, security requirements definition, threat modeling, and cybersecurity architecture views per FDA pre-Market Guidance for Medical Devices.
• Conduct cybersecurity risk assessment leveraging STRIDE and CVSS.
• Manage Software Bill of Materials (SBOM), Software Composition Analysis (SCA), SAST, DAST, and additional security testing.
• Monitor for new vulnerabilities (CVEs) and assist with patching and remediation plans for marketed devices.
• Support and respond to customer security questionnaires and review security language within contractual agreements.

Qualifications

• Bachelor’s degree or equivalent.
• 8-10+ years industry experience in CyberSecurity.
• 8+ years industry experience within MS Azure cloud.
• Experience working in a Cloud Scrum/Agile Azure DevOps environment.
• Familiarity with tools: Snyk, Veracode, Wiz, JIRA, Confluence.
• Experience with Containerization technologies such as Docker and Kubernetes.
• Working knowledge of regulatory standards and compliance frameworks (e.g., NIST Cybersecurity Framework, ISO27001, SOC2, HIPAA, GDPR).
• Experience with security risk management techniques.
• Demonstrated organizational skills, attention to detail, and ability to handle multiple assignments simultaneously.
• Strong communication and interpersonal skills.

Requirements

• Experience with connected medical devices or IoTs connected to the cloud supporting secure data transmission and connectivity.
• Drive alignment of the Cloud security controls and adherence to the J&J Product Security’s overarching framework.
• Experience creating a Cybersecurity Threat Model and Risk Assessment using STRIDE and CVSS frameworks for the Cloud environment.
• Experience implementing PKI and cryptographic controls.
• Understanding of FDA Pre-Market Guidance for Medical Device Appendix 1 and its application to Cloud environments for compliance.
• Define and enforce cryptographic protocols for data-at-rest and data-in-transit.
• Implement Zero Trust security for device-to-cloud connectivity.
• Oversee secure OTA (over-the-air) update mechanisms.

Benefits

• Vacation – 120 hours per calendar year.
• Sick time - 40 hours per calendar year; for employees in Colorado – 48 hours; for employees in Washington – 56 hours.
• Holiday pay, including Floating Holidays – 13 days per calendar year.
• Work, Personal and Family Time - up to 40 hours per calendar year.
• Parental Leave – 480 hours within one year of the birth/adoption/foster care of a child.
• Bereavement Leave – 240 hours for an immediate family member; 40 hours for an extended family member per calendar year.
• Caregiver Leave – 80 hours in a 52-week rolling period.
• Volunteer Leave – 32 hours per calendar year.
• Military Spouse Time-Off – 80 hours per calendar year.