Principal Product Security Engineer

Role Description

Johnson & Johnson’s MedTech cybersecurity team is recruiting for an experienced Principal Product Security Engineer. The role can be remote-based or located onsite in Danvers, MA or Raritan, NJ. This role will require up to 10% travel.

As the world’s most comprehensive MedTech business, J&J MedTech Companies are building on a century of experience, merging science and technology, to shape the future of health and benefit even more people around the world. We are in this for life.

Are you passionate about security and interested in joining a community of collaborative colleagues working in a Patient First! culture? If that’s you, we have an immediate opportunity for a Principal Product Security Engineer to join the Product Cybersecurity team to help ensure security is implemented by design for this top-performing medical device company.

The Principal Product Security Engineer will be responsible for implementation of J&J’s enterprise Product Security strategy and framework throughout the Heart Recovery portfolio of medical devices and supporting platforms. Specific responsibilities include:

• Supporting heart recovery throughout a new product’s development phases.
• Reviewing product security requirements and recommending security design solutions.
• Completing Quality documentation, threat modeling, coordinating third-party penetration testing, software architecture review, and design recommendations.
• Monitoring for new vulnerabilities, assisting with patching and remediation plans, and responding to customer security questionnaires.
• Driving alignment to J&J Product Security’s overarching framework.
• Defining and implementing secure boot, firmware integrity validation, and anti-tamper mechanisms.
• Enforcing cryptographic protocols for data-at-rest and data-in-transit.
• Developing real-time vulnerability assessment techniques for detecting security flaws in wireless communications.
• Implementing Zero Trust security for device-to-cloud connectivity.
• Overseeing secure OTA update mechanisms.
• Leading Secure Development Lifecycle practices.
• Implementing memory safety strategies to mitigate vulnerabilities.

Qualifications

• Bachelor’s degree or equivalent.
• 8+ years industry experience in Information Security.
• 5+ years experience with embedded system, IoT, or medical device cybersecurity.
• Experience generating Threat models without the use of threat modeling tools.
• Experience performing risk assessments utilizing CVSS 3.1 or higher, with STRIDE per element.
• Ability to write technical security requirements for embedded systems and web platforms.
• Understanding and execution of third-party penetration testing and vulnerability scanning.
• Experience supporting regulatory security submissions, ensuring compliance with FDA Cybersecurity Guidance.
• Knowledge of real-time operating systems hardening techniques.
• Knowledge of cloud security principles.
• Ability to generate SBOMs from Software source code and Binaries.
• Ability to generate pre-market and post-market risk assessments.
• Ability to translate technical security requirements into solutions.
• Data privacy experience, including HIPAA and GDPR.
• Understanding of industry standards and certifications such as HITRUST & ISO 27001.
• Ability to work autonomously and proactively seek out product security opportunities.
• Excellent communication and collaboration skills.
• Strong leadership skills.

Requirements

• Ability to lead large projects and track to project plan timelines from a security perspective.
• Ability to create and deliver cybersecurity awareness campaigns.
• Creative problem-solving skills.
• Customer focus (internal & external).

Benefits

• Vacation – 120 hours per calendar year.
• Sick time - 40 hours per calendar year; varies by state.
• Holiday pay, including Floating Holidays – 13 days per calendar year.
• Work, Personal and Family Time - up to 40 hours per calendar year.
• Parental Leave – 480 hours within one year of the birth/adoption/foster care of a child.
• Bereavement Leave – 240 hours for an immediate family member.
• Caregiver Leave – 80 hours in a 52-week rolling period.
• Volunteer Leave – 32 hours per calendar year.
• Military Spouse Time-Off – 80 hours per calendar year.