Principal Med Device Security Engineer

About the role

Johnson & Johnson’s MedTech cybersecurity team is recruiting for an experienced Principal Product Security Engineer to be located in Danvers, MA. Remote work options may be considered on a case‑by‑case basis and if approved by the Company. This role will require up to 10%-20% travel.

Responsibilities

• Support heart recovery throughout a new product’s development phases
• Review product security requirements and recommend security design solutions
• Complete Quality documentation
• Perform threat modelling
• Coordinate third‑party penetration testing
• Conduct software architecture review and provide design recommendations
• Perform code analysis and other security testing as needed
• Monitor for new vulnerabilities in marketed Heart Recovery devices
• Assist with patching and remediation plans
• Respond to customer security questionnaires
• Review security language within contractual agreements as needed
• Drive alignment to J&J Product Security’s overarching framework
• Support the Product Security strategy and objectives within Heart Recovery
• Define and implement secure boot, firmware integrity validation, and anti‑tamper mechanisms to protect Heart Recovery Device firmware against unauthorized modification
• Enforce cryptographic protocols for data‑at‑rest and data‑in‑transit, ensuring compliance with FDA cybersecurity requirements, NIST 800‑175, FIPS 140‑3, and IEC 62443
• Define and implement key management infrastructure (PKI, HSMs, TPMs, and secure enclave integration) for device identity, authentication, and software signing
• Develop real‑time vulnerability assessment techniques for detecting security flaws in wireless communications (Bluetooth LE, NFC, Wi‑Fi, 5G, proprietary RF) used in Heart Recovery’s medical devices
• Implement Zero Trust security for device‑to‑cloud connectivity, integrating mTLS and continuous authentication models into clinical applications
• Oversee secure OTA (over‑the‑air) update mechanisms, ensuring firmware rollbacks, code signing, and supply chain integrity validation
• Lead Secure Development Lifecycle practices, integrating threat modeling, static/dynamic analysis, fuzz testing, and formal verification into the development process
• Work with R&D Engineering to define hardware security architecture, including trust zones, hardware root of trust (HRoT), and secure microcontroller protections
• Implement memory safety strategies to mitigate buffer overflows, side‑channel attacks, and execution vulnerabilities in real‑time operating systems (RTOS) and bare‑metal firmware
• Respond to customer cybersecurity questionnaires and contractual language for post‑market medical devices under your responsibility as necessary

Requirements

• 10+ years industry experience in Information Security
• 8+ years experience with embedded system, IOT, or medical device cybersecurity
• Bachelor’s degree or equivalent
• Experience generating Threat models without the use of threat modeling tools
• Experience performing risk assessments utilizing CVSS 3.1 or higher, with STRIDE per element
• Ability to write technical security requirements for embedded systems and web platforms based on the latest regulations
• Understanding and execution of third‑party penetration testing, vulnerability scanning, CV