Principal Med Device Security Engineer

About the role

Johnson & Johnson’s MedTech cybersecurity team is recruiting for an experienced Principal Product Security Engineer to be located in Danvers, MA. Remote work options may be considered on a case‑by‑case basis if approved by the Company. The role requires up to 10%‑20% travel. You will join a collaborative, Patient First! culture and have the opportunity to impact development initiatives that shape future product development and industry standards. You will own the Product Security process for the products you support throughout the product development lifecycle, covering both pre‑market and post‑market activities.

Responsibilities

• Implement J&J’s enterprise Product Security strategy and framework throughout the Heart Recovery portfolio of medical devices and supporting platforms.
• Provide technical expertise and strategic leadership in securing Impella heart pump technologies, next‑generation cardiac support systems, and connected medical devices.
• Deliver security architecture, cryptographic controls, embedded system protections/controls, and threat mitigation techniques to ensure robust, regulatory‑compliant security across the product lifecycle.
• Support heart recovery throughout new product development phases: review product security requirements and recommend security design solutions; complete Quality documentation; perform threat modelling; coordinate third‑party penetration testing; conduct software architecture reviews and design recommendations; perform code analysis and other security testing as needed.
• Handle post‑market responsibilities for marketed Heart Recovery devices: monitor for new vulnerabilities; assist with patching and remediation plans; respond to customer security questionnaires; review security language within contractual agreements as needed.
• Drive alignment to J&J Product Security’s overarching framework and support the Product Security strategy and objectives within Heart Recovery.
• Define and implement secure boot, firmware integrity validation, and anti‑tamper mechanisms to protect Heart Recovery device firmware against unauthorized modification.
• Enforce cryptographic protocols for data‑at‑rest and data‑in‑transit, ensuring compliance with FDA cybersecurity requirements, NIST 800‑175, FIPS 140‑3, and IEC 62443.
• Define and implement key management infrastructure (PKI, HSMs, TPMs, secure enclave integration) for device identity, authentication, and software signing.
• Develop real‑time vulnerability assessment techniques for detecting security flaws in wireless communications (Bluetooth LE, NFC, Wi‑Fi, 5G, proprietary RF) used in Heart Recovery’s medical devices.
• Implement Zero Trust security for device‑to‑cloud connectivity, integrating mTLS and continuous authentication models into clinical applications.
• Oversee secure OTA (over‑the‑air) update mechanisms, ensuring firmware rollbacks, code signing, and supply chain integrity validation.
• Lead Secure Development Lifecycle practices, integrating threat modeling, static/dynamic analysis, fuzz testing, and formal verification into the development process.
• Work with R&D Engineering to define hardware security architecture, including trust zones, hardware root of trust (HRoT), and secure microcontroller protections.
• Implement memory safety strategies to mitigate buffer overflows, side‑channel attacks, and execution