Principal Med Device Security Engineer

Johnson & Johnson

Principal Product Security Engineer ensuring security for medical devices at Johnson & Johnson. Collaborating with engineering teams to implement security strategies and handle compliance during the product lifecycle.

Posted 7/22/2026full-timeDanvers • Maine, Massachusetts, Nevada, Pennsylvania, South Carolina • 🇺🇸 United StatesLead💰 $102,000 - $177,100 per yearWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates extensive expertise in Information Security, particularly in embedded systems and medical device cybersecurity, with a strong focus on secure development practices, risk assessments, and regulatory compliance. Proficient in translating technical security requirements into actionable solutions while leading projects and fostering cybersecurity awareness.

Highest-signal resume keywords

10+ Years Industry Experience In Information Security8+ Years Experience With Embedded System, IOT, Or Medical Device CybersecurityExperience Generating Threat Models Without ToolsExperience Supporting Regulatory Security SubmissionsKnowledge Of Real-Time Operating Systems Hardening Techniques

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Threat ModelingRisk Assessments Utilizing CVSS 3.1Technical Security Requirements WritingThird-Party Penetration TestingVulnerability ScanningSecure Coding RecommendationsSBOM GenerationMemory Safety StrategiesExecution Vulnerabilities MitigationData Privacy Experience

Soft Skills

Autonomous WorkProactive Problem SolvingProject ManagementCommunication SkillsLeadership

Tools & Technologies

Static AnalysisDynamic AnalysisFuzz TestingFormal VerificationCloud Security Principles

Certifications & Qualifications

Bachelor's DegreeHITRUSTISO 27001

Industry Keywords

FDA Cybersecurity Guidance (2025)EU MDRNIST 800-53IMDRFAAMI TIR57HIPAAGDPR

Tech Stack

Tools & technologies

CloudCyber SecurityIoTRTOS

About the role

Key responsibilities & impact

Lead Secure Development Lifecycle practices, integrating threat modeling, static/dynamic analysis, fuzz testing, and formal verification into the development process.
Work with R&D Engineering to define hardware security architecture, including trust zones, hardware root of trust (HRoT), and secure microcontroller protections.
Implement memory safety strategies to mitigate buffer overflows, side-channel attacks, and execution vulnerabilities in real-time operating systems (RTOS) and bare-metal firmware.
Respond to customer cybersecurity questionnaires and contractual language for post-market medical devices under your responsibility as necessary.

Requirements

What you’ll need

10+ years industry experience in Information Security
8+ years experience with embedded system, IOT, or medical device cybersecurity
Bachelor’s degree or equivalent
Experience generating Threat models without the use of threat modeling tools
Experience performing risk assessments utilizing CVSS 3.1 or higher, with STRIDE per element
Ability to write technical security requirements for embedded systems and web platforms based on the latest regulations
Understanding and execution of third-party penetration testing, vulnerability scanning, CVSS and/or other general security testing principles
Experience supporting regulatory security submissions, ensuring compliance with FDA Cybersecurity Guidance (2025), EU MDR, NIST 800-53, IMDRF, and AAMI TIR57
Knowledge of real-time operating systems hardening techniques
Knowledge of cloud security principles
Ability to generate SBOMs from Software source code and Binaries, Firmware, and Operating Systems
Ability to generate pre-market risk assessments against the threat model leveraging STRIDE and post-market risk assessments via SCA SBOM scans.
Ability to generate the security architecture views for medical devices that could include: Global System View, Multi-Patient Harm View, Updateability/Patchability view and, detailing system boundaries, data flows, and external interactions to show risk mitigation, ensuring transparency, and supporting post-market management
Ability to translate technical security requirements into solutions
Ability to provide secure coding recommendations and execute reviews
Data privacy experience, including HIPAA and GDPR
Understanding of industry standards and certifications such as HITRUST & ISO 27001
Ability to work autonomously and proactively seek out product security opportunities within heart recovery
Ability to lead large projects and proven ability to track to project plan timelines from a security perspective
Ability to create and deliver cybersecurity awareness campaigns and other communications

Benefits

Comp & perks

Vacation –120 hours per calendar year
Sick time - 40 hours per calendar year; for employees who reside in the State of Colorado –48 hours per calendar year; for employees who reside in the State of Washington –56 hours per calendar year
Holiday pay, including Floating Holidays –13 days per calendar year
Work, Personal and Family Time - up to 40 hours per calendar year
Parental Leave – 480 hours within one year of the birth/adoption/foster care of a child
Bereavement Leave – 240 hours for an immediate family member: 40 hours for an extended family member per calendar year
Caregiver Leave – 80 hours in a 52-week rolling period
Volunteer Leave – 32 hours per calendar year
Military Spouse Time-Off – 80 hours per calendar year