Principal Product Security Engineer
Not Disclosed•Full-TimeHybrid
location_onHybrid
About the Team
At Johnson & Johnson, we believe health is everything. Our strength in healthcare innovation empowers us to build a world where complex diseases are prevented, treated, and cured, where treatments are smarter and less invasive, and solutions are personal. Through our expertise in Innovative Medicine and MedTech, we are uniquely positioned to innovate across the full spectrum of healthcare solutions today to deliver the breakthroughs of tomorrow, and profoundly impact health for humanity.
This role sits within the newly formed Product Security team at Abiomed, a top-performing medical device company within the Johnson & Johnson family. We are building a community of collaborative colleagues working in a "Patient First!" culture, dedicated to ensuring security is implemented by design.
About the Role
As a Principal Product Security Engineer, you will own the Product Security process, encompassing both pre-market and post-market phases that engineering teams leverage throughout the product development lifecycle. This is an exciting opportunity to impact development initiatives that will shape future product development and industry standards.
You will partner with diverse engineering teams—including cloud, console, and pump development—to drive successful adherence to Abiomed's product security policies and program objectives. Acting as a Subject Matter Expert (SME) on cybersecurity matters, you will advocate for the proactive inclusion of security input into all phases of the product life cycle, process improvements, CAPAs, and strategic product roadmap planning. Your work will directly balance business needs with medical device security objectives, guiding teams to make informed decisions while maintaining empathy for both internal and external customers.
Hiring Process
We are committed to providing an interview process that is inclusive of our applicants' needs. If you are an individual with a disability and would like to request an accommodation, please email the Employee Health Support Center (ra-employeehealthsup@its.jnj.com) or contact AskGS to be directed to your accommodation resource.
Candidates for this role must be located in Danvers, MA, or Raritan, NJ. For candidates within commutable distance to the site, being in the office for a minimum of 3 days per week is required. Remote work options may be considered on a case-by-case basis and if approved by the Company.
Equal Opportunity
Johnson & Johnson is an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, age, national origin, disability, protected veteran status, or other characteristics protected by federal, state, or local law. We actively seek qualified candidates who are protected veterans and individuals with disabilities as defined under VEVRAA and Section 503 of the Rehabilitation Act.
Work location
Work model: Hybrid
Hybrid
Key Responsibilities
- check_circlePartner with engineering teams to drive adherence to product security policies and program objectives
- check_circleCreate, update, and improve product security processes throughout the development lifecycle
- check_circleDrive and monitor post-market vulnerability management activities with strict adherence to timelines
- check_circleSupport compliance certification activities such as SOC2, FedRAMP, and ISO 27001
- check_circleIdentify and integrate new compliance requirements and industry standards into security programs
- check_circleGuide teams to balance business needs with medical device security objectives
- check_circleDeliver pre-market documentation including security plans, threat models, and risk management artifacts
- check_circleAct as a subject matter expert to provide cybersecurity guidance to development teams
Requirements
- verifiedBachelor's degree
- verified5+ years industry experience in Information Security
- verifiedWorking knowledge of regulatory standards and compliance frameworks (e.g., NIST Cybersecurity Framework, ISO27001, SOC2, HIPAA, GDPR)
- verifiedExperience with security risk management techniques
Nice to Have
Experience working in a regulated environment, specifically FDA-regulated.
Benefits & Perks
check_circleMedical, dental, vision, life, short- and long-term disability, business accident, and group legal insurancecheck_circleCompany-sponsored consolidated retirement plan (pension) and 401(k) savings plancheck_circleVacation time up to 120 hours per calendar yearcheck_circleSick time up to 40 hours per calendar year (56 hours for Washington residents)
