Principal Product Security Engineer
Not Disclosed•Full-TimeHybrid
location_onHybrid
About the Team
At Johnson & Johnson, we believe health is everything. Our strength in healthcare innovation empowers us to build a world where complex diseases are prevented, treated, and cured, where treatments are smarter and less invasive, and solutions are personal. Through our expertise in Innovative Medicine and MedTech, we are uniquely positioned to innovate across the full spectrum of healthcare solutions today to deliver the breakthroughs of tomorrow, and profoundly impact health for humanity.
This role sits within the newly formed Product Security team at Abiomed, a top-performing medical device company within the Johnson & Johnson family. The team operates within a "Patient First!" culture, fostering a community of collaborative colleagues dedicated to ensuring security is implemented by design.
About the Role
We are searching for a Principal Product Security Engineer to join our mission of shaping future product development and industry standards. This is an exciting opportunity to leverage your security risk and compliance skills to make a direct difference in patient lives.
You will own the Product Security process, encompassing both pre-market and post-market phases that engineering teams leverage throughout the product development lifecycle. Your day-to-day will involve partnering with engineering teams (cloud, console, pump, etc.) to drive adherence to product security policies and serving as a Subject Matter Expert (SME) on cyber security matters. You will advocate for the proactive inclusion of cyber security input into all phases of the product life cycle, strategic road map planning, and process improvements. By guiding teams to balance business needs with medical device security objectives, you will help ensure the integrity of the products that impact patients globally.
Hiring Process & Application
We are looking for candidates passionate about security who are eager to join a collaborative community. Remote work options may be considered on a case-by-case basis if approved by the Company. For this specific role, candidates located in Danvers, MA or Raritan, NJ are required to be in the office for a minimum of 3 days per week (for those within commutable distance).
If you are committed to working with a sense of urgency and embracing new challenges, we invite you to apply. Johnson & Johnson is committed to providing an interview process that is inclusive of our applicants' needs. If you are an individual with a disability and would like to request an accommodation, please email the Employee Health Support Center or contact AskGS to be directed to your accommodation resource.
Equal Opportunity & Culture
Johnson & Johnson is an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, age, national origin, disability, protected veteran status, or other characteristics protected by federal, state, or local law. We actively seek qualified candidates who are protected veterans and individuals with disabilities as defined under VEVRAA and Section 503 of the Rehabilitation Act.
Work location
Work model: Hybrid
Hybrid
Key Responsibilities
- check_circlePartner with engineering teams to drive adherence to product security policies and program objectives
- check_circleCreate, update, and improve product security processes throughout the development lifecycle
- check_circleDrive and monitor post-market vulnerability management activities with strict adherence to timelines
- check_circleSupport compliance certification activities such as SOC2, FedRAMP, and ISO 27001
- check_circleIdentify and integrate new compliance requirements and industry standards into security programs
- check_circleGuide teams to balance business needs with medical device security objectives
- check_circleDeliver pre-market documentation including security plans, threat models, and risk management artifacts
- check_circleAct as a subject matter expert to provide cybersecurity guidance to development teams
Requirements
- verifiedBachelor's degree
- verified5+ years industry experience in Information Security
- verifiedWorking knowledge of regulatory standards and compliance frameworks (e.g., NIST Cybersecurity Framework, ISO27001, SOC2, HIPAA, GDPR)
- verifiedExperience with security risk management techniques
Nice to Have
Experience working in a regulated environment, specifically FDA-regulated.
Benefits & Perks
check_circleMedical, dental, vision, life, short- and long-term disability, business accident, and group legal insurancecheck_circleConsolidated retirement plan (pension) and 401(k) savings plancheck_circleVacation time up to 120 hours per calendar yearcheck_circleSick time up to 40 hours per calendar year (56 hours for Washington residents)Holiday pay including up to 13 floating holidays per calendar year
