Principal Product Security Engineer (Cybersecurity)

Location: Santa Clara, California, United States; up to 10% travel. Relocation to the San Francisco Bay Area may be considered case by case.

Salary: $118,000–$203,550 base pay annually.

Company

Johnson & Johnson MedTech develops connected healthcare technologies and less invasive, personalized medical treatments.

What you will do

• Lead cybersecurity activities for complex medical device and digital health product programs.
• Develop and maintain security requirements for embedded systems, software, cloud services, and connected devices.
• Conduct threat modeling, attack surface analysis, security design reviews, and cybersecurity risk assessments.
• Perform or coordinate security testing, including static analysis, software composition analysis, vulnerability scanning, fuzz testing, and penetration testing.
• Lead vulnerability investigations, root cause analysis, remediation planning, patching strategies, and post-market security activities.
• Provide technical input for product releases, quality documentation, regulatory submissions, audits, and customer security materials.

Requirements

• Bachelor’s degree in computer science, cybersecurity, software engineering, computer engineering, or equivalent practical experience.
• 8+ years of experience in cybersecurity, product security, cloud security, or related technical disciplines.
• Expertise in threat modeling, secure software development, vulnerability management, penetration testing, security design reviews, and cybersecurity risk assessment.
• Experience securing embedded systems, connected medical devices, IoT products, robotics platforms, cloud-connected systems, or other cyber-physical products.
• Strong knowledge of authentication, authorization, cryptography, secure boot, key management, operating system hardening, network security, logging, monitoring, and secure update mechanisms.
• Ability to lead complex security initiatives across multiple teams and translate cybersecurity risks into practical engineering recommendations.

Nice to have

• Experience with medical devices, healthcare technology, surgical robotics, regulated software, or connected health platforms.
• Knowledge of FDA and global medical device cybersecurity requirements and standards including ISO 14971, IEC 62304, IEC 81001-5-1, HIPAA, GDPR, HITRUST, ISO 27001, OWASP Top 10, SOC 2, or FedRAMP.
• Experience with AWS, Azure, cloud security, web application security, or secure infrastructure design.
• Software development experience in C, C++, C#, Java, Python, or similar languages.
• CISSP, CSSLP, GIAC, GICSP, or a similar security certification.

Culture & Benefits

• Inclusive work environment guided by the company’s Credo.
• Retirement pension and 401(k) savings plans.
• Vacation, sick time, holiday pay, personal and family time, parental leave, bereavement leave, caregiver leave, volunteer leave, and military spouse time off.
• Up to 10% travel may be required.