Lead Product Security Engineer
Johnson & Johnson
August 30, 2026
On-site
Danvers, MA
IT
Product Security Analyst
Primary Duties and Responsibilities:
- Partner with engineering and cross-functional teams (cloud, console, pump, etc.) to drive adherence to J&J Heart Recovery’s product security program.
- Deliver pre-market documentation: security plans, architecture and data flow diagrams, threat models, requirements, SBOM, and risk documentation.
- Define and implement key management infrastructure (PKI, HSMs, TPMs, secure enclave integration) for device identity, authentication, and software signing.
- Monitor and drive post-market vulnerability management activities within strict timelines.
- Support compliance certification activities (e.g., SOC2, FedRAMP, ISO 27001).
- Identify, research, evaluate, and integrate new compliance requirements and industry standards/trends into the program.
- Guide teams to balance business needs with security objectives.
- Think across organizational boundaries; empathize with internal and external customers.
Job Qualifications:
- Bachelor’s degree in Computer Science, Information Systems, or related field.
- 4+ years industry experience in Information Security.
- Working knowledge of regulatory standards and compliance frameworks (e.g., NIST Cybersecurity Framework, ISO27001, SOC2, HIPAA, GDPR).
- Experience with security risk management techniques and tactics.
- Experience in a regulated environment; FDA-regulated preferred.
- Strong organizational skills, attention to detail, ability to manage multiple assignments and meet deadlines.
- Urgency, willingness to embrace new challenges.
- Strong communication and interpersonal skills.
Other:
- Up to 20% travel.
Primary Duties and Responsibilities:
- Partner with engineering and cross-functional teams (cloud, console, pump, etc.) to drive adherence to J&J Heart Recovery’s product security program.
- Deliver pre-market documentation: security plans, architecture and data flow diagrams, threat models, requirements, SBOM, and risk documentation.
- Define and implement key management infrastructure (PKI, HSMs, TPMs, secure enclave integration) for device identity, authentication, and software signing.
- Monitor and drive post-market vulnerability management activities within strict timelines.
- Support compliance certification activities (e.g., SOC2, FedRAMP, ISO 27001).
- Identify, research, evaluate, and integrate new compliance requirements and industry standards/trends into the program.
- Guide teams to balance business needs with security objectives.
- Think across organizational boundaries; empathize with internal and external customers.
Job Qualifications:
- Bachelor’s degree in Computer Science, Information Systems, or related field.
- 4+ years industry experience in Information Security.
- Working knowledge of regulatory standards and compliance frameworks (e.g., NIST Cybersecurity Framework, ISO27001, SOC2, HIPAA, GDPR).
- Experience with security risk management techniques and tactics.
- Experience in a regulated environment; FDA-regulated preferred.
- Strong organizational skills, attention to detail, ability to manage multiple assignments and meet deadlines.
- Urgency, willingness to embrace new challenges.
- Strong communication and interpersonal skills.
Other:
- Up to 20% travel.