Lead Product Security Engineer

Responsibilities

• Partner with engineering and other cross-functional teams (cloud, console, pump, etc.) to drive successful adherence to J&J Heart Recovery's product security program.
• Deliver documentation for pre-market development activities including security plans, architecture and data flow diagrams, threat models, requirements, SBOM, and risk documentation.
• Define and implement key management infrastructure (PKI, HSMs, TPMs, and secure enclave integration) for device identity, authentication, and software signing.
• Monitor and drive post-market vulnerability management activities, with adherence to strict timelines.
• Support compliance certification activities, such as SOC2, FedRAMP, ISO 27001, etc.
• Identify, research, evaluate, and integrate new compliance requirements and industry standards/trends into the product security program.
• Guide teams to make decisions that balance business needs with security objectives.

• Bachelor’s degree in Computer Science, Information Systems, or related field
• 4+ years industry experience in Information Security
• Working knowledge of regulatory standards and compliance frameworks (e.g., NIST Cybersecurity Framework, ISO
  27001, SOC2, HIPAA, GDPR)
• Experience with security risk management techniques and tactics
• Experience working in a regulated environment, FDA-regulated preferred
• Demonstrated organizational skills, attention to detail
• Strong communication and interpersonal skills