Product Security Engineer

This is a rare opportunity to join a team that is bringing an entirely new category of brain health to the world. At Cognito, we are developing therapies designed to promote dignity, clarity, and coherence in the lives they touch.

Cognito is a neurotechnology company developing a new therapeutic approach to cognitive and neurological health, designed to work with the brain's own activity and biology. Born from pioneering neuroscience research at MIT, Cognito brings together neuroscience, engineering, medicine and technology to translate breakthroughs in brain science into practical therapies designed for everyday life.

Our first therapeutic application, Spectris AD, is an investigational, prescription, at-home therapy for Alzheimer's disease. With our pivotal HOPE study now complete, Cognito is entering an important new phase as we advance Spectris AD toward regulatory review, prepare for potential commercialization and continue exploring the broader potential of our science across neurological health.

We are building an interdisciplinary team united by a shared purpose: protecting and progressing the human ability to think, learn and remember. For innovators who want to work at the intersection of breakthrough science, technology and human health, Cognito offers the chance to help shape what comes next.

Cognito is building a Security, Privacy, and IT organization from the ground up under the SVP of Security, Privacy, and IT, structured across three functions. The Product Security Engineer is a founding hire in Information Security. This is a specialized medical device product security role: you'll work directly alongside our hardware, software, and systems engineers to build security into the product's design and architecture, own the cybersecurity portions of our FDA submission, and run security operations for the product once it's in the field.

This role reports to the Information Security Director; until that role is filled, it may report directly to the SVP.

• Partner directly with hardware, software, and systems engineers throughout the product development lifecycle to build security into the product's design, requirements, and architecture from the start — not bolted on after the fact.
• Own system-level threat modeling (e.g., STRIDE or an equivalent structured method) spanning hardware, firmware, software, and connectivity, and maintain the security requirements that feed into design reviews.

• Own the cybersecurity portions of our FDA submission — premarket cybersecurity documentation, software bill of materials (SBOM), security risk assessments, architecture views, threat models, Secure Product Development Framework, Cybersecurity Management Plan, Coordinated Vulnerability Disclosures, and other portions of our FDA submission.
• Respond directly to FDA review questions during the submission process.

• Operate within Cognito's Quality Management System (e.g., ISO 13485 / 21 CFR 820 design controls), ensuring security work products — risk assessments, verification and validation evidence, design history file inputs — meet QMS documentation, traceability, and change-control requirements.
• Own the security risk management process for the product, integrating cybersecurity risk into the broader product risk management file in alignment with medical device risk management practice (e.g., ISO 14971-aligned methodology).

• Plan and execute (or coordinate third-party) security testing across the product — penetration testing, vulnerability scanning, and other targeted assessments — both pre-release and as part of periodic post-market testing, driving findings…