[Remote] Product Security Engineer

Note: The job is a remote job and is open to candidates in USA. Cognito Therapeutics is hiring a Product Security Engineer to build security into the design and architecture of its medical device product. The role owns cybersecurity documentation for FDA submissions, product security risk management, testing, and post-market vulnerability operations.

Responsibilities

• Partner directly with hardware, software, and systems engineers throughout the product development lifecycle to build security into the product's design, requirements, and architecture from the start — not bolted on after the fact
• Own system-level threat modeling (e.g., STRIDE or an equivalent structured method) spanning hardware, firmware, software, and connectivity, and maintain the security requirements that feed into design reviews
• Own the cybersecurity portions of our FDA submission — premarket cybersecurity documentation, software bill of materials (SBOM), security risk assessments, architecture views, threat models, Secure Product Development Framework, Cybersecurity Management Plan, Coordinated Vulnerability Disclosures, and other portions of our FDA submission
• Respond directly to FDA review questions during the submission process
• Operate within Cognito's Quality Management System (e.g., ISO 13485 / 21 CFR 820 design controls), ensuring security work products — risk assessments, verification and validation evidence, design history file inputs — meet QMS documentation, traceability, and change-control requirements
• Own the security risk management process for the product, integrating cybersecurity risk into the broader product risk management file in alignment with medical device risk management practice (e.g., ISO 14971-aligned methodology)
• Plan and execute (or coordinate third-party) security testing across the product — penetration testing, vulnerability scanning, and other targeted assessments — both pre-release and as part of periodic post-market testing, driving findings through to verified closure
• Run the vulnerability management program for the fielded product: intake, CVSS-based triage and prioritization, remediation tracking against defined SLAs, and SBOM-based monitoring of third-party and open-source component vulnerabilities
• Build and operate ongoing post-market monitoring — threat intelligence review, vulnerability disclosure intake, and field data review — to meet FDA post-market cybersecurity obligations, including trend analysis and escalation into the complaint-handling / CAPA process where security issues are involved
• Serve as the embedded security point of contact across hardware, software, and systems engineering teams, joining design reviews and risk management activities as needed
• Build reusable documentation, templates, and repeatable processes now so these practices scale as the security team grows

Skills

• 8+ years of experience in product/application security, including direct prior experience working as a Product Security Engineer (or a closely equivalent role) at a medical device company
• Hands-on experience preparing cybersecurity content for FDA submissions — premarket cybersecurity documentation, SBOM, risk assessments, and security architecture views — and experience responding to FDA review questions
• Direct experience working within a Quality Management System (e.g., ISO 13485, 21 CFR 820), including comfort operating under design controls, document control, and traceability requirements
• Experience integrating cybersecurity risk into a medical device product risk management process (e.g., ISO 14971-aligned risk management file)
• Demonstrated experience partnering directly with hardware, software, and systems engineers to build security into product design and architecture — this is not a software-only application security role
• Hands-on experience running security testing (e.g., penetration testing, vulnerability scanning) and post-market vulnerability management, including SBOM-based third-party/component risk tracking
• All applicants must be legally authorized to work in the United States
• Bachelor's degree in Computer Science, Computer Engineering, Electrical Engineering, Cybersecurity, Biomedical Engineering, or a related technical discipline
• Familiarity with FDA's postmarket cybersecurity guidance and experience supporting field actions or post-market corrective actions tied to security findings
• Experience specifically with connected or networked medical devices, or software as a medical device (SaMD)
• Working knowledge of SOC 2, HIPAA, and/or HITRUST control frameworks
• Experience coordinating third-party penetration testing or running a responsible disclosure / bug bounty intake process
• Experience presenting cybersecurity risk directly to auditors, notified bodies, or regulatory reviewers

Benefits

• Unlimited PTO
• Wellness perks
• Virtual medical support
• Health, dental, and vision insurance
• Hybrid position preferred

Company Overview