Product Security Engineer

This is a rare opportunity to join a team that is bringing an entirely new category of brain health to the world. At Cognito, we are developing therapies designed to promote dignity, clarity, and coherence in the lives they touch.

Cognito is a neurotechnology company developing a new therapeutic approach to cognitive and neurological health, designed to work with the brain's own activity and biology. Born from pioneering neuroscience research at MIT, Cognito brings together neuroscience, engineering, medicine and technology to translate breakthroughs in brain science into practical therapies designed for everyday life.

Our first therapeutic application, Spectris AD, is an investigational, prescription, at-home therapy for Alzheimer's disease. With our pivotal HOPE study now complete, Cognito is entering an important new phase as we advance Spectris AD toward regulatory review, prepare for potential commercialization and continue exploring the broader potential of our science across neurological health.

We are building an interdisciplinary team united by a shared purpose: protecting and progressing the human ability to think, learn and remember. For innovators who want to work at the intersection of breakthrough science, technology and human health, Cognito offers the chance to help shape what comes next.

About the Job

Cognito is building a Security, Privacy, and IT organization from the ground up under the SVP of Security, Privacy, and IT, structured across three functions. The Product Security Engineer is a founding hire in Information Security. This is a specialized medical device product security role: you'll work directly alongside our hardware, software, and systems engineers to build security into the product's design and architecture, own the cybersecurity portions of our FDA submission, and run security operations for the product once it's in the field. This role reports to the Information Security Director; until that role is filled, it may report directly to the SVP.

Responsibilities

• Partner directly with hardware, software, and systems engineers throughout the product development lifecycle to build security into the product's design, requirements, and architecture from the start - not bolted on after the fact.
• Own system-level threat modeling (e.g., STRIDE or an equivalent structured method) spanning hardware, firmware, software, and connectivity, and maintain the security requirements that feed into design reviews.

FDA Submission & Regulatory Documentation

• Own the cybersecurity portions of our FDA submission - premarket cybersecurity documentation, software bill of materials (SBOM), security risk assessments, architecture views, threat models, Secure Product Development Framework, Cybersecurity Management Plan, Coordinated Vulnerability Disclosures, and other portions of our FDA submission.
• Respond directly to FDA review questions during the submission process.

Quality Management System (QMS) Integration & Risk Management

• Operate within Cognito's Quality Management System (e.g., ISO 13485 / 21 CFR 820 design controls), ensuring security work products - risk assessments, verification and validation evidence, design history file inputs - meet QMS documentation, traceability, and change-control requirements.
• Own the security risk management process for the product, integrating cybersecurity risk into the broader product risk management file in alignment with medical device risk management practice (e.g., ISO 14971-aligned methodology).

Security Testing

• Plan and execute (or coordinate third-party) security testing across the product - penetration testing, vulnerability scanning, and other targeted assessments - both pre-release and as part of periodic post-market testing, driving findings through to verified closure.

Post-Market Security Operations

• Run the vulnerability management program for the fielded product: intake, CVSS-based triage and prioritization, remediation tracking against defined SLAs, and SBOM-based monitoring of third-party and open-source component vulnerabilities.
• Build and operate ongoing post-market monitoring - threat intelligence review, vulnerability disclosure intake, and field data review - to meet FDA post-market cybersecurity obligations, including trend analysis and escalation into the complaint-handling / CAPA process where security issues are involved.

Cross-Functional Partnership & Program Building

• Serve as the embedded security point of contact across hardware, software, and systems engineering teams, joining design reviews and risk management activities as needed.
• Build reusable documentation, templates, and repeatable processes now so these practices scale as the security team grows.

Qualifications

Required

• 8+ years of experience in product/application security, including direct prior experience working as a Product Security Engineer (or a closely equivalent role) at a medical device company.
• Hands-on experience preparing cybersecurity content for FDA submissions - premarket cybersecurity documentation, SBOM, risk assessments, and security architecture views - and experience responding to FDA review questions.
• Direct experience working within a Quality Management System (e.g., ISO 13485, 21 CFR 820), including comfort operating under design controls, document control, and traceability requirements.
• Experience integrating cybersecurity risk into a medical device product risk management process (e.g., ISO 14971-aligned risk management file).
• Demonstrated experience partnering directly with hardware, software, and systems engineers to build security into product design and architecture - this is not a software-only application security role.
• Hands-on experience running security testing (e.g., penetration testing, vulnerability scanning) and post-market vulnerability management, including SBOM-based third-party/component risk tracking.
• Travel as needed.

Preferred

• Bachelor’s degree in Computer Science, Computer Engineering, Electrical Engineering, Cybersecurity, Biomedical Engineering, or a related technical discipline.
• Familiarity with FDA's postmarket cybersecurity guidance and experience supporting field actions or post-market corrective actions tied to security findings.
• Experience specifically with connected or networked medical devices, or software as a medical device (SaMD).
• Working knowledge of SOC 2, HIPAA, and/or HITRUST control frameworks.
• Experience coordinating third-party penetration testing or running a responsible disclosure / bug bounty intake process.
• Experience presenting cybersecurity risk directly to auditors, notified bodies, or regulatory reviewers.

Other

• Hybrid position preferred; flexibility required during peak periods, which may include supporting time-sensitive FDA submission or post-market security activities outside normal business hours as needed.
• Working onsite in Cognito's Cambridge, MA office, manufacturing partners, or test sites may be required.

Competitive Benefits

Taking care of our own is one of our highest priorities. That’s why we offer benefits including unlimited PTO, wellness perks, virtual medical support, and health, dental, and vision insurance.

Physical Requirements & Work Environment

• This role is primarily performed in an office or home-office setting. Essential physical requirements include the ability to work at a computer for extended periods, communicating effectively in written and verbal formats, and participate in video and in-person meetings.
• Occasional travel to partner sites may be required. For remote roles, occasional travel to Cognito’s Cambridge, MA office may also be required.

Cognito Therapeutics is committed to providing reasonable accommodation for qualified individuals with disabilities throughout the application and hiring process. If you require accommodation, please contact us at [email protected].

Cognito Therapeutics is an Equal Opportunity Employer. We are committed to building a diverse and inclusive workplace and make employment decisions based on qualifications, merit, business needs, and job requirements. We do not discriminate on the basis of race, color, religion, sex, sexual orientation, gender identity or expression, national origin, age, disability, veteran status, genetic information, or any other characteristic protected by applicable federal, state, or local law.

All applicants must be legally authorized to work in the United States.