{"id":2933397,"url":"https://alion.io/job/cognito-therapeutics-inc-product-security-engineer","title":"Sr Product Security Engineer","company":{"id":2151697,"name":"Cognito Therapeutics, Inc.","domain":"cognitotx.com","url":"https://alion.io/company/cognitotx","size_band":"51-200","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Ashby","truth_index":null},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"explicit","locations":["Cambridge, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":122000,"max_usd":234000,"period":"year","method":"role_seniority_country_remote_cell","sample_n":1385},"experience_years_min":8,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"21 CFR Part 820","optional":false},{"name":"CAPA","optional":false},{"name":"CVSS","optional":false},{"name":"Design Controls","optional":false},{"name":"Design History File","optional":false},{"name":"HIPAA","optional":false},{"name":"ISO 13485","optional":false},{"name":"ISO 14971","optional":false},{"name":"SBOM","optional":false},{"name":"SOC 2","optional":false},{"name":"STRIDE","optional":false},{"name":"Threat Modeling","optional":false},{"name":"Verification & Validation","optional":false}],"status":"live","first_seen_at":"2026-10-20T12:57:19Z","employer_posted_date":"2026-10-20","last_verified_at":"2026-11-02T16:19:31Z","board_verified":true,"closed_at":null,"days_open":13,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":13},"description":"This is a rare opportunity to join a team that is bringing an entirely new category of brain health to the world. At Cognito, we are developing therapies designed to promote dignity, clarity, and coherence in the lives they touch. \nCognito is a neurotechnology company developing a new therapeutic approach to cognitive and neurological health, designed to work with the brain's own activity and biology. Born from pioneering neuroscience research at MIT, Cognito brings together neuroscience, engineering, medicine and technology to translate breakthroughs in brain science into practical therapies designed for everyday life. \nOur first therapeutic application, Spectris AD, is an investigational, prescription, at-home therapy for Alzheimer's disease. With our pivotal HOPE study now complete, Cognito is entering an important new phase as we advance Spectris AD toward regulatory review, prepare for potential commercialization and continue exploring the broader potential of our science across neurological health. \nWe are building an interdisciplinary team united by a shared purpose: protecting and progressing the human ability to think, learn and remember. For innovators who want to work at the intersection of breakthrough science, technology and human health, Cognito offers the chance to help shape what comes next.\nAbout the Job\nCognito is building a Security, Privacy, and IT organization from the ground up under the SVP of Security, Privacy, and IT, structured across three functions. The Sr Product Security Engineer is a founding hire in Information Security. This is a specialized medical device product security role: you'll work directly alongside our hardware, software, and systems engineers to build security into the product's design and architecture, own the cybersecurity portions of our FDA submission, and run security operations for the product once it's in the field. This role reports to the Information Security Director; until that role is filled, it may report directly to the SVP.\nResponsibilities\nPartner directly with hardware, software, and systems engineers throughout the product development lifecycle to build security into the product's design, requirements, and architecture from the start - not bolted on after the fact.\nOwn system-level threat modeling (e.g., STRIDE or an equivalent structured method) spanning hardware, firmware, software, and connectivity, and maintain the security requirements that feed into design reviews.\nFDA Submission & Regulatory Documentation\nOwn the cybersecurity portions of our FDA submission - premarket cybersecurity documentation, software bill of materials (SBOM), security risk assessments, architecture views, threat models, Secure Product Development Framework, Cybersecurity Management Plan, Coordinated Vulnerability Disclosures, and other portions of our FDA submission.\nRespond directly to FDA review questions during the submission process.\nQuality Management System (QMS) Integration & Risk Management\nOperate within Cognito's Quality Management System (e.g., ISO 13485 / 21 CFR 820 design controls), ensuring security work products - risk assessments, verification and validation evidence, design history file inputs - meet QMS documentation, traceability, and change-control requirements.\nOwn the security risk management process for the product, integrating cybersecurity risk into the broader product risk management file in alignment with medical device risk management practice (e.g., ISO 14971-aligned methodology).\nSecurity Testing\nPlan and execute (or coordinate third-party) security testing across the product - penetration testing, vulnerability scanning, and other targeted assessments - both pre-release and as part of periodic post-market testing, driving findings through to verified closure.\nPost-Market Security Operations\nRun the vulnerability management program for the fielded product: intake, CVSS-based triage and prioritization, remediation tracking against defined SLAs, and SBOM-based monitoring of third-party and open-source component vulnerabilities.\nBuild and operate ongoing post-market monitoring - threat intelligence review, vulnerability disclosure intake, and field data review - to meet FDA post-market cybersecurity obligations, including trend analysis and escalation into the complaint-handling / CAPA process where security issues are involved.\nCross-Functional Partnership & Program Building\nServe as the embedded security point of contact across hardware, software, and systems engineering teams, joining design reviews and risk management activities as needed.\nBuild reusable documentation, templates, and repeatable processes now so these practices scale as the security team grows.\nQualifications\nRequired\n8+ years of experience in product/application security, including direct prior experience working as a Product Security Engineer (or a closely equivalent role) at a medical device company.\nHands-on experience preparing cybersecurity content for FDA submissions - premarket cybersecurity documentation, SBOM, risk assessments, and security architecture views - and experience responding to FDA review questions.\nDirect experience working within a Quality Management System (e.g., ISO 13485, 21 CFR 820), including comfort operating under design controls, document control, and traceability requirements.\nExperience integrating cybersecurity risk into a medical device product risk management process (e.g., ISO 14971-aligned risk management file).\nDemonstrated experience partnering directly with hardware, software, and systems engineers to build security into product design and architecture - this is not a software-only application security role.\nHands-on experience running security testing (e.g., penetration testing, vulnerability scanning) and post-market vulnerability management, including SBOM-based third-party/component risk tracking.\nTravel as needed.\nPreferred\nBachelor’s degree in Computer Science, Computer Engineering, Electrical Engineering, Cybersecurity, Biomedical Engineering, or a related technical discipline.\nFamiliarity with FDA's postmarket cybersecurity guidance and experience supporting field actions or post-market corrective actions tied to security findings.\nExperience specifically with connected or networked medical devices, or software as a medical device (SaMD).\nWorking knowledge of SOC 2, HIPAA, and/or HITRUST control frameworks.\nExperience coordinating third-party penetration testing or running a responsible disclosure / bug bounty intake process.\nExperience presenting cybersecurity risk directly to auditors, notified bodies, or regulatory reviewers.\nOther\nHybrid position preferred; flexibility required during peak periods, which may include supporting time-sensitive FDA submission or post-market security activities outside normal business hours as needed.\nWorking onsite in Cognito's Cambridge, MA office, manufacturing partners, or test sites may be required.\nCompetitive Benefits\nTaking care of our own is one of our highest priorities. That’s why we offer benefits including unlimited PTO, wellness perks, virtual medical support, and health, dental, and vision insurance.\nPhysical Requirements & Work Environment\nThis role is primarily performed in an office or home-office setting. Essential physical requirements include the ability to work at a computer for extended periods, communicating effectively in written and verbal formats, and participate in video and in-person meetings.\nOccasional travel to partner sites may be required. For remote roles, occasional travel to Cognito’s Cambridge, MA office may also be required.\nCognito Therapeutics is committed to providing reasonable accommodation for qualified individuals with disabilities throughout the application and hiring process. If you require accommodation, please contact us at .\nCognito Therapeutics is an Equal Opportunity Employer. We are committed to building a diverse and inclusive workplace and make employment decisions based on qualifications, merit, business needs, and job requirements. We do not discriminate on the basis of race, color, religion, sex, sexual orientation, gender identity or expression, national origin, age, disability, veteran status, genetic information, or any other characteristic protected by applicable federal, state, or local law.\nAll applicants must be legally authorized to work in the United States.","description_format":"text","description_chars":8432,"description_truncated":false,"requirements":{"experience_years_min":8,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[]},"benefits":["Unlimited PTO","Vision insurance"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Drug Discovery","Information Security","Oncology Therapeutics"],"lifecycle":[{"event":"open","at":"2026-10-20T15:22:06Z"}],"visa":[],"liveness":{"score":76,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.849,"p_room":0.9,"age_days":12,"expected_fill_days":36,"reasons":["conf:2","win:mid"],"computed_at":"2026-11-02T06:13:15Z"},"pay":null,"html_url":"https://alion.io/job/cognito-therapeutics-inc-product-security-engineer","json_url":"https://alion.io/job/cognito-therapeutics-inc-product-security-engineer.json","meta":{"generated_at":"2026-11-02T18:23:18Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":25711,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-03T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":2151697},"rest":"https://alion.io/mcp/rest/get_company?id=2151697"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fcognito-therapeutics-inc-product-security-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fcognito-therapeutics-inc-product-security-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fcognito-therapeutics-inc-product-security-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/cognito-therapeutics-inc-product-security-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fcognito-therapeutics-inc-product-security-engineer"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":2933397}},{"tool":"search_jobs","arguments":{"company":"cognitotx.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":2933397},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}