MedTech Product Security Steward: Secure by Design

Antler Co; Town of Florida (NY); On-site; USD 79,000 - 142,000; Full time

Job summary

Johnson & Johnson is recruiting a Professional, Quality Steward in cybersecurity to embed Secure by Design across the product lifecycle. You will partner with R&D, Product Management, Engineering, Regulatory Affairs, and Quality to ensure security requirements are defined early, designed in, and verified through testing.

The role requires 4+ years in product security, knowledge of threat modeling methods, vulnerability management, SBOMs, and CI/CD security integration.

Qualifications

• 4+ years in product security or related cybersecurity engineering role.
• Experience applying Secure by Design across product lifecycles.
• Hands-on threat modeling for embedded/mobile/connected systems.
• Knowledge of OWASP Top 10, CWE, vulnerability testing tools.
• SBOM generation and management of third-party components.
• Familiarity with regulatory guidance (FDA, EU MDR) is a plus.

Responsibilities

• Embed Secure by Design requirements into the product lifecycle.
• Define security requirements, design inputs, and acceptance criteria.
• Coordinate threat modeling and security reviews for devices and cloud.
• Lead vulnerability assessments and remediation tracking.
• Maintain SBOMs and monitor third-party components for risks.
• Support secure software development practices and CI/CD gates.
• Prepare cybersecurity documentation for regulatory submissions.
• Engage with stakeholders to report security metrics.

Skills

Secure lifecycle

Threat modeling

SAST/DAST/SSA tools

Vulnerability management

SBOM generation

CI/CD security gates

Regulatory awareness

Technical writing

Education

Bachelor's in CS/Cybersecurity/Engineering

Master's in Cybersecurity/CS/Biomedical Eng

Tools

SAST tools

DAST tools

SCA tools

CI/CD tooling

Job description

Johnson & Johnson is recruiting a Professional, Quality Steward in cybersecurity to embed Secure by Design across the product lifecycle. You will partner with R&D, Product Management, Engineering, Regulatory Affairs, and Quality to ensure security requirements are defined early, designed in, and verified through testing.

The role requires 4+ years in product security, knowledge of threat modeling methods, vulnerability management, SBOMs, and CI/CD security integration.