Product Security Analyst — Med Tech & Regulatory Risk

Johnson & Johnson Co.; New Brunswick (NJ); On-site; USD 120,000 - 170,000; Full time

Benefits offered by this job

Travel: Up to 10% domestic travel

Job summary

Johnson & Johnson, through its DePuy Synthes Technology organization, seeks a cybersecurity professional to embed secure practices across the product lifecycle for digital and connected medical devices. You will partner with engineering, quality, regulatory, and IT teams to identify risks early and design secure solutions that meet cybersecurity and regulatory expectations.

You will perform risk assessments, threat modeling, vulnerability analysis, and support security testing, while tracking

Qualifications

• Bachelor’s degree in Computer Science, Engineering, Information Security, or a related technical field.
• Preferred: Master’s degree in Cybersecurity, Computer Engineering, or a related discipline.
• 2–4 years of professional experience in cybersecurity, product security, or secure software development.
• Familiarity with ISO, NIST, OWASP standards.

Responsibilities

• Integrate security requirements and controls into the design and development of digital and connected products.
• Perform product security risk assessments, threat modeling, and vulnerability analysis across the product lifecycle.
• Partner with product development, quality, and regulatory teams to support secure design reviews and remediation activities.
• Support security testing activities, including static and dynamic analysis, penetration testing coordination, and vulnerability validation.
• Track, document, and manage product security findings to closure in alignment with internal governance processes.
• Contribute to the development and maintenance of product security standards, procedures, and best practices.
• Monitor emerging cybersecurity threats, vulnerabilities, and regulatory guidance relevant to medical devices and digital health.
• Support audits, assessments, and regulatory inquiries related to product cybersecurity.

Skills

SDLC knowledge

Threat modeling

Vulnerability analysis

Cross-functional collaboration

Security documentation & communication

Education

Bachelor’s degree in CS/Engineering/Info Security or related field

Master’s degree in Cybersecurity or related discipline

Tools

SAST

DAST

Dependency scanning

Job description

Johnson & Johnson, through its DePuy Synthes Technology organization, seeks a cybersecurity professional to embed secure practices across the product lifecycle for digital and connected medical devices. You will partner with engineering, quality, regulatory, and IT teams to identify risks early and design secure solutions that meet cybersecurity and regulatory expectations.

You will perform risk assessments, threat modeling, vulnerability analysis, and support security testing, while tracking