Product Security Steward: MedTech Cyber Defense

Antler Co; New Brunswick (NJ); On-site; USD 79,000 - 142,000; Full time

Job summary

Johnson & Johnson, via DePuy Synthes, is recruiting a Professional, Quality Steward in cybersecurity across its medical device portfolio. The role embeds Secure by Design into the full product lifecycle from R&D to postmarket, coordinating with R&D, Product Management, Engineering, Regulatory Affairs, and Quality to ensure safety and regulatory compliance.

The position offers multiple U.S. locations including New Brunswick NJ and West Chester PA.

Qualifications

• 4+ years of experience in product security, application security, secure software development, or a related cybersecurity engineering discipline.
• Experience applying Secure by Design principles across a product development lifecycle, including security requirements definition and design review.
• Hands-on experience with threat modeling methodologies for embedded, mobile, or connected systems.
• Working knowledge of secure coding practices, OWASP Top 10, CWE, and security testing tools (SAST/DAST/SCA).
• Experience with vulnerability management, CVE analysis, CVSS scoring, and risk-based remediation prioritization.

Responsibilities

• Serve as the product security steward for assigned product lines, embedding Secure by Design requirements into the product development lifecycle from concept through end-of-support.
• Define and document security requirements, design inputs, and acceptance criteria in collaboration with product owners, systems engineers, and R&D teams during early design phases.
• Facilitate threat modeling and security architecture reviews for connected devices, embedded software, mobile apps, and cloud services; ensure threats are mitigated and traceable to controls.
• Conduct and coordinate product security risk assessments aligned to standards (AAMI TIR57, ISO 14971).
• Generate, validate, and maintain SBOMs; monitor components for vulnerabilities and drive remediation planning.
• Support secure software development practices including secure coding, SAST/DAST/SCAs, and CI/CD security gates.
• Coordinate penetration testing and remediation tracking with internal teams and third-party assessors.
• Prepare cybersecurity documentation for regulatory submissions aligned to FDA/EU MDR and international requirements.
• Operate postmarket vulnerability management and coordinate disclosure and advisories.
• Develop customer-facing security artifacts (MDS2 forms, security white papers).
• Partner with Quality and Regulatory to capture security activities in design history files and QMS.
• Establish and report product security metrics to leadership.

Skills

Threat modeling

Secure coding

Vulnerability management

SBOM generation

Regulatory submissions

Cloud security

Embedded/connected systems security

Communication

Education

Bachelor's degree in tech

Master's degree in Cybersecurity/CS/BioEngineering

Tools

SAST

DAST

SCA

SBOM formats (SPDX/CycloneDX)

CI/CD security tooling

Job description

Johnson & Johnson, via DePuy Synthes, is recruiting a Professional, Quality Steward in cybersecurity across its medical device portfolio. The role embeds Secure by Design into the full product lifecycle from R&D to postmarket, coordinating with R&D, Product Management, Engineering, Regulatory Affairs, and Quality to ensure safety and regulatory compliance.

The position offers multiple U.S. locations including New Brunswick NJ and West Chester PA.