Product Security Steward — MedTech & Regulatory

Johnson & Johnson MedTech; Raynham (MA); On-site; USD 79,000 - 142,000; Full time

Job summary

Johnson & Johnson's DePuy Synthes seeks a Professional, Quality Steward in cybersecurity to embed Secure by Design across the medical device portfolio. You will partner with R&D, Product Management, Engineering, Regulatory Affairs and Quality to define security requirements early, design in, verify, and monitor postmarket.

Requirements include 4+ years in product security, threat modeling, secure coding practices, SBOM knowledge (SPDX/CycloneDX), and experience with regulatory guidance.

Qualifications

• 4+ years in product security, application security, or related field.
• Experience applying Secure by Design across a product lifecycle.
• Knowledge of threat modeling for embedded, mobile, or connected systems.
• Familiarity with vulnerability management and security testing tools.
• Strong written and verbal communication, with regulatory context awareness.

Responsibilities

• Serve as the product security steward for assigned lines, embedding Secure by Design into the lifecycle.
• Define security requirements, design inputs, and acceptance criteria with product owners and R&D.
• Coordinate threat modeling and security reviews for connected devices, embedded software, apps, and cloud services.
• Perform security risk assessments aligned to ISO 14971 and related standards; manage SBOMs and vendor risk.
• Support secure software development, including gates in CI/CD, SAST/DAST/Software testing, and vulnerability remediation.

Skills

Product security

Threat modeling

Secure by Design

Regulatory awareness

Security documentation

Education

Bachelor's degree in Computer Science, Cybersecurity, or related

Master's degree in Cybersecurity, Computer Science, or Biomedical Engineering

Tools

SAST

DAST

SCA

SBOM formats SPDX/CycloneDX

CI/CD integration

Job description

Johnson & Johnson's DePuy Synthes seeks a Professional, Quality Steward in cybersecurity to embed Secure by Design across the medical device portfolio. You will partner with R&D, Product Management, Engineering, Regulatory Affairs and Quality to define security requirements early, design in, verify, and monitor postmarket.

Requirements include 4+ years in product security, threat modeling, secure coding practices, SBOM knowledge (SPDX/CycloneDX), and experience with regulatory guidance.