Product Security Steward (MedTech) - Secure by Design

Antler Co; Warsaw (IN); On-site; USD 79,000 - 142,000; Full time

Job summary

Johnson & Johnson, a global health leader, is recruiting a Professional, Quality Steward for DePuy Synthes in multiple U.S. locations including Warsaw, IN.

You will embed Secure by Design principles across the product lifecycle, partnering with R&D, Product Management, Engineering, Regulatory Affairs, and Quality to ensure safety, security, and regulatory compliance. You will lead threat modeling, SBOM management, and vulnerability remediation while aligning with FDA/EU guidance and industry

Qualifications

• 4+ years of experience in product security or a related cybersecurity engineering discipline.
• Experience applying Secure by Design across a product lifecycle, including security requirements definition and design review.
• Threat modeling methodologies (e.g., STRIDE) for embedded, mobile, or connected systems.
• Familiarity with OWASP Top 10, CWE, and security testing tools (SAST, DAST, SCA).
• Experience with vulnerability management, including CVE analysis and risk-based remediation.
• SBOM generation and third-party/open-source component risk management.
• Strong written and verbal communication skills for engineering, quality, regulatory, and commercial stakeholders.

Responsibilities

• Serve as the product security steward for assigned product lines, embedding Secure by Design requirements into the lifecycle.
• Define and document security requirements, design inputs, and acceptance criteria with cross-functional teams.
• Facilitate threat modeling and security architecture reviews for connected devices and software.
• Conduct and coordinate product security risk assessments aligned to industry standards.
• Generate and maintain SBOMs; monitor third-party components for vulnerabilities and remediation.
• Coordinate secure software development practices and CI/CD security gates.
• Coordinate penetration testing and vulnerability remediation with internal teams and third parties.
• Prepare cybersecurity documentation for regulatory submissions and postmarket monitoring.

Skills

Product security

Threat modeling

Vulnerability management

SBOM management

Secure coding

Communication skills

Security testing tools

DevSecOps

Education

Bachelor's degree in Computer Science / Cybersecurity

Master's degree in Cybersecurity / CS / Biomedical Engineering

Tools

SAST

DAST

SCA

CI/CD pipelines

SBOM formats SPDX/CycloneDX

Cloud security (AWS/Azure)

Job description

Johnson & Johnson, a global health leader, is recruiting a Professional, Quality Steward for DePuy Synthes in multiple U.S. locations including Warsaw, IN.

You will embed Secure by Design principles across the product lifecycle, partnering with R&D, Product Management, Engineering, Regulatory Affairs, and Quality to ensure safety, security, and regulatory compliance. You will lead threat modeling, SBOM management, and vulnerability remediation while aligning with FDA/EU guidance and industry