Secure by Design Product Security Steward

Antler Co; Raynham (MA); On-site; USD 79,000 - 142,000; Full time

Job summary

Johnson & Johnson’s DePuy Synthes seeks a Professional, Quality Steward within Cybersecurity to embed Secure by Design across the medical device portfolio, working with R&D, Product Management, Engineering, Regulatory Affairs, and Quality.

This role ensures security requirements are defined early, verified through testing, and sustained through postmarket monitoring, with regular engagement across global teams and regulators.

Qualifications

• 4+ years of experience in product security, application security, secure software development, or related cybersecurity engineering.
• Experience applying Secure by Design principles across a product development lifecycle, including security requirements definition and design review.
• Hands-on experience with threat modeling methodologies for embedded, mobile, or connected systems.
• Working knowledge of secure coding practices and security testing tools (SAST, DAST, SCA).
• Experience with vulnerability management, CVE analysis, CVSS scoring, and risk-based remediation.
• Familiarity with SBOM generation and third-party/open-source component risk management.
• Strong written and verbal communication skills for cross-functional stakeholders.

Responsibilities

• Serve as the product security steward for assigned product lines, embedding Secure by Design requirements into the development lifecycle.
• Define and document security requirements, design inputs, and acceptance criteria with product owners and R&D teams.
• Facilitate threat modeling and security architecture reviews for connected devices and software.
• Conduct security risk assessments aligned to regulatory guidance and industry standards.
• Generate, validate, and maintain SBOMs; monitor components for vulnerabilities and drive remediation.
• Coordinate penetration testing and security verification activities; triage findings and track remediation.
• Prepare cybersecurity documentation for regulatory submissions and postmarket monitoring.

Skills

Secure by Design

Threat modeling

Regulatory submissions

SBOM management

Vulnerability management

Clear communication

Education

Bachelor's degree in Computer Science or related field

Master's degree in Cybersecurity or related field

Tools

SAST

DAST

SCA

SBOM formats SPDX

CycloneDX

Job description

Johnson & Johnson’s DePuy Synthes seeks a Professional, Quality Steward within Cybersecurity to embed Secure by Design across the medical device portfolio, working with R&D, Product Management, Engineering, Regulatory Affairs, and Quality.

This role ensures security requirements are defined early, verified through testing, and sustained through postmarket monitoring, with regular engagement across global teams and regulators.