Senior Product Security & OS Strategy Leader

6149-DePuy Synthes Products Inc. Legal Entity; Boston (MA); Hybrid; USD 122,000 - 213,000; Full time

Benefits offered by this job

Long-term incentive program

Retirement plan (pension/401k)

Paid time off

Job summary

Johnson & Johnson in Boston, MA invites a Sr Product Security R&D Manager to lead a global team responsible for Product Security, Privacy, and OS patching across connected devices and medical technologies. The role drives security strategy from development through regulatory submissions, balancing risk and compliance with business goals in a hybrid work environment.

You will partner with Regulatory, Legal, and R&D to ensure secure design, manage budgets, and influence cross-functional

Qualifications

• Bachelor’s degree in Computer Science, Software or Computer Engineering, Electrical Engineering, or a related technical field.
• Minimum of 8 years of relevant technical experience, or an advanced degree with 5 years of technical experience, including at least 5 years leading and developing technical teams.
• Proven track record leading product security programs for medical devices or other regulated, connected products, including accountability for regulatory submissions and audits.
• Working knowledge of FDA Premarket and Postmarket Cybersecurity guidance, IEC 62304, ISO 14971, cybersecurity risk assessment frameworks and NIST framework.
• Strong technical grounding in threat modeling, SBOMs, vulnerability management, security testing, and OS hardening and patch management, sufficient to guide technical decisions and review team deliverables.
• Demonstrated ability to make risk-based decisions and communicate them clearly to executives, regulators, and customers.
• Experience managing budgets, vendors, and competing priorities, and influencing cross-functional stakeholders without direct authority.
• Advanced degree in a technical field.
• Experience with IEC 81001-5-1, AAMI SW96/TIR57, ISO 27001.
• Knowledge of global privacy regulations (e.g., HIPAA, GDPR) and data protection practices.
• Experience leading teams through organizational change.
• CISSP or other relevant security certification.

Responsibilities

• Strategy & vision: Set the multi-year Product Security, Privacy, and OS strategy and roadmap across the connected device portfolio, aligning investment with business priorities and evolving FDA and global requirements.
• Pre-market accountability: Serve as the accountable owner for cybersecurity and privacy content in all product submissions (e.g., 510(k)), setting standards and review gates to ensure deliverables are complete, consistent, and on time.
• Post-market risk decisions: Own the vulnerability management program and make or elevate risk decisions, including remediation priorities, residual risk acceptance, and coordinated disclosure.
• OS & patching program: Own the secure baseline OS and patching program for fielded products, balancing security, release timelines, and validation effort across supported software versions.
• Privacy & market access: Champion privacy-by-design, and partner with Privacy, Legal, and Regulatory to clear cybersecurity and privacy requirements for new market launches.
• External representation: Serve as the organization’s Product Security voice with regulators, auditors, and key customers, including security questionnaires, contractual terms, and escalations.
• Talent & organization: Build, lead, and develop a high-performing global team of engineers, contractors, and partners; define roles, hiring plans, development paths, and succession.
• Operating model & performance: Own the team’s budget, vendor strategy, and governance (KPIs, dashboards, executive reporting), and drive scale through standardization, automation, and AI-assisted tools.
• Influence & culture: Build a security-first culture across R&D by influencing engineering, Quality, Regulatory, and Enterprise Security leaders, embedding secure development practices, and raising security capability across teams.

Skills

Leadership

Regulatory submissions

Vendor management

Cross-functional collaboration

Threat modeling

OS hardening

Security architecture design

Strategic thinking

Communication with executives

Budget management

Education

Bachelor’s degree in Computer Science, Software or Computer Engineering, Electrical Engineering, or a related technical field

Advanced degree in a technical field

CISSP or other security certification

Tools

CISSP certification

Job description

Johnson & Johnson in Boston, MA invites a Sr Product Security R&D Manager to lead a global team responsible for Product Security, Privacy, and OS patching across connected devices and medical technologies. The role drives security strategy from development through regulatory submissions, balancing risk and compliance with business goals in a hybrid work environment.

You will partner with Regulatory, Legal, and R&D to ensure secure design, manage budgets, and influence cross-functional