Prof Quality Steward – Product Security

Johnson & Johnson•Brunswick, OH

About The Position

The Professional, Quality Steward is an individual contributor in Johnson & Johnson’s Product Security organization, providing quality stewardship and oversight of cybersecurity activities across the medical-device and connected-product lifecycle. The role works with Product Security, R&D, Systems Engineering, Software Engineering, Quality, and Regulatory Affairs to ensure cybersecurity work is planned, documented, reviewed, and maintained in accordance with the Quality Management System (QMS), design controls, regulatory requirements, and Product Security processes. It helps ensure cybersecurity deliverables and objective evidence are complete, consistent, traceable, and inspection-ready, supporting safe, secure, and compliant products. The role provides quality and compliance guidance for cybersecurity planning, threat modeling, risk assessment, security requirements and testing, software bills of materials (SBOMs), and vulnerability management. It also supports regulatory submissions and inspections, postmarket cybersecurity, product changes, third-party software risk governance, and continuous improvement of Product Security processes. The anticipated base pay range is $81,000–$131,100.

Requirements

Bachelor’s degree in Engineering, Computer Science, Cybersecurity, Information Systems, Quality, Biomedical Engineering, or a related technical discipline.
At least 4 years of experience in medical-device Quality, software quality, design assurance, product security, cybersecurity compliance, systems engineering, or a related regulated product-development discipline.
Experience with design controls, risk management, verification and validation, change control, and Quality Management Systems.
Working knowledge of cybersecurity concepts, including threat modeling, cybersecurity risk management, vulnerability management, security testing, and SBOMs.
Experience reviewing technical documentation and objective evidence for completeness, traceability, and compliance.
Strong communication and cross-functional collaboration skills.

Nice To Haves

An advanced degree.
Medical-device, MedTech, digital-health, or other regulated-product experience.
Knowledge of FDA medical-device cybersecurity expectations, ISO 14971, ISO 13485, IEC 62304, IEC 81001-5-1, and AAMI TIR57/TIR97.
Experience reviewing cybersecurity deliverables such as threat models, cybersecurity risk assessments, security requirements, penetration-test reports, SBOMs, and vulnerability assessments.
Experience supporting regulatory submissions, audits, inspections, or postmarket cybersecurity activities.
Relevant certifications such as CQE, CSQE, RAC, CSSLP, CISSP, or CISA.
Skills in AI Judgement Integration, Business Behavior, Compliance Management, Critical Thinking, Cybersecurity, Fraud Management, Legal Services, Problem Solving, Process Oriented, Risk Assessments, Security Architecture Design, Security Incident Response, Security Policies, Situational Awareness, Standard Operating Procedure (SOP), Technical Credibility, Technology Quotient, and Training Delivery Methods.

Responsibilities

Serve as the Quality Steward for Product Security across assigned products, platforms, and programs throughout the product lifecycle.
Provide quality and compliance guidance for cybersecurity activities, including security planning, threat modeling, cybersecurity risk assessments, security requirements, testing, SBOMs, and vulnerability management.
Review Product Security deliverables and objective evidence for completeness, traceability, consistency, and alignment with QMS and cybersecurity processes.
Ensure cybersecurity activities are integrated into design controls, product risk management, Design History Files, and lifecycle processes.
Partner with Product Security, R&D, Quality, and Regulatory Affairs to identify and resolve cybersecurity documentation, process, and compliance gaps.
Support cybersecurity content and evidence for regulatory submissions, audits, inspections, and responses to regulatory authorities.
Provide quality stewardship for postmarket cybersecurity and vulnerability management, including risk assessments, remediation documentation, product changes, and coordinated vulnerability disclosure activities.
Support governance of SBOMs and third-party/open-source software cybersecurity risk throughout the product lifecycle.
Assess Product Security quality impacts associated with product changes, software releases, supplier changes, platform migrations, and lifecycle transitions.
Support development and continuous improvement of Product Security procedures, work instructions, templates, metrics, and training.
Monitor evolving medical-device cybersecurity regulations and standards and help translate requirements into practical Product Security and Quality System processes.

Benefits

Participation in the Company’s consolidated retirement plan (pension) and savings plan (401(k)), subject to plan terms.
Eligibility to participate in the Company’s long-term incentive program.
Vacation: 120 hours per calendar year.
Sick time: 40 hours per calendar year, with different amounts for eligible employees residing in Colorado or Washington.
Holiday pay, including floating holidays: 13 days per calendar year.
Work, Personal and Family Time: up to 40 hours per calendar year.
Parental Leave: 480 hours within one year of the birth, adoption, or foster care of a child.
Bereavement Leave: 240 hours for an immediate family member and 40 hours for an extended family member per calendar year.
Caregiver Leave: 80 hours in a 52-week rolling period.
Volunteer Leave: 32 hours per calendar year.
Military Spouse Time-Off: 80 hours per calendar year.