Prof Quality Steward – Product Security

At Johnson & Johnson,we believe health is everything. Our strength in healthcare innovation empowers us to build aworld where complex diseases are prevented, treated, and cured,where treatments are smarter and less invasive, and solutions are personal.

Through our expertise in Innovative Medicine and Med Tech, we are uniquely positioned to innovate across the full spectrum of healthcare solutions today to deliver the breakthroughs of tomorrow, and profoundly impact health for humanity.

Learn more at

Job Function:
Legal & Compliance

Job Sub Function:
Product Security

Job Category:
Professional All Job Posting Locations:
New Brunswick, New Jersey, United States of America, West Chester, Pennsylvania, United States of America

Job Description:

Job Overview The Professional, Quality Steward is an individual contributor within the Product Security organization responsible for providing quality stewardship and oversight of cybersecurity activities across the medical device and connected-product lifecycle. This role partners with Product Security, R&D, Systems Engineering, Software Engineering, Quality, and Regulatory Affairs to ensure cybersecurity activities are appropriately planned, documented, reviewed, and maintained in accordance with the Quality Management System (QMS), design controls, regulatory requirements, and Product Security processes.

The Quality Steward helps ensure cybersecurity deliverables and objective evidence are complete, consistent, traceable, and inspection-ready, supporting the development and maintenance of safe, secure, and compliant products.

• Provide quality and compliance guidance for cybersecurity activities, including security planning, threat modeling, cybersecurity risk assessments, security requirements, testing, SBOMs, and vulnerability management.
• Serve as the Quality Steward for Product Security across assigned products, platforms, and programs throughout the product lifecycle.
• Review Product Security deliverables and objective evidence for completeness, traceability, consistency, and alignment with established QMS and cybersecurity processes.
• Ensure cybersecurity activities are appropriately integrated into design controls, product risk management, Design History Files, and lifecycle processes.
• Partner with Product Security, R&D, Quality, and Regulatory Affairs to identify and resolve cybersecurity documentation, process, and compliance gaps.
• Support cybersecurity content and evidence for regulatory submissions, audits, inspections, and responses to regulatory authorities.
• Provide quality stewardship for postmarket cybersecurity and vulnerability management, including risk assessments, remediation documentation, product changes, and coordinated vulnerability disclosure activities.
• Support governance of SBOMs and third-party/open-source software cybersecurity risk throughout the product lifecycle.
• Assess Product Security quality impacts associated with product changes, software releases, supplier changes, platform migrations, and lifecycle transitions.
• Support development and continuous improvement of Product Security procedures, work instructions, templates, metrics, and training.
• Monitor evolving medical-device cybersecurity regulations and standards and help translate requirements into practical Product Security and Quality System processes.

Education Bachelor’s degree in Engineering, Computer Science, Cybersecurity, Information Systems, Quality, Biomedical Engineering, or a related technical discipline. Advanced degree preferred.

• 4+ years of experience in medical-device Quality, software quality, design assurance, product security, cybersecurity compliance, systems engineering, or a related regulated product-development discipline.
• Experience with design controls, risk management, verification and validation, change control, and Quality Management Systems.
• Working knowledge of cybersecurity concepts including threat modeling, cybersecurity risk management, vulnerability management, security testing, and SBOMs.
• Experience reviewing technical documentation and objective evidence for completeness, traceability, and compliance.
• Strong communication and cross-functional collaboration skills.

Preferred Medical device, Med Tech, digital health, or other regulated-product experience Knowledge of FDA medical-device cybersecurity expectations, ISO 14971, ISO 13485, IEC 62304, IEC 81001-5-1, and AAMI TIR
57/TIR
97. Experience…