Product Security Manager

Job Summary

Product Security Manager – Med Tech Product Security team. Based in Milpitas or Irvine, CA. Remote work options may be considered on a case‑by‑case basis. Requires up to 10% travel. The role implements J&J’s enterprise Product Security strategy and framework across the Johnson & Johnson Vision (JJV) medical device portfolio, from new product development through post‑market support.

• Support JJV throughout a new product’s development phases.
• Review product security requirements and recommend security design solutions.
• Help complete quality documentation, threat modelling, penetration testing, software architecture review, design recommendations, code analysis and other security testing as needed.
• Post-market responsibilities for marketed devices, including monitoring for new vulnerabilities, assisting with patching and remediation plans, responding to all customer security questionnaires, and reviewing security language within contractual agreements.
• Drive adherence to J&J Product Security’s overarching framework.
• Champion Product Security strategy and objectives within JJV.
• Partner with internal organizations to enhance existing processes and policies.
• Create and present Product Security metrics to management.
• Implement and enforce Product Security governance model for pre- and post-market medical devices.
• Perform automated code scanning and coordinate formal security testing.
• Respond to customer cybersecurity questionnaires and contractual language for all post-market medical devices.
• Other Med Tech cybersecurity related duties as needed.

• 8+ years IT or cybersecurity experience.
• Bachelor’s degree or equivalent.
• Minimum of 8 years progressive experience in leadership roles within information technology or cybersecurity functions.
• Threat modelling experience.
• Data privacy experience, including GDPR and CCPA.
• Understanding of HIPAA/HITRUST & ISO 27001.
• Understanding of penetration testing, vulnerability scanning, CVSS and/or other general security testing principles.
• Ability to work autonomously and proactively seek out security opportunities within JJV.
• Knowledge of traditional and real‑time operating systems (e.g., QNX, Windows Embedded) hardening techniques.
• Ability to create and deliver cybersecurity awareness campaigns and other communications.
• Ability to translate technical security requirements into solutions.
• Ability to provide secure coding recommendations.
• Ability to lead large projects and proven ability to track to project plan timelines from a security perspective.
• Ability to write technical security requirements for embedded systems and web platforms.
• Creative problem‑solving skills.
• Customer focus (internal & external).
• Excellent communication and collaboration skills, able to network, interface and influence at all levels of the organization, across sectors, across functions and globally.
• Strong leadership skills.

• Experience leading or participating in formal security audits (e.g., HITRUST, SOC2, FedRAMP).
• Familiarity with FDA and/or other global regulatory cybersecurity guidance requirements and submission process.
• Experience with web applications and server hardening (e.g., AWS, Azure), including knowledge of OWASP Top 10 and blue‑teaming techniques.
• Experience in cybersecurity pre‑sales.
• Software development experience.
• CISSP or other security certification.
• MS and/or advanced degree.

• Base pay range: $ – $ (Milpitas, CA) or $102,000 – $ for other locations.
• Company‑consolidated retirement plan (pension) and savings plan (401(k)).
• Vacation – 120 hours per calendar year.
• Sick time – 40 hours per calendar year; 48 hours if residing in Colorado; 56 hours if residing in Washington.
• Holiday pay, including floating holidays – 13 days per calendar year.
• Work, Personal and Family Time – up to 40 hours per calendar year.
• Parental Leave – 480 hours within one year of birth/adoption/foster care of a child.
• Bereavement Leave – 240 hours for an immediate family member; 40 hours for an extended family member per calendar year.
• Caregiver Leave – 80 hours in a 52‑week rolling period; 10 days.
• Volunteer Leave – 32 hours per calendar year.
• Military Spouse Time‑Off –…