This role pays less than
92%
of similar roles. Most pay
$146,400–$222,000
— the shaded band above.
At the midpoint, this role pays about
$110k
versus about
$184k
for comparable roles.
Based on 239 similar postings.
Employer
About Johnson & Johnson
Johnson & Johnson is a multinational corporation operating in three main segments: consumer health products, pharmaceuticals, and medical devices, known for brands like Tylenol, Band-Aid, and Janssen. Industry: Pharmaceuticals & Medical Devices
Johnson & Johnson currently has
73 open roles
on FindRole.
Listed pay typically runs
$109,000–$177,100
across 68 roles with salary data.
Professional, Quality Steward
The Professional, Quality Steward serves as a dedicated individual contributor within the Cybersecurity function to embed Secure by Design principles into the DePuy Synthes medical device and connected product portfolio. This role acts as a security steward across the total product lifecycle, collaborating with R&D, Engineering, and Regulatory teams to ensure products are safe, secure, and compliant. Key responsibilities include defining security requirements, performing threat modeling for embedded software and mobile applications, managing Software Bills of Materials (SBOMs), and conducting risk assessments aligned to AAMI TIR57 and ISO 14971. The role requires expertise in secure coding practices, SAST/DAST tools, and vulnerability management. Candidates must navigate complex medical device regulatory requirements, including FDA guidance and EU MDR, while managing postmarket vulnerability monitoring and developing customer-facing security artifacts for the medical technology sector.
Embed Secure by Design principles into the medical device product development lifecycle from concept to end-of-support.
Define and document security requirements, design inputs, and acceptance criteria in collaboration with engineering and R&D teams.
Facilitate threat modeling and security architecture reviews for connected devices, mobile applications, and cloud services.
Conduct and coordinate product security risk assessments aligned to AAMI TIR57 and ISO 14971 standards.
Generate, validate, and maintain Software Bills of Materials (SBOMs) while monitoring third-party components for vulnerabilities.
Coordinate penetration testing and security verification activities while triaging findings and tracking remediation to closure.
Prepare and review cybersecurity documentation for regulatory submissions including FDA premarket guidance and EU MDR requirements.
Manage postmarket vulnerability intelligence, impact analysis, and the creation of customer-facing security artifacts like MDS2 forms.
What we're looking for
Bachelor's degree in Computer Science, Cybersecurity, Software/Biomedical/Electrical Engineering, Information Systems, or a related technical discipline.
Master's degree in Cybersecurity, Computer Science, or Biomedical Engineering.
4+ years of experience in product security, application security, secure software development, or a related cybersecurity engineering discipline.
Demonstrated experience applying Secure by Design principles across a product development lifecycle.
Hands-on experience with threat modeling methodologies for embedded, mobile, or connected systems.
Working knowledge of secure coding practices, common vulnerability classes (OWASP Top 10, CWE), and application security testing tools.
Experience with vulnerability management, including CVE analysis, CVSS scoring, and risk-based remediation prioritization.
Familiarity with SBOM generation, formats (SPDX, CycloneDX), and third-party/open-source component risk management.
MedTech or medical device experience (preferred).
Knowledge of FDA premarket and postmarket guidance, EU MDR, IEC 62304, ISO 14971, ISO 13485, and AAMI TIR57/TIR97 (preferred).
Microsoft Playwright
Angular
REST API
JSON
Postman
Bruno
GitHub Actions
Harness
Jenkins
CI/CD
Tosca
Agile
Performance Testing
Regression Testing
Test Data Management