Exp, Analyst, Security Engineer Product

Description

The role sits in the DePuy Synthes Technology organization and supports security for digital products and connected medical technologies. You will embed security practices across the product lifecycle, working with engineering, quality, regulatory and IT teams to find risks early, design secure solutions and meet cybersecurity and regulatory expectations.

The work is in a highly regulated environment where product trust and patient safety are directly affected. The role is hybrid. Johnson & Johnson is the parent company; DePuy Synthes is the orthopaedics business being separated into a standalone company, which is expected to take 18 to 24 months and is subject to legal requirements, works council consultation where needed, regulatory approvals and other customary conditions. If you accept and the transaction completes, you would be employed by DePuy Synthes under its own employment processes, policies and benefit plans, and any planned changes would be communicated to you at an appropriate time.

Responsibilities

• Build security requirements and controls into the design and development of digital and connected products.
• Run product security risk assessments, threat modeling and vulnerability analysis at every stage of the lifecycle.
• Work with product development, quality and regulatory teams on secure design reviews and remediation.
• Support security testing, including static and dynamic analysis, coordination of penetration tests and validation of vulnerabilities.
• Track, document and close product security findings in line with internal governance.
• Help write and maintain product security standards, procedures and best practices.
• Follow emerging cybersecurity threats, vulnerabilities and regulatory guidance for medical devices and digital health.
• Support audits, assessments and regulatory inquiries on product cybersecurity.

Requirements

• Required: a bachelor's degree in computer science, engineering, information security or a related technical field.
• Required: 2 to 4 years of professional experience in cybersecurity, product security or secure software development.
• Required: working knowledge of secure development lifecycle (SDLC) practices and security-by-design principles.
• Required: experience running security risk assessments, threat modeling or vulnerability analysis.
• Required: familiarity with common standards and frameworks such as ISO, NIST and OWASP.
• Required: ability to work well with technical and non-technical colleagues across functions.
• Required: strong analytical, documentation and communication skills.
• Required: English proficiency.
• Preferred: a master's degree in cybersecurity, computer engineering or a related discipline.
• Preferred: experience with cybersecurity work in a regulated industry such as medical devices, healthcare or life sciences.
• Preferred: hands-on use of security testing tools and techniques, such as SAST, DAST and dependency scanning.
• Preferred: knowledge of security for cloud, embedded or connected devices.
• Preferred: understanding of regulatory cybersecurity expectations, such as FDA premarket and postmarket guidance.
• Preferred: experience contributing to internal security policies, standards or governance processes.
• Preferred: CISSP, CSSLP, GSEC or an equivalent security certification.

Conditions

Hybrid work across New Brunswick, NJ; West Chester, PA; Palm Beach Gardens, FL; Warsaw, IN; or Raynham, MA.

Up to 10% domestic travel.

Accommodations for the interview process are available on request; external applicants contact the careers team through the company's contact page, and internal employees contact AskGS.

The company is an equal opportunity employer and considers applicants on merit.

Benefits

• Information on wellness, career and life support is available on the careers site.