Professional, Quality Steward

Job Overview

The Professional Quality Steward is an established and productive individual contributor within the Cybersecurity function accountable for embedding Secure by Design principles into the DePuy Synthes medical device and connected product portfolio. This role serves as the quality and security steward across the total product lifecycle partnering with R&D Product Management Engineering Regulatory Affairs and Quality to ensure security requirements are defined early designed in verified through testing and sustained through postmarket monitoring. Working under moderate supervision the analyst applies practical knowledge of product security secure development practices and medical device regulatory expectations to ensure products are safe secure compliant and defensible to regulators and customers.

Key Responsibilities

• Serve as the product security steward for assigned product lines embedding Secure by Design requirements into the product development lifecycle from concept through end-of-support.

• Define and document security requirements design inputs and acceptance criteria in collaboration with product owners systems engineers and R&D teams during early design phases.

• Facilitate threat modeling and security architecture reviews for connected devices embedded software mobile applications and supporting cloud services; ensure identified threats are mitigated and traceable to controls.

• Conduct and coordinate product security risk assessments aligned to AAMI TIR57 and ISO 14971 ensuring cybersecurity risk is integrated with overall product risk management files.

• Generate validate and maintain Software Bills of Materials (SBOMs) for products; monitor third-party and open-source components for known vulnerabilities and drive remediation planning.

• Support secure software development practices including secure coding standards static and dynamic analysis dependency scanning and integration of security gates into CI/CD pipelines.

• Coordinate penetration testing and security verification activities with internal teams and third-party assessors; triage findings assess exploitability and patient safety impact and track remediation to closure.

• Prepare and review cybersecurity documentation for regulatory submissions aligned to FDA premarket cybersecurity guidance EU MDR and applicable international requirements.

• Operate postmarket vulnerability management for released products monitoring threat intelligence performing impact analysis and supporting coordinated vulnerability disclosure and customer advisories.

• Develop and maintain customer-facing security artifacts including MDS2 forms security white papers and responses to hospital and health system security assessments.

• Partner with Quality and Regulatory to ensure product security activities are captured in design history files design controls and the Quality Management System.

• Establish and report product security metrics design review coverage vulnerability aging SBOM currency and remediation SLA performance to leadership and program stakeholders.

• Assess security implications of product changes platform migrations supplier changes and separation/carve-out activity affecting the product portfolio.

• Deliver Secure by Design training and enablement to engineering and product teams to strengthen security ownership and cyber culture.

Qualifications

Education

• Bachelors degree in Computer Science Cybersecurity Software/Biomedical/ Electrical Engineering Information Systems or a related technical discipline.

• Masters degree in Cybersecurity Computer Science or Biomedical Engineering.

Experience and Skills

Required:

• 4 years of experience in product security application security secure software development or a related cybersecurity engineering discipline.

• Demonstrated experience applying Secure by Design principles across a product development lifecycle including security requirements definition and design review.

• Hands-on experience with threat modeling methodologies (e.g. STRIDE attack trees) for embedded mobile or connected systems.

• Working knowledge of secure coding practices common vulnerability classes (OWASP Top 10 CWE) and application security testing tools (SAST DAST SCA).

• Experience with vulnerability management including CVE analysis CVSS scoring and risk-based remediation prioritization.

• Familiarity with SBOM generation formats (SPDX CycloneDX) and third-party/open-source component risk management.

• Strong written and verbal communication skills with the ability to explain security risk to engineering quality regulatory and commercial stakeholders.

Preferred:

• MedTech or medical device experience; working knowledge of FDA premarket and postmarket cybersecurity guidance EU MDR IEC 62304 ISO 14971 ISO 13485 and AAMI TIR57/TIR97.

• Experience preparing cybersecurity content for regulatory submissions and responding to agency questions.

• Experience supporting product security within a divestiture carve-out or standalone entity stand-up.

• Familiarity with embedded systems security firmware analysis secure boot cryptographic key management and hardware root of trust.

• Experience with cloud and connected-platform security (AWS Azure) API security and IoT/IoMT architectures.

• Exposure to coordinated vulnerability disclosure programs and customer security assessment response (MDS2 HSCC guidance).

• Experience applying Generative AI / LLM-enabled tooling to accelerate code review threat modeling and security documentation.

• Familiarity with DevSecOps toolchains and integrating security gates into CI/CD pipelines.

Other:

• Travel: Up to 10% domestic and international travel expected across DePuy Synthes sites.

• Language: English proficiency .

• Certifications: CSSLP GWAPT OSCP CEH CISSP or equivalent product/application security certification preferred.

For more information on how we support the whole health of our employees throughout their wellness career and life journey please visit .